Switch:
The network switch, packet switch (or just switch) plays an integral part in most Ethernet local area networks or LANs. Mid-to-large sized LANs contain a number of linked managed switches. Small office, home office (SOHO) applications typically use a single switch, or an all-purpose converged device such as gateway access to small office/home office broadband services such as DSL router or cable, Wi-Fi router. In most of these cases, the end user device contains a router and components that interface to the particular physical broadband technology, as in the Linksys 8-port and 48-port devices. User devices may also include a telephone interface to VoIP.
In the context of a standard 10/100 Ethernet switch, a switch operates at the data-link layer of the OSI model to create a different collision domain per switch port. If you have 4 computers A/B/C/D on 4 switch ports, then A and B can transfer data between them as well as C and D at the same time, and they will never interfere with each others' conversations. In the case of a "hub" then they would all have to share the bandwidth, run in half-duplex and there would be collisions and retransmissions. Using a switch is called micro-segmentation. It allows you to have dedicated bandwidth on point to point connections with every computer and to therefore run in full duplex with no collisions.
Role of switches in networks
Network switch is a marketing term rather than a technical one. Switches may operate at one or more OSI layers, including physical, data link, network, or transport (i.e., end-to-end). A device that operates simultaneously at more than one of these layers is called a multilayer switch, although use of the term is diminishing.In switches intended for commercial use, built-in or modular interfaces make it possible to connect different types of networks, for example Ethernet, Fibre Channel, ATM, and 802.11. This connectivity can be at any of the layers mentioned. While Layer 2 functionality is adequate for speed-shifting within one technology, interconnecting technologies such as Ethernet and token ring are easier at Layer 3.
Interconnection of different Layer 3 networks is done by routers. If there are any features that characterize "Layer-3 switches" as opposed to general-purpose routers, it tends to be that they are optimized, in larger switches, for high-density Ethernet connectivity.
In some service provider and other environments where there is a need for much analysis of network performance and security, switches may be connected between WAN routers as places for analytic modules. Some vendors provide firewall, network intrusion detection, and performance analysis modules that can plug into switch ports. Some of these functions may be on combined modules.
In other cases, the switch is used to create a mirror image of data that can go to an external device. Since most switch port mirroring provides only one mirrored stream, network hubs can be useful for fanning out data to several read-only analyzers, such as intrusion detection systems and packet sniffers.
Router:
A router is a device that forwards data packets along networks. A router is connected to at least two networks, commonly two LANs or WANs or a LAN and its ISP's network. Routers are located at gateways, the places where two or more networks connect, and are the critical device that keeps data flowing between networks and keeps the networks connected to the Internet. When data is sent between locations on one network or from one network to a second network the data is always seen and directed to the correct location by the router. They accomplish his by using headers and forwarding tables to determine the best path for forwarding the data packets, and they use protocols such as ICMP to communicate with each other and configure the best route between any two hosts.
The Internet itself is a global network connecting millions of computers and smaller networks so you can see how crucial the role of a router is to our way of communicating and computing.Why Would we Need a Router?
For most home users, they may want to set-up a LAN (local Area Network) or WLAN (wireless LAN) and connect all computers to the Internet without having to pay a full broadband subscription service to their ISP for each computer on the network. In many instances, an ISP will allow you to use a router and connect multiple computers to a single Internet connection and pay a nominal fee for each additional computer sharing the connection. This is when home users will want to look at smaller routers, often called broadband routers that enable two or more computers to share an Internet connection. Within a business or organization, you may need to connect multiple computers to the Internet, but also want to connect multiple private networks — and these are the types of functions a router is designed for.
Routers for Home & Small Business:
Not all routers are created equal since their job will differ slightly from network to network. Additionally, you may look at a piece of hardware and not even realize it is a router. What defines a router is not its shape, color, size or manufacturer, but its job function of routing data packets between computers. A cable modem which routes data between your PC and your ISP can be considered a router. In its most basic form, a router could simply be one of two computers running the Windows 98 (or higher) operating system connected together using ICS (Internet Connection Sharing). In this scenario, the computer that is connected to the Internet is acting as the router for the second computer to obtain its Internet connection.
Going a step up from ICS, we have a category of hardware routers that are used to perform the same basic task as ICS, albeit with more features and functions. Often called broadband or Internet connection sharing routers, these routers allow you to share one Internet connection between multiple computers.
Basic Network Diagram
(Configuration Example)
First we configure Switch 1:
Switch>en
Switch#configure terminal
Switch(config)#
switch(config)#hostname SW1
SW1(config)#enable password cisco
SW1(config)#vlan 1
SW1(config)#name test
SW1(config)#interface vlan1
SW1(config-if)#ip address 192.168.30.5 255.255.255.0
SW1(config-if)#no shutdown
SW1(config-if)#exit
SW1(config)# ip default-gateway 192.168.30.1
SW1(config)#
SW1(config)#line vty 0 15
SW1(config-line)#password cisco
SW1(config-line)#login
SW1(config)#exit
SW1(config)#
SW1# copy running-config startup-config
SW1#
Configuring Switch2:
Switch>en
Switch#configure terminal
Switch(config)#
switch(config)#hostname SW2
SW2(config)#enable password cisco
SW2(config)#vlan 1
SW2(config)#name test
SW2(config)#interface vlan1
SW2(config-if)#ip address 192.168.10.5 255.255.255.0
SW2(config-if)#no shutdown
SW2(config-if)#exit
SW2(config)# ip default-gateway 192.168.10.1
SW2(config)#
SW2(config)#line vty 0 15
SW2(config-line)#password cisco
SW2(config-line)#login
SW2(config)#exit
SW2(config)#
SW2# copy running-config startup-config
SW2#
Router1:
Router>en
Router#configure terminal
Router(config)#hostname RT1
RT1(config)#enable password cisco
RT1(config)#interface fastEthernet o/1
RT1(config-if)#ip address 192.168.30.1 255.255.255.0
RT1(config-if)#no shutdown
RT1(config-if)#
RT1(config-if)#exit
RT1(config)#interface fastEthernet 0/0
RT1(config-if)#ip address 192.168.20.1 255.255.255.252
RT1(config-if)#no shutdown
RT1(config-if)#
RT1(config-if)#exit
RT1(config)#
RT1(config)#line vty 0 4
RT1(config-line)#password cisco
RT1(config-line)#login
RT1(config-line)#exit
RT1(config)#
RT1(config)#ip route 0.0.0.0 0.0.0.0 192.168.20.2
RT1(config)#exit
RT1# copy running-config startup-config
RT1#
Router2:
Router>en
Router#configure terminal
Router(config)#hostname RT2
RT2(config)#enable password cisco
RT2(config)#interface fastEthernet o/1
RT2(config-if)#ip address 192.168.10.1 255.255.255.0
RT2(config-if)#no shutdown
RT2(config-if)#
RT2(config-if)#exit
RT2(config)#interface fastEthernet 0/0
RT2(config-if)#ip address 192.168.20.2 255.255.255.252
RT2(config-if)#no shutdown
RT2(config-if)#
RT2(config-if)#exit
RT2(config)#
RT2(config)#line vty 0 4
RT2(config-line)#password cisco
RT2(config-line)#login
RT2(config-line)#exit
RT2(config)#
RT2(config)#ip route 0.0.0.0 0.0.0.0 192.168.20.1
RT2(config)#exit
RT2# copy running-config startup-config
RT2#
Test
Ping 192.168.10.10 pc from 192.168.30.10 pc.
Also ping 192.168.30.10 pc from 192.168.10.10 pc.
Both PCs are pinging.
Vlan with wireless setup
Requirements
· Cisco Aironet Access Points and Wireless Bridges
· Cisco Catalyst Switches
Note :- We can use the switch side of this configuration with any of these hardware or software:
1. Catalyst 6x00/5x00/4x00 that runs CatOS or IOS
2. Catalyst 35x0/37x0/29xx that runs IOS
3. Catalyst 2900XL/3500XL that runs IOS
Conventions
A VLAN is a switched network that is logically segmented by functions, project teams, or applications rather
than on a physical or geographical basis. For example, all workstations and servers used by a particular
workgroup team can be connected to the same VLAN, regardless of their physical connections to the network
or the fact that they can be intermingled with other teams. Use VLANs to reconfigure the network through
software rather than physically unplug or move the devices or wires.
A VLAN can be thought of as a broadcast domain that exists within a defined set of switches. A VLAN
consists of a number of end systems, either hosts or network equipment (such as bridges and routers),
connected by a single bridging domain. The bridging domain is supported on various pieces of network
equipment, such as LAN switches, that operate bridging protocols between them with a separate group for
each VLAN.
When you connect a device to a Cisco Catalyst switch, the port where the device is connected is a member of
VLAN 1. The MAC address of that device is a part of VLAN 1. You can define multiple VLANs on a single
switch, and you can configure a switch port on most Catalyst models as a member of multiple VLANs.
When the number of ports in a network exceeds the port capacity of the switch, you must cross−connect
multiple switch chassis, which defines a trunk. The trunk is not a member of any VLAN, but a conduit over
which traffic passes for one or more VLANs.
In fundamental terms, the key in the configuration of an access point to connect to a specific VLAN is to
that, if the SSID on an access point is configured to recognize a specific VLAN ID or name, a connection to
the VLAN is established. When this connection is made, associated wireless client devices that have the same
SSID can access the VLAN through the access point. The VLAN processes data to and from the clients the
same way that it processes data to and from wired connections. You can configure up to 16 SSIDs on your
access point, so you can support up to 16 VLANs. You can assign only one SSID to a VLAN.
You extend VLANs into a wireless LAN when you add IEEE 802.11Q tag awareness to the access point.
Frames destined for different VLANs are transmitted by the access point wirelessly on different SSIDs with
different WEP keys. Only the clients associated with that VLAN receive those packets. Conversely, packets
that come from a client associated with a certain VLAN are 802.11Q tagged before they are forwarded onto
the wired network.
For example, employees and guests can access the wireless network of a company at the same time and be
administratively separate. A VLAN maps to an SSID, and the wireless client attaches to the appropriate SSID.
In networks with wireless bridges, you can pass multiple VLANs across the wireless link in order to provide
connectivity to a VLAN from separate locations.
If 802.1q is configured on the FastEthernet interface of an access point, the access point always sends
keepalives on VLAN1 even if VLAN 1 is not defined on the access point. As a result, the Ethernet switch
connects to the access point and generates a warning message. There is no loss of function on either the access
point or the switch, but the switch log contains meaningless messages that can cause more important messages
to be wrapped and not seen.
This behavior creates a problem when all SSIDs on an access point are associated to mobility networks. If all
SSIDs are associated to mobility networks, the Ethernet switch port to which the access point is connected can
be configured as an access port. The access port is normally assigned to the native VLAN of the access point,
which is not necessarily VLAN1. This causes the Ethernet switch to generate warning messages noting that
traffic with an 802.1q tag is sent from the access point.
You can eliminate the excessive messages on the switch if you disable the keepalive function.
If you ignore minor points in these concepts when you deploy VLANs with Cisco Aironet wireless
equipment, you can experience unexpected performance, for example:
The failure to limit allowed VLANs on the trunk to those defined on the wireless device
If VLANs 1, 10, 20, 30 and 40 are defined on the switch, but only VLANs 1, 10 and 30 are defined on
the wireless equipment, you must remove the others from the trunk switchport.
•
Misuse of the designation of infrastructure SSID
When you install access points, only assign the infrastructure SSID when you use an SSID on:
workgroup bridge devices
<00Α8>
repeater access points
<00Α8>
non−root bridges
<00Α8>
It is a misconfiguration to designate the infrastructure SSID for an SSID with only wireless laptop
computers for clients, and causes unpredictable results.
In bridge installations, you can only have one infrastructure SSID. The infrastructure SSID must be
the SSID that correlates to the Native VLAN.
•
Misuse or incorrect design of guest mode SSID designation
When you define multiple SSIDs/VLANs on Cisco Aironet wireless equipment, one (1) SSID can be
assigned as guest mode SSID with the SSID broadcast in 802.11 radio beacons. The other SSIDs are
not broadcast. The client devices must indicate which SSID to connect.
•
Failure to recognize that multiple VLANs and SSIDs indicate multiple OSI Model Layer 3 subnets
Deprecated versions of Cisco Aironet software permit binding multiple SSIDs to one VLAN. Current
versions do not.
•
OSI Model Layer 3 routing failures or incorrect designs
Each SSID and its linked VLAN must have a routing device and some source to address clients, for
example a DHCP server or the scope on a DHCP server.
•
Misunderstand or incorrectly configure Native VLAN
•
Significance of Native VLAN
When you use an IEEE 802.1Q trunk port, all frames are tagged except those on the VLAN configured as the
"native VLAN" for the port. Frames on the native VLAN are always transmitted untagged and are normally
received untagged. Therefore, when an AP is connected to the switchport, the native VLAN configured on the
AP must match the native VLAN configured on the switchport.
Note:
If there is a mismatch in the native VLANs, the frames are dropped.
This scenario is better explained with an example. If the native VLAN on the switchport is configured as
VLAN 12 and on the AP, the native VLAN is configured as VLAN 1, then when the AP sends a frame on its
native VLAN to the switch, the switch considers the frame as belonging to VLAN 12 since the frames from
the native VLAN of the AP are untagged. This causes confusion in the network and results in connectivity
problems. The same happens when the switchport forwards a frame from its native VLAN to the AP.
The configuration of native VLAN becomes even more important when you have a Repeater AP setup in your
wireless network. You cannot configure multiple VLANs on the Repeater APs. Repeater APs support only the
native VLAN. Therefore, the native VLAN configuration on the root AP, the switch port to which the AP is
connected, and the Repeater AP, must be the same. Otherwise traffic through the switch does not pass to and
from the Repeater AP.
An example for the scenario where the mismatch in the Repeater AP's native VLAN configuration can create
problems is when there is a DHCP server behind the switch to which the root AP is connected. In this case the
clients associated with the Repeater AP do not receive an IP address from the DHCP server because the
frames (DHCP requests in our case) from the Repeater AP's native VLAN (which is not the same as root AP
and the switch) are dropped.
Also, when you configure the switch port,
ensure that all the VLANs that are configured on the APs are
allowed on the switchport.
For example, if VLANs 6, 7, and 8 exist on the AP (Wireless Network) the
VLANs have to be allowed on the switchport. This can be done using this command in the switch:
switchport trunk allowed vlan add 6,7,8
By default, a switchport configured as a trunk allows all VLANs to pass through the trunk port. Refer to
Interaction with Related Switches for more information on how to configure the switchport.
Note:
Allowing all VLANs on the AP can also become a problem in some cases, specifically if it is a large
network. This can result in high CPU utilization on the APs. Prune the VLANs at the switch so that only the
VLAN traffic that the AP is interested in passes through the AP to avoid high CPU.
VLANs on Access Points
In this section, you are presented with the information to configure the features described in this document.
Note:
In order to find additional information on the commands used in this document, use the Command
Lookup Tool (
registered customers only
) .
Concepts with Access Points
This section discusses concepts about how to deploy VLANs on access points and refers to this network
diagram.
In this sample network, VLAN 1 is the Native VLAN, and VLANs 10, 20, 30 and 40 exist, and are trunked to
another switch chassis. Only VLANs 10 and 30 are extended into the wireless domain. The Native VLAN is
required to provide management capability and client authentications.
Access Point Configuration
In order to configure the access point for VLANs, complete these steps:
1.From the AP GUI, click Services > VLAN to navigate to the Services: VLAN page . The first step is to configure the native VLAN. From the Current VLAN List, select New
.
a. Enter the VLAN number of the Native VLAN in the VLAN ID box. The VLAN number must match the Native VLAN configured on the switch.
b. Because interface BVI 1 is associated to the sub interface of the Native VLAN, the IP address assigned to interface BVI 1 must be in the same IP subnet as other infrastructure devices on the network (that is, the interface SC0 on a Catalyst switch that runs Cat OS.)
c. Select the checkbox for the Native VLAN.
d. Select check boxes for the radio interface or interfaces where this VLAN applies.
e. ClickApply
Or, from the CLI, issue these commands:
AP# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
AP(config)# interface Dot11Radio0.1
AP(config−subif)# encapsulation dot1Q 1 native
AP(config−subif)# interface FastEthernet0.1
AP(config−subif)# encapsulation dot1Q 1 native
AP(config−subif)# end
AP# write memory
2. In order to configure other VLANs, follow these steps:
From the Current VLAN List, select1 New
.
a. Enter the VLAN number of the desired VLAN in the VLAN ID box. The VLAN numbermust match a VLAN configured on the switch.
b. Select check boxes for the radio interface or interfaces where this VLAN applies.
c. Click Apply
.
Or, from the CLI, issue these commands:
AP# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
AP(config)# interface Dot11Radio0.10
AP(config−subif)# encapsulation dot1Q 10
AP(config−subif)# interface FastEthernet0.10
AP(config−subif)# encapsulation dot1Q 10
AP(config−subif)# end
AP# write memory
D. Repeat steps 2a through 2d for each VLAN desired or enter these commands from the CLI with appropriate changes to the subinterface and VLAN numbers:
AP# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
AP(config)# interface Dot11Radio0.30
AP(config−subif)# encapsulation dot1Q 30
AP(config−subif)# interface FastEthernet0.30
AP(config−subif)# encapsulation dot1Q 30
AP(config−subif)# end
AP# write memory
3. The next step is to associate the configured VLANs to the SSIDs. In order to do this, click Security >SSID Manager
Note: You do not need to associate every VLAN defined on the access point with an SSID. For xample, for security reasons, most access point nstallations do not associate an SSID with the ative VLAN.
a. In order to create a new SSID, choose New
b. Enter the desired SSID (case−sensitive) in the SSID box.
c. Select the desired VLAN number to associate this SSID with from the dropdown list.
Note: In order to keep this document within its intended scope, security for an SSID is not addressed.
d. Click apply−RadioX o create the SSID on the selected radio, or Apply−all to create it on allradios.
Or from the CLI, issue these commands:
AP# configure terminal
]Enter configuration commands, one per line. End with CNTL/Z.
AP(config)# interface Dot11Radio0
AP(config−if)# ssid Red
AP(config−if−ssid)# vlan 10
AP(config−if−ssid)# end
AP# write memory
4. Repeat steps 3a through 3d for each SSID desired or enter these commands from the CLI with appropriate changes to the SSID.
AP# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
AP(config)# interface Dot11Radio0
AP(config−if)# ssid Green
AP(config−if−ssid)# vlan 30
AP(config−if−ssid)# end
AP# write memory
VLANs on Bridges
Concepts on BridgesThis section discusses concepts related to how to deploy VLANs on bridges and refers to this network diagram.In this sample network, VLAN 1 is the Native VLAN, and VLANs 10, 20, 30 and 40 exist. Only VLANs 10 and 30 are extended to the other side of the link. The wireless link is encrypted.
In order to encrypt data that passes over the radio link, apply encryption to only the SSID of the Native VLAN. That encryption applies to all other VLANs. When you bridge, there is no need to associate a separate
SSID with each VLAN. VLAN configurations is the same on both the root and non−root bridges.
Bridge Configuration
In order to configure the bridge for VLANs, like the sample network diagram, complete these steps:
1. From the AP GUI, clickServices > VLANto navigate to the Services: VLAN page.
a. The first step is to configure the Native VLAN. In order to do this, choose \<New> from theCurrent VLAN List.
b. Enter the VLAN number of the Native VLAN in the VLAN ID box. This must match the Native VLAN configured on the switch.
c. Because interface BVI 1 is associated to the sub interface of the Native VLAN, the IP address assigned to interface BVI 1 must be in the same IP subnet as other infrastructure devices on the network (i.e. interface SC0 on a Catalyst switch that runs CatOS.)
d. Select the checkbox for the Native VLAN.
e. Click Apply
Or, from the CLI, issue these commands:
bridge# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
bridge(config)# interface Dot11Radio0.1
bridge(config−subif)# encapsulation dot1Q 1 native
bridge(config−subif)# interface FastEthernet0.1
bridge(config−subif)# encapsulation dot1Q 1 native
bridge(config−subif)# end
bridge# write memory
2. In order to configure other VLANs, follow these steps:
a. From the Current VLAN List, select New
b. Enter the VLAN number of the desired VLAN in the VLAN ID box. The VLAN number must match a VLAN configured on the switch.
c. Click Apply
Or, from the CLI, issue these commands:
bridge# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
bridge(config)# interface Dot11Radio0.10
bridge(config−subif)# encapsulation dot1Q 10
bridge(config−subif)# interface FastEthernet0.10
bridge(config−subif)# encapsulation dot1Q 10
bridge(config−subif)# end
bridge# write memory
d. Repeat steps 2a through 2c for each VLAN desired or enter the commands from the CLI with appropriate changes to the subinterface and VLAN numbers.
AP# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
bridge(config)# interface Dot11Radio0.30
bridge(config−subif)# encapsulation dot1Q 30
bridge(config−subif)# interface FastEthernet0.130
bridge(config−subif)# encapsulation dot1Q 30
bridge(config−subif)# end
bridge# write memory
3. From the SSID Manager (under the Security > SSID Manager
menu item,) associate the Native VLAN with an SSID.
Note: When you bridge, the only SSID that you must associate with a VLAN is the one that correlates to the Native VLAN. You must designate this SSID as the Infrastructure SSID.
a. From the Current SSID List, select New
b. Enter the desired SSID (case−sensitive) in the SSID box.
c. Select the VLAN number that correlates to the Native VLAN from the dropdown list.
Note: In order to keep this document within its intended scope, security for an SSID is not addressed.
d. Click Apply to create the SSID on the radio and associate it to the Native VLAN.
