VTP PRUNING: Troubleshoot L2 Connectivity Issue

VTP ensures that all switches in the VTP domain are aware of all VLANs. However, there are occasions when VTP can create unnecessary traffic. All unknown unicasts and broadcasts in a VLAN are flooded over the entire VLAN. All Cisco switches in the network receive all broadcasts, even in situations in which few users are connected in that VLAN. VTP pruning is a feature that you use in order to eliminate or prune this unnecessary traffic.

Broadcast traffic in a switched network without pruning

This figure shows a switched network without VTP pruning enabled. Port 1 on Switch A and Port 2 on Switch D are assigned to the Red VLAN. If a broadcast is sent from the host connected to Switch A, Switch A floods the broadcast and every switch in the network receives it, even though Switches C, E, and F have no ports in the Red VLAN.

Broadcast traffic in a switched network with pruning

This figure shows the same switched network with VTP pruning enabled. The broadcast traffic from Switch A is not forwarded to Switches C, E, and F because traffic for the Red VLAN has been pruned on the links shown (Port 5 on Switch B and Port 4 on Switch D).

When VTP pruning is enabled on a VTP server, pruning is enabled for the entire management domain. Making VLANs pruning-eligible or pruning-ineligible affects pruning eligibility for those VLANs on that trunk only (not on all switches in the VTP domain). VTP pruning takes effect several seconds after you enable it. VTP pruning does not prune traffic from VLANs that are pruning-ineligible. VLAN 1 and VLANs 1002 to 1005 are always pruning-ineligible; traffic from these VLANs cannot be pruned. Extended-range VLANs (VLAN IDs greater than 1005) are also pruning-ineligible.

The example:

In my experience in LAN Switching TAC, I have come across network connectivity problems that have taken a lot of time to solve. Symptoms observed are as follows

Intermittent connectivity to host connect to an access switch

One way audio in IP telephony

Default gateway cannot ping few hosts and when traffic is initiated from host, pings from the default gateway magically starts working and all other devices can ping these host

Clients connected to same access switch can ping each other but clients connected to an upstream switch cannot and so on.

Typical setup is as follows

CORE MLS(gi1/1)-----trunk------Access Switch----Clients

In most cases CORE Switch is the default gateway for the Clients.

Typical Troubleshooting is as follows

1)      Is the ARP complete ?

CORE#sh ip arp 10.10.1.144Protocol Address         Age (min) Hardware Addr   Type   InterfaceInternet 10.10.1.144           100   8cb6.4faa.8a41 ARPA   Vlan93

YES IT IS

2)  Is the switch learning mac address ?

CORE# sh mac-address-table address 8cb6.4faa.8a41 <NOT LEARNING MAC ADDRESS>

That should not cause connectivity loss as the packets will be flooded and will make its way to the clients

3)  Lets check the spanning tree status for vlan 93

CORE # show spanning-tree vlan 93<SNIP>Gigabitethernet 1/1 shows forwarding

Well, spanning tree status is forwarding – so my packets are supposed to leave interface Gi1/1

Lets SPAN interface Gi1/1 and see if packets are leaving – Result: SPAN Captures show no packets leave the interface.

Crazy !! so it is the CORE switch that is culprit – lets replace it ??

NO WAY -- Are we sure it is a hardware issue – No

What have we missed ? Hmm.. Lets add a static mac entry and see if that helps

CORE(config)# mac address-table static 8cb6.4faa.8a41 vlan 93 int gi1/1

CORE# ping 10.10.1.144

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.10.1.144, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

Lets remove the static mac address and now initiate traffic from end client –

mac address learned and everyone in the network can reach the client

From the troubleshhoting performed so far the observations made are as follows:

We intermittently lose connectivity to client. When traffic is initiated from client, we are immediately able to establish

connectivity to client and finally, we observe that the problem is seen when mac address of client ages out on the CORE switch

So what feature can block unicast flooding?

switchport block unicast command on the interface - not configured here

VTP pruning – Ah ha!!

Let us check if any vlan is pruned

CORE#show int gi1/1 trunk

Port          Mode         Encapsulation  Status        Native vlan

Gi1/1        on           802.1q         trunking      1

Port          Vlans allowed on trunk

Gi1/1        1-4094

Port          Vlans allowed and active in management domain

Gi1/1        1,10-18,20-30,32,60-61,90-103,111,138,155-156,201-203,400

Port          Vlans in spanning tree forwarding state and not pruned

Gi1/1        1,10,22

Also check

CORE#show int gi1/1 pruning

Port      Vlans pruned for lack of request by neighbor

Gi1/1    11-18,20-21,23-30,32,60-61,90-103,111,138,155-156,201-203,400 

-> All these VLAN’s are pruned because neighbor did not request for them

Port      Vlan traffic requested of neighbor

Gi1/1    1,10-18,20-30,32,60-61,90-103,111,138,155-156,201-203,400 

-> This is what CORE Switch is requesting from its neighbor switch

So VTP pruning was the culprit – As the mac address of end client aged out, the switch would have to unicast flood the packet to all ports on

VLAN 93, which is not sent on Gi1/1 as VLAN 93 was pruned.

Once VTP pruning is turned off – All connectivity issues are corrected.

When can such a scenario occur ?

1)  In environment which has switches in VTP server/client mode along with switch that maybe in VTP transparent mode

2)  When a non Cisco switch that does not understand VTP is connected to a Cisco Switch which has VTP turned ON (in most cases)

So please keep in mind that VTP pruning can be the cause of connectivity issues.

In an all Cisco environment where all switches are configured to be in VTP server or client mode, you can turn ON VTP pruning as this will help limit unnecessary flooding in the network and is of great help.

After all, VTP pruning need not be a PIA.

It is referred from: https://supportforums.cisco.com/blog/150491/troubleshoot-l2-connectivity-issue-vtp-pruning

More about the Cisco configuration, please visit: http://www.3anetwork.com/blog

How to set the speed limit on Cisco router

In the Cisco router device, such as Cisco 2911 and 1941 router , only the support Cisco fast forwarding (CEF, CiscoExpressForward) of the switch or router can use rate-limit to flow, the specific settings at three steps:

Fast router limit inputoutput: This is the definition of data flow direction.

BPS: define the flow rate limit, the unit is BPS

Burst-normalburst-max: the definition of the data size, using 80001600032000 general, in bytes,when arriving data exceeds this capacity, will trigger an action, discarded or forwarding, so as to achieve the purpose of speed.

Conform-action and exceed-action: refers to the processing strategy following the rates and more than the rate of flow.

How to upgrade IOS of Cisco Catalyst 2960 Switch

Cisco 2960 IOS upgrade:

To upgrade IOS of Cisco Catalyst 2960 Switch we have to follow some basic checklist first-

a.    Check for the older version.

b.    Backup Older Version of IOS.

c.    Backup Switch Configuration.

Required Softwares –

a.    TFTP server utility for taking/ restoring backup of IOS.

b.    Putty / Hyper-terminal Utility to access switch.

Commands to Check IOS version –

Switch01#sh flash:

Directory of flash:/

2 -rwx 3096 Mar 1 1993 05:40:50 +05:30 multiple-fs

3 -rwx 10644 Mar 1 1993 05:38:52 +05:30 config.text

4 -rwx 5 Mar 1 1993 05:38:52 +05:30 private-config.text

6 -rwx 8040418 Mar 1 1993 01:28:27 +05:30 c2960-lanbasek9-mz.122-46.bin

32514048 bytes total (24457728 bytes free

Commands to take Backup of Old IOS –

a.    Start TFTP software on PC (Ip address of PC – 10.10.11.60).  Location were backup will be stored – C:\tftpd32.273

b.    Commands on Switch –

Switch01#copy flash: tftp:

Source filename []? c2960-lanbasek9-mz.122-46.bin

Address or name of remote host []? 10.10.11.60

Destination filename [c2960-lanbasek9-mz.122-46.bin]? c2960-lanbasek9-mz.122-46.bin

! Com pleted.

Commands to take Backup of Switch Configuration –

a. Start TFTP software on PC (Ip address of PC – 10.10.11.60)

Location were backup will be stored – C:\tftpd32.273

b. Commands on Switch -

Switch01#copy startup tftp:

Address or name of remote host []? 10.10.11.60

Destination filename [Switch01-confg]? Switch01-confg

! Completed.

Upgrading Cisco Catalyst 2960 Switch IOS –

TFTP Settings – Select the directory where New Cisco IOS is located –

i.e. C:\tftpd32.273

Commands on Switch –

Switch01#copy tftp: flash

Address or name of remote host []? 10.10.11.60

Source filename[]? c2960-lanbasek9-mz.122-50.SE3.bin

Destination filename [c2960-lanbasek9-mz.122-50.SE3.bin]?

! Completed.

Check for new IOS in Flash –

Switch01#sh flash:

Directory of flash:/

2 -rwx 3096 Mar 1 1993 05:40:50 +05:30 multiple-fs

3 -rwx 10644 Mar 1 1993 05:38:52 +05:30 config.text

4 -rwx 5 Mar 1 1993 05:38:52 +05:30 private-config.text

6 -rwx 8040418 Mar 1 1993 01:28:27 +05:30 c2960-lanbasek9-mz.122-46.bin

7 -rwx 8040418 Feb 11 2010 01:28:27 +05:30 c2960-lanbasek9-mz.122-50.SE3.bin

Now, the Up gradation is Completed, we have to remove Old IOS from Flash –

Switch01#delete flash:c2960-lanbasek9-mz.122-46.bin

! Completed.

Setup new IOS as the default IOS during Boot process –

Switch01(config)#boot system flash: c2960-lanbasek9-mz.122-50.SE3.bin

Reload Cisco Switch for new IOS to Take effect -

Switch01# reload

Cisco Router Throughput

Let’s know about the Cisco router throughput from the below message:

1 No Drop Rate and RFC-2544 Tests

Routers have traditionally been tested using RFC 2544 or similar types of performance tests. RFC 2544 requires tests to be run at a no drop rate (NDR). This testing is done by using a fixed packet size, usually 64-byte packets, and the results are usually published as a metric in kilopackets per second (kpps). The tests are designed to show the CPU power and processing power of the platform (Table 1).

Another popular technique for providing router performance information is also an NDR test, but it is performed with maximum packet size and presented as a throughput test. Results are delivered as megabits per second (Mbps).

This test yields a maximum data-rate forwarding of specific features.

For NDR tests sometimes the platforms can process and forward packets faster than the aggregate bandwidth of the interfaces that the specific models can support. In this situation, all available interfaces are driven to line rate and CPU usage recorded.

What these tests do not provide is any indication of how the router will perform in a production environment. They assume that router CPUs scale linearly to the point where they drop packets. The tests provide no means for analyzing router services, software-based algorithms, or other features. There is no ability to account for real protocols, application layer gateways (ALGs), or other real-world traffic.

Also, production networks tend to have varied packet sizes. Voice traffic and TCP acknowledgements (ACKs) tend to be very small packets, generally 64 to 80 bytes. File transfers and some applications tend to use as large a packet size as they can negotiate. Thus, NDR tests with fixed packet sizes do not provide a very realistic look at router performance in a production environment.

2 Firewall testing

Firewall testing is much more complicated than any other test discussed in this document. Zone-based firewall (ZBF) is a stateful application, maintaining and monitoring the state of all TCP connections through it. It has multiple ALGs that allow it to inspect and monitor specific protocols and applications. ZBF also inspects traffic both within and between zones.

Thus, test methodology significantly affects performance. Testing different applications invokes specific ALGs, each of which may affect test results differently. Many test tools can generate packets with TCP headers, but never complete the handshake and establish state for monitoring. In some situations, the firewall may see this situation as a denial-of-service (DoS) attack, because it would rarely be encountered in a production network unless under attack. The use of pure User Datagram Protocol (UDP) or other stateless traffic patterns can also produce varying results.

For the purposes of this document, firewall is configured with two zones, and all traffic is sent between zones. The traffic generated is stateless and uses the same UDP port number. Performance is measured in maximum throughput and the number of maximum concurrent sessions. One element that influences the maximum-sessions metric is the

amount of installed memory in the platforms. These tests used default memory. Table 4 gives firewall performance information by platform.

Again, the data presented in this section is for maximum performance and is not very valuable for use in a production network. Although a router may be able to forward more than 1 Gbps of encrypted traffic in a lab-based performance test, it should not be expected to perform at that level in a customer’s network. Packet sizes will vary in a real

network, and routers cannot be stressed to NDR.

Maximum tunnels are a specific point where performance derived in a lab situation varies from a production design.

Although this number is easy to reproduce in a test environment, very little traffic will be forwarded over those tunnels during the test.

Firewall performance will vary depending on the nature of the traffic. Because ZBF monitors the state of traffic and monitors specific protocols and applications, actual application traffic will affect the throughput of the firewall.

Cisco 1921 the most popular router discount 49% off on 3anetwork.com.

Why the AP can not connect with the Cisco 2960?

2 Cisco switches 2960 (WS-C2960S-24TD-L and WS-C2960S-48TD-L ) were connected with a trunk to carry 2 VLANs - VLAN 101 for data, and VLAN 102 for voice - IP phones. Please see the switch configurations as attached:

 Basically, switch01 is a 24-port Gigabit Ethernet with POE support, whereas Switch02 is a 24-port Fast Ethernet without POE. A trunk was created that carries VLAN101 and 102 between 2 switches. Switch01 is working fine with mixture of laptop/desktops/ip phones, with DHCP server hosted on one of the server connected to switch02. However, for switch01, only existing devices that connected are working fine. My co-worker tried to connect a Wireless AP with a static IP, and he found that the network port "Activity" and "link" LEDs are off.  Connect to other port on switch01 is the same.

What could be a problem? Does the switch configured wrongly? How about trunk? Could it be the port speed, duplex? How about spanning-tree, does this needed?

The solution:

On the trunks:

interface GigabitEthernet0/2

 no switchport access vlan 101

 switchport trunk allowed vlan 101,102

 switchport mode trunk

 switchport nonegotiate

 duplex full

You don't need the switchport access vlan 101

For the port on switch one that you want to connect to the AP do this:

interface GigabitEthernet0/24

 switchport mode access

 switchport access vlan 101

 no switchport voice vlan 102

 spanning-tree portfast

Try that. It may be that since you have voice vlan configured, the port is trying to negotiate a trunk with the AP and the AP is not configured for that.

The AP should be configured as VLAN 101. I am saying change the port that the AP will connect to into an ACCESS port. With voice vlan on it, it's really a trunk port.

The access command doesn't have any effect since the port is in trunk mode, so it's not needed.   VLAN 1 by default is the native vlan anyway unless you specify a different vlan with switchport trunk native vlan x (x being the vlan number)

More information about the cisco 2960 FAQ, please visit: http://cisco2960faq.blogspot.com

What's the fastest way to connect the 3 Cisco 2960-S switches

what's the best/recommended and most reliable/fastest way to connect my 3 Cisco 2960-S switches? WS-C2960S-48LPS-L and WS-C2960S-24TS-S

I work with  a home automation company that needs the most reliable network possible since the entire house relies on the network/wireless.

i have a Fortigate 60C as my main router, 5 Ruckus 7363 APs and 1 Cisco 2960-S PoE and 2 Cisco 2960-S Catalyst Switches.

All 3 swtiches are located in 3 different parts of the house and are connected via CAT6 from the main 2960-S PoE on port 23 and 24 to switches in Living and Theater respectively.

i know this swtiches have 4 SFP ports?

can i get an adapter form SFP to CAT6e or CAT5?

is there an advantage to configuring a port role depending on what's connected on each port?

The solution:

1 If you can connect all three switches together, Switch A to B, B to C and C to A, you will have the most redundancy. Spanning tree will prevent a switching loop. Most of your equipment will likely support only one network connection; however, ideally, connecting a server to two separate switches will provide better redundancy.

If possible, try distributing the AP across the various switches for redundancy as well. 

As for the SFP ports, you can get Copper SFP's, but since the switches are Gigabit to begin with, there really is now point. Unless you are using VLANs, any switch port will do.

If throughput is an issue, you may choose to connect the switches with two or more cables, and enable etherchannel for link aggregation.

2 I advise to use Optical SFPs to crossconnect the swithes, if you bought 10G version you able to use 10G if not you able to use 1G.

You need to use STP (which is defaultly enabled)

If you have 1g UPLINK you able to use 2 SFP-s for same for link aggregation  switch to another via PaGP.

I advise to use single mode cable for optical!

Tips for where to buy the SFP

The distrobutor 3anetwork is a world leading Cisco networking products wholesaler, offers Cisco networking  products, Cisco switches, Cisco routers and other products at competitive price. Best price on SFP modules. You can request a quote by emailing us at info@3Anetwork.com or pick up the phone and speak to one of our friendly and helpful sales reps at +852-3069-7733.

Contact information:

Telephone: +852-3069-7733(Hong Kong)

Fax: +852-3069-7731

Email:   info@3Anetwork.com(Sales Inquiries)

Address: 23/F Lucky Plaza, 315-321 Lockhart Road, Wanchai, Hongkong

Website: http://www.3anetwork.com

How to Connecting Cisco Router to another DSL modem-router

I have two routers:

First one, connected to the DSL line directly, a huawei HG532ci, it gives me access to the internet correctly to any computer by simply connection an ethernet cable to any of its 4 ports (or wireless as well).

I have another Cisco 2911(cisco WRT120N) i want to connect to the fist one, and connect another computer to this second router (i have my reasons to do this, and not connecting directl to the first one).

So i want the second router (cisco) to give access to the internet with its ports, just like the first one.

I connected the second router (cisco) to the first one, from a LAN2 port in the first router to the "internet" port in the second, that receives the signal, as you see in the picture below.

The first (huawei) router, settings are as follows: see picture huawei.jpg

And the cisco router settins are also in the next pictures.

Whan am i doing wrong? Cisco IP is 192.168.1.2, Huawei router IP is the same but .1, dhcp is enabled, etc... I have no i idea what setting should be whats causing the cisco router not givin internet access

I have also attached an IPconfig from the computer connected to the cisco router.

thank you!!

The solution:

It sounds like you just want to use the Cisco router as a switch to get more network ports.  If this is the case, then you will want to disable all DHCP services on the Cisco and connect the LAN ports of the two routers.  If you are trying to segment a section of your network behind the Cisco router, then you will need to choose separate IP ranges for the two networks, in order for the Cisco router to properly NAT.  If I am completely off on what you are trying to do, then you may want to provide a little more information as to why you are adding the cisco into the mix. Then we can figure out how it should be setup.

Cisco 2911 price: 

http://www.3anetwork.com/cisco-cisco2911/k9-price_p238.html