How to Set Switches on the IP-MAC Binding

Although in the TCP / IP networks, computers often need to set the IP address to communicate, in fact, the communication between computers is not via IP address, but by means of the MAC address of the network card. IP addresses only to be used to query the MAC address of the target computer which is to communicate.   

ARP protocol is used to notify corresponding MAC address of our own IP for other's computers, network equipment. There are one or more tables in the computer's cache ARJ for storing IP address and parsed Ethernet MAC address. The corresponding MAC address will retain in the ARP cache after one computer was communicated with another IP address computer. So the next time when communicate with the same IP address, it will use the cache MAC addresses directly instead of querying the MAC address.

Under a switched network, the switch also maintains a MAC address table, and then sends data to the target computer according to MAC address. 

Why do we need to bind MAC and IP Address? IP address is very easy to modify while MAC address is stored in the EEPROM of the card, and only the card's MAC address is determined. Therefore, in order to prevent insider from doing illegal IP embezzlement (for example: embezzle the higher IP address authority to get the information outside the permission) we can bind the internal network IP address and MAC address, and the embezzlement will be failed due to the unmatched MAC address even if the embezzler changed the IP address. What’s more, we can find corresponding user of the network card according to the MAC address and then find out the embezzler due to the only certainty of MAC address.

Currently, the MAC address and IP address binding techniques has been adopted to the internal network of many companies. Here we will introduce the IP and MAC binding programs of the Cisco switch.

There are three options as below to choose as to the Cisco, and the function of option 1 and 2 is the same, that is to say, bind the specific host MAC address (network card hardware address) to the specific switch port. Option 3 is simultaneously binding the specific host MAC address (network card hardware address) and IP address to the specific host port on the switch.

Option 1 - Based on MAC address binding on port

Take Cisco 2950 switch for example, to log into the switch, enter the administrative password into the configuration mode, and then input the command:

Switch#config terminal
＃Enter into the configuration mode
Switch(config)# Interface fastethernet 0/1
＃Enter into the specific port configuration mode
Switch(config-if)#Switchport port-secruity
＃Configure port security mode
Switch(config-if )switchport port-security mac-address MAC (MAC address of the mainframe)
＃Configure the port to bind the host's MAC address
Switch(config-if )no switchport port-security mac-address MAC (MAC address of the host computer)
＃Delete the binding host's MAC address

Note:

These functions apply to Cisco 2950,3550,4500,6500 Series Switches

Option 2 - based on extended access lists of MAC addresses

Switch(config)Mac access-list extended MAC10
＃ Define a MAC address access control list and name the list to be MAC10  
Switch(config)permit host 0009.6bc4.d4bf any
＃Define the host MAC address 0009.6bc4.d4bf  to access any host computers
Switch(config)permit any host 0009.6bc4.d4bf
＃Define all host computers to access the host MAC address 0009.6bc4.d4bf
Switch(config-if )interface Fa0/20
# Enter into specific interface configuration mode
Switch(config-if )mac access-group MAC10 in
＃Apply to access list with the name of MAC 10 on the port (that is the access policies we defined before)
Switch(config)no mac access-list extended MAC10
＃Clear the access list which named MAC 10

Note:

The above functions can be achieved on Cisco 2960,3560,4500,6500 Series switches, however, the 2960, 3560 switches need the Enhanced Image.

Option 3 - MAC address binding of IP address

Only the combination between option 1 or 2 and the based ACL (access control lists) of IP can achieve the IP-MAC binding function.   

Switch(config)Mac access-list extended MAC10
＃Define a MAC address access control list and name the list to be MAC10
Switch(config)permit host 0009.6bc4.d4bf any
＃Define the host MAC address 0009.6bc4.d4bf  to access any host computers
Switch(config)permit any host 0009.6bc4.d4bf
＃Define all host computers to access the host MAC address 0009.6bc4.d4bf
Switch(config)Ip access-list extended IP10
＃Define a IP address access control list and name the list to be IP10
Switch(config)Permit 192.168.0.1 0.0.0.0 any
＃Define the host of 192.168.0.1 IP address to access any host computers

Permit any 192.168.0.1 0.0.0.0
＃Define all host computers to access the host of 192.168.0.1 IP address
Switch(config-if )interface Fa0/20
# Enter into specific interface configuration mode
Switch(config-if )mac access-group MAC10 in
＃Apply to access list with the name of MAC 10 on the port (that is the access policies we defined before)

Switch(config-if )Ip access-group IP10 in
＃Apply to access list with the name of IP10 on the port (that is the access policies we defined before)

Switch(config)no mac access-list extended MAC10
＃Clear the access list which named MAC10
Switch(config)no Ip access-group IP10 in
＃Clear the access list which na med IP10

The above mentioned option 1 is based on the binding between MAC address of host computer and switch ports, Option 2 is based on the MAC address access control list, the functions of the first two schemes can be achieved the same. The IP and MAC address binding can be achieved if you do as the Option 3. You can combine Option 1 or 2 with ACL (access control lists) to realize what you want.

Note:

The above functions can be achieved on Cisco 2960,3560,4500,6500 Series switches, however, the 2960, 3560 switches need the Enhanced Image.

Note:

Apparently, the binding between MAC address and IP address can avoid embezzlement of internal IP addresses, however, in fact, there are a lot of defects between the binding and can not really avoid the embezzlement of the internal IP addresses due to the layers of protocols and network card drivers and other technologies.

More related:

The command line operation modes and functions of Cisco switches

FAQ for Cisco Integrated Services Router Generation 2

Cisco 3650 Series Switches Overview

The Cisco Catalyst 3650 Switch delivers converged wired and wireless access on a single platform, creating an uncompromised user experience in any workspace. The converged system provides a single platform for wired and wireless networkwide visibility for faster troubleshooting, advanced security and quality of service (QoS) control, maximum resiliency with fast stateful recovery, and scale with distributed wired and wireless data plane.

Cisco Catalyst 3650 Highlights

• Built on Cisco Unified Access Data Plane (UADP) application-specific integrated

circuit (ASIC) with programmability to support Cisco ONE Enterprise Networks

Architecture and software-defined networking (SDN)

• Integrated wireless LAN controller functionality

• Native Flexible NetFlow (FnF) on all ports

• Granular, hierarchical bandwidth management

• Cisco TrustSec support

Cisco Catalyst 3650 Primary Features

• Integrated wireless LAN controller capability with:

-Up to 40G of wireless capacity per switch (48-port models)

-Support for up to 25 access points and 1000 wireless clients on each switch or stack

• 24 and 48 10/100/1000 data and Power over Ethernet Plus (PoE+) models with

Energy-Efficient Ethernet (EEE)

-Optional Cisco StackWise-160 technology provides scalability and resiliency with 160 Gbps of stack throughput (for additional wired and wireless capabilities, please visit the Cisco Catalyst 3850 Series Switches page)

-Fixed, built-in 4 x Gigabit Ethernet, 2 x 10 Gigabit Ethernet, or 4 x 10 Gigabit

Ethernet Small Form-Factor Pluggable (SFP) and SFP+ uplink ports

-Dual redundant power supplies and three modular fans, providing higher redundancy

-Full IEEE 802.3at (PoE+) with 30W power on all ports in 1 rack unit (RU) form factor

• Software support for IPv4 and IPv6 routing, multicast routing, modular QoS, FnF

Version 9, and advanced security features

• Single, consistent Cisco IOS XE Software image across all license levels, providing an easy upgrade path for access points and software features Enhanced limited lifetime warranty (E-LLW) with next business day (NBD) advance hardware replacement and 90-day access to Cisco Technical Assistance Center (TAC) support

Switch Configurations

The Cisco Catalyst 3650 Series Switches are available in LAN Base, IP Base, and IP Services feature sets. All switches ship with a default AC power supply. A DC power supply can be purchased as an option or spare. The base switch does not include any access point licenses.

StackWise-160 Technology

The Cisco Catalyst 3650 provides maximum data, power, and wireless resiliency using Cisco StackWise-160 technology, which is built on the highly successful industry-leading Cisco StackWise technology. The StackWise-160 technology provides optional stacking with 160 Gbps of bandwidth for providing resiliency within the stack. The stack behaves as a single switching unit that is managed by an active switch elected from one of the member switches. The active switch creates and updates all the switching, routing, and wireless tables. In an event of the active member failure, the standby member assumes the role of the active switch, continuing to keep the stack operational.

Cisco Catalyst 3650 Primary Advantages

Converged Wired and Wireless Platform

The Cisco Catalyst 3650 is a stackable platform that converges wired and wireless services on a Cisco IOS XE Software based platform. The CAPWAP tunnels from the access points terminate at the 3650 switch, enabling users to configure and apply software features such as QoS, security, and FnF across wired ports and wireless SSIDs on the same switch at the same time. The converged wired and wireless platform supports the Cisco Unified Access solution. With “one policy, one management, one network,” the Cisco Catalyst 3650 and Cisco Unified Access help IT spend less time running the network and more time on business innovation.

Advanced Security

The Cisco Catalyst 3650 is hardware capable of supporting Cisco TrustSec functionality. Cisco TrustSec uses the device and user credentials acquired during authentication for classifying the packets by security groups as they enter the network with scalability and simplified management. The classification is maintained through the network by the security group tag (SGT) and through integration with the Cisco Identity Services Engine. The Cisco Catalyst 3650 is also hardware-ready for link layer MACsec encryption, which provides networkwide encryption to protect data traffic across the network.

Application Visibility and Control (AVC)

With the native support for FnF on all the ports, the Cisco Catalyst 3650 can monitor both east-west and north-south wired traffic at the same time. The Cisco Catalyst 3650 switch terminates the wireless CAPWAP tunnels from the access point, providing full visibility into the wireless traffic at the switch. Because the wireless traffic is now visible at the switch, it is possible to identify wireless traffic using FnF and prioritize the traffic using advanced QoS capabilities for an improved user experience and faster troubleshooting.

SmartOperations

The Cisco Catalyst 3650 supports Cisco Catalyst SmartOperations. SmartOperations features such as Auto Smartports, Auto QoS, and Smart Install reduce deployment time by automating most of the basic switch and port configurations.

Foundation for Cisco ONE Enterprise Networks Architecture

The Cisco Catalyst 3650 is built on the UADP ASIC, which provides wire-rate hardware performance with software programmability. The UADP ASIC features a programmable data plane, enabling deployment of SDN services and support of future software features over the product lifetime. The Cisco Catalyst 3650 supports the Cisco ONE Enterprise Networks Architecture for openness, programmability, and operational simplicity.

Reduced Total Cost of Ownership

The Cisco Catalyst 3650 reduces the total cost of ownership and provides superior investment protection through:

• Built-in wireless controller functionality

• Optional stacking

• Support for fixed GE or 10 GE uplink

• Support for IP Base and IP Services software options

• Dual redundant power supply and three individual fans to help ensure high availability

• E-LLW with NBD advance hardware replacement and 90-day access to Cisco TAC support

More related:

Cisco Catalyst 3650 Series Configurations

Power Specifications for Cisco Catalyst 3650 Series

Cisco Catalyst 2960-X and Catalyst 3650/3850 Comparison

End-of-Sale and End-of-Life Announcement for the Cisco Catalyst 3560V2 and 3750V2 Switches

VTP PRUNING: Troubleshoot L2 Connectivity Issue

VTP ensures that all switches in the VTP domain are aware of all VLANs. However, there are occasions when VTP can create unnecessary traffic. All unknown unicasts and broadcasts in a VLAN are flooded over the entire VLAN. All Cisco switches in the network receive all broadcasts, even in situations in which few users are connected in that VLAN. VTP pruning is a feature that you use in order to eliminate or prune this unnecessary traffic.

Broadcast traffic in a switched network without pruning

This figure shows a switched network without VTP pruning enabled. Port 1 on Switch A and Port 2 on Switch D are assigned to the Red VLAN. If a broadcast is sent from the host connected to Switch A, Switch A floods the broadcast and every switch in the network receives it, even though Switches C, E, and F have no ports in the Red VLAN.

Broadcast traffic in a switched network with pruning

This figure shows the same switched network with VTP pruning enabled. The broadcast traffic from Switch A is not forwarded to Switches C, E, and F because traffic for the Red VLAN has been pruned on the links shown (Port 5 on Switch B and Port 4 on Switch D).

When VTP pruning is enabled on a VTP server, pruning is enabled for the entire management domain. Making VLANs pruning-eligible or pruning-ineligible affects pruning eligibility for those VLANs on that trunk only (not on all switches in the VTP domain). VTP pruning takes effect several seconds after you enable it. VTP pruning does not prune traffic from VLANs that are pruning-ineligible. VLAN 1 and VLANs 1002 to 1005 are always pruning-ineligible; traffic from these VLANs cannot be pruned. Extended-range VLANs (VLAN IDs greater than 1005) are also pruning-ineligible.

The example:

In my experience in LAN Switching TAC, I have come across network connectivity problems that have taken a lot of time to solve. Symptoms observed are as follows

Intermittent connectivity to host connect to an access switch

One way audio in IP telephony

Default gateway cannot ping few hosts and when traffic is initiated from host, pings from the default gateway magically starts working and all other devices can ping these host

Clients connected to same access switch can ping each other but clients connected to an upstream switch cannot and so on.

Typical setup is as follows

CORE MLS(gi1/1)-----trunk------Access Switch----Clients

In most cases CORE Switch is the default gateway for the Clients.

Typical Troubleshooting is as follows

1)      Is the ARP complete ?

CORE#sh ip arp 10.10.1.144Protocol Address         Age (min) Hardware Addr   Type   InterfaceInternet 10.10.1.144           100   8cb6.4faa.8a41 ARPA   Vlan93

YES IT IS

2)  Is the switch learning mac address ?

CORE# sh mac-address-table address 8cb6.4faa.8a41 <NOT LEARNING MAC ADDRESS>

That should not cause connectivity loss as the packets will be flooded and will make its way to the clients

3)  Lets check the spanning tree status for vlan 93

CORE # show spanning-tree vlan 93<SNIP>Gigabitethernet 1/1 shows forwarding

Well, spanning tree status is forwarding – so my packets are supposed to leave interface Gi1/1

Lets SPAN interface Gi1/1 and see if packets are leaving – Result: SPAN Captures show no packets leave the interface.

Crazy !! so it is the CORE switch that is culprit – lets replace it ??

NO WAY -- Are we sure it is a hardware issue – No

What have we missed ? Hmm.. Lets add a static mac entry and see if that helps

CORE(config)# mac address-table static 8cb6.4faa.8a41 vlan 93 int gi1/1

CORE# ping 10.10.1.144

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.10.1.144, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

Lets remove the static mac address and now initiate traffic from end client –

mac address learned and everyone in the network can reach the client

From the troubleshhoting performed so far the observations made are as follows:

We intermittently lose connectivity to client. When traffic is initiated from client, we are immediately able to establish

connectivity to client and finally, we observe that the problem is seen when mac address of client ages out on the CORE switch

So what feature can block unicast flooding?

switchport block unicast command on the interface - not configured here

VTP pruning – Ah ha!!

Let us check if any vlan is pruned

CORE#show int gi1/1 trunk

Port          Mode         Encapsulation  Status        Native vlan

Gi1/1        on           802.1q         trunking      1

Port          Vlans allowed on trunk

Gi1/1        1-4094

Port          Vlans allowed and active in management domain

Gi1/1        1,10-18,20-30,32,60-61,90-103,111,138,155-156,201-203,400

Port          Vlans in spanning tree forwarding state and not pruned

Gi1/1        1,10,22

Also check

CORE#show int gi1/1 pruning

Port      Vlans pruned for lack of request by neighbor

Gi1/1    11-18,20-21,23-30,32,60-61,90-103,111,138,155-156,201-203,400 

-> All these VLAN’s are pruned because neighbor did not request for them

Port      Vlan traffic requested of neighbor

Gi1/1    1,10-18,20-30,32,60-61,90-103,111,138,155-156,201-203,400 

-> This is what CORE Switch is requesting from its neighbor switch

So VTP pruning was the culprit – As the mac address of end client aged out, the switch would have to unicast flood the packet to all ports on

VLAN 93, which is not sent on Gi1/1 as VLAN 93 was pruned.

Once VTP pruning is turned off – All connectivity issues are corrected.

When can such a scenario occur ?

1)  In environment which has switches in VTP server/client mode along with switch that maybe in VTP transparent mode

2)  When a non Cisco switch that does not understand VTP is connected to a Cisco Switch which has VTP turned ON (in most cases)

So please keep in mind that VTP pruning can be the cause of connectivity issues.

In an all Cisco environment where all switches are configured to be in VTP server or client mode, you can turn ON VTP pruning as this will help limit unnecessary flooding in the network and is of great help.

After all, VTP pruning need not be a PIA.

It is referred from: https://supportforums.cisco.com/blog/150491/troubleshoot-l2-connectivity-issue-vtp-pruning

More about the Cisco configuration, please visit: http://www.3anetwork.com/blog

How to set the speed limit on Cisco router

In the Cisco router device, such as Cisco 2911 and 1941 router , only the support Cisco fast forwarding (CEF, CiscoExpressForward) of the switch or router can use rate-limit to flow, the specific settings at three steps:

Fast router limit inputoutput: This is the definition of data flow direction.

BPS: define the flow rate limit, the unit is BPS

Burst-normalburst-max: the definition of the data size, using 80001600032000 general, in bytes,when arriving data exceeds this capacity, will trigger an action, discarded or forwarding, so as to achieve the purpose of speed.

Conform-action and exceed-action: refers to the processing strategy following the rates and more than the rate of flow.

How to upgrade IOS of Cisco Catalyst 2960 Switch

Cisco 2960 IOS upgrade:

To upgrade IOS of Cisco Catalyst 2960 Switch we have to follow some basic checklist first-

a.    Check for the older version.

b.    Backup Older Version of IOS.

c.    Backup Switch Configuration.

Required Softwares –

a.    TFTP server utility for taking/ restoring backup of IOS.

b.    Putty / Hyper-terminal Utility to access switch.

Commands to Check IOS version –

Switch01#sh flash:

Directory of flash:/

2 -rwx 3096 Mar 1 1993 05:40:50 +05:30 multiple-fs

3 -rwx 10644 Mar 1 1993 05:38:52 +05:30 config.text

4 -rwx 5 Mar 1 1993 05:38:52 +05:30 private-config.text

6 -rwx 8040418 Mar 1 1993 01:28:27 +05:30 c2960-lanbasek9-mz.122-46.bin

32514048 bytes total (24457728 bytes free

Commands to take Backup of Old IOS –

a.    Start TFTP software on PC (Ip address of PC – 10.10.11.60).  Location were backup will be stored – C:\tftpd32.273

b.    Commands on Switch –

Switch01#copy flash: tftp:

Source filename []? c2960-lanbasek9-mz.122-46.bin

Address or name of remote host []? 10.10.11.60

Destination filename [c2960-lanbasek9-mz.122-46.bin]? c2960-lanbasek9-mz.122-46.bin

! Com pleted.

Commands to take Backup of Switch Configuration –

a. Start TFTP software on PC (Ip address of PC – 10.10.11.60)

Location were backup will be stored – C:\tftpd32.273

b. Commands on Switch -

Switch01#copy startup tftp:

Address or name of remote host []? 10.10.11.60

Destination filename [Switch01-confg]? Switch01-confg

! Completed.

Upgrading Cisco Catalyst 2960 Switch IOS –

TFTP Settings – Select the directory where New Cisco IOS is located –

i.e. C:\tftpd32.273

Commands on Switch –

Switch01#copy tftp: flash

Address or name of remote host []? 10.10.11.60

Source filename[]? c2960-lanbasek9-mz.122-50.SE3.bin

Destination filename [c2960-lanbasek9-mz.122-50.SE3.bin]?

! Completed.

Check for new IOS in Flash –

Switch01#sh flash:

Directory of flash:/

2 -rwx 3096 Mar 1 1993 05:40:50 +05:30 multiple-fs

3 -rwx 10644 Mar 1 1993 05:38:52 +05:30 config.text

4 -rwx 5 Mar 1 1993 05:38:52 +05:30 private-config.text

6 -rwx 8040418 Mar 1 1993 01:28:27 +05:30 c2960-lanbasek9-mz.122-46.bin

7 -rwx 8040418 Feb 11 2010 01:28:27 +05:30 c2960-lanbasek9-mz.122-50.SE3.bin

Now, the Up gradation is Completed, we have to remove Old IOS from Flash –

Switch01#delete flash:c2960-lanbasek9-mz.122-46.bin

! Completed.

Setup new IOS as the default IOS during Boot process –

Switch01(config)#boot system flash: c2960-lanbasek9-mz.122-50.SE3.bin

Reload Cisco Switch for new IOS to Take effect -

Switch01# reload

Cisco Router Throughput

Let’s know about the Cisco router throughput from the below message:

1 No Drop Rate and RFC-2544 Tests

Routers have traditionally been tested using RFC 2544 or similar types of performance tests. RFC 2544 requires tests to be run at a no drop rate (NDR). This testing is done by using a fixed packet size, usually 64-byte packets, and the results are usually published as a metric in kilopackets per second (kpps). The tests are designed to show the CPU power and processing power of the platform (Table 1).

Another popular technique for providing router performance information is also an NDR test, but it is performed with maximum packet size and presented as a throughput test. Results are delivered as megabits per second (Mbps).

This test yields a maximum data-rate forwarding of specific features.

For NDR tests sometimes the platforms can process and forward packets faster than the aggregate bandwidth of the interfaces that the specific models can support. In this situation, all available interfaces are driven to line rate and CPU usage recorded.

What these tests do not provide is any indication of how the router will perform in a production environment. They assume that router CPUs scale linearly to the point where they drop packets. The tests provide no means for analyzing router services, software-based algorithms, or other features. There is no ability to account for real protocols, application layer gateways (ALGs), or other real-world traffic.

Also, production networks tend to have varied packet sizes. Voice traffic and TCP acknowledgements (ACKs) tend to be very small packets, generally 64 to 80 bytes. File transfers and some applications tend to use as large a packet size as they can negotiate. Thus, NDR tests with fixed packet sizes do not provide a very realistic look at router performance in a production environment.

2 Firewall testing

Firewall testing is much more complicated than any other test discussed in this document. Zone-based firewall (ZBF) is a stateful application, maintaining and monitoring the state of all TCP connections through it. It has multiple ALGs that allow it to inspect and monitor specific protocols and applications. ZBF also inspects traffic both within and between zones.

Thus, test methodology significantly affects performance. Testing different applications invokes specific ALGs, each of which may affect test results differently. Many test tools can generate packets with TCP headers, but never complete the handshake and establish state for monitoring. In some situations, the firewall may see this situation as a denial-of-service (DoS) attack, because it would rarely be encountered in a production network unless under attack. The use of pure User Datagram Protocol (UDP) or other stateless traffic patterns can also produce varying results.

For the purposes of this document, firewall is configured with two zones, and all traffic is sent between zones. The traffic generated is stateless and uses the same UDP port number. Performance is measured in maximum throughput and the number of maximum concurrent sessions. One element that influences the maximum-sessions metric is the

amount of installed memory in the platforms. These tests used default memory. Table 4 gives firewall performance information by platform.

Again, the data presented in this section is for maximum performance and is not very valuable for use in a production network. Although a router may be able to forward more than 1 Gbps of encrypted traffic in a lab-based performance test, it should not be expected to perform at that level in a customer’s network. Packet sizes will vary in a real

network, and routers cannot be stressed to NDR.

Maximum tunnels are a specific point where performance derived in a lab situation varies from a production design.

Although this number is easy to reproduce in a test environment, very little traffic will be forwarded over those tunnels during the test.

Firewall performance will vary depending on the nature of the traffic. Because ZBF monitors the state of traffic and monitors specific protocols and applications, actual application traffic will affect the throughput of the firewall.

Cisco 1921 the most popular router discount 49% off on 3anetwork.com.

Why the AP can not connect with the Cisco 2960?

2 Cisco switches 2960 (WS-C2960S-24TD-L and WS-C2960S-48TD-L ) were connected with a trunk to carry 2 VLANs - VLAN 101 for data, and VLAN 102 for voice - IP phones. Please see the switch configurations as attached:

 Basically, switch01 is a 24-port Gigabit Ethernet with POE support, whereas Switch02 is a 24-port Fast Ethernet without POE. A trunk was created that carries VLAN101 and 102 between 2 switches. Switch01 is working fine with mixture of laptop/desktops/ip phones, with DHCP server hosted on one of the server connected to switch02. However, for switch01, only existing devices that connected are working fine. My co-worker tried to connect a Wireless AP with a static IP, and he found that the network port "Activity" and "link" LEDs are off.  Connect to other port on switch01 is the same.

What could be a problem? Does the switch configured wrongly? How about trunk? Could it be the port speed, duplex? How about spanning-tree, does this needed?

The solution:

On the trunks:

interface GigabitEthernet0/2

 no switchport access vlan 101

 switchport trunk allowed vlan 101,102

 switchport mode trunk

 switchport nonegotiate

 duplex full

You don't need the switchport access vlan 101

For the port on switch one that you want to connect to the AP do this:

interface GigabitEthernet0/24

 switchport mode access

 switchport access vlan 101

 no switchport voice vlan 102

 spanning-tree portfast

Try that. It may be that since you have voice vlan configured, the port is trying to negotiate a trunk with the AP and the AP is not configured for that.

The AP should be configured as VLAN 101. I am saying change the port that the AP will connect to into an ACCESS port. With voice vlan on it, it's really a trunk port.

The access command doesn't have any effect since the port is in trunk mode, so it's not needed.   VLAN 1 by default is the native vlan anyway unless you specify a different vlan with switchport trunk native vlan x (x being the vlan number)

More information about the cisco 2960 FAQ, please visit: http://cisco2960faq.blogspot.com