So in this example, let's assume A is sending a frame to DH.
So the source address at layer two will be A and the destination address will be DH.
I will send the frame to switch one.
Switch one will then copy that frame to all ports based once again on the switch architecture.
The central asec will check the destination in the cam table and let's assume for the moment that DH
is not in switch one's cam table or MAC address table.
So the frame will attempt to go out of this port zero two But because the internal tag color is red
for that frame and this is a green port, the frame is not permitted out of zero two.
However, on this port, because it's a trunk link and let's assume for the moment that all VLANs are
allowed across this trunk, that frame will be sent out of Port zero three to switch two.
However, just before the frame is sent out, it needs to be tagged with the VLAN number.
So in this case the villain identifier would be red.
Now as mentioned in switches, VLANs identified by numbers.
But to keep these examples simple, we're going to use colors.
So this would in actual fact be a number from 0 to 4096.
That frame is then sent across the trunk to switch to who then receives the frame.
Once again, the frame is processed internally.
Now this switch reads the VLAN, identifying the attitude of one Q header and sees that it belongs to
the red VLAN that is tagged internally within the switch.
The frame is sent to all ports zero two as well as zero one.
And let's assume once again that the Mac address table of switch two does not contain the Mac address
of DX.
So when the frame is attempting to go out of Port zero one, it is denied because the color of the frame
is red and thus interfaces in the green VLAN.
So the frame is dropped.
However, out of this interface the frame is permitted because the port is in the red VLAN and the frame
is tagged with the red VLAN.
All tagging is stripped out of this port, so it's sent as a normal ethernet frame to PCD.
Once again, the PCs are oblivious to the fact that they have been put into VLANs.
They just see standard Ethernet.
So a standard frame with a source address of a destination address.
A DX is transmitted out of port zero to and processed by the PC.
Edit2 one key trunks have a special VLAN known as the native VLAN.
Native VLANs are untagged when a port on the switch is set up as a trunk.
For instance, this interface on switch one and switch two, that interface can receive and transmit
tagged frames.
Frames belonging to the native VLAN do not carry VLAN tags when sent over this trunk.
By the same token, if an untagged frame were received on this trunk port, that frame would automatically
be associated with a native VLAN for the support.
Now specific management traffic will go across the native VLAN.
So for instance spanning tree CPUs will use the native VLAN and so will dynamic trunking protocol.
Dynamic Trunking Protocol is a way that switches negotiate to set up a trunk between themselves automatically.
And I'll show you an example of that in a moment.
Certain management traffic always uses VLAN one.
If you have left VLAN one as the native VLAN traffic like CDP, http, agp and UDL dx will be transmitted
across the native VLAN untagged.
If however, the native VLAN is changed to something other than VLAN one, these protocols will then
be tagged in that specific VLAN.
CDP was explained in the ICD one portion of this course.
It allows us to view directly connected devices.
VLAN trunking protocol we're going to discuss in the next few slides.
It is a way to dynamically update other switches with changes made on a single switch in a HTTP domain.
AGP or port aggregation protocol is a protocol used for the automatic creation of either channels and
UDL, dx or uni.
Directional link detection is used to monitor the physical configuration of cables between devices and
detect unidirectional links.
This allows us to detect incorrectly cabled links.
The important thing to take note of here is that on trunk links there is a special VLAN known as the
native VLAN where traffic is sent untagged if left at the default of VLAN one.
A lot of management traffic will be sent across that native VLAN.
It's important that the native VLAN on both sides of the trunk be the same.
If they not set the same.
The switches will notify you by telling you that there's a native VLAN mismatch.
The issue that arises if the native VLANs are not the same is that traffic from one VLAN on this switch
will automatically be associated and end up in a different VLAN on another switch.
And obviously the whole concept of VLANs is to separate traffic into a specific VLAN.
In other words, a separate broadcast domain or separate subnet traffic from one VLAN should not end
up in another VLAN because of a native VLAN misconfiguration.
Now, this is something you probably not see in networks today.
In theory, with a native VLAN, a switch like switch one could send tagged frames to switch to and
untagged frames to this MacBook.
So by using the native VLAN, this MacBook or a PC would still be able to communicate with the network
even though it doesn't understand tagged frames edited on one cue frames or tagged frames are useful.
Communicating VLAN information between networking devices like switches this end device wouldn't necessarily
understand edited or one Q frames, but could still communicate with the network by using the native
VLAN.
However, that's not common today.
What is more typical today is a scenario like this where you have a PC connected to an IP phone connected
to a Cisco switch.
Now a Cisco IP phone has a built in three way switch.
One port is connected back to the network infrastructure.
So our Cisco switch a second port allows the PC to connect to the infrastructure through the phone and
a third port allows for voice traffic from the handset to be prioritized over data when sent to the
network infrastructure.
So the phone has a built in three way switch, always prioritizing voice over data.
The thing to take note of here, though, is that the phone can be configured in a separate VLAN to
the PC, so the phone could be in the red VLAN and the PC could be in the green VLAN.
There are a lot of advantages to doing it this way.
Firstly, from a security point of view, this PC will not be able to sniff voice traffic and therefore
listen in on the voice conversation.
Now there are a lot of caveats relating to Cisco.
Phones and different models are set up different ways, but in theory the concept is that the phone
is in a separate VLAN to the PC and therefore the PC is not able to see the voice traffic.
There are applications like Cane Enable, which is a very powerful hacking tool that allow you to sniff
the network, capture the voice traffic, and then replay that traffic as a web file on your local PC
so you can replay the voice conversation.
But if the phone is in a separate VLAN, security is enhanced because the PC is not able to see the
voice traffic from a quality of service point of view.
This is also a lot better because it's easier to prioritize the voice traffic over the data traffic
if it's in a separate VLAN setting up your network this way.
It also has the advantages of easier IP address management because you can assign a separate subnet
to your phones versus your PCs and thus scale your IP address.
So what happens is the switch is configured with what's called a voice VLAN and a native VLAN.
The voice VLAN is tagged, so tagged frames get sent to the phone and the phone with its built in three
way switch is able to read the attitude of one Q frames, untagged frames or send on what's called the
native VLAN or data VLAN.
That information is sent to the phone and the phone just switches that to the PC.
So the PC receives the untagged or native VLAN frames and the phone receives the tagged or voice VLAN
frames.
No configuration of the phone is necessary to enable this.
You literally type a few commands on the switch, telling the switch what the voice VLAN is and what
the data VLAN is.
And this happens automatically because when the phones boot up they query the switch through CDP to
find out which VLAN they belong to.
So the switch updates the phone's configuration through the use of CDP.
So this is a very common implementation of native VLANs in the real world today.
So just to sum up how ports are assigned to VLANs.
Firstly, they can be statically assigned by an administrator.
So use an administrator, go on to an interface and statically put that port into a VLAN.
The second option is to create what are called dynamic VLANs using a VLAN membership policy server.
Dynamic VLANs allow for a ports VLAN to be dynamically updated based on the Mac address of the device
attached to that port.
So in a boardroom, for example, when a director plugs in a laptop based on the Mac address of that
laptop, that port is dynamically assigned to the director's VLAN.
When a manager plugs his laptop into that same port the next day, for example, that VLAN is automatically
updated to the manager's VLAN.
So based on the source MAC address of frames received on the port, the port is automatically assigned
to different VLANs.
And lastly, we have voice VLANs, which are used specifically for IP phones.
VP or VLAN Trunking Protocol is a Cisco proprietary layer two protocol which allows for the propagation
of VLAN information from one switch to another rather than TELNET to multiple switches.
You can create, delete or rename VLANs on one switch and have that information automatically propagated
to other switches across trunk links.
Notice the name VLAN Trunking protocol.
This information can only be propagated across trunk links.
Now HTTP can save you a lot of time, but as a lot of Cisco engineers will tell you, VoIP can cause
you a lot of headaches.
Switches can have the entire VLAN configuration wiped out if a new switch is added to the network without
following a proper procedure.
So a lot of Cisco engineers will not enable VoIP in modern environments because of the inherent risks
associated with this protocol.
HTTP messages are sent to the following MAC address, which is a well known multicast address for flooding
of the CDP and HTTP protocols.
There are three types of messages.
In HTTP, you have summary advertisements, subset advertisements and advertisement requests, and I'll
explain each of these in more detail in the upcoming slides.
But please be aware that there are three message types.
When setting up VoIP devices will by default belong to the null domain.
For VDP to work, you need to configure and put the devices into a specific HTTP domain.
Only devices within the same HTTP domain will be updated with VLAN information.
The switch can only be configured in a single HTTP domain at any given time.
By default, Cisco switches are in the null domain or no management domain until they receive an advertisement
for a domain over trunk link or until you manually configure a management domain.
So in this example, let's assume that these devices have been put into the HTTP domain with the name
of Cisco.
Remember, please.
HTTP is a layer two protocol and requires trunk links for communication.
So HTTP will not traverse errata.
An important concept to understand in HTTP is the concept of a revision number.
Every time it changes made to the VLAN database, the revision number in VP will increment by one.
So let's assume that all devices in this topology have a revision number of one.
You as an administrator at a VLAN, let's say VLAN three to this switch.
Each revision number will then increment from a vision number one to revision number two.
That information will then be advertised to all other switches in the HTTP domain so that they can synchronize
their databases to the latest revision number, which is revision number two.
So the switch at the top will send what is called a HTTP summary advertisement to all other switches,
informing them that a change has been made.
Remember, this is sent using a multicast address.
So all of these devices will see that message.
They will then request the latest information using an advertisement request, and the switch at the
top will send them detailed information about the change using a subset.
Advertisement.
The net result is that the revision numbers in all of these switches will increment to the same revision
number as the switch where the change was made.
So VLAN three will appear in all the databases of these switches and the revision number will be set
to revision number two.
The whole concept with VPP is that you can make changes on an individual device.
As those changes are made, all other switches are informed of the change and they will synchronize
their databases to the latest revision number so that they end up having the same VLANs in their VLAN
databases.
That means that you as the administrator only need to make changes on one switch rather than five switches
in this topology.
Please note ports are put into individual VLANs by, for example, an administrator.
VDP does not put ports into individual VLANs, it just updates the VLAN database so that the switches
know which VLANs exist.
Use an administrator still need to put those ports into the relevant vlans.
So this is just a VLAN database update mechanism so that switches know the vlans that exist in the topology.
So let's look at the HTTP messages in more detail.
The first type of HTTP message is a summary advertisement.
This is sent every 5 minutes or whenever there's a change.
So whenever an administrator makes a change on a switch by for instance, adding a VLAN, a summary
advertisement will be sent out on the well-known multicast address to all other switches in the domain.
So this is used to inform other switches of the current HTTP domain and the current configuration revision
number.
So as an example on switch one, the administrator adds another VLAN, let's say VLAN four.
The revision number will be incremented.
So if the revision number was three, it would now be incremented to four.
This switch will send a summary advertisement to all neighboring switches, informing them of the current
HTTP domain and the new configuration revision number switches that receive that summary advertisement
will then send back a summary request asking for detailed information of the changes that have been
made.
There are three situations when summary requests are used.
Firstly, when a switch has been reset or when the HTTP domain name has been changed, or when the switch
has received a VDP summary advertisement with a higher configuration revision number than its own.
So because switch two received a summary advertisement from switch one indicating a high revision number.
In other words, the revision number on switch one is revision number four, and the revision number
on switch two is revision number three.
Switch two will now request information from switch one so that it can update its database with the
latest VLAN information.
That detailed information is sent from switch one to switch to using what's called a subset advertisement.
This contains a list of VLAN information and if there are several VLANs, more than one subset advertisement
may be required to update and synchronize the databases of other switches.
So essentially what this is, is detailed information of the changes that have been made.
The summary advertisement just informs the switch in summary format of the latest revision number and
HTTP domain.
If the local switch sees that it's out of date, it will request detailed information so that it can
synchronize its database and that information will be provided using a subset.
Advertisement.
The switch is now able to synchronize their local databases to the database of the switch with the latest
information.
Now there are three modes in FTP.
The default mode is server.
A VP switch in server mode can create VLANs, modify VLANs and delete VLANs.
It also sends and forwards advertisements, so if it received an advertisement from another switch,
it would forward that.
On if you made changes on the local switch, it would send summary advertisements.
It would also synchronize its local database to the latest revision number and it also saves the VLAN
configuration information locally.
So this is the device where you're going to make your changes.
Multiple switches can be configured as HTTP servers, but you need to be really careful with this.
The second mode is VOIP client.
A HTTP client cannot create change or delete VLANs.
It is also able to send and forward advertisements so it can send any VLANs currently listed in its
database to other HTTP switches.
It can also forward advertisements received from other switches.
Thirdly, it would also synchronize its database to the latest configuration revision number.
This is a major potential issue with FTP and has burnt many Cisco engineers in the past.
A lot of Cisco engineers will not use HTTP because of this issue.
So here's a sample topology.
Notice we have a HTTP server and let's assume that all of these switches at the top are configured as
HTTP clients.
The host machines are in the red VLAN or green VLAN, and currently the revision number for the domain
is revision number two.
So the latest configuration revision number is to the HTTP domain is Cisco and the VLANs that have been
configured on the switches of VLANs, red and green.
Please note once again that the switches have a VLAN database.
That is what HTTP updates the individual ports on the switches need to manually be put in the correct
VLANs.
Now someone plugs another switch into the topology from, for instance, a lab environment.
The reason why this is dangerous is that in a lab environment, VLANs may have been added and removed
and thus the revision number may be a lot higher than the production network.
So let's assume for the moment that the revision number is 50.
This switch only has the blue VLAN configured on it, so the green and red vlans do not exist in the
VLAN database.
A lot of people make the mistake of assuming that as long as the switch is configured as a HTTP client,
it will not cause any problems on the network.
So an administrator plugs in the switch and configures this port as a trunk.
Please note once again that VDP advertisements are only sent across trunk ports.
So let's assume that throughout the network all of these links are configured as trunks.
As soon as this client is added to the HTTP domain.
And what's really scary is that this client can be automatically updated with the HTTP information.
In other words, if it's configured with a null domain, it can automatically join the current HTTP
domain of Cisco.
And as soon as that happens, the devices will synchronize their databases to the latest configuration
revision number, which in this case is 50.
So on all switches in the live domain, the revision number is changed to 50 because all of the switches,
including the HTTP server, will synchronize automatically to the HTTP client.
The current VLANs, red and green are automatically removed from the VLAN database and the only VLAN
that will now be available in the VLAN databases of all of these switches is VLAN blue.
Now all of the ports on, all the switches that have manually been put into the green or red VLAN are
error disabled.
The issue here is that a port belongs to the red VLAN, but the red VLAN does not exist in the database,
so the port is automatically disabled.
That means that no traffic can be sent or received on this port and the same thing happens on all other
switches.
Essentially what happens is that the entire network is brought down by the introduction of the single
switch.
That's extremely worrying, to say the least, that the introduction of a single switch can bring down
an entire enterprise network.
The only way to fix this is to physically connect to the HTTP server and then manually add the VLANs
that have been deleted.