Switching Architectures:�L2 Protection Features
Enterprise Network 101 Workshop
Other Layer 2 Features
• Link Aggregation
• Network Protection
• Switch Configuration Advice:
– Network Management
– Documentation
Link Aggregation
• Also known as port bundling, link bundling
• You can use multiple links in parallel as a single, logical link
– For increased capacity
– For redundancy (fault tolerance)
• LACP (Link Aggregation Control Protocol) is a standardized
method (802.1AX) of negotiating these bundled links between
switches
• Proprietary methods exist too (Cisco’s PAgP, EtherChannel;
Juniper’s Aggregated Ethernet, etc)
LACP Operation
• Two switches connected via multiple links will send LACPDU
packets, identifying themselves and the port capabilities
• They will then automatically build the logical aggregated links,
and then pass traffic.
• Switch ports can be configured as active or passive
• Software implementations of LACP exist allowing Linux, BSD
servers etc. to combine ports as well. Useful for things like NAS
devices.
LACP Operation
• Switches A and B are connected to each other using two sets of
Fast Ethernet ports
• LACP is enabled and the ports are turned on
• Switches start sending LACPDUs, then negotiate how to set up
the aggregation
LACP Operation
• The result is an aggregated 200 Mbps logical link
• The link is also fault tolerant: If one of the member links fail, LACP
will automatically take that link off the bundle, and keep sending
traffic over the remaining link
Distributing Traffic in Bundled Links
• Bundled links distribute frames using a hashing algorithm, based
on:
– Source and/or Destination MAC address
– Source and/or Destination IP address
– Source and/or Destination Port numbers
• This can lead to unbalanced use of the links, depending on the
nature of the traffic
• Always choose the load-balancing method that provides the most
distribution
Network Protection Features
Problem 1: Rogue switches
Solution 1a: “Root Guard”
• Enable “Root Guard” on edge ports
• Switch can still be plugged in, and can participate in STP
• However, if it ever tries to become root, the port is shut down
– Error condition must be cleared manually, unless you configure automatic recovery (errdisable-timeout)
Solution 1b: “BPDU Guard”
• Enable “BPDU Guard” on edge ports
– A more brutal solution!
• If any spanning tree BPDU at all is received on this port, the port
is immediately shut down
– Prevents users plugging in their own switches, mostly
– Does not detect the dumbest, non-STP switches or hubs
– Does not prevent “connection sharing” at layer 3 (NAT)
Problem 2: Unidirectional links
• Switch A can see BPDUs from switch B – but not vice versa
– Typically, due to faulty leg on a bidirectional fiber link, or mis- patching
• Major STP problems, e.g. two simultaneous roots!
– Hence loops, broadcast storms etc
Solution 2: “UDLD”
• “Unidirectional Link Detection”
– Configure at both ends of fiber switch-to-switch trunks
– Cisco protocol, but some other vendors implement and interoperate
• Sends periodic echo/response packets
• Shuts down link if not working bidirectionally
• “Aggressive mode” gives best protection, but will shut down link if
far end doesn’t have UDLD enabled
Problem 3: Rogue DHCP servers
Solution 4: “DHCP snooping”
• This is a common problem, often accidental not malicious
• User plugs in a consumer router/wireless access point using one
of its “LAN” ports
– but these devices contain a DHCP server!
– client gets two offers and accepts the first one it receives
– wrong IP = lost connectivity. Affects everyone on the same VLAN
• “DHCP Snooping” blocks DHCP responses except from trusted
ports (those which connect to the upstream/core network)
• “RA Guard” is a similar feature for IPv6 router advertisements
Questions?