Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Spanning Tree Protocol (STP) W.lilakiatsakun Redundancy (1) Redundancy (2) Redundancy (3) Examine Redundancy (1) Examine Redundancy (2) Examine Redundancy (3) Examine Redundancy (4) Examine Redundancy (5) Issues with Redundancy- layer2 loop (1) • LAYER 2 Loop • Ethernet frames do not have a time to live (TTL) like IP packets traversing routers. As a result, if they are not terminated properly on a switched network, they continue to bounce from switch to switch endlessly or until a link is disrupted and breaks the loop. Broadcast frames are forwarded out all switch ports, except the originating port. – This ensures that all devices in the broadcast domain are able to receive the frame. • If there is more than one path for the frame to be forwarded out, it can result in an endless loop. Issues with Redundancy - layer2 loop (2) Issues with Redundancy - layer2 loop (3) Issues with Redundancy - layer2 loop (4) Issues with Redundancy - layer2 loop (5) Issues with Redundancy – broadcast storm (1) • Broadcast storm • A broadcast storm occurs when there are so • many broadcast frames caught in a Layer 2 loop that all available bandwidth is consumed. Consequently, no bandwidth is available bandwidth for legitimate traffic, and the network becomes unavailable for data communication. Issues with Redundancy – broadcast storm (2) Issues with Redundancy – Duplicate Unicast frame (1) • Duplicate Unicast Frames • Broadcast frames are not the only type of frames that are affected by loops. • Unicast frames sent onto a looped network can result in duplicate frames arriving at the destination device. Issues with Redundancy – Duplicate Unicast frame (2) Issues with Redundancy – Duplicate Unicast frame (3) Issues with Redundancy – Duplicate Unicast frame (4) Real world Redundancy issues Loops in the Wiring Closet(1) • Loops in the Wiring Closet • – If the network cables are not properly labeled when they are terminated in the patch panel in the wiring closet, it is difficult to determine where the destination is for the patch panel port on the network. Network loops that are a result of accidental duplicate connections in the wiring closets are a common occurrence. Real world Redundancy issues Loops in the Wiring Closet(2) Real world Redundancy issues Loops in the Wiring Closet(3) Real world Redundancy issues Loops in the Cubicles (1) • Loops in the Cubicles – Unlike the wiring closet, the administrator is not in control of how personal hubs and switches are being used or connected, so the end user can accidentally interconnect the switches or hubs. Real world Redundancy issues Loops in the Cubicles (2) STP Topology (1) • STP ensures that there is only one logical path between all destinations on the network by intentionally blocking redundant paths that could cause a loop. – Blocking the redundant paths is critical to preventing loops on the network. – The physical paths still exist to provide redundancy, but these paths are disabled to prevent the loops from occurring. – If the path is ever needed to compensate for a network cable or switch failure, STP recalculates the paths and unblocks the necessary ports to allow the redundant path to become active. STP Topology (2) STP Topology (3) STP Algorithm (1) • STP uses the Spanning Tree Algorithm (STA) to • determine which switch ports on a network need to be configured for blocking to prevent loops from occurring. The STA designates a single switch as the root bridge and uses it as the reference point for all path calculations. – All switches participating in STP exchange BPDU frames to determine which switch has the lowest bridge ID (BID) on the network. – The switch with the lowest BID automatically becomes the root bridge for the STA calculations. STP Algorithm (2) STP Algorithm (2) • After the root bridge is selected, the STA calculates the • • • • • shortest path to the root bridge. Each switch uses the STA to determine which ports to block. The STA considers both path and port costs when determining which path to leave unblocked. The path costs are calculated using port cost values associated with port speeds for each switch port along a given path. The sum of the port cost values determines the overall path cost to the root bridge. If there is more than one path to choose from, STA chooses the path with the lowest path cost. STP Algorithm (3) • Root ports - Switch ports closest to the root bridge. STP Algorithm (4) • Designated ports - All non-root ports that are still permitted to forward traffic on the network. STP Algorithm (5) • Non-designated ports - All ports configured to be in a blocking state to prevent loops. Selecting The root bridge (1) • The Root Bridge • Every spanning-tree instance (switched LAN or broadcast domain) has a switch designated as the root bridge. • The root bridge serves as a reference point for all spanning-tree calculations to determine which redundant paths to block. Selecting The root bridge (2) • After a switch boots, it sends out BPDU frames • • • containing the switch BID and the root ID every 2 seconds. By default, the root ID matches the local BID for all switches on the network. The root ID identifies the root bridge on the network. Initially, each switch identifies itself as the root bridge after bootup. Selecting The root bridge (3) • If the root ID from the BPDU received is lower than the root ID on the receiving switch, the receiving switch updates its root ID identifying the adjacent switch as the root bridge. • Eventually, the switch with the lowest BID ends up being identified as the root bridge for the spanning-tree instance. Selecting The root bridge (4) Best Path to the root bridge (1) • The path information is determined by summing up the individual port costs along the path from the destination to the root bridge. • The default port costs are defined by the speed at which the port operates. – – – – 10-Gb/s Ethernet ports have a port cost of 2, 1-Gb/s Ethernet ports have a port cost of 4, 100-Mb/s Fast Ethernet ports have a port cost of 19, 10-Mb/s Ethernet ports have a port cost of 100. Best Path to the root bridge (2) • Default port cost Best Path to the root bridge (3) Best Path to the root bridge (4) Best Path to the root bridge (5) STP - BPDU (1) STP - BPDU (2) STP - BPDU (3) STP - BPDU (4) BPDU Process (1) • Each switch in the broadcast domain initially • • assumes that it is the root bridge for the spanningtree instance, so the BPDU frames sent contain the BID of the local switch as the root ID. By default, BPDU frames are sent every 2 seconds after a switch is booted; that is, the default value of the hello timer specified in the BPDU frame is 2 seconds. Each switch maintains local information about its own BID, the root ID, and the path cost to the root. BPDU Process (2) BPDU Process (3) • When adjacent switches receive a BPDU frame, • • • they compare the root ID from the BPDU frame with the local root ID. If the root ID in the BPDU is lower than the local root ID, the switch updates the local root ID and the ID in its BPDU messages. Also, the path cost is updated to indicate how far away the root bridge is. If the root ID in the BPDU is higher than the local root ID, the switch discard the BPDU frame BPDU Process (4) BPDU Process (5) BPDU Process (6) • After a root ID has been updated to identify a • • new root bridge, all subsequent BPDU frames sent from that switch contain the new root ID and updated path cost. As the BPDU frames pass between other adjacent switches, the path cost is continually updated to indicate the total path cost to the root bridge. Each switch in the spanning tree uses its path costs to identify the best possible path to the root bridge. BPDU Process (7) BPDU Process (8) BPDU Process (8) BPDU Process (9) BPDU Process (10) BPDU Process (11) Bridge ID field (1) • The bridge ID (BID) is used to determine the root bridge on a network. • The BID field of a BPDU frame contains three separate fields: bridge priority, extended system ID, and MAC address. • Each field is used during the root bridge election. Bridge ID field (2) Bridge ID field (3) • Bridge Priority • The bridge priority is a customizable value that you • • • can use to influence which switch becomes the root bridge. The switch with the lowest priority, which means lowest BID, becomes the root bridge (the lower the priority value, the higher the priority). The default value for the priority of all Cisco switches is 32768. The priority range is between 1 and 65536; therefore, 1 is the highest priority. Bridge ID field (4) • Extended System ID • The early implementation of STP was designed for networks that did not use VLANs. – There was a single common spanning tree across all switches. • When VLANs started became common for network infrastructure segmentation, STP was enhanced to include support for VLANs. – As a result, the extended system ID field contains the ID of the VLAN with which the BPDU is associated. Bridge ID field (5) • When the extended system ID is used, it • • changes the number of bits available for the bridge priority value, so the increment for the bridge priority value changes from 1 to 4096. Therefore, bridge priority values can only be multiples of 4096. The extended system ID value is added to the bridge priority value in the BID to identify the priority and VLAN of the BPDU frame. Bridge ID field (6) • MAC Address • When two switches are configured with the same • priority and have the same extended system ID, the switch with the MAC address with the lowest hexadecimal value has the lower BID. Initially, all switches are configured with the same default priority value. The MAC address is then the deciding factor on which switch is going to become the root bridge. This results in an unpredictable choice for the root bridge. Bridge ID field (7) • It is recommended to configure the desired root bridge switch with a lower priority to ensure that it is elected root bridge. • This also ensures that the addition of new switches to the network does not trigger a new spanning-tree election, which could disrupt network communication while a new root bridge is being selected. Bridge ID field (8) Priority Based Decision Bridge ID field (9) MAC Based Decision Configure BID (1) • Method 1 - To ensure that the switch has the lowest bridge priority value, use the spanning-tree vlan vlan-id root primary command in global configuration mode. • The priority for the switch is set to the predefined value of 24576 or to the next 4096 increment value below the lowest bridge priority detected on the network. Configure BID (2) Configure BID (3) • If an alternate root bridge is desired, use the • • spanning-tree vlan vlan-id root secondary global configuration mode command. This command sets the priority for the switch to the predefined value of 28672. This ensures that this switch becomes the root bridge if the primary root bridge fails and a new root bridge election occurs and assuming that the rest of the switches in the network have the default 32768 priority value defined. Configure BID (4) Port Roles (1) • Root Port • The root port exists on non-root bridges and is the switch • • • port with the best path to the root bridge. Root ports forward traffic toward the root bridge. The source MAC address of frames received on the root port are capable of populating the MAC table. Only one root port is allowed per bridge. • In the example, switch S1 is the root bridge and switches S2 and S3 have root ports defined on the trunk links connecting back to S1. Port Roles (2) Port Roles (3) • Designated Port • The designated port exists on root and non-root bridges. – For root bridges, all switch ports are designated ports. – For non-root bridges, a designated port is the switch port that receives and forwards frames toward the root bridge as needed. • Only one designated port is allowed per segment. • If multiple switches exist on the same segment, an • election process determines the designated switch, and the corresponding switch port begins forwarding frames for the segment. Designated ports are capable of populating the MAC table. Port Roles (4) • Non-designated Port • The non-designated port is a switch port that is blocked, • • so it is not forwarding data frames and not populating the MAC address table with source addresses. A non-designated port is not a root port or a designated port. For some variants of STP, the non-designated port is called an alternate port. • In the example, switch S3 has the only non-designated ports in the topology. The non-designated ports prevent the loop from occurring. Port Roles (5) Port Roles (6) • Disabled Port • The disabled port is a switch port that is administratively shut down. • A disabled port does not function in the spanning-tree process. Port Roles (7) • When determining the root port on a switch, the • • switch compares the path costs on all switch ports participating in the spanning tree. The switch port with the lowest overall path cost to the root is automatically assigned the root port role because it is closest to the root bridge. In a network topology, all switches that are using spanning tree, except for the root bridge, have a single root port defined. Port Roles (8) • When there are two switch ports that have the same path cost to the root bridge and both are the lowest path costs on the switch, the switch needs to determine which switch port is the root port. • The switch uses the customizable port priority value, or the lowest port ID if both port priority values are the same. Port Roles (9) Configure Port Priority (1) • You can configure the port priority value using the spanning-tree port-priority value interface configuration mode command • The port priority values range from 0 240, in increments of 16. • The default port priority value is 128. • As with bridge priority, lower port priority values give the port higher priority. Configure Port Priority (2) Port Role Decision (1) Port Role Decision (2) Port Role Decision (3) Port Role Decision (4) Port Role Decision (5) Port Role Decision (6) Port Role Decision (7) Port States (1) • STP introduces five port states • Blocking – The port is a non-designated port and does not participate in frame forwarding. – The port receives BPDU frames to determine the location and root ID of the root bridge switch and what port roles each switch port should assume in the final active STP topology. Port States (2) • Listening – STP has determined that the port can participate in frame forwarding according to the BPDU frames that the switch has received thus far. – At this point, the switch port is not only receiving BPDU frames, it is also transmitting its own BPDU frames and informing adjacent switches that the switch port is preparing to participate in the active topology. Port States (3) • Learning – The port prepares to participate in frame forwarding and begins to populate the MAC address table. • Forwarding – The port is considered part of the active topology and forwards frames and also sends and receives BPDU frames. • Disabled – The Layer 2 port does not participate in spanning tree and does not forward frames. – The disabled state is set when the switch port is administratively disabled Port States (4) BPDU Timers (1) • The amount of time that a port stays in the • • various port states depends on the BPDU timers. Only the switch in the role of root bridge may send information through the tree to adjust the timers. The following timers determine STP performance and state changes: – Hello time – Forward delay – Maximum age BPDU Timers (2) BPDU Timers (3) • When STP is enabled, every switch port in the • • network goes through the blocking state and the transitory states of listening and learning at power up. The ports then stabilize to the forwarding or blocking state, as seen in the example. During a topology change, a port temporarily implements the listening and learning states for a specified period called the "forward delay interval." BPDU Timers (4) BPDU Timers (5) • These values allow adequate time for convergence in a network with a switch diameter of seven. – To review, switch diameter is the number of switches a frame has to traverse to travel from the two farthest points on the broadcast domain. • A seven-switch diameter is the largest diameter that STP permits because of convergence times. – Convergence in relation to spanning tree is the time it takes to recalculate the spanning tree if a switch or a link fails. BPDU Timers (6) • It is recommended that the BPDU timers not be • adjusted directly because the values have been optimized for the seven-switch diameter. Adjusting the spanning-tree diameter value on the root bridge to a lower value automatically adjusts the forward delay and maximum age timers proportionally for the new diameter. • Typically, you do not adjust the BPDU timers nor reconfigure the network diameter. BPDU Timers (7) Cisco PortFast Technology(1) • When a switch port configured with PortFast is • configured as an access port, that port transitions from blocking to forwarding state immediately, bypassing the typical STP listening and learning states. You can use PortFast on access ports, which are connected to a single workstation or to a server, to allow those devices to connect to the network immediately rather than waiting for spanning tree to converge. Cisco PortFast Technology(2) Cisco PortFast Technology(3) Cisco PortFast Technology(4) STP convergence (1) • Convergence is the time it takes for the network • to determine which switch is going to assume the role of the root bridge, go through all the different port states, and set all switch ports to their final spanning-tree port roles where all potential loops are eliminated. The convergence process takes time to complete because of the different timers used to coordinate the process. STP convergence (2) • To understand the convergence process more thoroughly, it has been broken down into three distinct steps: • Step 1. Elect a root bridge • Step 2. Elect root ports • Step 3. Elect designated and non-designated ports STP convergence – Elect a root bridge (1) • A root bridge election is triggered after a switch has finished booting up, or when a path failure has been detected on a network. • Initially, all switch ports are configured for the • blocking state, which by default lasts 20 seconds. This is done to prevent a loop from occurring before STP has had time to calculate the best root paths and configure all switch ports to their specific roles. STP convergence – Elect a root bridge (2) • While the switch ports are in a blocking state, they are still able to send and receive BPDU frames so that the spanningtree root election can proceed. • Spanning tree supports a maximum network diameter of seven switch hops from end to end. – This allows the entire root bridge election process to occur within 14 seconds, which is less than the time the switch ports spend in the blocking state. STP convergence – Elect a root bridge (3) STP convergence – Elect a root bridge (4) STP convergence – Elect a root port (1) • Every switch in a spanning-tree topology, except • • • • for the root bridge, has a single root port defined. The root port is the switch port with the lowest path cost to the root bridge. If switch ports have equivalent path costs to the root, it uses the configurable port priority value. They use the port ID to break a tie. When a switch chooses one equal path cost port as a root port over another, the losing port is configured as the non-designated to avoid a loop. STP convergence – Elect a root port (2) STP convergence – Elect a root port (3) STP convergence – Elect a root port (4) STP convergence – Electing Designated Ports and NonDesignated Ports (1) • Each segment in a switched network can have only one designated port. • When two non-root port switch ports are connected on the same LAN segment, a competition for port roles occurs. • The two switches exchange BPDU frames to sort out which switch port is designated and which one is non-designated. STP convergence – Electing Designated Ports and NonDesignated Ports (2) • Generally, when a switch port is configured as a designated port, it is based on the BID. • However, keep in mind that the first priority is the lowest path cost to the root bridge and that only if the port costs are equal, is the BID of the sender. STP convergence – Electing Designated Ports and NonDesignated Ports (3) • When two switches exchange their BPDU frames, they examine the sending BID of the received BPDU frame to see if it is lower than its own. • The switch with the lower BID wins the competition and its port is configured in the designated role STP convergence – Electing Designated Ports and NonDesignated Ports (4) STP convergence – Electing Designated Ports and NonDesignated Ports (5) STP Topology change (1) • A switch considers it has detected a topology change either – when a port that was forwarding is going down (blocking for instance) or – when a port transitions to forwarding and the switch has a designated port. • When a change is detected, – the switch notifies the root bridge of the spanning tree. – The root bridge then broadcasts the information into the whole network. STP Topology change (2) • STP Topology Change Notification Process • When a switch needs to signal a topology change, it starts • • • to send TCNs (Topology Change Notification) on its root port to the root bridge. The TCN is a very simple BPDU that contains no information and is sent out at the hello time interval. The receiving switch is called the designated bridge and it acknowledges the TCN by immediately sending back a normal BPDU with the Topology Change Acknowledgement (TCA) bit set. This exchange continues until the root bridge responds. STP Topology change (3) STP Topology change (4) • Broadcast Notification • Once the root bridge is aware that there has been a • • • topology change event in the network, it starts to send out its configuration BPDUs with the topology change (TC) bit set. These BPDUs are relayed by every switch in the network with this bit set. As a result, all switches become aware of the topology change and can reduce their aging time to forward delay. Switches receive topology change BPDUs on both forwarding and blocking ports. STP Topology change (5) The TC bit is set by the root for a period of max age + forward delay seconds, which is 20+15=35 seconds by default. Cisco and STP Variants PVST+ (Per VLAN Spanning Tree) (1) • Cisco developed PVST+ so that a network can • • run an STP instance for each VLAN in the network. With PVST+, more than one trunk can block for a VLAN and load sharing can be implemented. However, implementing PVST+ means that all switches in the network are engaged in converging the network, and the switch ports have to accommodate the additional bandwidth used for each PVST+ instance to send its own BPDUs. PVST+ (Per VLAN Spanning Tree) (2) PVST+ (Per VLAN Spanning Tree) (3) • In a Cisco PVST+ environment, you can tune the • • • spanning-tree parameters so that half of the VLANs forward on each uplink trunk. This is accomplished by configuring one switch to be elected the root bridge for half of the total number of VLANs in the network, and a second switch to be elected the root bridge for the other half of the VLANs. In the figure, switch S3 is the root bridge for VLAN 20, and switch S1 is the root bridge for VLAN 10. As a result, port F0/3 on switch S2 is the forwarding port for VLAN 20, and F0/2 on switch S2 is the forwarding port for VLAN 10. PVST+ (Per VLAN Spanning Tree) (4) PVST+ (Per VLAN Spanning Tree) (5) Configure PVST+(1) The goal is to configure - S3 as the root bridge for VLAN 20 and S1 as the root bridge for VLAN 10. - Port F0/3 on S2 is the forwarding port for VLAN 20 and the blocking port for VLAN 10. - Port F0/2 on S2 is the forwarding port for VLAN 10 and the blocking port for VLAN 20. Configure PVST+(2) • Step 1. Select the switches you want for the primary and secondary root bridges for each VLAN. • Step 2. Configure the switch to be a primary bridge for one VLAN, for example switch S3 is a primary bridge for VLAN 20. • Step 3. Configure the switch to be a secondary bridge for the other VLAN, for example, switch S3 is a secondary bridge for VLAN 10. • Optionally, set the spanning-tree priority to be low enough on each switch so that it is selected as the primary bridge. Configure PVST+(3) Configure PVST+(4) Configure PVST+(5) RSTP (Rapid Spanning Tree Protocol) (1) • RSTP (IEEE 802.1w) is an evolution of the 802.1D (Bridge - STP) standard. • The 802.1w STP terminology remains primarily the same as the IEEE 802.1D STP terminology. • Most parameters have been left unchanged, so users familiar with STP can rapidly configure the new protocol. RSTP (Rapid Spanning Tree Protocol) (2) Discard State (No blocking State) RSTP (Rapid Spanning Tree Protocol) (3) • RSTP speeds the recalculation of the spanning • • • tree when the Layer 2 network topology changes. RSTP can achieve much faster convergence in a properly configured network, sometimes in as little as a few hundred milliseconds. RSTP redefines the type of ports and their state. If a port is configured to be an alternate or a backup port it can immediately change to a forwarding state without waiting for the network to converge. RSTP (Rapid Spanning Tree Protocol) (4) • RSTP (802.1w) supersedes STP (802.1D) while • • retaining backward compatibility. RSTP keeps the same BPDU format as IEEE 802.1D, except that the version field is set to 2 to indicate RSTP, and the flags field uses all 8 bits. RSTP is able to actively confirm that a port can safely transition to the forwarding state without having to rely on any timer configuration. • Cisco-proprietary enhancements to 802.1D, such as UplinkFast and BackboneFast, are not compatible with RSTP. RSTP – BPDU (1) • RSTP (802.1w) uses type 2, version 2 BPDUs, so an • RSTP bridge can communicate 802.1D on any shared link or with any switch running 802.1D. RSTP sends BPDUs and populates the flag byte in a slightly different manner than in 802.1D: – Protocol information can be immediately aged on a port if hellos are not received for three consecutive hello times, 6 seconds by default, or if the max age timer expires. – Because BPDUs are used as a keepalive mechanism, three consecutively missed BPDUs indicate lost connectivity between a bridge and its neighboring root or designated bridge. – The fast aging of the information allows failures to be detected quickly. RSTP – BPDU (2) RSTP – BPDU (3) • RSTP uses the flag byte of version 2 BPDU as shown in the figure: • Bits 0 and 7 are used for topology change notification and acknowledgment as they are in 802.1D. • Bits 1 and 6 are used for the Proposal Agreement process (used for rapid convergence). • Bits 2-5 encode the role and state of the port originating the BPDU. • Bits 4 and 5 are used to encode the port role using a 2bit code. RSTP – Edge Port (1) • An RSTP edge port is a switch port that is never intended • to be connected to another switch device. It immediately transitions to the forwarding state when enabled. Edge Port RSTP – Edge Port (2) • Cisco uses “Port Fast” function as RSTP “Edge • • Port” except, an RSTP edge port that receives a BPDU loses its edge port status immediately and becomes a normal spanning-tree port. Neither edge ports nor PortFast-enabled ports generate topology changes when the port transitions to a disabled or enabled status. The Cisco RSTP implementation maintains the PortFast keyword using the spanning-tree portfast command for edge port configuration. RSTP – Port States (1) RSTP – Port States (2) RSTP – Port Roles (1) RSTP – Port Roles (2) Configuring RSTP (1) • Rapid PVST+ is a Cisco implementation of RSTP. Configuring RSTP (2) Configuring RSTP (3) Trouble Avoidance for STP design (1) • Know where the root is • Do not leave it up to the STP to decide which bridge is root. • For each VLAN, you can usually identify which switch can best serve as root. • Generally, choose a powerful bridge in the middle of the network. Trouble Avoidance for STP design (2) If switch S2 is the root, the link from S1 to S3 is blocked on S1 or S3. In this case, hosts that connect to switch S2 can access the server and the router in two hops. Hosts that connect to bridge S3 can access the server and the router in three hops. The average distance is two and one-half hops. If switch S1 is the root, the router and the server are reachable in two hops for both hosts that connect on S2 and S3. The average distance is now two hops. Trouble Avoidance for STP design (3) • Minimize the Number of Blocked Ports • The only critical action that STP takes is the • • blocking of ports. A single blocking port that mistakenly transitions to forwarding can negatively impact a large part of the network. A good way to limit the risk inherent in the use of STP is to reduce the number of blocked ports as much as possible. Trouble Avoidance for STP design (4) Trouble Avoidance for STP design (5) Trouble Avoidance for STP design (6) • Use Layer 3 Switching • Layer 3 switching means routing approximately at the speed of switching. A router performs two main functions: – It builds a forwarding table. The router generally exchanges information with peers by way of routing protocols. – It receives packets and forwards them to the correct interface based on the destination address. Trouble Avoidance for STP design (7) Trouble Avoidance for STP design (8) • Redundancy is still present, with a reliance on • Layer 3 routing protocols. The design ensures a convergence that is even faster than convergence with STP. • STP no longer blocks any single port, so there is • no potential for a bridging loop. Leaving the VLAN by Layer 3 switching is as fast as bridging inside the VLAN. Trouble Avoidance for STP design (9)