Switching fundamentals and MAC learning

Why this matters

Objective 2.2 is "given a scenario, configure switching technologies and features" — a configuration objective, so questions describe a requirement and ask what you would set.

Switching is also where a large share of real faults live. A loop takes down a whole site in seconds. An MTU mismatch produces the maddening symptom of small packets working and large ones vanishing. Both are in this lesson, and both are examined.

The lesson

How a switch learns

A switch builds its MAC address table — also called the CAM table — purely by watching traffic.

When a frame arrives, the switch reads the source MAC and records that this address is reachable through this port. Then it reads the destination MAC and does one of three things:

• Forward, if the destination is in the table: send it out that one port.
• Flood, if it is not: send it out every port except the one it arrived on. The reply teaches the switch where the destination is, so flooding for an unknown address happens once.
• Filter, if the destination is on the same port it arrived on: drop it, because it has already been delivered.

Entries age out — typically after five minutes of silence — so a device that moves does not remain wrongly mapped forever.

Two properties follow and are worth stating explicitly. Every port is its own collision domain, which is what made switches replace hubs. But all ports are in the same broadcast domain by default, which is the problem VLANs exist to solve.

Spanning tree

Redundant links between switches are desirable — you want a spare path. They are also, at layer 2, catastrophic, because an Ethernet frame has no TTL. A broadcast entering a loop is forwarded forever, multiplying at each switch, until the CPUs saturate and the segment dies. That is a broadcast storm, and it happens in seconds.

Spanning Tree Protocol (STP, 802.1D) prevents it by building a loop-free logical topology over a physically looped one. It works out which links are needed and puts the rest into a blocking state, ready to activate if the active path fails.

The mechanism, in the order the exam asks about it:

1. Switches exchange BPDUs (bridge protocol data units).
2. They elect a root bridge — the switch with the lowest bridge ID, which is priority followed by MAC address. Lowest priority wins; on a tie, the lowest MAC address wins.
3. Every other switch determines its root port: the single port with the lowest path cost toward the root.
4. Each segment elects a designated port, the one that forwards for that segment.
5. Everything else is put into blocking.

Port states in classic STP are blocking, listening, learning and forwarding, and convergence takes 30 to 50 seconds — slow enough to be a problem. Rapid Spanning Tree (RSTP, 802.1w) reduces that to a few seconds and is what you should assume in modern equipment.

Two features frequently asked about:

PortFast puts an access port straight into forwarding, skipping the listening and learning delay. Use it on ports facing end devices — a workstation that waits 45 seconds for a link often fails to get DHCP. Never use it on a port facing another switch.

BPDU Guard disables a port that receives a BPDU. Paired with PortFast, it means an access port that suddenly has a switch plugged into it shuts down rather than becoming part of the topology. That combination is the standard protection against someone plugging a desk switch into the network.

MTU and jumbo frames

The maximum transmission unit is the largest payload an interface will carry in one frame. The Ethernet default is 1500 bytes.

Jumbo frames raise it, typically to 9000 bytes. Fewer, larger frames means less per-frame overhead and fewer interrupts, which measurably helps storage traffic — iSCSI, NFS, backup — and east-west data-centre traffic.

The rule that makes this examinable: every device in the path must agree. Both hosts, every switch, every router. If one link in the path uses 1500 and the rest use 9000, you have an MTU mismatch, and its symptom is distinctive:

Small packets work. Ping works. The connection establishes. Then large transfers hang or crawl.

That happens because small frames fit everywhere, and the large ones are either dropped or need fragmenting. If the packet has the Don't Fragment bit set, the router drops it and sends back an ICMP "fragmentation needed" message — and if ICMP is being filtered, that message never arrives and the sender simply never learns why. The result is a black hole: the connection is open and nothing crosses it.

This is why blocking all ICMP is a bad idea, and it is one of the most satisfying faults to diagnose. ping with a large payload and the don't-fragment flag set will find the breaking size.

VLANs

A VLAN (virtual local area network) divides one physical switch into several logical switches. Ports in VLAN 10 and ports in VLAN 20 behave as though they are on separate, unconnected switches — even on the same chassis.

Each VLAN is its own broadcast domain, which is the point. Instead of buying separate hardware to contain broadcast traffic and separate departments, you configure it.

What VLANs buy you:

• Smaller broadcast domains, so broadcast traffic scales.
• Segmentation for security, keeping guest traffic away from finance.
• Grouping by function rather than geography — the whole engineering department on one VLAN across four floors.
• Fewer physical switches, since one switch serves several networks.

The consequence people trip over: devices in different VLANs cannot reach each other without routing, because a VLAN boundary is a broadcast-domain boundary. Inter-VLAN routing is done by a multilayer switch or a router, and a question describing "VLANs configured correctly but the two departments cannot communicate" is usually a missing route, not a switching fault.

The VLAN database and switch virtual interfaces

The VLAN database is where the switch stores its VLAN definitions — the ID, the name, and the state. VLAN IDs run 1 to 4094, with VLAN 1 the default: every port belongs to it until configured otherwise, which is exactly why security guidance says not to use VLAN 1 for user traffic.

A switch virtual interface (SVI) is a logical layer 3 interface for a VLAN. It gives the VLAN an IP address on the switch, which does two things: it provides a management address, and on a multilayer switch it acts as the default gateway for hosts in that VLAN, so the switch itself routes between VLANs without an external router.

An SVI is up only when at least one port in that VLAN is up — a detail that explains the occasional mystery of a management interface that will not come up on a switch with nothing plugged in.

Interface configuration

The per-port settings that come up repeatedly:

• Access or trunk mode. An access port carries one VLAN and connects an end device. A trunk carries many and connects switches. Covered in the next lesson.
• Speed and duplex. Auto-negotiate is correct in nearly all cases; the next lesson covers why hardcoding one end is a classic fault.
• Port security, limiting which or how many MAC addresses may appear on a port.
• PortFast and BPDU Guard on access ports, as above.
• Description. Not a technical control, but the difference between a diagnosable estate and a guessing game at 2 a.m.
• Shutdown state. Unused ports should be administratively shut down and, if possible, placed in an unused VLAN — an open live port in a lobby is an access control failure.