Domain 2 capstone: build and troubleshoot a branch's switched network

Steps

1. Place the devices and cable them as the Links table lists: Copper Straight-Through to the PCs and between DSW1 and R1, Copper Cross-Over between the switches. Packet Tracer places the 3650-24PS with its power supply bay empty, so it stays dark. Click the switch, open the Physical tab, drag the AC-POWER-SUPPLY module into the empty bay on the back panel, and the switch boots. When a router first boots, Packet Tracer asks Would you like to enter the initial configuration dialog? [yes/no]:. Answer no and press Enter to reach the Router> prompt. Give the three PCs their addresses and gateways from the Addressing table.
2. Create the same VLAN database on DSW1, ASW1 and ASW2. These are DSW1's commands; repeat them on each access switch after setting its hostname (hostname ASW1 and hostname ASW2):

Switch> enable
Switch# configure terminal
Switch(config)# hostname DSW1
DSW1(config)# vlan 10
DSW1(config-vlan)# name STAFF
DSW1(config-vlan)# exit
DSW1(config)# vlan 20
DSW1(config-vlan)# name SALES
DSW1(config-vlan)# exit
DSW1(config)# vlan 30
DSW1(config-vlan)# name PRINT
DSW1(config-vlan)# exit
DSW1(config)# vlan 99
DSW1(config-vlan)# name NATIVE-MGMT
DSW1(config-vlan)# exit

3. Make DSW1 the Layer 3 core: routing on, a routed port to R1, and one SVI per VLAN. Then address R1's end of the /30 and test the routed link.

DSW1(config)# ip routing
DSW1(config)# interface GigabitEthernet1/0/24
DSW1(config-if)# description Routed link to R1
DSW1(config-if)# no switchport
DSW1(config-if)# ip address 10.0.0.1 255.255.255.252
DSW1(config-if)# no shutdown
DSW1(config-if)# interface Vlan10
DSW1(config-if)# ip address 192.168.10.1 255.255.255.0
DSW1(config-if)# no shutdown
DSW1(config-if)# interface Vlan20
DSW1(config-if)# ip address 192.168.20.1 255.255.255.0
DSW1(config-if)# no shutdown
DSW1(config-if)# interface Vlan30
DSW1(config-if)# ip address 192.168.30.1 255.255.255.0
DSW1(config-if)# no shutdown
DSW1(config-if)# interface Vlan99
DSW1(config-if)# ip address 192.168.99.1 255.255.255.0
DSW1(config-if)# no shutdown
DSW1(config-if)# end
Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# ip address 10.0.0.2 255.255.255.252
R1(config-if)# no shutdown
R1(config-if)# end
DSW1# ping 10.0.0.2

Expect at least four !. Until the trunks in the next steps carry the VLANs, show ip interface brief on DSW1 shows the SVIs up with protocol down. 4. Build the LACP EtherChannel between DSW1 and ASW1 and make it a trunk with native VLAN 99 and only the four branch VLANs allowed. Trunk settings go on Port-channel1 at both ends:

DSW1# configure terminal
DSW1(config)# interface range GigabitEthernet1/0/1 - 2
DSW1(config-if-range)# channel-group 1 mode active
DSW1(config-if-range)# exit
DSW1(config)# interface Port-channel1
DSW1(config-if)# switchport trunk encapsulation dot1q
DSW1(config-if)# switchport mode trunk
DSW1(config-if)# switchport trunk native vlan 99
DSW1(config-if)# switchport trunk allowed vlan 10,20,30,99
DSW1(config-if)# switchport nonegotiate
DSW1(config-if)# end
ASW1# configure terminal
ASW1(config)# interface range GigabitEthernet0/1 - 2
ASW1(config-if-range)# channel-group 1 mode active
ASW1(config-if-range)# exit
ASW1(config)# interface Port-channel1
ASW1(config-if)# switchport mode trunk
ASW1(config-if)# switchport trunk native vlan 99
ASW1(config-if)# switchport trunk allowed vlan 10,20,30,99
ASW1(config-if)# switchport nonegotiate
ASW1(config-if)# end

5. Build the two single trunks, DSW1 Gi1/0/3 to ASW2 Gi0/1 and ASW1 Fa0/24 to ASW2 Fa0/24, with the same native VLAN and allowed list. Each end needs the same four lines; the 3650 alone also needs the encapsulation line:

DSW1# configure terminal
DSW1(config)# interface GigabitEthernet1/0/3
DSW1(config-if)# switchport trunk encapsulation dot1q
DSW1(config-if)# switchport mode trunk
DSW1(config-if)# switchport trunk native vlan 99
DSW1(config-if)# switchport trunk allowed vlan 10,20,30,99
DSW1(config-if)# switchport nonegotiate
DSW1(config-if)# end
ASW2# configure terminal
ASW2(config)# interface GigabitEthernet0/1
ASW2(config-if)# switchport mode trunk
ASW2(config-if)# switchport trunk native vlan 99
ASW2(config-if)# switchport trunk allowed vlan 10,20,30,99
ASW2(config-if)# switchport nonegotiate
ASW2(config-if)# exit
ASW2(config)# interface FastEthernet0/24
ASW2(config-if)# switchport mode trunk
ASW2(config-if)# switchport trunk native vlan 99
ASW2(config-if)# switchport trunk allowed vlan 10,20,30,99
ASW2(config-if)# switchport nonegotiate
ASW2(config-if)# end
ASW1# configure terminal
ASW1(config)# interface FastEthernet0/24
ASW1(config-if)# switchport mode trunk
ASW1(config-if)# switchport trunk native vlan 99
ASW1(config-if)# switchport trunk allowed vlan 10,20,30,99
ASW1(config-if)# switchport nonegotiate
ASW1(config-if)# end

6. Configure the edge ports and the access switches' management. Every PC port is a fixed access port with PortFast and BPDU guard. These are ASW2's commands; on ASW1 configure Fa0/1 the same way in VLAN 10 and use 192.168.99.11 for its SVI.

ASW2# configure terminal
ASW2(config)# interface FastEthernet0/1
ASW2(config-if)# switchport mode access
ASW2(config-if)# switchport access vlan 20
ASW2(config-if)# spanning-tree portfast
ASW2(config-if)# spanning-tree bpduguard enable
ASW2(config-if)# exit
ASW2(config)# interface FastEthernet0/2
ASW2(config-if)# switchport mode access
ASW2(config-if)# switchport access vlan 30
ASW2(config-if)# spanning-tree portfast
ASW2(config-if)# spanning-tree bpduguard enable
ASW2(config-if)# exit
ASW2(config)# interface Vlan99
ASW2(config-if)# ip address 192.168.99.12 255.255.255.0
ASW2(config-if)# no shutdown
ASW2(config-if)# exit
ASW2(config)# ip default-gateway 192.168.99.1
ASW2(config)# end
ASW1# configure terminal
ASW1(config)# interface FastEthernet0/1
ASW1(config-if)# switchport mode access
ASW1(config-if)# switchport access vlan 10
ASW1(config-if)# spanning-tree portfast
ASW1(config-if)# spanning-tree bpduguard enable
ASW1(config-if)# exit
ASW1(config)# interface Vlan99
ASW1(config-if)# ip address 192.168.99.11 255.255.255.0
ASW1(config-if)# no shutdown
ASW1(config-if)# exit
ASW1(config)# ip default-gateway 192.168.99.1
ASW1(config)# end

7. Design the spanning tree. Run Rapid PVST+ on all three switches, make DSW1 root primary for every VLAN and ASW1 root secondary, so the backup root is chosen rather than left to MAC addresses. Then put root guard on DSW1's two designated downlinks, so no access switch can take the root role:

DSW1# configure terminal
DSW1(config)# spanning-tree mode rapid-pvst
DSW1(config)# spanning-tree vlan 10 root primary
DSW1(config)# spanning-tree vlan 20 root primary
DSW1(config)# spanning-tree vlan 30 root primary
DSW1(config)# spanning-tree vlan 99 root primary
DSW1(config)# interface Port-channel1
DSW1(config-if)# spanning-tree guard root
DSW1(config-if)# interface GigabitEthernet1/0/3
DSW1(config-if)# spanning-tree guard root
DSW1(config-if)# end
ASW1# configure terminal
ASW1(config)# spanning-tree mode rapid-pvst
ASW1(config)# spanning-tree vlan 10 root secondary
ASW1(config)# spanning-tree vlan 20 root secondary
ASW1(config)# spanning-tree vlan 30 root secondary
ASW1(config)# spanning-tree vlan 99 root secondary
ASW1(config)# end
ASW2# configure terminal
ASW2(config)# spanning-tree mode rapid-pvst
ASW2(config)# end

Before you look, predict ASW2's roles in VLAN 10: Gi0/1 reaches the root directly over 1 Gbps for a root path cost of 4, so it is the root port. On the ASW1-ASW2 segment, ASW1 advertises a lower or equal cost and the lower bridge ID (28682 against 32778), so ASW1's Fa0/24 is designated and ASW2's Fa0/24 is the alternate port. Check with show spanning-tree vlan 10 on ASW2. 8. Prove the build end to end, after about 30 seconds for the bundle and spanning tree to settle:

DSW1# show etherchannel summary
DSW1# show interfaces trunk
DSW1# show ip interface brief
C:\> ping 192.168.20.10
C:\> ping 192.168.30.10

Run the two pings from PC1. Po1 should be SU with both members P; Po1 and Gi1/0/3 should both be trunking with native VLAN 99; every SVI should be up/up. PC1 reaching PC2 and PC3 proves the trunks, the SVIs and routing on DSW1 together. 9. Audit the documentation with CDP. The branch drawing says: DSW1 Gi1/0/1 and Gi1/0/2 go to ASW1 Gi0/1 and Gi0/2; DSW1 Gi1/0/3 goes to ASW2 Gi0/2; DSW1 Gi1/0/24 goes to R1 G0/0/0; ASW1 Fa0/24 goes to ASW2 Fa0/24. Run show cdp neighbors on DSW1 and on ASW1 and check every row: Local Intrfce is your port, Port ID is the neighbour's. One documented port is wrong: CDP on DSW1 shows ASW2 on local Gig 1/0/3 with Port ID Gig 0/1, not Gi0/2. Record the correction and each neighbour's address from show cdp neighbors detail. 10. Fault 1: a native VLAN mismatch. Plant it on ASW2, as if a technician had reset the uplink and missed one line:

ASW2# configure terminal
ASW2(config)# interface GigabitEthernet0/1
ASW2(config-if)# switchport trunk native vlan 1
ASW2(config-if)# end

Within a minute both consoles show %CDP-4-NATIVE_VLAN_MISMATCH. Read the DSW1 copy: the first interface and VLAN, GigabitEthernet1/0/3 (99), are local; the ones after with are ASW2's, GigabitEthernet0/1 (1). Confirm it from show commands alone: show interfaces trunk on DSW1 gives Gi1/0/3 native vlan 99, and on ASW2 gives Gi0/1 native vlan 1. The design says 99, so the fix belongs on ASW2:

ASW2# configure terminal
ASW2(config)# interface GigabitEthernet0/1
ASW2(config-if)# switchport trunk native vlan 99
ASW2(config-if)# end

11. Fault 2: an access switch tries to become root. On ASW2, set the lowest possible priority for VLAN 10, as a careless change might:

ASW2# configure terminal
ASW2(config)# spanning-tree vlan 10 priority 0
ASW2(config)# end
DSW1# show spanning-tree vlan 10

ASW2's BPDUs for VLAN 10 are now superior, and ASW1 relays the new root's BPDUs too, so both of DSW1's downlinks receive superior BPDUs. Root guard puts each one into the root-inconsistent state and blocks it for VLAN 10 (IOS marks the ports BKN* and ROOT_Inc; your release's wording may differ). DSW1 still reports This bridge is the root for VLAN 10, and PC1 can no longer reach its gateway: from PC1, ping 192.168.10.1 times out. VLANs 20 and 30 are untouched, because each VLAN runs its own instance. Remove the cause:

ASW2# configure terminal
ASW2(config)# no spanning-tree vlan 10 priority 0
ASW2(config)# end

Root guard recovers by itself once the superior BPDUs stop. Within a few seconds PC1's ping to 192.168.10.1 replies again, with no command on DSW1. 12. Write a one-page handover for the branch: the VLAN plan, which port carries what, the root and backup root for each VLAN, the corrected cabling documentation, and the two faults with the command that located each one and the fix.