CCNA tutorial: Router On A stick

A couple of previous posts were about

   1. Introduction to Vlan

   2. Implementation of VLAN in Cisco devices with the help of Cisco Packet Tracer.

 A special topology known as Router On a Stick was also mentioned(it is an interesting topic taught in Cisco's CCNA curriculum). In certain situations VLAN prove to be too restrictive since they disallow inter-VLAN communication ( to understand why see VLAN Intro PART 2). To resolve this problem a router is set up and configured to allow such communication. Usually the topology ends up looking something like this:

Note:

switch0's (2960 model) fa0/1 is connected to router's fa0/0 (2811) 

PC-0-5 are connected to fa0/2 and so on 

Router configuration:

For each VLAN id there will be a corresponding sub-interface and an ip address assigned to it. Explanation of a couple of key commands:

int fa0/0.1  //create a subinterface with id 1
encapsulation dot1Q 2 //dot1q refers to IEEE 802.1Q which documents VLAN
//standards. 
//This command sets VLAN tagging and all hosts in VLAN id 2
//will be communicate with this interface 

A sub-interface:

In cisco devices a sub-interface is a division of the physical interface into many logical,independent interfaces.So a physical port, say fa0/0 may be divided into fa0/0 , fa0/0.1 ,fa0/0.2 -3 separate interfaces belonging to the same physical interface but logically acting independently. 
Pinging PC1 from PC0 will not work initially. What you need to do is to create subinterfaces and enable 802.1Q encapsulation/tagging. Now the router will be able to understand the tagged packets. 

Additionally assign a unique subnetwork to each VLAN group and the router's subinterface.In the following code note that VLAN id 1 has been assigned 10.0.0.0/8 subnetwork, id 2 with 20.0.0.0/8 and VLAN id 3 with 30.0.0.0/8 .Router's fa0/0 interface has 10.0.0.1/8 , fa0/0.1 20.0.0.1/8 and fa0/0.3 with 30.0.0.1/8. 

All the hosts need to be assigned a gateway address. Remember that the gateway address and host address always belong to the same (sub)network. Keeping this in mind: 

PC0,PC3,PC5 will have their gateway address as 10.0.0.1/8
PC1 will have 20.0.0.1/8
and PC2 and PC4 will have 30.0.0.1/8

Interestingly 30.0.0.1 interface has been configured to accept VLAN id- 3 packets which is correct since all the nodes in VLAn id -3 will have their gateway address as 30.0.0.1/8.

Finally try to ping PC1 from PC0. If pings are successful you have been able to do inter-VLAN communication. If not try the realtime mode to see where packets are being dropped. The most common mistakes include not setting the encapsulation type on the router, binding subinterface with the wrong vlan id. Remember that by default VLAN id 1 is called the native VLAN and these packets are NEVER tagged. That is the reason why you DO NOT need to set encapsulation/tagging on fao/0 interface.

//switch:
en
conf t
vlan 2
name account
exit
vlan 3
name admin
exit

int fa0/1
switchport mode trunk //sets this port as trunking port
exit

int fa0/3
switchport access vlan 2 //this port belongs to VLAN id 2
exit
int range fa0/4,fa0/6
switchport access vlan 3
exit
end //jump from config mode to privileged mode
copy running-config startup-config //save all the settings

//Router:

enable
configure terminal
int fa0/0
ip address 10.0.0.1 255.0.0.0
no shutdown  //enable interface
int fa0/0.1 //enable logical subinterface fa0/0 id 1
encapsulation dot1Q 2 //Enables router to 'read' vlan tagged packets.
ip address 20.0.0.1 255.0.0.0
int fa0/0.3 
encapsulation dot1Q 3
ip address 30.0.0.1 255.0.0.0
end

copy running-config startup-config

Important Links:

Introduction to VLAN
Wiki on router on stick/one armed router
Wiki on 802.1Q standard

CCNA tutorial: VLAN and trunk ports

To understand what is a Vlan and the rich features that it provides follow the link (also provided at the end). This article discusses how to setup and configure VLAN on Cisco devices. Suppose we have the following scenario and network topology.

We will assign the switch's physical port a special VLAN id. A switch will forward requests only if the destination belongs to the physical port having the same VLAN id. Consequently, devices connected to the same VLAN will be able to communicate.This fragments a single broadcast domain as discussed in VLAN Part 1. But there are a few points to ponder:

• How do 2 switches communicate with each other?
• How to make physically distant devices belong to the same VLAN?
• Is there any way at all to make inter-VLAN communication possible?

VLAN in Detail and intro to Trunk lines:

Cisco switches implement VLAN by attaching a small header to the Ethernet frame which contains VLAN id and other additional info.  If the destination host resides locally it the outgoing interface will remove this tag and the host will receive the packet, unaware of the tagging and untagging done in the background. Even during broadcasts only those ports will receive the packet which belong to the same Vlan set.

 Two switches communicate their respective VLAN information over 'trunk' lines. A trunk line is a special link designated to carry traffic belonging to all the VLANs. Trunk lines do not belong to any Vlan which is quite obvious since they will be carrying traffic of all the Vlans.

The protocols used to configure and manage VLANs are collectively known as IEEE 802.1q.

This explains the first two questions. By implementing trunk lines and Vlan tagging we can achieve our objective of designing a secure and efficient network. But the flexibility is lost since two host in different VLan groups cannot communicate with each other at all.

Inter-VLAN connectivity with the help of a router

Since switches cannot solve the problem we move onto the the next device we can work with-a Router!

But there is yet another problem. Routers are essentially layer -3 devices and tagging is being done at layer-2. When a packet meant for a different VLAN reaches the switch it will eventually get discarded ( due to lack of ARP responses). For packets to reach a router either there must be some redirection mechanism or the host should directly send its request to the router. Redirection is out of question since switches cannot operate at layer-3 or above.

We are left with only one option- whenever a host needs to communicate with a host on another VLAN it should send its request to a designated router. Again hosts have no knowledge of VLANs but it can be overcome if each VLAN is given a separate address space, basically assigned a unique subnetwork. In such a scenario the router will act as a default gateway and whenever there is a need for inter-VLAN communication the packet will be sent to this designated router.

The final step is to make the designated router aware of VLAN. An interesting topology known as "Router on a stick" ( illustration below) appears when a router routes traffic for many (sub)networks over a single link. (More on how to configure such topologies in some later post). I have also put up the basic commands required to set up vlan with useful comments. I have also provided a link to download this file

Router on a stick

en 
configure terminal
vlan 2 //create vlan with id 2
name account //give it an identifier 
exit
vlan 3 //create vlan with id 3
name admin
exit
interface range fa0/1,fa0/2... //select all the physical ports that 
// you need to assign to some vlan
switchport access vlan 2 //assign all these ports to vlan 2
//here access tells it to make it an access port 
// (ports which can belong to a single vlan

exit

interface range fa0/3,fa0/4 ... //select all ports to assign to 
//vlan 3
switchport access vlan 3
exit

interface fa0/5 //select the port that acts as the trunk port
//a trunk port is a port which carries all the vlan information from one
// switch to another. 

switchport mode trunk //make the port a trunking port
exit 

Useful Links :

CCNA tutorial: Introduction to Vlans PART 1
Wiki on Vlan
Sample Vlan configuration file

CCNA tutorial: Introduction to Vlans, its benefits PART 1

One of the most interesting topics in CCNA curriculum deals with VLans known as Virtual LAN. It is layer-2 technology and can be implemented on switches to allow devices connected to remote switches to behave as if they are connected to a single common switch. Additionally it can be used isolate certain ports of a switch by logically removing them from the broadcast domain of the switch.

Broadcast Domain

A broadcast domain is basically a group of computers effected when one of the PC in the group broadcasts. For example in a typical LAN setting, where all the computers are connected with a hub or a switch, all the computers form a single broadcast domain.

To make it more clearer suppose I have the following scenario where PCs -A,B and D belong to the accounts section and  C and E belong to the admin section. Also pc G in building 2 belongs to the admin section as well. PCs from different section must not be able to communicate with each other and should not be present in the same LAN segment.

Ordinarily they all form a single LAN and any broadcasts will be seen by all the PCs. We need to implement a solution where A,B and D form a LAN and C,E,G form another LAN. PC F should be isolated from all of them. With VLAN we have the flexibility to segment our physical LAN to logical subnetworks and merge PCs from different physical networks together.

Given below is a network topology resembling the given scenario. I have also provided a link to a text file containing all the necessary commands to configure the switches. The next part will be about these commands and how to configure switches as well as routers to make them aware of VLANS. To make PCS residing in different VLANs communicate with each other we need a router.

If we want to partition our network why not use a router?

First of all routers are very expensive. Secondly they have a limited number of physical interfaces. For example if I want to create 20 subnetworks then I will need 20 physical interface,(such routers are very costly) one for each subnetwork, while in the case of switches I need to create 20 VLANS , no additional hardware is required.

To summarize Vlans provide the following benefits:

• Security
• Flexibilty
• Reduced traffic hence better network efficiency

Important links:

Wiki on VLAN
VLAN Part 2
VLAN configuration file

Cisco Packet Tracer

Cisco has developed a superb tool known as Cisco Packet tracer and is essential for anyone preparing for CCNA or higher exams. Since it is very difficult to realize complex network topologies with different devices and interconnections with actual hardware, Cisco developed this product to simulate such topologies and added features which makes debugging easier to understand and implement in real world situations. Therefore one can simulate real life network topologies on their PCs without needing to physically set up devices.

Modes in Cisco Packet tracer

Packet tracer has 2 modes - realtime and simulation.

In realtime mode devices run as they are expected to in normal operation. Simulation mode allows user to filter certain packet, change packet transfer speed to isolate certain packets for better analysis and understanding of the network topology and the path taken by a particular packet.

On the bottom left hand pane there is a list of devices such as routers,switches and WAN cloud which on clicking will display a list of models Cisco has manufactured. The most common router model used in CCNA is 2811 and for switches 2960 is used.

Dragging and dropping a device in the main window will boot it up and make it ready for configuration. Double clicking it will open a new window which will list the hardware specifications which can be modified according to your needs (like adding new modules such as ethernet ports) . There is a config mode and a CLI mode.

Config mode is useful for quick configuration of the device whereas CLI mode simulates a console session. Cisco devices can be configured using a console cable and such a session is called a console session. Obviously CLI mode allows user to fully explore a device's features, unlike the config mode.

The simulation mode is a wonderful feature and behaves like wireshark in some ways, for example it allows you to watch the details of a particular packet. Additionally, you can adjust the speed of the packet transfer for debugging and better understanding.

For example, in the above topology suppose I want to know what type of messages and path is taken when HostA pings router1. All I need to do is start the simulation mode and ping the destination. Clicking on the autocapture button will show a graphical "journey" of the packet. You can also click on a packet any time to view the headers and other details.

ARP packets are not forwarded by Routers

While using a MAC address scanner in my campus, I realized that it was able to show the correct MAC addresses corresponding to the hosts on my local subnet ONLY. For the rest of the hosts outside my subnet, the same MAC address was shown and surprisingly it corresponded to the router connected to our subnet. Why was this happening?

Well I have found the answer to that when I read Richard Stevens' TCP/IP Illustrated Vol-1 a month back. It is an amazing book and explains the concepts very well.

The reason for the anomaly I described above was that MAC addresses are hardware addresses which work at the LINK LAYER of the OSI Model, the MAC scanner simply sends out ARP REQUEST packets for the different ip addresses. Now these ARP REQUESTS are broadcast WITHIN the subnet and the hosts respond to the requests if the destination ipaddress of the request packet matches with theirs. Then that host sends an ARP REPLY packet with the correct MAC ADDRESS. But you may still be wondering why does the local router responds to request packets having the ipaddress not meant for it?

Actually, when the router, through its ROUTING TABLE is always aware which hosts belong to its subnet and which are not(Its more complicated than that). When a host tries to send packet outside its own subnet ,the router realises this and sends its own mac address. A router works at the IP layer, which means that it needs an IP datagram, for forwarding any packet, and since ARP packets work at the link layer, do not have any IP header therefore are never forwarded to the outside networks.

This was written in an ultra-condensed form and reading a book on the TCP/IP suite is a must if you feel this article did not do justice to the topic.

I would recommend

1. TCP/IP Illustrated by Richard Stevens
2.Computer Networks by Tenebaum (I have not read it but i have heard it is very good as well)

Some important links:

1.Wiki on OSI Model

2.Wiki on LINK LAYER

3.Wiki on ARP

4.Richard Stevens' Home Page

5.Computer Network by Tanebaum book review