The Catalyst 2960 is a very common switch in any environment that has
Cisco devices. A couple of years ago the 2960 got stacking via the
2960-S model. It also got the ability to do static routes which
was a nice feature. I used it in some deployments to do routing
locally in 2960 and then add a default route towards WAN provider.
That way I didn’t have to go through a slow CPE to route my local
The 2960-X and -XR are available in 24 or 48 port configurations.
Uplinks are either 2x 10 Gbit SPF+ or 4x 1 Gbit SFP. The PoE models
can support 370W or 740W of power.
The 2960-X provides up to 80 Gbps of stack bandwidth which is 2x more
compared to the 2960-S. It is now also possible to stack up to 8 switches
compared to the earlier maximum of 4. The 2960-S model uses FlexStack while
the newer -X and -XR models uses FlexStack-Plus. FlexStack-Plus supports
detecting stack port operational state in hardware and change the forwarding
according to it. This takes 100 ms or less. The older model does it in CPU
which can take 1 or 2 seconds.
Here are some notable differences between 2960-X and -XR compared to 2960-S.
- Dual core CPU @ 600 MHz. 2960-S has single core
- 2960-XR has support for dual power supplies
- 256 MB of flash for -XR, 128 MB for -X. The S model has 64 MB
- 512 MB of DRAM compared to 256 for 2960-S
- 1k active VLANs compared to 255 for 2960-S
- 48 Etherchannel groups for -XR, 24 for -X and 6 for -S
- 4 MB of egress buffers instead of 2 MB
- 4 SPAN sessions instead of 2
- 32k MACs for -XR, 16k for -X and 8k for -S
- 24k unicast routes for -XR, 16 static routes for -X and -S
The newer models also support Netflow lite, hibernation mode and EEE.
The 2960-XR does support dynamic routing. It has support for RIP, OSPF stub,
OSPFv3 stub, EIGRP stub, HSRP, VRRP and PIM.
Here are some performance numbers:
2960-X Lan Lite has 100 Gbps of switching bandwidth and 64 active VLANS.
2960-X Lan Base has 216 Gbps of switching bandwidth and 1023 active VLANs.
The same holds true for 2960-XR with IP Lite feature set. The 2960-S had
a maximum of 255 VLANs and 176 Gbps switching bandwidth. Depending on
model the 2960-X tops out at 130.9 Mpps compared to 101.2 for 2960-S.
The switches also have added support for IPv6. Notable features are:
- IPv6 MLDv1 and v2 snooping
- IPv6 First Hop Security (RA guard, source guard, and binding integrity guard
- IPv6 ACLs
- IPv6 QoS
- HTTP/HTTPs over IPv6
- SNMP over IPv6
- Syslog over IPv6
I’m expecting more information to come out as it gets presented during Cisco Live
Sorry for the lack of updates lately but I spent the whole last week skiing and recharging my
batteries and now I’m back fully motivated to continue my path to the lab.
This time we will be talking about Integrated Routing and Bridging (IRB). Before studying for
the lab I had never used this feature. I’m not sure why we would use this feature in a
production network, maybe because we need to bridge two networks instead of routing
them due to some badly written application. If you have used it in real networks please post
in the comments. It is fair game for the lab so we need to know about it.
IRB is a feature used on routers that lets us bridge between a bridged domain and a
routed domain. Remember that in order for a VLAN to span a router the router must
be able to forward frames from one interface to another while maintaining the VLAN
header. If a network protocol is configured on a router interface (IP) it will terminate
the VLAN. This means that the VLAN header will not be maintained. When configuring
IRB we will be using a Bridged Virtual Interface (BVI), this can be compared to a SVI
on a switch. A BVI gives the bridged interfaces a connection to the routed world.
When IRB is configured and traffic comes in on a routed interface (IP address configured)
that is destined for a host in the bridge group the traffic will first be routed to the BVI.
The packet will then be forwarded to the bridging engine which forwards it through a
bridged interface, the forwarding is based on the destination MAC address. If a packet
comes in on a bridged interface destined for a host in a routed network the traffic will
first go to the BVI and then be sent to the routing engine before it sends it out the
routed interface. If bridging between two interfaces with no routed protocols the traffic
will not pass the BVI interface. Think of the bridge-group as an external switch and
the BVI lets us connect this external switch to the router.
The image below describes the scenario. R1 and R3 are in different VLANs but in
the same subnet, we need communication between the two routers. Between the
routers we have a couple of switches.
The configuration on R1 and R3 is straightforward. They have physical interfaces
with an IP address.
R1 is connected to SW1 and R3 to SW3. The switch configuration is just a basic access port.
Router R6 is connected to SW2 and it needs a trunk port.
Now we need to configure R6 to bridge between the two different VLANs. We start by activating IRB.
Then we need to tie the interfaces to the bridge-group.
Now we create a BVI interface in the subnet.
Lastly we need to activate spanning-tree and activate routing for the bridged interfaces.
So using IRB we can both bridge and route between interfaces on a
router, something that is not possible otherwise.
Finally, these are some useful commands to show what is going on when using IRB.
Private VLANs is a method to segment devices at layer 2 that are in the same IP network. Different VLANs are used but they share a common IP network.
The most common scenario for a private VLAN is a residential network where customers
connect to a switch provisioned by the ISP and the ISP wants to provision only one
subnet but the customers should not be able to reach each other at layer 2.
The reason to disallow layer two intercommunication is for security, to prevent someone
from interfearing or eavesdropping on another customers traffic. Another scenario could
be a hosting environment where servers are connected to a switch and a common VLAN
is used instead of provisioning one VLAN for every new customer.
Take a look at this picture.
PC’s in the grey VLAN can only communicate with each other and the router. The same goes for the PC’s in the green VLAN. PC’s in the blue VLAN can ONLY communicate with the router not with each other. The picture shows only one PC but if there was another PC it would not be able to communicate with the other PC in the same VLAN.
Lets look at some of the building blocks of private VLANs.
Types of VLAN:
Primary VLAN – The VLAN that is used for receiving traffic from the device connected to the promiscous port.
Community VLAN – Everybody that is located in a community VLAN may communicate with others in the same
community VLAN and with the primary VLAN but not with other VLANs.
Isolated VLAN – Can only reach the device on the promiscous port, can not reach any other devices.
Types of ports:
Promiscous port – A port that is connected to the primary VLAN where a promiscous device is connected. This device will route traffic between the different VLANs. Requires mapping between primary VLAN and all secondary VLANs.
Host port – Hosts are connected to host ports, requires a association between the secondary VLAN in use on the port and the primary VLAN.
This picture shows the traffic flow.
When communicating in the same community VLAN the traffic forwarding is direct (layer 2) but it traffic is sent between different secondary VLANs the traffic must pass through the router which allows us to do packet filtering at layer 3 and it also means that ARP can not be sent directly between hosts even though they are in the same IP subnet. The arrows from the PC in the blue VLAN to the PC in the black VLAN shows the traffic flow with numbering. First the PC in the blue VLAN sends a packet, this packet is always source with the VID from the secondary VLAN. The router receives the traffic and if no filtering is done it sends the packet out sourcing with the primary VLAN. The PC in the black VLAN receives the packet from the primary VLAN and sends it response with its secondary VLAN. Finally the router sends the packet back to the blue VLAN with the VID of the primary VLAN.
Lets have a look at what needs to be configured, lets start with the VLAN configuration. The scenario is that there are two switches connected by a trunk and routers are connected to the switchports (INE topology).
We create the VLANs and configure them to be primary, community or isolated. The primary VLAN needs to know the secondary VLANs it should be be associated to. Next is the interface configuration.
One port is configured as promiscous and the others as hosts. The host ports with secondary VLANs need to know what primary VLAN is used and the promiscous port needs to know what the secondary VLANs are.
Show vlan private-vlan will show what has been configured.
We also need configuration for SW2.
Show interface switchport will show how the port is configured.
Lets try the configuration, we will start at R1 which is on the promiscous port and see if it can ping R2-R6.
As expected we can ping all the devices. R2 should only be able to ping R3 and R1.
Working as expected. R6 should only be able to ping R1 since it is in an isolated VLAN.
The configuration is working. What if we want to create a SVI in one of the switches? This is the configuration.
Lets try to ping.
Why can’t we ping R2? We have no mapping to the secondary VLAN!
Still no success, why?
IP routing was needed! If you need to find documentation @ Cisco here is how you find it:
Support -> Configure -> Products -> Switches -> LAN Switches -> Access -> Cisco Catalyst 3560 Series Switches -> Configuration Guides -> Catalyst 3560 Software Configuration Guide, Release 12.2(52)SE -> Configuring Private VLANs