SWITCH: Implementing Cisco IP Switched Networks

Explore network design principles, hierarchical models, and design choices that improve scalability and future growth, while examining how switches forward packets based on ip addresses or mac addresses.

Explore the Cisco hierarchical model with its access, distribution, and core layers, and see how it overcomes flat-network broadcast storms for scalable growth and converged traffic.

Explore how a flat network causes broadcast storms and bum traffic, and learn hierarchical design with access, distribution layer (multilayer), and core layers using VLANs to scale without flooding.

The access layer connects end devices via switches or wireless access points, handling converged traffic like voice, data, and video, with port-based authentication and vlan access lists.

Understand how the distribution layer aggregates traffic from the access layer, makes routing decisions, and provides redundancy to prevent failures, using multilayer switches and QoS for latency-sensitive traffic.

The core layer prioritizes high-speed throughputs and does not enforce security policies, serving as an aggregation point for distribution traffic with redundancy and fast convergence.

Explore the collapsed core option by using the distribution layer as the core, ensuring redundancy with multiple paths between access and distribution layers while noting scalability challenges.

Explore the collapsed core design, using high-speed core switches to aggregate traffic, reduce cabling, and improve scalability and redundancy by centralizing connectivity through a core layer.

Explore switch types across core, distribution, and access layers, including 6800 series with dual supervisor cards, line cards, throughput, and uplink options for 3850, 29-60, and 60-800 series.

Compare switched and routed architectures by tracing traffic from the access layer devices to distribution and core layers, highlighting layer two mac forwarding and layer three ip routing.

Layer 2 switching dynamically learns mac addresses per port, builds a cam-based mac address table, and forwards frames within the same vlan, using static or dynamic bindings.

Explore how switches use ternary content addressable memory containing access lists and quality of service, integrate security and QoS into forwarding decisions, and execute line-speed lookups in hardware.

Explore how switches base forwarding decisions on the forwarding information base, control plane, and data plane, and compare process switching with routing using the FIB, CAM, and TQM tables.

Explain how a host reaches a different subnet through a default gateway, ARP-resolved gateway MAC, and how a router rewrites the frame for the next hop while preserving IPs.

Explain how the control plane runs routing protocols to populate the routing and MAC tables, while the data plane forwards via the FIB, CAM, ACLs, and QoS in parallel.

Compare process switching, fast switching, and Cisco express forwarding, explaining how the routing and switching engines shape the data and control planes for line-rate forwarding.

Explore switching methods from process switching to fast switching and Cisco express forwarding, showing how the data plane uses FIB and CAM/TCAM for rapid routing.

Explore fast switching and route caching, where the first packet enters the control plane for routing and frame rewriting, and the default gateway mac constrains subsequent flow at hardware speed.

Explore typology-based switching, detailing how the control plane builds the forwarding information base and how Cisco express forwarding populates the data plane to enable per-destination load balancing.

Explore how the SDM templates allocate switch memory and resources between MAC/CAM tables, routing, IPv6, security, and QoS to fine-tune performance, starting from the default template, on Cisco Catalyst switches.

Explore the new CDP and the open LLDP, which advertise device type and hostname to directly connected neighbors across multi-vendor networks to verify connectivity and map topology.

Turn on ldp from global configuration using the ldp run command, then turn it off on an interface as needed; verify with show ldp neighbors.

Discover how power over ethernet lets access layer devices—such as access points, VoIP phones, video devices, and CCTV cameras—be powered directly from the switch via ethernet.

Explore power options for network devices, including power over ethernet switches, power injectors, and wall adapters, with per-port power control, installation considerations, cost, and remote management.

Power over Ethernet enables IP phones, access points, and surveillance cameras to receive power through copper cables. Maintain reach up to 100 meters due to attenuation limits on copper.

Trace the evolution of PoE standards from 802.3af to 802.3at, with per-port power up to 25.5 watts (50W with four pairs), and plan switch power budgets for IP phones.

Explore how PoE negotiates device power, mitigates hazards by a low current check, and gradually delivers up to 15.4 watts to avoid hardware damage.

Explore PoE negotiation, detailing default 15.4 W per interface, optional classes like class 3 at 15.4 W, and class 4 up to 15 W, with 802.3 devices favored.

Configure PoE on switch interfaces by entering interface configuration mode and using the power inline command with auto or never, then use show power inline to verify interfaces providing power.

Learn foundational switch networking, comparing flat and hierarchical designs, and the access, distribution, and core layers. Explore layer 2/3 architectures, LDP, PoE, SDM templates, and Cisco express forwarding.

Explore how switches shape campus area networks, from large switch environments to vlan concepts and trunking protocols, and enable IP address distribution via a dhp server on Cisco IOS devices.

Explore how switches forward frames by destination MAC using the CAM table, keeping traffic within the same VLAN. Learn to create VLANs and enable inter‑VLAN routing with a layer 3 device.

Explain how a six-port switch uses a CAM table to map MAC addresses to ports and VLANs, including VLANs 10 and 20 and dynamic learning.

Discover why VLANs exist to separate broadcast domains, reduce broadcast storms, and enhance security by segmenting traffic with layer 3 routing between VLANs, each on its own subnet.

Configure a vlan in global config mode, assign it to an interface as an access port, name the vlan, noting the default native vlan is 1 to avoid trunking.

Demonstrate the basics of VLANs on access layer switches, assign IPs and VLAN 10, configure access ports, and show why trunks and inter-VLAN routing are required for cross-switch communication.

Explain vlan trunking and port types, compare access and trunk ports, illustrate end-to-end vlans across switches, and show how routers break vlans into separate broadcast domains.

Disable dynamic trunking protocol (DTP) to prevent ports from becoming trunks. Configure switchport mode access and switchport access vlan to lock ports as access ports and contain VLAN traffic.

Demonstrate creating trunk links between distribution and access switches to carry VLANs 10 and 20, using range commands and dot1q encapsulation, and verify connectivity with pings.

Identify the native vlan as the untagged traffic on a trunk, never tagged on frames. Ensure both ends use the same native vlan so untagged frames traverse trunks.

Configure trunk connections manually to allow VLAN 10 traffic between switches, prevent negotiations via dynamic trunking protocol, and set unused ports to access or shut down for security.

Deploy vlan across multiple switches without routing to keep users on different floors in the same view, ensuring consistent security access lists across the network.

Explains local vlans confine segmentation to a single switch, avoids trunks, and notes that inter-vlan access requires a layer 3 device and security rules to control resources.

Explore end-to-end VLAN design across switches, using trunks and native VLAN to carry VLAN 10 and VLAN 20 traffic, and explain broadcast flooding and pruning as bandwidth-saving solutions.

Explore voice VLANs that keep VoIP traffic separate from data on access ports, ensuring security and quality of service, with Cisco switches auto-detecting phones via CDP or LLDP.

Configure data VLAN 20 as the access VLAN and set voice VLAN 120 on the same port, enabling IP phones to use the voice VLAN across switches.

Connect access points to switches and assign VLANs to guest and business traffic. Use a wireless LAN controller to enable roaming, tunnel traffic, and keep the IP address constant.

Examine the vlan trunking protocol (vtp) and its server, client, and transparent modes, how domain name sharing affects vlan information across switches, and why it remains rarely used.

Explore vtp modes: server creates and propagates VLANs, client learns them, and transparent relays updates; domain names are case sensitive and revision numbers track VLAN changes.

Configure VTP neighbors to propagate VLAN information by agreeing on a case-sensitive domain and version, secure with passwords, track revision numbers, update every five minutes, and push changes immediately.

Explore VTP versions, including version 1's defaults and version 3's extended and private lands, and learn how transparent mode and domain settings control VLAN propagation and security.

Explore how VTP distributes VLAN information across access and distribution switches, including domain name handling, revision numbers, and modes (server, client, transparent) that govern VLAN data storage in vlan.dat.

Learn how a switch can provide dhcp in small networks to automatically assign ip addresses to hosts, printers, and devices, reducing manual configuration and typos.

Configure a DHCP pool to allocate IPs within a subnet with a lease time, and use DHCP options to set gateway, DNS, and exclude certain addresses.

Explore dhcp client server negotiation: discover, offer, request, and acknowledgment, with pool inspection via show ip dhcp pool; learn dhcp relay using ip helper address across routers and subnets.

Explore DHCP bindings on switches and routers, view client id and MAC address, manually assign IPs via gui, and exclude addresses to keep a specific IP reserved.

Configure a switch as a dhcp server, create vlan 30, assign port 3 to it, and define a dhcp pool with network, default router, and dns options; verify bindings.

Review how the original DHCP discoverer relies on broadcast and how ip helper-address forwards broadcasts as unicast to the DHCP server across routers.

Explain how SLAAC (St. Louis automatic address configuration) lets each IPv6 host configure its own 64-bit host address within a 128-bit address, guided by router advertisements and noting security considerations.

Explore IPv6 basics with SLAAC, including link-local addresses, router advertisements, and 64-bit EUI-64 host identifiers. Learn how devices derive global addresses, gateways, and when DHCP supplies DNS and other options.

Learn how dhcp remains useful for ipv6 by delivering dns and tftp options to phones, wlc, and lightweight ap, and by enabling address ranges for easier troubleshooting.

Explain how IPv6 DHCP uses multicast instead of broadcast and introduce the solicitor and advertisement messages, plus request and confirmation to discover and configure a DHCP server with DNS settings.

Configure IPv6 on Cisco devices using stateless DHCP and router advertisements to obtain global unicast addresses while understanding link-local addresses, DHCP pools, DNS servers, and domain names.

Explore etherchannel, a link aggregation (lags) that bundles up to eight interfaces between switches into a single logical channel, delivering redundancy and improved throughput without spanning tree loops.

Understand how etherchannel protocols negotiate port channels between switches using link aggregation protocol or Cisco’s AGP, with active, passive, or static options, and match speed, duplex, mode, and native lands.

Configure ether channel by placing interfaces into a channel group on both switches, create a port channel template, and verify with show commands to confirm the channel is up.

Both ends must use the same port type and negotiate speed and duplex settings. They must share the same mode and VLAN, with trunk native VLAN matching on both sides.

Configure EtherChannel between two gigabit switches using interface ranges and a matching channel group, then set port-channel interfaces to trunk mode and verify with show commands.

Learn how EtherChannel load balancing distributes traffic across two gigabit links using an exclusive or decision, with options based on source or destination IP or MAC, and monitor performance.

Configure a port-channel load balancing policy on the switch by hashing traffic using destination IP or MAC, or source and destination IP/MAC, then monitor port-channel statistics to tune results.

Review the services of an iOS-based switch, including trunking between switches, access and trunk ports, VLAN trunking protocol, DHCP for IPv4 and IPv6 addresses, and etherchannel options.

Explore a variety of spanning tree options and learn how switches communicate to establish a loop-free topology.

Explore how spanning tree elects a root bridge and blocks redundant paths to prevent bridging loops, delivering a single path to the root while preserving redundancy.

Explore spanning tree types, from STP to rapid spanning tree and PVST/MST designs. See how these variants cut convergence from 50 seconds to 3–4 seconds and enable region bridges.

Discover how spanning tree elects a bridge, blocks a port to prevent loops, and uses BPDU timers—max age 20s, forward delay 15s—to converge in about 50 seconds.

Explore how bpdu elections select the root bridge using bridge id, port id, and path cost to determine blocking and convergence in switched networks.

Explore configuration BPDUs that form the spanning-tree topology and elect the root bridge, and topology change notification BPDUs that trigger convergence when a non-root bridge port fails.

Learn how the root bridge is elected by the eight-byte bridge id, combining priority and base mac address. Lower priority in vlan spanning tree guides traffic to the elected bridge.

Explain how switches elect the root bridge using bridge IDs and port IDs, compare path costs to select root and designated ports, and blocking on non-root bridges to prevent loops.

Explore how STP timers (max age, forwarding delay, BPDU timers) drive transitions from blocking to listening to learning to forwarding, ensuring loop-free bridges and learning the MAC address table.

Balance traffic by assigning VLANs to separate bridges (10,20,30 vs 40,50,60) and adjust bridge priority per VLAN using the 2-byte priority and 6-byte MAC.

This demo covers PVST and spanning-tree basics, identifies the root bridge, configures VLAN 1, 10, and 20, and shows how priorities, MAC addresses, and trunk ports influence path selection.

Learn to influence the root bridge election in switch networks by manually setting STP priority or using route primary and route secondary commands to design primary and backup bridges.

Learn how port cost and priority influence path selection in switching. Adjust cost or port priority to change the port ID and decide which link is blocking toward the root.

Adjust port cost to influence STP path manipulation, since cost wins over priority when determining the root and designated ports, with changes reflected from the advertising switch.

Demo with two switches and three links shows STP path manipulation: lowering a port priority to 64 changes which port forwards.

Explore STP convergence time, including default max age of 20 seconds, forwarding delay of 15 seconds, and BPDU intervals; lowering timers speeds convergence but may cause temporary loops if misapplied.

Explore rapid spanning tree port states in a two-switch topology, where designated ports forward, route ports forward, and alternate or backup ports discard traffic for rapid convergence.

Explore port states, edge ports, and link types (edge, shared, point-to-point) in spanning-tree networks. See how topology change notifications propagate via tcn bpdu to recalibrate paths to the root bridge.

Learn how rapid spanning tree improves convergence with tools like uplinkfast, backbonefast, and portfast across access, distribution, and edge ports, plus safety measures to prevent loops.

Explore spanning-tree security concepts, including BPDU guard, BPDU filter, root guard, and loop guard, and how they protect ports with PortFast from unauthorized bridges and loops.

Demonstrates uplink fast by quickly updating the CAM table across switches when a root port fails, flooding MAC addresses to establish a new designated path to the bridge.

Explore backbone fast convergence in Ethernet networks, detailing root ports, designated ports, blocking paths, and how switches exchange bridge protocol data units to maintain loop-free connectivity.

Configure the spanning tree uplink fast command globally on access layer switches; uplink fast is on by default and part of Rapide spanning tree.

Enable backbone fast on basically all switches with the global spanning tree backbone fast command to improve convergence in rapid spanning tree protocol, noting it is not on by default.

Apply PortFast on edge ports to forward instantly while enabling BPDU guard on those interfaces to prevent topology changes and loops caused by rogue switches or unauthorized devices.

Use bpdu filter on access ports to stop bpdu transmission, preventing unintended spanning-tree topology changes; avoid on links between switches while enabling globally with spanning-tree portfast bpdu-filter default.

Explore root guard in spanning tree to prevent unauthorized switches from becoming roots by validating bridge IDs and blocking misconfigured paths, preserving a stable topology.

Demonstrates configuring portfast and BPDU guard on switch access ports to prevent spanning-tree loops, with emphasis on edge ports and avoiding portfast on trunk links.

Explore unidirectional link problems in fiber between switches and how transmit and receive paths can fail directionally, with unidirectional link detection (ULD) restoring traffic by downing affected interfaces.

Enable loop guard on interfaces that connect to the bridge to prevent a port from forwarding when bpdu messages stop, blocking loops.

Enable unidirectional link detection on trunk ports as alternative to loop guard to mark interfaces down when a failure disrupts transmit or receive, and monitor SNMP traps for link failure.

Learn flex links as an alternative to spanning tree, providing primary and backup paths between two upstream switches with under 50 milliseconds convergence and cam table handover.

Implement flex links between access and distribution switches to provide active and backup paths, enabling traffic to stay up with a 50 ms failover and CAM table updates.

Learn how multiple spanning tree enables scalable switched networks by dividing them into regions with internal spanning trees and connecting regions via trunks with common region names and vlan tables.

Group switches into regions and run an internal spanning tree per region to elect regional bridges, then apply a common spanning tree across regions for a multiple spanning tree design.

Identify and elect a root bridge within each MST region, exchange BPDUs across regions, and use the extended system ID to derive the MST instance number for inter-region routing.

Explore mst concepts by examining spanning tree configurations and root bridge selection in a common spanning tree, and influence path selection using priority, port cost, and port IDs.

Identify edge ports and configure inter-switch links as trunks when migrating to MST, ensuring no pruning between instances. Design from core to access, grouping devices to map the topology effectively.

Review spanning tree concepts to prevent loops, including rapid spanning tree and multiple spanning tree, and explore flex links and udld for loop-free topologies with load balancing.

Explore inter-VLAN routing and moving traffic between broadcast domains, each with its own subnet, using routers or multilayer switches.

Learn how a single router interface can service multiple vlan by creating subinterfaces, using dot1q encapsulation, and configuring a trunk on the switch for inter-vlan routing.

Watch a hands-on router on a stick demo, creating VLANs on a switch, configuring sub interfaces on the router, and testing reachability with ping and trace route.

Assess the external router on a stick approach, noting easy configuration and trunk-link compatibility, but recognize its single point of failure and potential congestion and latency.

Explore a multilayer switch that combines switching and routing using switched virtual interfaces (SVIs) as VLAN gateways, enabling inter-VLAN routing between VLAN 10 and VLAN 20.

Configure a multilayer switch as the distribution core, create an SVI per VLAN (10, 20, 30), and use trunks to connect access switches for inter-subnet routing.

Convert a switch port on a multilayer switch to a layer 3 interface by disabling layer 2 port capabilities, enabling routing like a router interface.

Demonstrates setting up a multilayer switch with SVIs for VLAN 100 and 101, enabling inter-VLAN routing and static routes for internet access.

Configure a layer 3 svi on the access switch as the gateway. Assign an IP and enable routing with a default route or OSPF/EIGRP.

Identify the requirements for a switched virtual interface: configure the VLAN, assign at least one switch port to that VLAN, and enable the SVI with no shutdown to allow traffic.

Configure layer 3 etherchannel between switches, using up to eight identical ports. Aggregate ports into one port channel with a single IP, boosting bandwidth and simplifying routing.

Explore router on a stick with subinterfaces for each vlan, and multilayer switches with ip routing and layer 3 ports that have their own ip addresses.

Explore advanced switch configuration options for Cisco IP switched networks, including dealing with a.p and other critical settings to understand all options available to you.

Keep all network devices time-synced to aid troubleshooting and secure connections, preventing replay attacks by matching clocks within five minutes using NDP, a simple NTP variant, or manual setting.

learn how to manually set a switch clock with the clock set command, verify time with show clock, and enable service timestamps for logs, while considering network time protocol.

explore how ntp synchronizes a network device with a time server, understand stratum levels 1–16, and see how a stratum 1 clock can serve as an ntp server.

Learn how ntp uses stratum levels to build a time accuracy hierarchy, syncing devices from a stratum 1 clock to others within 30 seconds, staying within five minutes.

Explore NTP modes, including server mode that provides time to clients, client synchronization with a better stratum server, and the optional broadcast or multicast push.

Establish a hierarchical network time protocol with a stratum one or two time server, enabling routers and devices to synchronize locally and reduce wide-area traffic.

Configure ntp on Cisco devices to synchronize clocks with an ntp server, verify with show ntp associations and show ntp status, and adjust time zones and daylight saving.

Use a hierarchical NTP design with a single internal time server to synchronize many devices, reducing flat network bandwidth and avoiding external time services.

Secure NTP communications with authentication keys, MD5 hashing, and trusted keys to prevent time spoofing by rogue AP. Use access lists and serve-only options to limit NTP peers.

Compare NTP versions 3 and 4, highlighting why version 4 supports IPv6, improves security, and uses multicast time updates instead of broadcast to protect network time sources.

Learn about the simple network time protocol (sntp), a receive-only multicast time source for devices like tablets or phones, enabling automatic time sync when connected to a network.

Explore the simple network management protocol (SNMP) for remote network management, using polling with get requests, traps, and optional set operations, guided by the management information base.

version 2 adds bulk get requests, while version 3 encrypts the community string, shifts from des to aes, and introduces authentication, integrity checks, and views-based authorization.

Implement SNMP best practices by keeping read-only access, using views for least-privilege visibility, and enforcing version 3 with encryption and access lists to restrict managers.

Configure snmpv3 by creating an access control list that allows only the server IP. Define views, groups, and users, set up trap receivers, and enable interface index persistence.

Explore configuring SNMPv3 with enhanced security, including access lists, views, groups, users, privileges, and traps to control what monitors can access.

Cisco IP SLA tests network performance against service level agreements and proves contract compliance with test results to support planning before contracts, isolation, and verification of performance.

Document and test customer services with tests for jitter, round-trip latency, and packet loss along the network path. Use a responder to isolate issues and verify sla compliance.

Configure an IP SLA source to test from a Cisco device to a destination, which could be non-Cisco or Cisco, and configure both sides with a responder for measurement accuracy.

Explore how IP SLA tests measure jitter, latency, and packet loss in voice over IP, using ping and UDP/RTP samples to ensure 150 ms end-to-end delivery and seamless failover.

Demonstrates configuring IP SLA and SLA monitor between two Cisco routers, including setting up IP ICMP echo tests, selecting protocols, and scheduling tests to monitor network performance.

Measure network performance with a source and responder on the same AP server, computing round-trip time, latency, jitter, and packet loss using T-1 to T-4.

Record timestamps at T-2 and T-3 to compute delta and reveal latency, jitter, and loss, noting that a busy router may trigger quality of service adjustments instead of an SLA.

Configure an IP SLA responder to monitor jitter by sending 300 packets of 160 bytes to router 1. Start the monitor now and verify zero jitter and no losses.

Explore how switch SPAN copies traffic to a listening device for protocol analyzers and intrusion detection systems, enabling traffic analysis, troubleshooting, and real-time security alerts across networks.

Configure a span session to copy inbound traffic from a source port to a destination port for monitoring, troubleshooting, or malware protection using a local span configuration.

learn how to configure remote span by creating inbound and outbound sessions and copying traffic across a trunk port to another switch for a protocol analyzer, using a dedicated vlan.

Configure span by creating a session number, selecting source ports in vlan 10, and choosing an outbound egress port. You can run multiple span sessions at once.

Plan and configure RSPAN traffic across trunk links, associating the RSPAN source session with source ports and the RSPAN VLAN, then map the destination session to the destination port.

Discover Cisco stack wise and the virtual switch chassis, enabling multiple switches to operate as one, eliminate loops without spanning tree, and maximize port utilization with their own communication protocol.

Explore Cisco's stackwise that joins multiple switches into a single chassis, with a master switch pushing configurations to others via a backbone cable and a single management IP.

Explore how switch stacking creates a single high-speed fabric with a master switch and redundant backbone, enabling loop-free traffic forwarding across multiple line cards.

StackWise lets multiple switches operate as a single unit, enabling a second stack to communicate with the first, while EtherChannel provides high-speed, redundant links without loops or spanning tree concerns.

Explore switch supervision with Cisco supervisor engines in modular chassis, employing dual active and standby engines for continuous management and non-stop forwarding, with line cards for various interfaces.

Explore supervisor redundancy modes including PR, PR+, and SSO, showing standby takes over with minimal reinitialization, preserves existing FIB routes, and maintains routing with OSPF neighbors during failover.

Activate the virtual switch system (vss) to merge multiple chassis into one switch using the virtual switch link (vsl) protocol, with one active control plane and redundancy across data planes.

Discover how VSS provides a single management point and presents itself as a single switch, enabling resilience through chassis-stateful failover after various failures.

Explore advanced switch options, including NTP, SNMP, SPAN traffic copying, and stackwise VSS, to improve availability, security, and performance while maximizing interface use and reducing spanning tree reliance.

Explore Cisco's first hop redundancy protocols (FHRP), comparing different redundancy options to ensure continuous communication at the network edge and maintain reliable connectivity.

Explore why FHRP is needed by examining two multilayer switches acting as a single gateway, ensuring a backup path when a link fails and clients have a single default gateway.

Explore how primary and backup switches use a virtual router to provide redundancy at the distribution layer, via FHRP protocols like hot standby routing protocol and gateway load balancing.

Map the standard distribution-layer topology of multilayer switches and implement HSRP and VRP to provide high-availability first-hop redundancy, ensuring connectivity despite link or switch failures.

Use HSRP to create a virtual router with two switches sharing a virtual IP as the default gateway, using standby group and priority and gratuitous ARP for failover.

Demonstrates configuring HSRP across two routers, creating standby groups, assigning a virtual IP, enabling preemption, adjusting priorities, and verifying failover and basic load sharing with ping tests.

Describe how HSRP preemption allows a restored active router to reclaim the role, discuss failover and failback consequences, hold time, and stability when devices differ.

Explore how routers transition to standby or active in HSRP, starting from the initial state, through listening and speaking phases to elect a standby and an active router.

Configure hsrp state transitions on two routers, moving from initial to listen to speak, then assign active and standby roles by priority, enabling failover and preempt when interfaces change.

Explore how STP and HSRP govern layer 2 and layer 3 topologies and why aligning the HSRP active gateway with the root bridge prevents suboptimal paths.

Learn how two distribution layer switches share load by having one active and one standby router per VLAN, such as VLAN 10 and VLAN 20, though not true load balancing.

Learn how interface tracking with HSRP enables high availability across multi-layer switches by monitoring the northbound interface and IP SLA pings to trigger a takeover.

Configure IP SLA to track an address with echo requests every five seconds, starting now and running indefinitely, using SLA 10 on interface to adjust priorities if the test fails.

Demonstrates configuring interface tracking to trigger HSRP failover and maintain router 3's connectivity through router 5, using ping tests and IP SLA to measure packet loss.

Learn how to define tracking objectives for interfaces connected to routers and use IP SLA objects to monitor remote addresses, so standby routers take over when outages occur.

Explore srp-based authentication between routers, using clear text or md5 hash of the password so routers verify one another and exchange messages, guarding against rogue routers hijacking the network.

Learn how HSRP timers control failover after missed hello messages, using default one-second intervals or faster like 200 ms, with a three-miss rule, aligned to OSPF or EIGRP convergence.

HSRP versions compare version 1 and version 2, with version 2 adding IPv6 support, larger standby groups up to 4095, and updated virtual MAC, multicast, and virtual IP addressing.

Learn VRRP, a non proprietary routing redundancy protocol used across vendors, with a master and multiple backups sharing a virtual IP, advertising hello messages every second via multicast 224.0.0.18.

this lecture explains vrp with a virtual router, master, and backups that take over by priority, using group values 1 to 255 and noting brp minor differences.

Configure BRP/VRRP to create backup routers with virtual IPs, assign priorities and preempt, and test failover by tracking interfaces to keep traffic continuous.

Understand VRRP settings, priority ranges from 1 to 254 (default 100), with preemption on by default, and compare with HSRP’s group and standby command rules, including no group 0.

Explore VRRP authentication options, including a plain text password or an empty hash, and note that future open standards may remove authentication, while Cisco routers continue to support VRRP authentication.

Explore VRRP tracking by monitoring objects such as line protocol status, IP routes, and IP SLA objects, so the master router can lower its priority and backups take over.

Examine how Cisco ip switched networks use active and standby routers with master and backups, BRP and SRP, and compare virtual ip versus real ip addressing.

Introduce GLBP, a Cisco proprietary gateway load balancing protocol where all routers in a group forward traffic, delivering load balancing without extra administrative overhead via a virtual IP and MAC.

Explore GLBP roles: the active virtual gateway manages virtual MAC addresses and responses, while up to four active virtual forwarders back it up for failover and load balancing.

Designate the highest-priority router as the AEG in GLBP election, with others as AVFs backups. Enable preemption on the AEG; it's off by default.

Explore how glbp uses a virtual ip (10.1.1.1) and per-router virtual macs to balance client traffic via round-robin or weighted distributions, adapting to link failures.

Analyze traffic types to determine the GLBP load sharing method, including weighted load balancing, host dependent load balancing, and the default round robin, with participating devices rotating through.

Examine the first hop redundancy protocol, where two routers share duties—one forwards while the other takes over; note nearly identical protocols including the Cisco proprietary brp as an open standard.

Identify essential layer 2 security settings to prevent lower-level compromise and protect the entire switched network from takeover.

Examine how attackers escalate from layer 1 to layer 2 and how layer 2 defenses, including transparent firewalls and host-based intrusion detection, guard against spoofing and rogue DHCP.

Secure the access layer (layer 2) to prevent malware and external remote access from compromising the network. Shut down unused switches and guard against physical access and external threats.

Learn best practices for securing switch and router access: use enable secret and strong console passwords, encrypt passwords, implement AAA, and disable insecure web and telnet access.

Enhance switch security by using SNMPv3 with encryption, avoiding plain text credentials and deprecated v1/v2. Disable unused ports and discovery protocols like CDP/LLDP to prevent information leakage and topology changes.

Explore how rogue devices such as switches and bridges can alter topologies, cause suboptimal paths, and enable traffic interception, while rogue wireless access points and insecure hubs threaten network security.

Examine layer 2 switch attacks such as MAC flooding, trunking issues, and ARP spoofing, and learn how to mitigate them by enabling security options and securing management access.

MAC flooding floods the CAM table with thousands of MAC addresses, exhausting switch memory and purging legitimate entries, causing the switch to broadcast to all ports and enabling attacker eavesdropping.

Port security stops mac floods by limiting maximum learned mac addresses on a switch port and shutting the port down on violation with an air disable state, preventing rogue devices.

Learn how to configure port security on a switch to limit MAC addresses on a port, test violations with a hub, and understand shut down behavior and sticky MAC.

Explore how port errors cause port shutdowns, and how spanning tree protections, port fast, and route guard prevent topology changes, duplex mismatches, and link flapping in switched networks.

Configure a port-based ACL on switch interfaces to filter inbound traffic by IP or MAC, without affecting control packets; use preferred mode or merge mode to manage interactions.

Explore storm control on switch ports, using failing rate and rising threshold to manage unicast, multicast, and broadcast traffic, with ports shutting down or SNMP traps sent to management.

Explore storm control on a switch interface by configuring broadcast, multicast, and unicast levels with actions such as shutdown or trap, and analyze traffic to prevent outages.

Explore the triple-A framework—authentication, authorization, and accounting—and how centralized servers like radius or tacacs+ with Active Directory enable flexible, scalable remote access and single sign-on.

Explain the three authentication factors—something you know, something you have, and something you are—and implement AAA with RADIUS or TACACS, including a local fallback.

Explore how radius and tacacs+ authenticate and authorize users, comparing their security and command-level control, with the switch or router as the authenticator contacting the authentication server.

Compare TACACS and radius AAA models, noting separate authentication, authorization, and accounting in TACACS, and radius's emphasis on accounting and password encryption; discuss challenge-response and diameter as improvements.

The lecture explains how a switch and a radius server authenticate users via a challenge and response, then handle accept or reject, session start, and accounting.

This lecture demonstrates configuring a radius server with AAA, creating a radius host, key, and server group, and establishing a fallback to a local username for secure authentication.

Radius has limitations in multi-protocol and multi-vendor environments, with reduced flexibility for AAA; TACACS+ separates authentication, authorization, and accounting for faster, more flexible network access.

Verify every connection with 802.1x and a radius or tacacs+ server, assign users to network segments, and provide guest internet access based on authentication.

Explore how 802.1x port-based access control authenticates devices on switch ports using radius, with the switch acting as authenticator and assigning the proper view after authorization.

Shut down access ports by default and require 802.1x authentication for any device. The switch asks 'who are you', verifies credentials with a radius server, and enforces authorization and segmentation.

Configure 802.1X on iOS devices by enabling dot1x, specifying radius server IPs (including backups), and applying port-based authentication to challenge each device with credentials.

Show how dhcp spoofing with a rogue dhcp server can assign a malicious gateway, letting an attacker intercept traffic, record data, and cause denial of service.

Explore DHCP snooping on Cisco switches, identify the real DHCP server and the traffic path, and enforce trusted ports to allow DHCP traffic while dropping on untrusted ports.

Learn how DHCP snooping builds a switch table that maps IP addresses to MAC addresses and ports, enabling verification of traffic and dropping mismatched packets on untrusted ports.

Explore ARP spoofing with gratuitous ARP demonstrations that redirect victim traffic to a rogue gateway, revealing how switches update MAC tables and why same-segment exposure matters.

Learn how dynamic ARP inspection uses the DHCP snooping database to validate ARP traffic, block gratuitous ARPs on untrusted ports, and protect networks with trusted interfaces.

Learn to prevent switch spoofing by statically defining port roles and disabling dynamic trunking protocol, ensuring access ports remain access and trunks aren’t negotiated.

VLAN hopping demonstrates using a double tagged frame to move from VLAN 10 to VLAN 20 across a trunk; fix by renaming the native VLAN and filtering the tag.

Explore VACLs, LAN access lists using access maps to match traffic and permit or deny it, applied to a VLAN to control inbound and outbound traffic by IP or MAC.

explain how pvlan architectures isolate dmz traffic using isolated, community, and promiscuous ports and map them to a trunked global vlan 100 for controlled inter-port communication.

Explore PVLAN port types: promiscuous, isolated, and community, and how isolated ports talk only to promiscuous ports, while community ports talk among themselves and with promiscuous ports on same subnet.

Learn how protected ports isolate communication between themselves while still allowing interaction with non-protected ports in Cisco switched networks.

Explore layer 2 security on switches, including port security, DHCP snooping, dynamic ARP inspection, private VLANs, and both port-based and VLAN-based access control lists.

Master campus network design from layer 2 fundamentals through layer 3 routing, including VLANs, routed ports, router-on-a-stick, SVIs, spanning-tree options, high availability, and protection against layer 2 attacks.