Archive for May, 2011
Lightweight AP – DHCP Configuration
Just some findings on lightweight access points, and configuration of DHCP pools. DHCP is used to tell the LAPs what the wireless controller(s) ap-mgmt address is on boot up.
Option 60 is specified in a DHCP discover packet by lightweight APs requesting an IP address, it’s used to tell the server what type of device it is, for example a client may set option 60 to ‘Cisco AP c1140’.
The DHCP server can be configured to provide additional options in a DHCP offer packet, only to those client’s that need it. In this case, if option 60 is ‘Cisco AP c1140’, the server will return option 43, which has the address of the wlc ap-mgmt interface IP addresses in hex format.
! ip dhcp pool ap_manager network 128.58.172.128 255.255.255.224 default-router 128.58.172.129 dns-server 192.23.23.192 192.23.23.193 # Identifies type of device option 60 ascii "Cisco AP c1140" # Specifies IP of WLC controllers 192.168.10.5|192.168.10.20 option 43 hex f108c0a80a05c0a80a14 domain-name eur.slb.net lease 8 !
The hex value is made up as follows:
f1 = 0xf1 (type)
08= 0x8 (total number of octets in both IP addresses 2×4)
c0a80a05=192168105 (first IP)
c0a80a14=1921681020 (second IP)
It should be noted that there is a bug on 3750 switches running 12.2(46)SE which prevents option 60 from being specified. “% Invalid input detected at ‘^’ marker.” is returned because there is a space in the text ‘Cisco AP c1140’. To resolve this change to a different version of code.
Read Full Post | Make a Comment ( None so far )Making IP Helper (UDP forwarding) HSRP Aware
This scenario involves multiple gateway routers using first-hop redundancy protocols like HSRP. The routers are using IP helper commands to forward DHCP requests to a central server, however the server is receiving many DHCP requests from the same client, as shown below:
dhcpserver#sh log | i through relay *Mar 1 00:20:41.291: DHCPD: DHCPDISCOVER received from client 0063.6973.636f.2d63 through relay 192.168.1.2 *Mar 1 00:20:43.819: DHCPD: DHCPDISCOVER received from client 0063.6973.636f.2d63 through relay 192.168.1.3
It must be understood that DHCP discover packets are broadcast, and thus received and forwarded by all routers configured with IP helper addresses. To prevent all routers from forwarding the request, the solution is to only allow the active HSRP router to do this.
Below is overall topology:
Configuration for R1:
interface FastEthernet0/0 ip address 192.168.1.2 255.255.255.0 ip helper-address 10.1.1.1 redundancy HSRP-Data duplex auto speed auto standby 10 ip 192.168.1.1 standby 10 preempt standby 10 name HRSP-Data
Configuration for R2:
interface FastEthernet0/0 ip address 192.168.1.3 255.255.255.0 ip helper-address 10.1.1.1 redundancy HSRP-Data duplex auto speed auto stand 10 ip 192.168.1.1 standby 10 priority 90 standby 10 preempt standby 10 name HSRP-Data
By linking the IP helper command to HSRP ‘ip helper-address 10.1.1.1 redundancy HSRP-Data’ it is now able to track the HSRP state. The IP helper redundancy name must match the HSRP name, in this case ‘HSRP-Data’. Now when the DHCP client requests an IP configuration, it can be observed that only the active HSRP router replies:
dhcpserver#sh log | i through relay *Mar 1 00:20:41.291: DHCPD: DHCPDISCOVER received from client 0063.6973.636f.2d63 through relay 192.168.1.2Read Full Post | Make a Comment ( None so far )
802.1Q (Q-In-Q) Tunnelling
Commonly used by service providers when providing L2 products, 802.1Q tunnel (aka Q-in-Q) can be used to allow multiple customers to trunk multiple VLANs over the service providers switched infrastructure. As a customer you can trunk your existing vlan numbering scheme, the VLAN tag you select is transparent to the service provider as they apply and use their own additional tag to identify you.
On receipt of a frame from the customer, the SP adds a second tag, in this case ’55’ , the ID must be unique for each customer. After potentially traversing multiple SP switches the second tag is removed on egress to the respective customer. Refer to this link to see a packet capture highlighting the two 802.1Q headers.
To configure, the first step is to increase the switch system MTU by 4 bytes in order to accomodate the additional tag:
system mtu 1504
Secondly, to avoid potential clashing of customer and provider native untagged vlans, enable tagging of the native vlan:
vlan tag dot1q native
Enable dot1q tunnel on the customer facing interface, and L2 protocol tunnelling
! interface FastEthernet0/16 description SWP | Customer 1 Site switchport access vlan 55 switchport mode dot1q-tunnel l2protocol-tunnel cdp l2protocol-tunnel stp l2protocol-tunnel vtp no cdp enable !
Interconnections between the providers switchs are configured as trunk links, in this case permitting VLAN 55 for customer 1.
Layer 2 protocol tunnel (not to be confused with L2 tunnelling protocol) has been activated on the interface. This feature provides the customer with transparency between their sites, they see their remote switches in CDP, VTP information can be propagated across their WAN along with STP information. It looks like the sites are directly connected, despite the providers switches being in the switching path.
As you can see below the CDP, VTP and STP information is fowarded over the providers infrastructure:
S1#show l2protocol-tunnel
Port Protocol Shutdown Drop Encapsulation Decapsulation Drop
Threshold Threshold Counter Counter Counter
---------- -------- --------- --------- ------------- ------------- -------------
Fa0/16 cdp ---- ---- 40 38 0
stp ---- ---- 5139 596 0
vtp ---- ---- 7 3 0
Read Full Post | Make a Comment ( None so far )
Disabling DHCP client default route
If you do not wish for your router to install the default route it receives when DHCP client is enabled on an interface, use the command below to raise the AD so it’s not entered into RIB. This is useful if you are using dynamic routing on a WAN interface, and want to use object tracking to detect lack of default routing.
! interface FastEthernet0/0 description WAN LINK bandwidth 1000000 ip dhcp client default-router distance 255 ip address dhcpRead Full Post | Make a Comment ( None so far )
Ethernet – Collisions
Interfaces operate at half-duplex when connected to a shared ethernet segment (collision domain).
When an inteface in half-duplex mode is receiving a frame, it may buffer a frame being transmitted at the same time. This will be displayed as a deferred frame when looking at the interface statistics.
Auto speed/duplex negotiation is the default, to deactivate it you can manually set speed/duplex. Speed must be set before duplex otherwise an error is displayed.
If auto-negotiation is disabled on one end, the Cisco switch will default to half duplex for 10/100M, and full duplex for 1G.
Read Full Post | Make a Comment ( None so far )
Technical Notes 