Boson Flashcards
Difference between ‘switchport port-security violation [protect/shutdown/restrict]’. What is the default violation mode?
They all discard unauthorized traffic
Protect: only discards
Restrict and Shutdown: logs unauthorized entry and increments SecurityViolation counter
Restrict: sends SNMP trap
Shutdown: places port in err-disabled state (effectively shuts down port)
Which FHRP protocol is specified in RFC5798 ?
VRRP
What occurs when you enable UplinkFast on a switch?
What does UplinkFast do?
Port costs increase by 3000
If enabled on a switch with bridge priority less than 49152, the bridge priority is changed to 49152, if already greater the bridge priority remains at the higher value
UplinkFast increases convergence speed for an access layer switch that detects a failure on the root port
What is the default switch bridge priority and which bridge is most likely to become the root bridge?
32768 and the switch with the lowest bridge priority
Which commands or command sets will reset a port that has been shut down by UDLD?
- ‘udld reset‘
- ‘errdisable recovery cause udld’
- ‘no udld enable’, then ‘udld port’ or ‘udld aggressive’
- ‘no udld port’, then ‘udld port’ or ‘udld port aggressive’
- ‘shutdown’, then ‘no shutdown’
UDLD monitors a link to verify that both ends of the link are functioning
What traffic is untagged in regards to VLANs?
Native VLANs are untagged
What are PVLANs (private VLANs) for and what are they consisted of?
Helps isolate traffic within a VLAN
They include a primary VLAN and one or more secondary VLANs
What’s the difference between a host that connects to an isolated VLAN and a host connected to a community VLAN?
Host connected to an isolated VLAN can communicate with only the primary VLAN
A host connected to community VLAN can communicate with other hosts associated with the community VLAN as well as with the primary VLAN
Enable 802.1x port-based authentication
‘aaa new-model’
‘aaa authentication dot1q’
‘dot1x system-with-control’ (globally enables 802.1x on switch)
‘dot1x port-control {force-authorized/force-unauthorized/auto}’
Configure router to use EIGRP for AS 2
ip routing
router eigrp 2
An interface that should participate in EIGRP must have an IP address assigned
Which ports will Portfast be enabled if you issue the ‘spanning-tree portfast default’ command?
The command enabled Portfast by default on all access ports, trunk ports are not affected
What command makes an interface an access port?
‘switchport mode access’
How do you enable PortFast on individual ports?
‘spanning-tree portfast’
Name all the different ‘port-channel load-balance [~~~]’ commands. What are they used for? What is the default?
- ‘port-channel load-balance dst-mac’ : configures the EthernetChannel to loss balance based on the destination MAC address
- ‘port-channel load-balance src-ip’ : configures the EthernetChannel to loss balance based on the source IP address
- ‘port-channel load-balance dst-ip ’ : configures the EthernetChannel to loss balance based on the destination IP address
- ‘port-channel load-balance src-dst-mac’ : configures the EthernetChannel to loss balance based on the source and destination MAC addresses
- ‘port-channel load-balance src-dst-ip’ : configures the EthernetChannel to loss balance based on the source and IP addresses
‘port-channel load-balance src-mac’ is the default (load balancing based on source MAC address), issuing this command is the same as issuing ‘no port-channel load-balance’
What does ‘mac address-table static 000c.bacb.100d. vlan 10 drop’ do?
This filters frames in VLAN 10 with a source or destination MAC address of 000c.bacb.100d
Command provides a convenient method for implementing unicast MAC address filtering on a Cisco switch
What does ‘switchport port-security’ do?
Enables security features for a single switch interface
Interface with port security configured will shut down if the max number of allowed MAC addresses is learned on the interface
What does ‘switchport mode dynamic auto’ do?
Allows a neighbor port to determine whether a link should become a trunk
What does ‘switchport host’
Macro command used to enable Portfast while disabling EtherChannel
What does ‘switchport mode access’
Configures a port to carry information for a single VLAN
What is a VSS? What is required when configuring a VSS? What does the VSS consist of?
VSS (Virtual Switching System) is a Cisco proprietary technique to create a single logical switch out of two physical switches
Supervisor type and IOS version must be identical on each physical device. One of the supervisors is active, and the other is designated as hot-standby; the active supervisor manages the control plane.
What is PAgP?
A link aggregation protocol that creates and maintains adjacencies in a VSS. Especially when the VSS enters dual active recovery mode
What is VSLP?
Framework that provides for the creation and maintenance of a VSL link
Virtual Switch Link (VSL). A VSL facilitates communication between two switches. Within the VSS, one chassis supervisor is designated as active and the other as hot-standby.
A protocol that helps in providing for the creation and maintenance of the link between switches in a VSS configuration
Consists of LMP and RRP
What is RRP?
Registry Registrar Protocol. Determines the role of each member in the VSS
A protocol that helps in providing for the creation and maintenance of the link between switches in a VSS configuration
Which command can you issue to determine the native VLAN configured on a neighboring Cisco switch?
show cdp neighbors detail
You plan to add a TACACS+ server to SwitchA. You want vty connection attempts on SwitchA to be authenticated by the TACACS+ server. You will assign the TACACS+ server the 192.168.1.100 IP address, and you will use ‘boson’ as the encryption key.
Configure SwitchA with the following parameters.
- Configure AAA on the switch
- Configure the TACACS+ server parameters on the switch
- Create an authentication list named ‘primary’ that configures the TACACS+ server as the authentication method for users who remotely log in to the switch
- Configure the first vty lines to use the ‘primary’ authentication list
SwitchA(config)#aaa new-model
SwitchA(config)#tacacs-server host 192.168.1.100
SwitchA(config)#tacacs-server key boson
SwitchA(config)#aaa authentication login primary group tacacs+
SwitchA(config)#line vty 0 4
SwitchA(config-line)#login authentication primary
What are the prefixes for the following? Give the 10th group of each
- IPv4 VRRP virtual MAC address
- IPv6 VRRP virtual MAC address
- HSRPv1 virtual MAC address
- HSRPv2 virtual MAC address
- IPv4 VRRP virtual MAC address: 0000.5E00.01~~
- IPv6 VRRP virtual MAC address: 0000.5E00.02~~
- HSRPv1 virtual MAC address: 0000.0C07.AC~~
- HSRPv2 virtual MAC address: 0000.0C9F.F~~~
10th group of each
- IPv4 VRRP virtual MAC address: 0000.5E00.01 0A
- IPv6 VRRP virtual MAC address: 0000.5E00.02 0A
- HSRPv1 virtual MAC address: 0000.0C07.AC 0A
- HSRPv2 virtual MAC address: 0000.0C9F.F 00A
What is the default max # of devices that can connect to an interface with ‘switchport port-security’? What command can change that and to what?
1
‘switchport port-security maximum [value]’
value can be from [1] to [132]
How do you enable 802.1x authentication globally on a switch?
‘dot1x system-auth-control’
How do you enable 802.1x authentication on a single interface?
‘authentication port-control’
What are the 3 modes of 802.1x authentication on a single interface? What does each do?
auto, force-authorized, force-unauthorized
Auto: Any device connected to the port must undergo the authorization process before gaining access to the network
Force-authorized: any device connected to an 802.1x enabled port is automatically authorized and granted access to the network
Force-unauthorized: any connected device is automatically unauthorized and denied from accessing the network
What does ‘authentication host-mode multi-host’ do?
Used to prepare a single port to accept traffic from multiple hosts
What command restores the default 802.1x parameters on a device?
‘dot1x default’
What does a GLBP do and what does the group consist of? How is everything in a GLBP group elected?
Gateway Load Balancing Protocol feature provides automatic router backup for IP hosts configured with a single default gateway
Members of a GLBP group elect one gateway to be the active virtual gateway (AVG) for that group. Other group members provide backup for the AVG in the event that the AVG becomes unavailable.
AVG (active virtual gateway) is elected based on which router is configured with the highest priority value…or highest IP address value if multiple routers are configured with the same high priority value
2nd highest priority is elected as SVG (standby virtual gateway)
Typically AVG and SVG function as AVFs within the group
Only AVG responds to ARP queries
What is the order of the election for the stackmaster? How do you change the priority?
- Switch with the highest priority is elected stack master.
- If many switches have same priority, switch with nondefault saved config is elected stack master
- Then other complex criteria (check notes)
‘switch [stack-id] priority [value]’
What is changed when a frame is encapsulated with an 802.1Q tag?
The original FCS
It needs to be recalculated
Which standards natively include PortFast, UplinkFast, and BackboneFast? Which standard can use them but does not include natively?
- 1w (RSTP)
802. 1D(STP)
How else can you call RSTP, STP, and MST?
- 1w (RSTP)
- 1D (STP)
- 1s (MST), Multiple Spanning Tree
What is the default priority value of a switch that has been configured with a Multiple Spanning Tree (MST) instance?
32768
What does ‘spanning-tree mst [instance #] root primary’ command do?
Configure local switch priority to a value that will ensure local switch will become new root for MST instance. Default is 24576, but will configure value 4096 less than the current root priority value
What does ‘spanning-tree mst [instance #] root secondary do?
Ensures switch is second lowest priority value. By default, configures switch to priority 28672. Lowest becomes root
What are the compatible modes for the channel groups in each switch to create a functional EtherChannel link? For PAgP and LACP, explain differences. How do you check what mode it’s in?
For PAgP (Cisco proprietary): Switch A and B have to be in desirable mode or auto mode. Desirable can be with both auto or desirable. Auto and auto pair don’t work.
For LACP (IEEE Standards): Switch A and B have to be in active mode or passive mode. Active can be with both active or passive. Passive and passive pair doesn’t work.
Image on iPad
‘show etherchannel summary’
Name all DTP configurations. Determine which switch port setting pairs make up a trunk or access interface.
What command changes the switch port mode setting.
‘switchport mode [~~~]’
Trunk [‘trunk’]: will only create trunk with any pair, except access (will make limited connectivity)
Dynamic desirable[‘desirable’]: will only crate trunk with all pairs except access (will make port access interface, nontrunking.)
Access [‘access’]: port is placed in nontrunking no matter the neighbor port pair
Dynamic auto [‘auto’]: put in trunk if pair is dynamic desirable or trunk. Place in access if dynamic auto (same) or access.
Image in IPad
What command will place port in a mode where the port does not transmit DTP frames? How would you create a trunk if the command is configured?
‘switchport nonegotiate’
To make trunk, the neighboring port must be set manually
What’s the DTP configuration recommended by Cisco?
desirable-desirable
What is the default switch port mode setting for DTP?
dynamic desirable
What are the 3 VTP(VLAN Trunking Protocol) modes and how do you configure? What is the default? What are the differences?
VTP server mode, VTP client mode, VTP transparent mode
‘vtp mode [server/client/transparent]’
‘vtp domain [‘domain-name’]’
VTP server mode is default
Switches in VTP server mode or VTP client mode will synchronize info with other VTP server mode and VTP client mode switches in the same VTP domain. You can modify VLAN and VTP configuration info on switches in VTP server mode.
Changes in a VTP server mode switch will propagate to other VTP server mode or client mode switches in VTP domain
Switches in VTP transparent mode do not participate in VTP synchronization but does forward VTP advertisements
What are the commands to set root bridge and secondary bridge?
‘spanning-tree vlan [primary/secondary] root’
What kind of connection is needed between two ports for VTP to work?
Trunk port connection
What is the default VTP domain name for a switch?
NULL
What parameters must be met so that VTP servers and VTP clients can synchronize information over VTP?
VTP domain name, VTP password, VTP version
What is the default native VLAN?
1
Difference between 802.1Q and ISL?
802.1Q is IEEE. ISL(inter-switch link) is Cisco proprietary
How do you know when VLANs are being pruned in ‘show interfaces trunk’?
VLANs that are listed under the ‘vlans allowed and active in management domain’ section BUT not listed under ‘Vlans in spanning tree forwarding state and not pruned’ section are either pruned or blocked by STP
What are the 3 main components involved in EAP authentication? What does each do?
The supplicant: EAP-capable client, such as a user workstation
-Sends authentication credentials to an authenticator
Authenticator: an access switch
-Forwards authentication credentials to an authentication server
Authentication server: a RADIUS server
-Verifies the credentials using either a local or a remote user database
What are all the ‘show ip dhcp snooping’ commands and what do they show?
‘show ip dhcp snooping’: displays general info about the DHCP snooping config on a switch, such as virtual LANs for which DHCP snooping is enabled and the trusted state of each interface
‘show ip dhcp snooping binding’: shows the dynamic entries in the binding table, you can see the ‘lease (sec)’
‘show ip dhcp snooping statistics’: displays statistical info regarding the number of frames that have been forwarded or dropped by the DHCP snooping config on a switch
‘show ip dhcp snooping database’: displays status of the DHCP snooping binding table agent and statistics regarding the status of the binding table, such as the URL where the binding table can be found and how many successful writes have been committed to the table
IPad has the output screenshots
What are the Hash Values on each port in an EtherChannel bundle? What # of links in an EtherChannel bundle is most likely to result in an unequal distribution of traffic?
2 ports, 4:4 3 ports, 3:3:2 4 ports, 2:2:2:2 5 ports, 2:2:2:1:1 6 ports, 2:2:1:1:1:1 7 ports, 2:1:1:1:1:1:1 8 ports, 1:1:1:1:1:1:1:1
Six
What is monitored by default on a SPAN source port?
What does SPAN do?
Both egress and ingress traffic
SPAN enables you to monitor traffic on a switch by configuring 1 or more ports in 1 or more VLANs on the switch as the source port and a single port on the switch as the destination port. Traffic that arrives on the source ports is copied to the destination port for analysis
What are the 4 parameters defined by IEEE that should be considered when optimizing STP timers? What does each do and what are the recommended max values?
Transit halt delay: defines max amount of time required to transition a port to the blocking state after the STP algorithm has determined that the port should be blocked
-Max value = 1 sec
Bridge transit delay: defines the amount of time between a switch receiving and then sending the same frame (single frame)
-Max value= 1 sec
BPDU transmission delay: defines the amount of time between a switch receiving and then sending a BPDU
-Max value=1 sec
Medium access delay: the amount of time between the switch CPU making a forwarding decision and the frame physically leaving the switch
-Max vlaue=.5 sec
What are the three tunk encapsulation modes?
ISL, Dot1q, Negotiate
What addresses do CDP (Cisco Discovery Protocol), LLDP(Link Layer Discovery Protocol) and PVST+(Per-VLAN Spanning Tree Plus) use to send advertisements?
CDP, 01:00:0C:CC:CC:CC
LLDP, 01:80:C2:00:00:00, 01:80:C2:00:00:03, 01:80:C2:00:00:0E (used exclusively, others used on older versions)
PVST+, 01:00:0C:CC:CC:CD [for VLANs other than 1] and 01:80:C2:00:00:00 [for VLAN 1]
Which frames does 802.1Q encapsulation add a tag to? How many bits?
32 bits -or- 4 bytes to every frame except frames on the native VLAN
What is the default VTP domain name?
NULL
What command configures a switch to tag traffic from all VLANs, including the native VLAN?
vlan dot1q tag native
What command is issued from interface configuration mode to manually prune VLANs? What does it do?
- swithcport trunk allowed vlan{add/all/except/remove [‘vlan-list’/all/none]}
- specifies which VLANs are allowed or denied on a trunk port
By default which VLANs are allowed over a trunk?
All VLANs
How do you apply a VLAN access control list (VACL) named ‘blurb’ to VLAN 1
‘vlan filter blurb vlan-list 1’
What must happen so that two switches can successfully establish an EtherChannel link?
Both switches must be configured with matching aggregation protocols [pagp/lacp]
What are all the different SDM templates and how do you change them? What is the default SDM template?
sdm prefer [~~]
Access—maximizes system resources for access control lists (ACLs) to accommodate a large number of ACLs.
Default—gives balance to all functions.
Routing—maximizes system resources for IPv4 unicast routing, decreases the number of unicast MAC addresses, but increases the number of indirect, unicast routes
VLAN—disables routing and supports the maximum number of unicast MAC addresses. It would typically be selected for a Layer 2 switch.
How do you verify SDM templates?
show sdm prefer
On which ports should the root guard feature of STP be enabled on a switch?
Ports connected to switches that should not become the root
On which ports should the root guard feature of STP be enabled on a switch? What is the config to enable root guard on port?
Ports connected to switches that should not become the root
‘spanning-tree root guard’
What does ‘standby 1 track fa0/2 15’ do if configured on interface Fa0/1 ln R1?
Configure the HSRP priority for router R1 to decrease or increase by 15 when Fa0/2 goes down or comes back up. If 15 was not specified, the default would be 10.
What happens if R2 has preempt enabled?
If R1 was the active router and the priority went below that of R2s, then R2 will send coup message and assume active router role. This happens in an HSRP standby group
