Majorbacon's Breakdown on Spanning Tree Protocol and Variants Part 1: The Problem

First, the Problem

Spanning Tree Protocol is one answer to a specific problem that occurs at a layer 1 & 2 levels - redundant connections between switches cause problems!

No Redundancy, No Problems



Now we've added a redundant connection enabling multiple paths for switch to switch communication

If a broadcast is sent out it will flood normally, but it will eventually also enter through the "back door" of the original switch that forwarded the broadcast, acting like a "new" message that needs further flooding, causing infinite flooding (remember this is layer 2, there is no time to live on a frame)

Worse yet, the broadcast actually went out both directions at the beginning of the flood, which means we actually have two broadcasts circulating the network infinitely!

The results of the unmanaged switching loop includes:

• Broadcast storms - no room for valid traffic - packets will keep getting forwarded until the switches run out of memory and start dropping frames.
  
• MAC Table Instability - remember that the source MAC address of a packet is used to update the switch's MAC address table - this means that eventually the first switch, the one connected to the broadcasting Server, will eventually believe that the server is attached to one of the other switches, since it will receive a broadcast from them with the Server's MAC address listed at the source. The switch will lose track of its own devices!
  
• Redundant Frames - both broadcasts and unicasts may be received multiple times by destination endpoints, bogging down intermediate services like TCP and higher level application services

So now we know the problem... see the Spanning Tree Protocol and Variants Part 2 to start seeing the solution!

Resetting your Cisco Router Password via ROMMON

How to perform password recovery on your Cisco IOS router

Here's the tools you will need
1) Router/Switch
2) Rollover cable
3) Terminal Emulator Program such as Tera Term or Putty
4) Knowledge of Register values

1. Connect the rollover cable's RJ-45 interface to your device and the serial or USB interface into to your computer



Picture thanks to: https://es.wikibooks.org/wiki/Planificaci%C3%B3n_y_Administraci%C3%B3n_de_Redes/Tema_6/Texto_complete

2. Fire up your terminal emulator
3. Connect to the appropriate COM port (remember the appropriate serial settings)

• 9600 baud rate
• No parity
• 8 data bits
• 1 stop bit
• No flow control
4. Reboot the Router
5. Send the break signal to the Router - the keystroke to signal break varies by terminal emulator
• PUTTY: Ctrl + Break
• Tera Term: Alt + B
• The List: http://www.cisco.com/c/en/us/support/docs/routers/10000-series-routers/12818-61.html
6. The break signal drops you into ROMMON mode instead of booting the IOS in this low level mode (kind of like booting to BIOS/CMOS on a desktop) you get different options such as configuring the boot register (like changing the boot order or hardware in BIOS)
7. To tell the system to boot normally, except without loading the startup configuration type:
• ROMMON>confreg 0x2142
8. To reboot type:
• ROMMON>reset
9. When the system boots you may be prompted to configure setup using the prompts - if so type:
• no
10. You have an un-configured system - log on by typing:
• Router#enable
11. Now load your startup configuration by typing:
• Router#copy start run
• (DO NOT DO THE OPPOSITE (copy run start) OR YOU WILL LOSE THE STARTUP CONFIG!!!)
• Yes, I did that once. Thank God for TFTP backups.
12. Now your configuration has loaded but you're already in, without having to have typed the official password! Sneaky! Now you can set the password to access privileged mode by typing:
• Router#conf t
• Router(config)#enable secret <enter your secret here>
13. Reset the device to boot normally instead of skipping the startup config by typing:
• Router(config)#config-register 0x2102 
• Router(config)#end
14. Backup your current configuration to survive rebooting by typing:
• Router#copy run start
• (if you type the opposite you will lose all your hard work and it will revert to the unknown secret)
15. Reboot the device to prove correct configuration and trigger all interfaces to return to an up / up status by typing
• Router#Reload

And that's how I get into all those systems where no one knows the password because it was set by a contractor who emailed the password to the guy who quit six months ago!

Hope it helps!

Cisco Spanning Tree Portfast and BPDUGuard

There are two powerful tools available for those of us (the majority I believe) that are still relying on Spanning Tree Protocol (STP) for our switch loop protection. They are Portfast! and BPDUGuard! (Don't the sound impressive with those exclamation points?)

Portfast!

Enabling PortFast on a switchport skips the listening and learning states when a device is plugged in (you know, that annoying wait time with the amber light?). From an STP perspective the port is set to a forwarding state immediately, This works out great for most accessthat are trustworthy to be connected only to a single device such as a server or workstation

Here are a couple of key commands related to basic portfast:

To globally set PortFast on all NON-Trunking ports:
Switch (config)#spanning-tree portfast default

To locally set PortFast on a particular interface:
Switch (config-if)#spanning-tree portfast

BPDUGuard!

PortFast is designed for access ports that do not receive Switch to Switch BPDU packets from STP. It is possible to have non-trunking ports that connect two switches, however, which can then cause spanning tree loops. With BPDUGuard enabled on top of PortFast the receipt of a BPDU packet over a PortFast interface triggers the port to move into an err-disabled state instead of configuring the port in an STP blocking port configuration which would look like this:
Switch#show interfaces gigabitethernet 1/1 status
Port    Name               Status       Vlan       Duplex  Speed Type

Gi1/1                      err-disabled 100          full   1000 1000BaseSX

This security measure then leads a network administrator to either:
a) unplug the switch from this port and move it to a correct port
b) change the port to a trunking port rather than an access port so that STP can function normally

 Here are a couple of key commands related to basic BPDUGuard:

To globally set BPDUGuard on all NON-Trunking ports:
Switch (config)#spanning-tree portfast bpduguard default

To locally set BPDUGuard on a particular interface:
Switch (config-if)#spanning-tree bpduguard enable

To recover from the err-disabled state:
Switch(config-if)#spanning-tree portfast disable

TestTakers!

1. Note the similarities and differences between the PortFast and BPDUGuard commands
2. Consider the order in which you would set them (Portfast first!)
3. Recognize Err-Disabled as a possibly a BPDUGuard issue

Err-Disabled triggers include:

• BPDU guard violation
• Duplex mismatch
• Port channel misconfiguration
• UniDirectional Link Detection (UDLD) condition
• Late-collision detection
• Link-flap detection
• Security violation
• Port Aggregation Protocol (PAgP) flap
• Layer 2 Tunneling Protocol (L2TP) guard
• DHCP snooping rate-limit
• Incorrect GBIC / Small Form-Factor Pluggable (SFP) module or cable
• Address Resolution Protocol (ARP) inspection
• Inline power

 Hope that keeps it all straight in your head!

Understanding Recursive Lookups in Cisco routing tables

First, the term "Recursive"

While recursion can just refer generically to repetition, the term in Information Systems and Technology contexts almost always refers to using a tool to enable the use of the same tool. Think of using a mirror to reflect a mirror (an example of infinite recursion).
Examples: 

1) A DNS server receives a DNS query for which it doesn't know the answer. It performs recursion by sending it's own DNS query to root DNS server to discover the answer for the client.

• DNS uses DNS to answer DNS.

2) In a Microsoft SQL database server there is a database called Master that is recursively used by SQL to find and reference the high level properties of all the other attached databases that are used by end-users.

• SQL uses SQL to manage SQL.

Now for understanding Cisco routing recursion:

A Recursive lookup refers to routes for which the router must look up the connected route to a next-hop gateway in order to route the packet to its ultimate destination.

• The Router uses Routes to 
• a) find the next router in the route path and 
• b) to Route to the next Router

This is because in a routing table the gateway for a routed network can be defined as an interface or as an IP address.

Using an interface works great when the router is referring to directly connected routes like this:
Router4#show ip route
Gateway of last resort is not set

     172.16.0.0/30 is subnetted, 1 subnets
C       172.16.100.0 is directly connected, Serial0/0
C    192.168.1.0/24 is directly connected, FastEthernet0/0 

or to point-to-point links in which there is only one possible intended destination:

Router5(config)#ip route 192.168.0.0 255.255.0.0 se 0/0
Router5(config)#end
%SYS-5-CONFIG_I: Configured from console by console
Router5#show ip route

Gateway of last resort is not set

     172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C       172.16.1.0/24 is directly connected, FastEthernet0/0
C       172.16.100.0/30 is directly connected, Serial0/0
S    192.168.0.0/16 is directly connected, Serial0/0

However, routes that reference an endpoint on multi-access networks like Ethernet or Frame Relay need a logical destination, since the physical interface could connect to many devices. This is where we see our standard routing entries that indicate an IP address as the gateway value:

Router4(config)#ip route 172.16.1.0 255.255.255.0 172.16.100.1
Router4(config)#end
%SYS-5-CONFIG_I: Configured from console by console
Router4#show ip route

Gateway of last resort is not set

     172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
S       172.16.1.0/24 [1/0] via 172.16.100.1
C       172.16.100.0/30 is directly connected, Serial0/0
C    192.168.1.0/24 is directly connected, FastEthernet0/0

So now you need to think like a router
1) You receive an incoming packet destined for 172.16.1.5
2) You find that the best route is the static route 172.16.1.0/24 (remember to always choose the longest subnet mask / slash notation that is a match)
3) You discover the gateway for that route is 172.16.100.1
4) As a router, you have multiple interfaces. Which one should you use to contact 172.16.100.1?
5) You look up 172.16.100.1 in the routing table
6) You find that the best route is the connected route 172.16.100.0/30
7) You forward the packet over the Serial 0/0 interface

You just used your routing table to figure out how to route the packet to the gateway you found in your routing table - Recursion!!!

Test Tip: Watch out for how this could apply to a gateway of last resort - your 0.0.0.0/0 route!

Hope this helps clear things up for everyone!