Lessons · Network switches · Quick reference
Network switches quick reference
98 topics, one line each, in the order Hone teaches them.
Hone is a place to practise programming. This sheet is the whole Network switches track at a glance: every idea it covers, in the order they are taught, one line each. It is a map rather than a lesson. Read opens the full explanation of an idea; Practise gives you a question on it. Both are free, and reading needs no account at all.
Run a switch, start to finish · Get to the prompt
what a switch doesA switch learns which device is on which port, then sends each frame only to the port that device is on. Read: What a switch is actually doing · Practise what a switch does
console accessA switch out of the box has no IP address, so the first session is always through the console socket with a cable and a terminal program. Read: Getting a screen on it · Practise console access
the mode stackUser mode can look at a little, privileged mode can look at everything, and configuration mode is the only place anything can be changed. Read: Three rooms, and the door between them · Practise the mode stack
reading the promptThe text before the cursor names the switch and the mode: CORE1> is user, CORE1# is privileged, CORE1(config)# is configuration, and CORE1(config-if)# is inside one interface. Read: The prompt is telling you where you are · Practise reading the prompt
? asks the switchA question mark at any point lists what may come next, with a one-line description of each. Read: The switch will tell you what it accepts · Practise ? asks the switch
abbreviating commandsYou may shorten any keyword to a prefix, as long as only one keyword in that position starts with it. Read: Type less, and know exactly when you cannot · Practise abbreviating commands
Run a switch, start to finish · Make the switch yours
naming the switchhostname sets the name in the prompt, and the prompt is what tells you which switch you are logged into. Read: Name the box · Practise naming the switch
port descriptionsdescription writes a line of free text onto one interface, and it appears in the configuration and in `show interfaces status`. Read: Label the port · Practise port descriptions
the running configshow running-config prints the switch's current settings as the commands that would recreate them. Read: The configuration is a document you can read · Practise the running config
saving the configurationThe running configuration lives in memory and is lost on a reboot; write memory copies it to the startup configuration, which survives. Read: Running is not saved · Practise saving the configuration
backing it upThe startup configuration is a copy on the same box; a real backup is the text of the running configuration kept somewhere else. Read: Keep a copy where the switch is not · Practise backing it up
the enable secretenable secret sets the password that guards privileged mode, and it is stored hashed rather than in plain text. Read: A password on the way in · Practise the enable secret
Run a switch, start to finish · Split it into VLANs
what a VLAN isA VLAN is a number that splits one physical switch into separate networks, and ports in different VLANs cannot talk to each other through the switch. Read: One switch, several networks · Practise what a VLAN is
broadcast domainsA VLAN is one broadcast domain: a broadcast sent by a device in VLAN 20 reaches every port in VLAN 20 and no port outside it. Read: What a VLAN actually separates · Practise broadcast domains
creating a VLAN`vlan <number>` in global configuration creates it and opens VLAN configuration mode, where `name` gives it a label. Read: Making a VLAN · Practise creating a VLAN
access portsAn access port belongs to exactly one VLAN: `switchport mode access` says it carries one, and `switchport access vlan <n>` says which. Read: Putting a port in a VLAN · Practise access ports
reading the VLAN table`show vlan brief` lists every VLAN with its number, its name, and every access port in it. Read: Reading the VLAN table · Practise reading the VLAN table
the VLAN that made itselfPutting a port into a VLAN that does not exist creates it, with a default name, and the switch tells you it did. Read: The VLAN that made itself · Practise the VLAN that made itself
a port in the wrong VLANA port in the wrong VLAN behaves exactly like a broken cable: link light on, no addresses, nothing reachable. Read: The desk that cannot see the server · Practise a port in the wrong VLAN
Run a switch, start to finish · Reach it over the network
the management interfaceThe management address lives on a virtual interface named after a VLAN, `interface vlan 1`, not on any physical port. Read: A switch does not have an IP address, a VLAN does · Practise the management interface
the management address`ip address <address> <mask>` on the VLAN interface sets where the switch answers, and the mask has to match the rest of that network. Read: Giving it an address · Practise the management address
the default gateway`ip default-gateway` tells the switch where to send replies that are going outside its own subnet. Read: Reaching it from another subnet · Practise the default gateway
shut and no shut`shutdown` disables a port until somebody types `no shutdown`, and until then it will not pass traffic whatever is plugged into it. Read: A port that is administratively down · Practise shut and no shut
making it reachableAn address on a VLAN interface, a default gateway, a port in that VLAN that is up, and a saved configuration. Miss any one and it is a console-only box. Read: The four things that make a switch reachable · Practise making it reachable
SSH instead of telnetSSH encrypts the session; telnet does not. Setting SSH up needs a hostname, a domain name, a key, a local user and the vty lines told to accept ssh only. Read: Telnet sends your password across the network in the clear · Practise SSH instead of telnet
Run a switch, start to finish · Carry VLANs between switches
trunksA trunk port carries traffic for many VLANs down one cable, by writing the VLAN number into each frame as it leaves. Read: One cable, every VLAN · Practise trunks
802.1Q tagging802.1Q inserts four bytes after the source address: 0x8100 to say a tag follows, then three bits of priority, one drop-eligible bit, and twelve bits of VLAN id. Read: The four bytes that carry the VLAN · Practise 802.1Q tagging
the 1 to 4094 rangeThe tag has twelve bits for the VLAN id, so 0 through 4095 fit, but 0 means priority only and 4095 is reserved: the usable range is 1 to 4094. Read: 1 to 4094, and not 4096 · Practise the 1 to 4094 range
VLAN 1Every port is in VLAN 1 out of the box, and control traffic uses it, so leaving user devices there mixes management with everything else. Read: VLAN 1 is not a good place to live · Practise VLAN 1
the native VLANA trunk tags every VLAN except its native one, which crosses the link with no tag at all. Read: The one VLAN on a trunk that goes untagged · Practise the native VLAN
the allowed VLAN list`switchport trunk allowed vlan` lists the VLANs a trunk carries; without it, a trunk carries all of them. Read: Let across only what belongs · Practise the allowed VLAN list
a native VLAN mismatchIf the two ends of a trunk have different native VLANs, untagged traffic leaves one VLAN and arrives in another, and both switches think they are correct. Read: Two switches disagreeing, quietly · Practise a native VLAN mismatch
a trunk that is not trunkingA port configured as a trunk still needs the far end to agree, the cable to be right, and the port not to be shut, before any VLAN crosses it. Read: The trunk that is not trunking · Practise a trunk that is not trunking
Run a switch, start to finish · Keep it up and keep it safe
the MAC address tableThe MAC address table maps each address the switch has heard to the port it was heard on, and it is built entirely from traffic that has already arrived. Read: What the switch has learned · Practise the MAC address table
flooding the unknownA frame for an address the switch has never heard is sent out of every port in that VLAN except the one it arrived on. Read: What it does when it has not learned yet · Practise flooding the unknown
portfastSpanning tree holds a new port in listening and learning before forwarding; portfast skips that on a port with a single device on it. Read: Thirty seconds of nothing, on every desk · Practise portfast
BPDU guardBPDU guard shuts a port down the moment it receives a spanning tree message, because a desk port should never hear one. Read: The port that must never see another switch · Practise BPDU guard
port securityPort security limits how many MAC addresses a port will accept, and says what to do when a different one appears. Read: One address per desk · Practise port security
auditing a switchFour screens tell you almost everything about a switch you have never seen: the configuration, the VLAN table, the port status and the management address. Read: Reading a switch you did not configure · Practise auditing a switch
Run a switch, start to finish · Look after the software
the switch's flashFlash is the switch's storage: the software image lives there, and `dir flash:` lists what is on it with the free space at the bottom. Read: The switch has a disk, and it can fill up · Practise the switch's flash
the software imageThe image is the switch's operating system, and its name says the platform, the feature set and the version. Read: What the .bin file actually is · Practise the software image
which image it boots`boot system flash:<image>` names the image the switch loads next time. Without it, it boots the first valid one it finds. Read: Telling it which image to boot · Practise which image it boots
upgrading the softwareCheck the space, copy the image, name it in a boot system line, save, then reload. Five steps, and the order is not a preference. Read: An upgrade, in the order the steps depend on each other · Practise upgrading the software
reloading`reload` restarts the switch. It comes back as its startup configuration, so anything in the running configuration that was not saved is gone. Read: Restarting, and what that costs · Practise reloading
backing up to a server`copy running-config tftp://<server>/<name>` sends the live configuration to a server as a text file. Source first, destination second, always. Read: A copy of the configuration that is not on the switch · Practise backing up to a server
erasing the configuration`erase startup-config` empties NVRAM, and the reload after it brings the switch up with defaults. Read: Back to how it came out of the box · Practise erasing the configuration
password recoveryThe configuration register decides whether the startup configuration is read at boot. 0x2142 skips it; 0x2102 is normal. Read: Getting back into a switch nobody has the password for · Practise password recovery
Run a switch, start to finish · On the plant floor
Allen-Bradley StratixStratix managed switches were developed with Cisco and run an IOS derivative, so the commands you know are the commands they take. Read: Allen-Bradley Stratix, and why Cisco knowledge carries over · Practise Allen-Bradley Stratix
EtherNet/IPEtherNet/IP carries CIP messages over standard Ethernet and IP. The IP stands for Industrial Protocol, and the network underneath is the one you already know. Read: EtherNet/IP is ordinary Ethernet · Practise EtherNet/IP
VLANs for a cellThe cell gets its own VLAN, with one controlled way in and out, so office traffic can never reach it and its own traffic never leaves. Read: Designing VLANs for a production cell · Practise VLANs for a cell
IGMP snoopingIGMP snooping listens to join messages and forwards multicast only to the ports that asked for it. Without it, a switch floods multicast like a broadcast. Read: Multicast, and the switch that knows who asked · Practise IGMP snooping
industrial ring topologiesA ring gives every device two paths. One port is blocked so the ring is not a loop, and it is unblocked in milliseconds when a cable breaks. Read: Why the plant floor is wired in a ring · Practise industrial ring topologies
voice VLANsA voice VLAN sits alongside the access VLAN on the SAME access port: the phone tags its own traffic and passes the PC's through untagged. Read: A phone and a PC on one socket · Practise voice VLANs
duplex and speedAuto-negotiation needs a partner. Fix one end and leave the other on auto, and the auto end falls back to half duplex: the link comes up and runs badly. Read: The link that works badly rather than failing · Practise duplex and speed
power over EthernetA PoE port supplies power as well as data, so a phone, a camera or an access point needs no socket at the far end. Read: Power down the same cable · Practise power over Ethernet
fibre linksCopper stops at about 100 metres and carries an electrical path between the two ends. Fibre carries light, so it goes kilometres and joins nothing electrically. Read: Why the link between buildings is fibre · Practise fibre links
Replace a switch without breaking anything · Before the box comes out
why a switch gets replacedA configuration backup, taken off the switch and read, is the only part of a swap that cannot be improvised on the night. Read: The one thing that has to exist before the box comes out · Practise why a switch gets replaced
the part number and the serial`show inventory` prints the part number and the serial number, and the serial is what a warranty replacement is raised against. Read: The serial nobody can reconstruct later · Practise the part number and the serial
what every port was doing`show interfaces status` is one line per port -- description, link, VLAN, duplex, speed -- and printed before a swap it becomes the check afterwards. Read: What every port was doing, before you unplug it · Practise what every port was doing
what is on the other endCDP reports the devices directly connected to this switch as those devices describe themselves; LLDP is the vendor-neutral equivalent. Read: What is on the other end of the cable · Practise what is on the other end
being able to go backA configured switch on a bench is a five-minute recovery; an erased one is a rebuild. It goes when the replacement has held for a week. Read: The old switch is the rollback · Practise being able to go back
Replace a switch without breaking anything · What a backup does and does not carry
copy, source firstEvery `copy` on a switch reads the first argument and writes the second. Source first, destination second, everywhere in IOS. Read: copy FROM TO, and there are no exceptions · Practise copy, source first
a backup you have readThe copy reporting bytes is a fact about the transfer. Whether the file is the configuration is a different question, and opening it is the answer. Read: A backup you have not read is a filename · Practise a backup you have read
what a backup leaves behindA configuration carries what was typed. It does not carry the crypto key, the software image, or the VLAN database -- none of which were typed. Read: What a backup leaves behind · Practise what a backup leaves behind
VLANs live outside the configIn the default VTP mode a switch keeps its VLANs in vlan.dat on flash -- not in the running configuration, and not in NVRAM. Read: The VLAN database is not part of the configuration · Practise VLANs live outside the config
server, client, transparentThe VTP mode decides where a switch keeps its VLANs: transparent puts them in the running configuration, server and client keep them in vlan.dat. Read: Server, client, transparent · Practise server, client, transparent
the secrets that do not travelPassword hashes and usernames are lines in the configuration and come across. The crypto key is not a line and does not. Read: The secrets that travel, and the one that does not · Practise the secrets that do not travel
Replace a switch without breaking anything · Putting it on the new one
the order a restore goes inSaving is the last step of a swap, and it is last on purpose: until you write it, a reload is a free undo. Read: Check, restore, verify, then save · Practise the order a restore goes in
the lines that did not takeA restore is parsed line by line, and every line the parser refuses is printed as it goes. The byte count says nothing about them. Read: The lines that did not take · Practise the lines that did not take
a config that does not fit the boxA port the chassis does not have is not a port, and the line naming it is refused -- whether the mismatch is the count or the interface names. Read: A configuration that does not fit the box · Practise a config that does not fit the box
two boxes, one addressThe management address is in the configuration, so a restored replacement has the address the old box still has if the old box is still on. Read: Two boxes, one address · Practise two boxes, one address
putting the VLAN names backAfter a restore in the default mode the VLANs exist as numbers with default names, because a port assignment creates them and the name was never in the file. Read: Putting the VLAN names back · Practise putting the VLAN names back
Replace a switch without breaking anything · Proving it works
checking the VLANs came out rightA restored port asks for its VLAN and the switch creates it on the spot, named VLAN0030. The number came back. The name never left the old box. Read: Check the VLANs, because they are what is missing · Practise checking the VLANs came out right
checking every port came back`show interfaces status` puts link state and VLAN side by side, one row per port. Printed before the swap, it is the only before-and-after you have. Read: Line by line against the paper · Practise checking every port came back
checking you can still get inYou are typing down a serial cable. It would work if every network setting on the box were wrong, which is exactly why it proves nothing about SSH. Read: The console cannot prove remote access · Practise checking you can still get in
saving it, lastEverything you have done lives in memory. The switch boots from a different file, and until you copy one onto the other, a reload undoes the whole evening. Read: Save last, and mean it · Practise saving it, last
wiping the one that is leaving`erase startup-config` clears NVRAM. The VLAN database is not in NVRAM -- it is a file on flash -- so it survives an erase and leaves with the box. Read: Two files, in two places · Practise wiping the one that is leaving
Replace a switch without breaking anything · In a corporate closet
an office closet, not a plant floorPeople and their devices move; a machine stays where it was bolted. So an office port is configured for a role and a plant port for one specific thing. Read: A desk port and a machine port are configured for different lives · Practise an office closet, not a plant floor
the phone and the PC on one portThe phone tags its own traffic with the voice VLAN and passes the PC's through untagged. One port, one cable, two devices. Read: One cable, two VLANs · Practise the phone and the PC on one port
where a desk gets its addressA PC asks, and the request travels out of the VLAN its port is in to a server somewhere else. The switch's whole contribution is which VLAN that is. Read: The switch does not hand out addresses · Practise where a desk gets its address
the port that asks who you are802.1X makes the port carry nothing until the device proves who it is. The port-level lines restore like any others. What the authentication server knows about the OLD switch does not. Read: The configuration arrives; the identity does not · Practise the port that asks who you are
the ticket and the windowA ticket has two audiences: the people whose ports go dark tonight, and whoever opens this closet in six months wondering what changed. Read: The serials are the part nobody can reconstruct · Practise the ticket and the window
Replace a switch without breaking anything · Remembering any of it
copy FROM TO, source firstEvery copy command on a switch is source first, destination second. Four commands you will use constantly are the same rule read left to right. Read: copy FROM TO, with no exceptions · Practise copy FROM TO, source first
the switch will tell you`?` works at every prompt and after any half-typed command, and it answers for the switch in front of you rather than for the one somebody wrote a cheat sheet about. Read: Ask the box · Practise the switch will tell you
the four questions at any consoleWhere am I. What has this box got. What did I change. Did I save it. Nearly every moment of confusion at a console is one of those four, unasked. Read: Four questions answer almost everything · Practise the four questions at any console
looking without leavingEvery mode has its own vocabulary, so a show command inside a port is not a wrong command -- it is a command from another room. `do` runs it there and puts you back. Read: do: one command somewhere else, and back · Practise looking without leaving
finding one line in three hundredThe pipe filters the output of a command. `include` keeps matching lines, `exclude` drops them, `begin` starts from the first match, `section` gives you a line plus the block indented under it. Read: Filter it, and mind the capital letters · Practise finding one line in three hundred
what you leave for the next personA configuration has no comments to leave a reason in. Everything about why tonight went the way it did lives in a note or it lives nowhere. Read: The note is the only history a switch has · Practise what you leave for the next person
More
building one outA switch going into service needs a name, its VLANs, its ports assigned, its uplink trunked, an address to manage it, and a save. In that order. Read: Building a switch out from nothing · Practise building one out
err-disabled portsQuestions on Hone; no lesson yet. Practise err-disabled ports
spotting a loopQuestions on Hone; no lesson yet. Practise spotting a loop
MAC ageingQuestions on Hone; no lesson yet. Practise MAC ageing
a flapping addressQuestions on Hone; no lesson yet. Practise a flapping address
moving a port between VLANsSetting the access VLAN again replaces the old one; there is nothing to remove first. Read: Moving a port from one VLAN to another · Practise moving a port between VLANs
topology changesQuestions on Hone; no lesson yet. Practise topology changes
the root bridgeQuestions on Hone; no lesson yet. Practise the root bridge
why spanning tree existsQuestions on Hone; no lesson yet. Practise why spanning tree exists
trunk or accessWhat is on the other end decides it. Another switch or a device that understands VLANs gets a trunk; anything else gets an access port. Read: Trunk or access: the decision, not the command · Practise trunk or access