Cisco Catalyst Series Switch 2940 Manual

1
© 2003 Cisco Systems, Inc. All rights reserved.
Session Number
Presentation_ID
Cisco Catalyst 2940 Series Switches
Smartports Macros
March 8, 2004

222
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Smartports Global Configuration
Cisco Catalyst 2940 Series
! VTP Transparent mode is current Best Practice
vtp domain [smartports]
vtp mode transparent
! Enable aggressive mode UDLD on all fiber uplinks
udld aggressive
! Enable Rapid PVST+ and Loopguard
spanning-tree mode rapid-pvst
spanning-tree loopguard default
spanning-tree extend system-id

333
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Technical Whys
Global Configuration
•udld aggressive
Software backup to GBIC hardware features
Helps prevent spanning tree issues
•spanning-tree mode rapid-pvst
Enable 802.1w per VLAN Spanning Tree
Allows quicker convergence times
•spanning-tree loopguard default
Helps prevent errant spanning tree loops
•spanning-tree extend system-id
Allows for VLAN IDs greater than 1024

444
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Smartports Cisco IOS Standard Desktop
Cisco Catalyst 2940 Series
! Reset all end-station interfaces to default configuration (global command)
default interface range FastEthernet0/[1 – 8]
! Basic interface - Enable data VLAN only
interface range FastEthernet0/[1 – 8]
switchport access vlan $AVID
switchport mode access
! Enable port security limiting port to a single MAC addresses.
! Ensure age is greater than one minute and use inactivity timer
switchport port-security
! “Port-security maximum 1” is the default and will not
! Show up in the config
switchport port-security violation restrict
switchport port-security aging time 2
switchport port-security aging type inactivity
! Configure port as an edge network port
spanning-tree portfast
spanning-tree bpduguard enable
! Remark all inbound data packets with COS=0
mls qos cos override

555
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Technical Whys
Desktop Configuration
•switchport port-security
Turn on port level MAC address security
•switchport port-security maximum 1 (or 3 for phones)
If port security is turned on, the default number of allowed MAC addresses is 1. For an IP phone, we need 3 – one for
the workstation, one for the phone on the voice VLAN and one for the phone on the native VLAN for Cisco® Discovery
Protocol.
•switchport port-security aging type inactivity
“Unlearn” MAC addresses once they have not been used for a while. The type of “inactivity” is needed for Cisco
Discovery Protocol from IP phones to be stable. During the MAC relearn process, packets can become out-of-order or
dropped. Using type “inactivity” helps prevent this after a MAC address is learned – especially for voice traffic.
•switchport port-security aging time 2
Two minutes is the shortest time possible and not have keep-alive problems with Cisco Discovery Protocol.
Also, IP phones do not signal the switch when a workstation is unplugged. Without specifying an aging time, the MAC
address would never age out.
•switchport port-security violation restrict
Do not take the port down when a violation occurs. Instead, allow the MAC addresses that we have already seen to
continue working. All other traffic is dropped. Necessary with IP phones.
•default interface
Used to return the interface to a known configuration state

666
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Technical Whys
Desktop Configuration (continued)
•spanning-tree portfast
This allows the port to pass traffic soon after the port
becomes active – without waiting for spanning tree (~3 sec)
•spanning-tree bpduguard enable
Disable the port if a switch or bridge is attached to this
port. Inhibits errant network topologies and rogue
switches.

777
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Smartports Cisco IOS Standard Desktop with IP Phone
Cisco Catalyst 2940 Series
! Reset all end-station interfaces to default configuration (global command)
default interface range FastEthernet0/[1 – 8]
! VoIP enabled interface - Enable voice (VVID) and data VLAN
interface range FastEthernet0/[1 - 48]
switchport access vlan $AVID
switchport mode access
switchport voice vlan $VVID
! Enable port security limiting port to 3 MAC addresses. Ensure age is
! greater than one minute and use inactivity timer
switchport port-security
switchport port-security maximum 3
switchport port-security violation restrict
switchport port-security aging time 2
switchport port-security aging type inactivity
! Enable qos to extend trust to attached Cisco phone
mls qos trust device cisco-phone
! Configure port as an edge network port
spanning-tree portfast
spanning-tree bpduguard enable

888
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Smartports Cisco IOS Switch Uplink
Cisco Catalyst 2940 Series
! Reset all uplink interfaces to default configuration (global command)
default interface GigabitEthernet0/1
! Uplink to Distribution
default interface GigabitEthernet0/1
! Define unique Native VLAN on trunk ports
switchport trunk encapsulation dot1q
switchport trunk native vlan $NVID
#switchport trunk allowed vlan (VRANGE) #commented out to show capability
! Hardcode trunk and disable negotiation to speed up convergence
switchport mode trunk
switchport nonegotiate
! Configure qos to trust this interface
mls qos trust cos
! 802.1w defines the link as pt-pt for rapid convergence
spanning-tree link-type point-to-point

999
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Technical Whys
Cisco IOS Switch Uplink
•switchport nonegotiate
This command speeds up convergence times but if issued
before both sides of the trunk have been configured for
802.1q can cause the port to shut down. The default trunk
type is ISL on many switches. When the trunk is up and
configured for 802.1q, the “switchport nonegotiate” can
safely be entered
•switchport trunk allowed VLAN [data,voice,native]
This provides absolute control over which VLANs this
switch will accept.

101010
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Recommended Configuration on Directly
Connected Uplink Switch for Cisco Switch Macro
interface FastEthernet0/1
switchport trunk encapsulation dot1q
switchport trunk native vlan 20
switchport mode trunk
mls qos trust cos
auto qos voip trust
macro description cisco-switch
spanning-tree link-type point-to-point

111111
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Smartports Cisco IOS Router Uplink
Cisco Catalyst 2940 Series
! Reset router uplink interface to default configuration (global command)
default interface FastEthernet0/[1]
! Branch Router Uplink
interface FastEthernet0/[1]
! Define unique Native VLAN on trunk ports
switchport trunk encapsulation dot1q
switchport trunk native vlan $NVID
#switchport trunk allowed vlan (VRANGE) #commented out to show capability
! Hardcode trunk and disable negotiation to speed up convergence
switchport mode trunk
switchport nonegotiate
! Configure qos to trust this interface
mls qos trust cos
! Ensure fast access to the network when enabling the interface.
! Ensure that switch devices cannot become active on the interface.
spanning-tree portfast
spanning-tree bpduguard enable

121212
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Recommended Configuration on Directly
Connected Uplink Router for Cisco Router Macro
interface FastEthernet0/1
no ip address
no ip proxy-arp
load-interval 30
full-duplex
!
interface FastEthernet0/1.110
description Voice-VLAN
encapsulation dot1Q 109
ip address 10.6.9.129 255.255.255.192
service-policy output output-L3-to-L2
!
interface FastEthernet0/1.510
description Data-VLAN
encapsulation dot1Q 509
ip address 10.6.9.1 255.255.255.128
service-policy output output-L3-to-L2
•This configuration is based on an access
switch connection to a branch router
configured for data and voice vlans.
class-map match-all MEDIA
match ip dscp 14
class-map match-all VOICE
match ip dscp 46
class-map match-all CALL-CONTROL
match ip dscp 26
class-map match-all MISSION-CRITICAL
match ip dscp 18
!
policy-map output-L3-to-L2
class VOICE
set cos 5
class CALL-CONTROL
set cos 3
class MISSION-CRITICAL
set cos 2
class MEDIA
set cos 1

131313
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Cisco Catalyst 2940 Series Global Macro Caveats
•Example of global macro application
Switch(config-if-range)# macro global apply cisco-global
•vtp domain [smartports]
There is a user interface to configure this. This is
applied by using the ‘macro global apply cisco-global
[smartports] <domain>
•VLANs should be predefined before any templates are
applied because some templates will add in VLANs, some
will not.

141414
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Cisco Catalyst 2940 Series Desktop and
Macro Application Caveats
•Example of cisco-desktop macro application:
Switch(config)#interface range f0/1 - 48
Switch(config-if-range)#macro apply cisco-desktop $AVID 2
% Access VLAN does not exist. Creating vlan 2
%Warning: portfast should only be enabled on ports connected to a single
host. Connecting hubs, concentrators, switches, bridges, etc... to this
interface when portfast is enabled, can cause temporary bridging loops.
Use with CAUTION
%Portfast will be configured in 48 interfaces due to the range command
but will only have effect when the interfaces are in a non-trunking mode.
•‘Command ?’ is available for applying macros. Meaning of each $ value is shown in help text.
•When multiple macros are overlaid or applied to the same interface, the ‘macro description’ shows
each overlaid macro name. This is for good use in macro application history and debugging
assistance.
interface FastEthernet0/1
macro description cisco-desktop | cisco-desktop | cisco-phone
•The command “switchport port-security maximum 1” listed in the cisco-desktop macro will NOT show
up in the running config, and is a default condition.
•VLAN’s should be pre-defined before any templates are applied because some templates will create
VLAN’s, some will not.

151515
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Cisco Catalyst 2940 Series Desktop with IP
Phone Macro Application Caveats
•Example of cisco-phone macro application:
Switch(config)#interface range f0/1 - 48
Switch(config-if-range)#macro apply cisco-phone $AVID 2 $VVID 3
•The same warnings from IOS that were displayed for the desktop macro are not standard across all
platforms. This appears to come from interaction between autoqos and vlan commands being applied
at the same time. It does not have a negative affect upon the operation of macro application.
•The VVID is NOT created by default much like the $AVID is on deploying the desktop profile. This
needs to be documented. VLAN’s should be pre-defined before any templates are applied because
some templates will create VLAN’s, some will not.
•‘Command ?’ is available for applying macros. Meaning of each $ value is shown in help text.

161616
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Cisco Catalyst 2940 Series Uplink Macro
Application Caveats
•Example of cisco-switch macro application
Switch(config)#interface g0/1
Switch(config-if-range)#macro apply cisco-switch $NVID 999
•switchport trunk allowed vlan VRANGE – This command is currently commented in the code but
remains to show capability. However, it is recommended for trunk configuration. If this command is
not included, then spanning-tree loops could occur. Most notably on VLAN1. Changing the native
VLAN will mitigate this threat somewhat, but that is only assuming there is not already a mismatch
across the link.
•There is a plan for the commands shown on this slide to be incorporated in mid-2004.
•VLANs should be predefined before any templates are applied because some templates will create
VLANs, some will not.

171717
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID
Cisco Catalyst 2940 Series Router Uplink
Macro Application Caveats
•Example of cisco-switch macro application
Switch(config)#interface g0/1
Switch(config-if-range)#macro apply cisco-router $NVID 999
•switchport trunk allowed vlan VRANGE – This command is currently commented in the code but
remains to show capability. However, it is recommended for trunk configuration. If this command is
not included, spanning-tree loops could occur. Most notably on VLAN1. Changing the native VLAN will
mitigate this threat somewhat, but that is only assuming there is not already a mismatch across the
link.
•There is a plan for the commands shown on this slide to be incorporated in mid-2004.
•VLANs should be predefined before any templates are applied because some templates will create
VLANs, some will not.

181818
© 2003 Cisco Systems, Inc. All rights reserved.
Presentation_ID 181818
© 2003, Cisco Systems, Inc. All rights reserved.
Presentation_ID