Topic 3- Securing switch ports

Question 1

What is port fast?

Answer 1

can be configured on a port
speeds up port activation
No RSTP delay in activating port
For ports with end devices only
(for ports you know cannot create a loop when connected)

Question 2

What is BPDU Guard?

Answer 2

Bridge Protocol Data Unit Guard
disables port with port fast connected if BPDU detected
- Prevents loop problems if switch is connected to what should be an end point

Question 3

how to configure

Answer 3

configure interfaces in access mode on specific VLANs

• set max concurrent MAC addr on a port
  ex: switchport port-security violation protect (drops frames from unknown sources)
  ex: switchport port-security violation restrict (drops frames from unknown sources and increments violation counter)
  ex: switchport port-security violation shutdown (shuts down interface)

Question 4

What is channel bonding?

aka port bonding

Answer 4

Combines up to 8 physical links into one logical link
protocols: Port aggression protocol (PAgP)
IEEE802.1d Link aggregation protocol (LACP)

Question 5

What is an EtherChannel?

Answer 5

It is created on a range of interfaces
(speed, duplex, trunking- must be done on both ends)
Use channel-group command to create port-channel interface
configure trunking on port-channel interface

Question 6

How to configure an etherchannel:

Answer 6

On a range of interfaces
- channel-group 1 mode active
on result port channel 1 interface
- config trunk encapsulation
-config trunk mode

Question 7

Channel-group

Answer 7

Command on ethernet interfaces used to add the specific interfaces to a single etherchannel. The number after the command is the port channel id

Question 8

Interface port-channel

Answer 8

Command that creates the bundled interface. Ports can be added to this interfave with the channel-group command

Question 9

Step by step etherchannel

Answer 9

Int range g0/1-2
Switchport trunk encapsulation dot1q
Switchport mode trunk
Channel-group 1 mode active
Int port-channel 1
Switchport trunk encapsulation dot1q
Switchport mode trunk
Switchport trunk allowed vlan 1,2,3
Do on both switches
Sh etherchannel port-channel