Routing & Switching

How a Switch Works (Layer 2)

A switch keeps a MAC address table (also called the CAM table) that maps MAC addresses to ports. For each frame it receives, it does the following:

1. Learn: records the source MAC address and the port it came in on.
2. Forward: if the destination MAC is in the table, sends the frame out that port only.
3. Flood: if the destination is unknown, or is broadcast (FF:FF:FF:FF:FF:FF), sends it out every port in the VLAN except the one it came in on.
4. Filter: if the destination is on the same port it came in on, drops it.

VLANs

A Virtual LAN splits one physical switch into several separate Layer 2 networks. Devices in different VLANs can't talk to each other without a router or Layer 3 switch. VLANs improve security, cut down broadcast traffic, and group users logically.

Switch(config)# vlan 10
Switch(config-vlan)# name USERS
Switch(config-vlan)# vlan 20
Switch(config-vlan)# name SERVERS
Switch(config-vlan)# exit

Switch(config)# interface gigabitEthernet0/2
Switch(config-if)# description PC-1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# spanning-tree portfast

set vlans USERS vlan-id 10
set vlans SERVERS vlan-id 20
set interfaces ge-0/0/2 description PC-1
set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members USERS

Trunks (802.1Q)

A trunk carries traffic for many VLANs over one link, usually switch-to-switch or switch-to-router. 802.1Q adds a 4-byte tag holding the VLAN ID to each frame. Frames in the native VLAN are sent untagged. It defaults to VLAN 1, which is why many teams change it to an unused VLAN.

Switch(config)# interface gigabitEthernet0/1
Switch(config-if)# description UPLINK-TO-CORE
Switch(config-if)# switchport trunk encapsulation dot1q   ! only needed on some models
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20
Switch(config-if)# switchport trunk native vlan 999

set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode trunk
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members [ USERS SERVERS ]

Spanning Tree Protocol (STP)

Redundant links between switches create Layer 2 loops. Ethernet frames have no TTL, so a broadcast storm can take the network down in seconds. STP (802.1D) and its faster versions RSTP (802.1w) and MSTP (802.1s) prevent loops by blocking redundant paths.

1. Elect a root bridge: the lowest bridge ID (priority + MAC) wins.
2. Each non-root switch picks one root port: its lowest-cost path to the root.
3. Each segment picks one designated port.
4. All other ports are blocked (RSTP calls them alternate or backup).

! Make this switch the root for VLANs 10 and 20 (Cisco)
Switch(config)# spanning-tree mode rapid-pvst
Switch(config)# spanning-tree vlan 10,20 root primary

How a Router Works (Layer 3)

A router forwards packets between networks using its routing table. For each packet it:

1. Reads the destination IP address.
2. Finds the longest prefix match: the most specific matching route.
3. Sends the packet to that route's next hop or exit interface, inside a new Layer 2 frame.
4. Drops it if nothing matches and there's no default route (0.0.0.0/0).

Longest Prefix Match Example

Routing table:
  0.0.0.0/0        via 203.0.113.1
  10.0.0.0/8       via 10.255.0.1
  10.1.0.0/16      via 10.255.0.2
  10.1.5.0/24      via 10.255.0.3

Destination 10.1.5.20  -> matches /0, /8, /16, /24 -> uses /24 (10.255.0.3)
Destination 10.1.9.9   -> best match /16            -> 10.255.0.2
Destination 8.8.8.8    -> only the default route    -> 203.0.113.1

Where Routes Come From

• Connected: networks on the router's own up/up interfaces.
• Static: entered by hand by an administrator.
• Dynamic: learned from routing protocols such as OSPF, EIGRP, IS-IS, BGP or RIP.

Administrative Distance

When two different sources offer the same prefix, the router trusts the one with the lowest administrative distance (AD). Within a single protocol, the lowest metric wins.

Static Routes

! Default route to the ISP
Router(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1

! Route to a remote LAN
Router(config)# ip route 192.168.50.0 255.255.255.0 10.0.0.2

! Floating static (backup) - higher AD so it's only used if the primary fails
Router(config)# ip route 0.0.0.0 0.0.0.0 198.51.100.1 250

set routing-options static route 0.0.0.0/0 next-hop 203.0.113.1
set routing-options static route 192.168.50.0/24 next-hop 10.0.0.2
set routing-options static route 0.0.0.0/0 qualified-next-hop 198.51.100.1 preference 250

OSPF Basics

Open Shortest Path First is a link-state interior gateway protocol. Every router in an area builds the same map of the network (the LSDB) and runs Dijkstra's SPF algorithm to find the best paths. Cost is based on interface bandwidth. All areas must connect to backbone Area 0.

• Neighbors form through Hello packets sent to multicast 224.0.0.5.
• To become neighbors, routers must match on: area ID, subnet, hello/dead timers, authentication, MTU, and stub flags.
• On broadcast segments a DR and BDR are elected to reduce flooding.

Router(config)# router ospf 1
Router(config-router)# router-id 1.1.1.1
Router(config-router)# network 10.0.0.0 0.0.0.255 area 0
Router(config-router)# network 192.168.10.0 0.0.0.255 area 0
Router(config-router)# passive-interface gigabitEthernet0/2   ! LAN side, no neighbors

set routing-options router-id 1.1.1.1
set protocols ospf area 0.0.0.0 interface ge-0/0/0.0
set protocols ospf area 0.0.0.0 interface ge-0/0/2.0 passive

Inter-VLAN Routing

Hosts in different VLANs need a Layer 3 device to talk to each other. There are two common designs.

Router-on-a-Stick

One router interface trunked to the switch, with one subinterface per VLAN.

Router(config)# interface gigabitEthernet0/0
Router(config-if)# no shutdown
Router(config)# interface gigabitEthernet0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config)# interface gigabitEthernet0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0

Layer 3 Switch with SVIs (preferred)

Switch(config)# ip routing
Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config)# interface vlan 20
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown

set interfaces irb unit 10 family inet address 192.168.10.1/24
set vlans USERS l3-interface irb.10

Verification Commands

Check Yourself