notes: Smartport Macros

Smartport Macros
- Used to define a well known template of config to apply onto multiple interfaces.
- There are default macros on a switch, that can be seen with "sh parser macro [brief]"

Type:

1. global - applying macro on global mode.
2. interface - applying macro on interface mode.

command to create macro:

macro name name

command to apply the macro:

macro apply name


example config for interface mode:

macro name setvlan
switchport access vlan $VLAN
spanning-tree portfast bpduguard
@

interface range fa0/10-19
macro apply setvlan $VLAN 5


example config for global:

macro name rangeport
interface range fa0/15-15
switchport mode access
spanning-tree portfast
@

Note: since the interface range cmd is included it is a macro global.
- macro is really not working for interface range cmd.



predefined macros

- need to be familiar with those macros

to check the built-in and custom macros:

show parser macro

CCIE lab scenario: use smartport macro voice vlan 20, enable switchport mode security using one cmd, an you may not need macro to do it.

macro apply cisco-phone $access_vlan 10 $voice-vlan 20

How to know when you used the macro: there is a macro definition:


Here are some predefine macros:

Rack1SW1#show parser macro
Total number of macros = 7
--------------------------------------------------------------
Macro name : cisco-global
Macro type : default global
# Enable dynamic port error recovery for link state failures.
errdisable recovery cause link-flap
errdisable recovery interval 60

# Config Cos to DSCP mappings
mls qos map cos-dscp 0 8 16 26 32 46 46 56

# Enable aggressive mode UDLD on all fiber uplinks
udld aggressive

# Enable Rapid PVST+ and Loopguard
spanning-tree mode rapid-pvst
spanning-tree loopguard default
spanning-tree extend system-id
--------------------------------------------------------------
Macro name : cisco-desktop
Macro type : default interface
# macro keywords $access_vlan
# Basic interface - Enable data VLAN only
# Recommended value for access vlan should not be 1
switchport access vlan $access_vlan
switchport mode access

# Enable port security limiting port to a single
# MAC address -- that of desktop
switchport port-security
switchport port-security maximum 1

# Ensure port-security age is greater than one minute
# and use inactivity timer
switchport port-security violation restrict
switchport port-security aging time 2
switchport port-security aging type inactivity

# Configure port as an edge network port
spanning-tree portfast
spanning-tree bpduguard enable
--------------------------------------------------------------
Macro name : cisco-phone
Macro type : default interface
# Cisco IP phone + desktop template

# macro keywords $access_vlan $voice_vlan


# VoIP enabled interface - Enable data VLAN
# and voice VLAN
# Recommended value for access vlan should not be 1
switchport access vlan $access_vlan
switchport mode access

# Update the Voice VLAN value which should be
# different from data VLAN
# Recommended value for voice vlan should not be 1
switchport voice vlan $voice_vlan

# Enable port security limiting port to a 2 MAC
# addressess -- One for desktop on data vlan and
# one for phone on voice vlan
switchport port-security
switchport port-security maximum 2

# Ensure port-security age is greater than one minute
# and use inactivity timer
switchport port-security violation restrict
switchport port-security aging time 2
switchport port-security aging type inactivity

# Enable auto-qos to extend trust to attached Cisco phone
auto qos voip cisco-phone

# Configure port as an edge network port
spanning-tree portfast
spanning-tree bpduguard enable
--------------------------------------------------------------
Macro name : cisco-switch
Macro type : default interface
# macro keywords $native_vlan
# Access Uplink to Distribution
# Do not apply to EtherChannel/Port Group
switchport trunk encapsulation dot1q

# Define unique Native VLAN on trunk ports
# Recommended value for native vlan should not be 1
switchport trunk native vlan $native_vlan

# Update the allowed VLAN range such that it
# includes data, voice and native VLANs
switchport trunk allowed vlan ALL

# Hardcode trunk
switchport mode trunk

# Configure qos to trust this interface
auto qos voip trust

# 802.1w defines the link as pt-pt for rapid convergence
spanning-tree link-type point-to-point
--------------------------------------------------------------
Macro name : cisco-router
Macro type : default interface
# macro keywords $native_vlan
# Access Uplink to Distribution
switchport trunk encapsulation dot1q

# Define unique Native VLAN on trunk ports
# Recommended value for native vlan should not be 1
switchport trunk native vlan $native_vlan

# Update the allowed VLAN range such that it
# includes data, voice and native VLANs
switchport trunk allowed vlan ALL

# Hardcode trunk
switchport mode trunk

# Configure qos to trust this interface
auto qos voip trust
mls qos trust dscp

# Ensure fast access to the network when enabling the interface.
# Ensure that switch devices cannot become active on the interface.
spanning-tree portfast trunk
spanning-tree bpduguard enable
--------------------------------------------------------------
Macro name : cisco-wireless
Macro type : default interface
# macro keywords $native_vlan
# Access Uplink to Distribution
switchport trunk encapsulation dot1q

# Define unique Native VLAN on trunk ports
# Recommended native vlan should NOT be 1
switchport trunk native vlan $native_vlan

# Update the allowed VLAN range such that it
# includes data, voice and native VLANs
switchport trunk allowed vlan ALL

# Hardcode trunk and disable negotiation to speed up convergence
switchport mode trunk
switchport nonegotiate

# Configure qos to trust this interface
auto qos voip trust
mls qos trust cos

# Ensure that switch devices cannot become active on the interface.
spanning-tree bpduguard enable
--------------------------------------------------------------

notes: Bridging

Transparent bridging
- is using normal STP rules
- same election root bridge and root port election

Router in bridge mode doesnt support the sys-id-ext, brigde priority will always be 32768 for any vlan which will make the router as a root bridge.

enabling transparent bridging on routers:

step1: enable bridging:

bridge # protocol ieee

step2: bind to the interfaces:

interface fa0/1
bridge-group #

for frame-relay interfaces:

interface s0/0
encapsulation frame-relay
frame-relay map bridge dlci# broadcast
bridge-group #


CRB (concurrent Routing and Bridging)
- this protocol can be routed on one interface while being bridged on another interface.
- When CRB is used traffic in the routed domain cannot be passed onto the bridge domain.
- CRB is considered legacy since IRB includes all the functionality of CRB with the addition of the BVI.


IRB (Integrated Routing and Bridging)
- this protocol can be both routed and bridged on the same interface.
- When IRB is used traffic from the routed domain can be passed onto the bridge domain.


enabling IRB:

1. Create transparent bridge group

bridge # protocol ieee

2. Enable IRB and what to be bridged

bridge irb
bridge # route ip

bridge # bridge ip
-on by default

3. Enable routing & bridging for the bridge-group under the interface

interface fa0/0
bridge-group #

4. Configure BVI to connect the bridged and routed domain

interface BVI #
ip add 1.1.1.1 255.255.255.0

Fallback Bridging (VLAN bridging)
used to bridge non-routed or non-supported protocols (SNA, DECNet, AppleTalk, etc.)
to communicate across VLANs and routed ports. one good implementation also is bridging IPv6.

enabling VLAN bridging

1. Specify the bridging VLAN

bridge # protocol vlan-bridge

2. Assign the SVI and routed port to this bridge.

interface vlan1
bridge-group #

interface fa0/1
no switchport

bridge-group #

verification:

sh bridge # group

notes: layer 2 tunneling

802.1q Tunnel
- Used to provide transparent layer2 VPN over a switched ethernet network, to carry unicast, broadcast, multicast, CDP, VTP or STP.
- Uses dot1q inside dot1q, to tunnel layer2 traffic.
- Cannot be dynamically negotiated, and traffic is not encrypted.
NOTE: Confirm prior to configuration that underlying end-to-end connectivity is established.
- When using dot1q tunneling CDP, STP & VTP are NOT carried across the tunnel by default.
- Additionally dot1q also supports etherchannels between customer sites.
- Dot1q-Tunnel requires:
- 802.1q trunking end-to-end
- System MTU should be a minimum of 1504, to support the additional 4-byte metro tag.

PITFALL: Careful when running OSPF to a switch with a system MTU of 1504, the adjacency won’t come up, due to a MTU mismatch.
Disable the MTU check on the routers OSPF interface with "ip ospf mtu-ignore"

Note: you can configure l2 protocol tunneling on ports configured as access or tunnel ports. You cant enable l2 tunneling on ports that is configured
switchport dynamic mode auto
switchport dynamic desirable

from Ruhan's CCIE notes