EIGRP Summary Considerations

     When a Router adds the EIGRP summary address interface command, it will inject a route for the summary address to interface Null0 into its global routing table with a default administrative distance (AD) of 5. This is known as the discard route, and it's not exclusive to EIGRP. However, this occurs because if the Router were to lose reachability to a more specific route that fell within the summary, the Router would wind up using the shorter summary route to Null0 for forwarding the traffic, thereby preventing packets from being sent to any neighbors that may no longer have the route. 


     If the Router did not have such a mechanism and instead forwarded the traffic anyway, then there could be a risk of a next hop neighbor having connectivity to some path that actually leads back to the Router - creating a loop!


     In this scenario, the Provider sends a default route to R1 via eBGP with an AD of 20.  R1's fa0/1 interface is then configured to send an EIGRP summary route. With no AD configured, a route to the EIGRP summary via interface Null0 with an AD of 5 is injected into the global routing table, thereby removing the previously accepted default route to 10.1.1.100 via eBGP with the AD of 20.
R2 learns the advertised route via EIGRP, and installs the route in its global routing table with the AD of 90. At this point, any destinations that R1 receives packets for that are not specifically in the global routing table will take the default route to Null0.

In this scenario, the Provider sends a default route to R1 via eBGP with an AD of 20. 

Provider Sends Default route to R1:

router bgp 100

 neighbor 10.1.1.1 remote-as 200

 neighbor 10.1.1.1 default-originate

Resulting routing table for R1:

R1#show ip route | in 0.0.0.0

Gateway of last resort is 10.1.1.100 to network 0.0.0.0

B*   0.0.0.0/0 [20/0] via 10.1.1.100, 00:00:10

R1's fa0/1 interface is then configured to send an EIGRP summary route. 

R1 Sends EIGRP Summary to R2:

interface fa0/1

 ip summary-address eigrp 100 0.0.0.0 0.0.0.0




R1#show ip route 0.0.0.0 | include distance

  Known via "eigrp 100", distance 5, metric 2169856, candidate default path, type internal

With no AD configured, a route to the EIGRP summary via interface Null0 with an AD of 5 is injected into the global routing table, thereby removing the previously accepted default route to 10.1.1.100 via eBGP with the AD of 20.

Resulting routing table for R1:

R1# show ip route | include 0.0.0.0

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

D*   0.0.0.0/0 is a summary, 00:21:30, Null0

R2 learns the advertised route via EIGRP, and installs the route in its global routing table with the AD of 90.

Resulting routing table for R2:

R2#show ip route | in 0.0.0.0

Gateway of last resort is 10.12.1.1 to network 0.0.0.0

D*   0.0.0.0/0 [90/2681856] via 10.12.1.1, 00:23:21, Fa0/1

At this point, any destination that R1 receives packets for that are not specifically in the global routing table will take the default route to Null0.

Although not always recommended and depending on your needs, you can remove the Null0 route by adding the AD of 255. However, in this case, a high AD of 220 is configured.

R1 Sends EIGRP Summary to R2:

interface fa0/1

 ip summary-address eigrp 100 0.0.0.0 0.0.0.0 220

This allows the previously accepted route with the AD of 20 back to the global routing table, but still maintains a floating route to Null0 in the event the default eBGP route is lost.

Resulting routing table for R1:

R1# clear ip route*

R1# show ip route  | in 0.0.0.0  

Gateway of last resort is 10.1.1.100 to network 0.0.0.0

B*   0.0.0.0/0 [20/0] via 10.1.1.100, 00:00:08

R2 has no change, and still learns the advertised route via EIGRP

Resulting routing table for R2:

R2#show ip route | in 0.0.0.0

Gateway of last resort is 10.12.1.1 to network 0.0.0.0

D*   0.0.0.0/0 [90/2681856] via 10.12.1.1, 00:33:21, Fa0/1

Multiple Instance Spanning Tree Protocol (MSTP)

In this scenario, I have 4 switches connected in a loop with two links per switch for peering. I want to configure MSTP in such a way that half of the VLANs use SW1 as the root bridge, and the other half of the VLANs use SW2 as the root bridge. If either SW1 or SW2 were to fail, I want the remaining switch of the two to take over as the root bridge for the failed device. Additionally, I want to ensure that SW3 reaches the root for Instance 1 through SW4 by adjusting port cost, and SW4 to use Fa0/17 to reach the root of Instance 2 adjusting port priority.

To set a baseline; VLANs 10, 20, 30, and 40 are configured for the switching domain, and cabling has been done per the diagram.

I'l start with configuring MST instances 1 and 2 on all 4 Switches (SW1 is shown).

SW1(config)#spanning-tree mode mst

SW1(config)#

SW1(config)#spanning-tree mst configuration 

SW1(config-mst)#name MST

SW1(config-mst)#revision 1

SW1(config-mst)#instance 1 vlan 10,30

SW1(config-mst)#instance 2 vlan 20,40

SW1(config-mst)#

SW1(config-mst)#do show spanning-tree mst configuration  

Name      [MST]

Revision  1     Instances configured 3

Instance  Vlans mapped

--------  ---------------------------------------------------------------------

0         1-9,11-19,21-29,31-39,41-4094

1         10,30

2         20,40

-------------------------------------------------------------------------------

SW1(config-mst)#exit

SW1(config)#

Note that with MST, any VLAN that I have not specifically configured for an instance will be found in MST instance 0.

To configure priority for an instance, I can either use the spanning-tree mst 'x' priority command, or the spanning-tree mst 'x' root command. Using the priority command, I can manually set the value, but using the root command, I allow the switch to calculate the value. Depending on the environment, it may be beneficial to set the priority manually. For MST 1, I'll use the priority command, and for MST 2, I'll use the root command.

SW1(config)#spanning-tree mst 1 priority 0 

SW1(config)#spanning-tree mst 2 root secondary 

SW1(config)#

SW2(config)#spanning-tree mst 1 priority 4096

SW2(config)#spanning-tree mst 2 root primary 

SW2(config)#

Here are the MST 1 and 2 resulting outputs for Switch 1 and 2.

SW1(config)#do show spanning-tree mst 1

##### MST1    vlans mapped:   10,30

Bridge        address 0023.ab6f.b980  priority      1     (0 sysid 1)

Root          this switch for MST1

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Desg FWD 200000    128.15   P2p 

Fa0/14           Desg FWD 200000    128.16   P2p 

Fa0/16           Desg FWD 200000    128.18   P2p 

Fa0/17           Desg FWD 200000    128.19   P2p 

SW1(config)#do show spanning-tree mst 2

##### MST2    vlans mapped:   20,40

Bridge        address 0023.ab6f.b980  priority      28674 (28672 sysid 2)

Root          address 0014.a8e1.fa80  priority      24578 (24576 sysid 2)

              port    Fa0/13          cost          200000    rem hops 19

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Root FWD 200000    128.15   P2p 

Fa0/14           Altn BLK 200000    128.16   P2p 

Fa0/16           Desg FWD 200000    128.18   P2p 

Fa0/17           Desg FWD 200000    128.19   P2p 

SW1(config)#

SW2(config)#do show spanning-tree mst 1

##### MST1    vlans mapped:   10,30

Bridge        address 0014.a8e1.fa80  priority      4097  (4096 sysid 1)

Root          address 0023.ab6f.b980  priority      1     (0 sysid 1)

              port    Fa0/13          cost          200000    rem hops 19

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Root FWD 200000    128.15   P2p 

Fa0/14           Altn BLK 200000    128.16   P2p 

Fa0/19           Desg FWD 200000    128.21   P2p 

Fa0/20           Desg FWD 200000    128.22   P2p 

SW2(config)#do show spanning-tree mst 2

##### MST2    vlans mapped:   20,40

Bridge        address 0014.a8e1.fa80  priority      24578 (24576 sysid 2)

Root          this switch for MST2

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Desg FWD 200000    128.15   P2p 

Fa0/14           Desg FWD 200000    128.16   P2p 

Fa0/19           Desg FWD 200000    128.21   P2p 

Fa0/20           Desg FWD 200000    128.22   P2p 

SW2(config)#

Note that the output shows SW1 as the root for MST 1, and SW2 as the root for MST 2; with SW1's priority for MST 2 putting it as the successor if there were a root bridge election, and SW2's priority for MST 1 putting it as the successor if there were a root bridge election. I can look at the inferior bridge priorities for SW3 and SW4 to verify that would indeed be the case.

SW3#show spanning-tree mst 1

##### MST1    vlans mapped:   10,30

Bridge        address 000c.30fd.2e80  priority      32769 (32768 sysid 1)

Root          address 0023.ab6f.b980  priority      1     (0 sysid 1)

              port    Fa0/13          cost          200000    rem hops 19

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Root FWD 200000    128.13   P2p 

Fa0/14           Altn BLK 200000    128.14   P2p 

Fa0/19           Desg FWD 200000    128.19   P2p 

Fa0/20           Desg FWD 200000    128.20   P2p 

SW3#show spanning-tree mst 2

##### MST2    vlans mapped:   20,40

Bridge        address 000c.30fd.2e80  priority      32770 (32768 sysid 2)

Root          address 0014.a8e1.fa80  priority      24578 (24576 sysid 2)

              port    Fa0/13          cost          400000    rem hops 18

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Root FWD 200000    128.13   P2p 

Fa0/14           Altn BLK 200000    128.14   P2p 

Fa0/19           Altn BLK 200000    128.19   P2p 

Fa0/20           Altn BLK 200000    128.20   P2p 

SW3#

SW4#show spanning-tree mst 1

##### MST1    vlans mapped:   10,30

Bridge        address 000b.be51.a680  priority      32769 (32768 sysid 1)

Root          address 0023.ab6f.b980  priority      1     (0 sysid 1)

              port    Fa0/16          cost          400000    rem hops 18

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/16           Root FWD 200000    128.16   P2p 

Fa0/17           Altn BLK 200000    128.17   P2p 

Fa0/19           Altn BLK 200000    128.19   P2p 

Fa0/20           Altn BLK 200000    128.20   P2p 

SW4#show spanning-tree mst 2

##### MST2    vlans mapped:   20,40

Bridge        address 000b.be51.a680  priority      32770 (32768 sysid 2)

Root          address 0014.a8e1.fa80  priority      24578 (24576 sysid 2)

              port    Fa0/16          cost          200000    rem hops 19

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/16           Root FWD 200000    128.16   P2p 

Fa0/17           Altn BLK 200000    128.17   P2p 

Fa0/19           Desg FWD 200000    128.19   P2p 

Fa0/20           Desg FWD 200000    128.20   P2p 

SW4#

Looking above, I can see that SW3's root port for MST 1 is currently Fa0/13 which is directly connected to SW1. In order for SW3 to use SW4 for its path to the root using port cost, I'll use 'show spanning-tree mst 1 detail' to learn how much I'll need to adjust the cost.

SW3#show spanning-tree mst 1 detail

##### MST1    vlans mapped:   10,30

Bridge        address 000c.30fd.2e80  priority      32769 (32768 sysid 1)

Root          address 0023.ab6f.b980  priority      1     (0 sysid 1)

              port    Fa0/13          cost          200000    rem hops 19

FastEthernet0/13 of MST1 is root forwarding 

Port info             port id         128.13  priority    128  cost      200000

Designated root       address 0023.ab6f.b980  priority      1  cost           0

Designated bridge     address 0023.ab6f.b980  priority      1  port id   128.18

Timers: message expires in 5 sec, forward delay 0, forward transitions 2

Bpdus (MRecords) sent 6072, received 4544

FastEthernet0/14 of MST1 is alternate blocking 

Port info             port id         128.14  priority    128  cost      200000

Designated root       address 0023.ab6f.b980  priority      1  cost           0

Designated bridge     address 0023.ab6f.b980  priority      1  port id   128.19

Timers: message expires in 4 sec, forward delay 0, forward transitions 1

Bpdus (MRecords) sent 15955, received 15033

FastEthernet0/19 of MST1 is designated forwarding 

Port info             port id         128.19  priority    128  cost      200000

Designated root       address 0023.ab6f.b980  priority      1  cost      200000

Designated bridge     address 000c.30fd.2e80  priority  32769  port id   128.19

Timers: message expires in 0 sec, forward delay 0, forward transitions 1

Bpdus (MRecords) sent 5677, received 7710

FastEthernet0/20 of MST1 is designated forwarding 

Port info             port id         128.20  priority    128  cost      200000

Designated root       address 0023.ab6f.b980  priority      1  cost      200000

Designated bridge     address 000c.30fd.2e80  priority  32769  port id   128.20

Timers: message expires in 0 sec, forward delay 0, forward transitions 2

Bpdus (MRecords) sent 13667, received 19642

SW3#    

Since I have a total cost of 200000 to reach the root through Fa0/13 and Fa0/14, and a total cost of 400000 for ports Fa0/19 and Fa0/20. I'll increase Fa0/13 and Fa0/14's cost to something higher.

SW3#conf t       

Enter configuration commands, one per line.  End with CNTL/Z.

SW3(config)#interface range fa0/13 - 14

SW3(config-if-range)#spanning-tree mst 1 cost 20000000

SW3(config-if-range)#exit

SW3(config)# 

SW3(config)#do show spanning-tree mst 1

##### MST1    vlans mapped:   10,30

Bridge        address 000c.30fd.2e80  priority      32769 (32768 sysid 1)

Root          address 0023.ab6f.b980  priority      1     (0 sysid 1)

              port    Fa0/19          cost          600000    rem hops 17

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Altn BLK 20000000  128.13   P2p 

Fa0/14           Altn BLK 20000000  128.14   P2p 

Fa0/19           Root FWD 200000    128.19   P2p 

Fa0/20           Altn BLK 200000    128.20   P2p 

SW3(config)#

Looking above, I can see that SW4 is currently using Fa0/16 to reach the root bridge for MST 2. I'll adjust where SW4 will use Fa0/17 as the root port to reach MST 2 by changing the port priority on SW2. Note that this adjustment must be done on SW2 and NOT on SW4 to be effective.

SW2(config)#interface fa0/20

SW2(config-if)#spanning-tree mst 2 port-priority 0

SW2(config-if)#

SW2(config-if)#do show spanning-tree mst 2

##### MST2    vlans mapped:   20,40

Bridge        address 0014.a8e1.fa80  priority      24578 (24576 sysid 2)

Root          this switch for MST2

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/13           Desg FWD 200000    128.15   P2p 

Fa0/14           Desg FWD 200000    128.16   P2p 

Fa0/19           Desg FWD 200000    128.21   P2p 

Fa0/20           Desg FWD 200000      0.22   P2p 

SW2(config-if)#

With the port priority adjusted on SW2, I should now see on SW4 that Fa0/17 is the root port for MST 2.

SW4#show spanning-tree mst 2

##### MST2    vlans mapped:   20,40

Bridge        address 000b.be51.a680  priority      32770 (32768 sysid 2)

Root          address 0014.a8e1.fa80  priority      24578 (24576 sysid 2)

              port    Fa0/17          cost          200000    rem hops 19

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/16           Altn BLK 200000    128.16   P2p 

Fa0/17           Root FWD 200000    128.17   P2p 

Fa0/19           Desg FWD 200000    128.19   P2p 

Fa0/20           Desg FWD 200000    128.20   P2p 

SW4#

Private VLANs

I want to simulate an environment where two customers - Customer A and Customer B - are supported by a service provider with private VLANs. In this scenario Customer A has two routers; R3 and R5, Customer B has a single router; R4, and the provider is offering Internet access with R1 and monitoring services to the Customers' loopback addresses with R2.

In this scenario, all Router FastEthernet interfaces are in "Primary" VLAN 20 with addressing in the 10.20.1.0/24 space. With private VLANs, the provider can conserve VLANs by not assigning each customer their own VLAN ID. With this configuration I will allow both Customers access to the services they need, but also ensure that they do not gain access to each other.

Here's a baseline before I begin configuring the Private VLANs.

Switches:

Both switches have had their VTP domain names set to cisco, and have had their VTP modes set to transparent. Fa0/13 on both switches will serve as the trunk port. Currently, only VLAN 1 is configured.

Routers:

All routers have had their Fa0/0 interfaces configured with the IP and mask of 10.20.1.X/24, where X = the router number.

With a PINGSCRIPT, I'll test connectivity from R3 to all devices.



R3#tclsh
R3(tcl)#proc PINGSCRIPT [] {
+>(tcl)#foreach IP {
+>(tcl)#10.20.1.1
+>(tcl)#10.20.1.2
+>(tcl)#10.20.1.3
+>(tcl)#10.20.1.4
+>(tcl)#10.20.1.5
+>(tcl)#} {
+>(tcl)#                set RESULT [exec "ping $IP repeat 3 timeout 1"];
+>(tcl)#if { [regexp "!!!"  $RESULT]} { puts "$IP OK"} else { puts "$IP Unreachable" }     
+>(tcl)#                }
+>(tcl)#  }


R3(tcl)#PINGSCRIPT
10.20.1.1 OK
10.20.1.2 OK
10.20.1.3 OK
10.20.1.4 OK
10.20.1.5 OK


R3(tcl)#

Connectivity appears to be successful.

Note: there are 3 port types, or roles, that are used in Private VLANs. There are Promiscuous ports, which talk to all ports, there are Isolated ports, which can only talk to Promiscuous ports, and there are Community ports, which can talk to other Community ports in the same community, as well as promiscuous ports.

In this scenario, R1 and R2's Fa0/0s are operating as Promiscuous ports, R3 and R5's Fa0/0s are operating as mutual Community Ports, and R4's Fa0/0 is operating as an Isolated port. After a successful Private VLAN configuration, I should be able to see that R3 and R5 can communicate within their own Community, as well as with the Promiscuous ports, but will not be able to speak to R4's Isolated port.

Starting with SW1, I'll configure primary and secondary VLANs, and associate the secondaries to the primary:

Sw1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Sw1(config)#vlan 21
Sw1(config-vlan)#name PVLAN_Community
Sw1(config-vlan)#private-vlan ?
  association       Configure association between private VLANs
  community         Configure the VLAN as a community private VLAN
  isolated          Configure the VLAN as an isolated private VLAN
  primary           Configure the VLAN as a primary private VLAN
  twoway-community  Configure the VLAN as a two way community private VLAN
Sw1(config-vlan)#private-vlan community
Sw1(config-vlan)#
Sw1(config-vlan)#vlan 22
Sw1(config-vlan)#name PVLAN_Isolated
Sw1(config-vlan)#private-vlan isolated
Sw1(config-vlan)#
Sw1(config-vlan)#vlan 20
Sw1(config-vlan)#name PVLAN_Primary
Sw1(config-vlan)#private-vlan primary
Sw1(config-vlan)#private-vlan association 21,22
Sw1(config-vlan)#exit
SW1(config)#do sh vlan b


VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12
                                                Fa0/14, Fa0/15, Fa0/16, Fa0/17
                                                Fa0/18, Fa0/19, Fa0/20, Fa0/21
                                                Fa0/22, Fa0/23, Fa0/24, Gi0/1
                                                Gi0/2
20   PVLAN_Primary                    active    
21   PVLAN_Community                  active    
22   PVLAN_Isolated                   active    
1002 fddi-default                     act/unsup 
1003 trcrf-default                    act/unsup 
1004 fddinet-default                  act/unsup 
1005 trbrf-default                    act/unsup 
SW1(config)#

Next, I'll configure the individual port modes and map the private VLANs to the correct ports for R1, R3 and R5's switchports on SW1.


SW1(config)#int fa0/1
SW1(config-if)#switchport mode private-vlan promiscuous
SW1(config-if)#switchport private-vlan mapping 20 21,22
SW1(config-if)#
SW1(config-if)#int fa0/3
SW1(config-if)#switchport mode private-vlan host
SW1(config-if)#switchport private-vlan host-association 20 21
SW1(config-if)#
SW1(config-if)#int fa0/5
SW1(config-if)#switchport mode private-vlan host
SW1(config-if)#switchport private-vlan host-association 20 21
SW1(config-if)#


I'll test connectivity from R1 to R3 and R5. I should not be able to connect to R4.



R1(tcl)#
R1(tcl)#proc PINGSCRIPT [] {
+>(tcl)#
+>(tcl)#foreach IP {
+>(tcl)#10.20.1.3
+>(tcl)#10.20.1.5
+>(tcl)#10.20.1.4
+>(tcl)#} { set RESULT [exec "ping $IP repeat 3 timeout 1"];
+>(tcl)#        $p "!!!"  $RESULT]} { puts "$IP OK"} else { puts "$IP Unreachable" }         
+>(tcl)#}
+>(tcl)# }


R1(tcl)#PINGSCRIPT
10.20.1.3 OK
10.20.1.5 OK
10.20.1.4 Unreachable


Now I'll configure primary and secondary VLANs, and associate the secondaries to the primary for SW2. I'll follow it up with configuring the individual port modes and map the private VLANs to the correct ports for R2 and R4's switchports.


SW2(config)#vlan 21
SW2(config-vlan)#name PVLAN_Community
SW2(config-vlan)#private-vlan community
SW2(config-vlan)# 
SW2(config-vlan)#vlan 22
SW2(config-vlan)#name PVLAN_Isolated
SW2(config-vlan)#private-vlan isolated 
SW2(config-vlan)#vlan 20
SW2(config-vlan)#name PVLAN_Primary
SW2(config-vlan)#private-vlan association 21,22
SW2(config-vlan)#exit
SW2(config)#
SW2(config)#int fa0/4
SW2(config-if)#switchport mode private-vlan host
SW2(config-if)#
SW2(config-if)#switchport private-vlan host-association 20 22
SW2(config-if)#end
SW2#


At this point, I should have connectivity from R2 to all other router's FastEthernet ports, but R4 should only have access to R1 and R2's FastEthernet ports.

R1:

R1(tcl)#PINGSCRIPT
10.20.1.1 OK
10.20.1.2 OK
10.20.1.3 OK
10.20.1.4 OK
10.20.1.5 OK

R3:

R3(tcl)#PINGSCRIPT
10.20.1.1 OK
10.20.1.2 OK
10.20.1.3 OK
10.20.1.4 Unreachable
10.20.1.5 OK


R5:

R5(tcl)#PINGSCRIPT
10.20.1.1 OK
10.20.1.2 OK
10.20.1.3 OK
10.20.1.4 Unreachable
10.20.1.5 OK


R2:

R2(tcl)#PINGSCRIPT
10.20.1.1 OK
10.20.1.2 OK
10.20.1.3 OK
10.20.1.4 OK
10.20.1.5 OK


R4:

R4(tcl)#PINGSCRIPT
10.20.1.1 OK
10.20.1.2 OK
10.20.1.3 Unreachable
10.20.1.4 OK
10.20.1.5 Unreachable

Looks good!