CCNP ENCOR

Layer 2 Forwarding
 Things we’ll cover
●
OSI Model
●
Collision & Broadcast domains
●
Layer 2 Forwarding
●
MAC Address Table
 OSI Model

7 Application ●
Interface between network and applications

6 Presentation ●
Data formatting and encryption

5 Session ●
Establishing and tracking connections between applications

●
End-to-end (host-to-host) connections/communication, segmentation,
4 Transport multiplexing, acknowledgement

3 Network ●
Logical addressing, routing, traffic control

2 Data Link ●
Physical addressing, forwarding of frames within network segments

●
Physical media (cables, connectors, radio frequency), transmission and
1 Physical reception of raw bits
 OSI Model vs TCP/IP Model

7 Application

6 Presentation 4 Application 5 Application

(7)

5 Session

4 Transport 3 Transport 4 Transport

3 Network 2 Internet 3 Internet

2 Data Link 2 Data Link

1 Link
1 Physical 1 Physical
OSI Model vs TCP/IP Model
 Encapsulation/De-Encapsulation

5 Encapsulation 5
Application Application
(7) (7)

Data

L4
4 Transport Data header =segment 4 Transport

L4 L3
3 Internet Data header header
=packet 3 Internet

L2 L4 L3 L2
2 Data Link trailer Data header header header 2 Data Link

1 Physical FRAME 1 Physical

 Encapsulation/De-Encapsulation

5 De-Encapsulation 5
Application Application
(7) (7)

Data

L4
4 Transport Data header 4 Transport

L4 L3
3 Internet Data header header 3 Internet

L2 L4 L3 L2
2 Data Link trailer Data header header header 2 Data Link

1 Physical FRAME 1 Physical

Encapsulation/De-Encapsulation

en:User:Kbrose (https://commons.wikimedia.org/wiki/File:IP_stack_connections.svg), „IP stack connections“,

https://creativecommons.org/licenses/by-sa/3.0/legalcode
 Collision Domains
●
Early networking technologies like Thinnet (10BASE-2) and Thicknet (10BASE-5) involved connecting
all devices to the same network cable (coaxial).

Thinnet Ethernet cable + BNC connector Thinnet Ethernet cable + BNC T connector

© Raimond Spekking / CC BY-SA 4.0 (via Wikimedia Commons)

© Raimond Spekking / CC BY-SA 4.0 (via Wikimedia Commons)

 Collision Domains
●
Early networking technologies like Thinnet (10BASE-2) and Thicknet (10BASE-5) involved connecting
all devices to the same network cable (coaxial).
●
Signals sent over the cable are received by all connected devices.

●
If two hosts attempt to communicate over the network at the same time, collisions occur.
→CSMA/CD

●
Communications in which devices can both send and receive data, but can’t do both at the same time
(meaning only one device can transmit at a time) are half-duplex.
●
A collision domain is a network segment where simultaneous data transmissions collide.
 Collision Domains
●
The Ethernet Hub is a precursor to the Ethernet Switch.
→Hubs function like multi-port repeaters: a signal received on one port is repeated out of all other ports.
→Hubs are not Layer 2 aware.
●
Hubs have no ability to buffer frames to forward them later; when a signal is received, it is immediately
repeated out of all other ports.
→If two devices connected to a hub send data at the same time, it will attempt to repeat both signals at the
same time = collision.
→All devices connected to a hub are in the same collision domain and must operate in half-duplex
(+CSMA/CD)

X
 Collision Domains
●
Switches are more intelligent than hubs; they are Layer 2 aware.
→They use information in the Layer 2 header to decide where to send frames.
●
Additionally, switches have the ability to buffer frames before sending them.
→If a switch receives two broadcast frames at the same time, it will not flood both at the same time.
→One message will be buffered and transmitted only after the other one.
→Devices connected to a switch are all in separate collision domains. Devices can operate in full-duplex.
Collision Domains

= 9 collision domains
 Broadcast Domains
●
A Broadcast Domain is a logical division of a network in which all nodes can reach each other by Layer
2 broadcast.
→a group of devices which will receive a broadcast frame sent by any one of the other devices.
●
All devices connected to a switch are in the same broadcast domain; switches flood broadcast frames.
→VLANs can be used to divide up broadcast domains on a switch.
●
Each router interface is a unique broadcast domain; routers do not forward Layer 2 broadcast messages.

= 4 broadcast domains
 Layer 2 Forwarding
●
Layer 2 Forwarding refers to the process switches use to forward frames within a LAN.
→Although routers operate ‘at Layer 3’, they still are Layer 2 aware as they must inspect the destination
MAC address of frames they receive, and use Layer 2 to address frames to the next hop device.
●
There are four main message types to be aware of from a Layer 2 forwarding perspective:

Message Type Action MAC Addresses = 48 bits, written in 0x

Unicast (known) Forward 0cf5.a452.b101

Unicast (unknown) Flood
OUI NIC Specific

Broadcast Flood Might be written as:

0C-F5-A4-52-B1-01
Multicast Flood (by default)
 Layer 2 Forwarding – Unknown Unicast
SW1#show mac address-table
R1 Mac Address Table
-------------------------------------------
Interface MAC address:
aaaa.aaaa.aaaa Vlan Mac Address Type Ports
---- ----------- -------- -----
1 aaaa.aaaa.aaaa DYNAMIC Gi0/0
Src: aaaa.aaaa.aaaa
Dst: 1111.1111.1111
Interface MAC address:
1111.1111.1111 G0/0 Interface MAC address:
SW1 3333.3333.3333 SW1 dynamically learns R1’s MAC
address by examining the source
MAC address of the frame
PC1 G0/1 G0/3 X PC3
The dst. MAC is not mine,
so I will drop the frame.
G0/2

The dst. MAC is not mine, Unknown unicast = flood out of all ports
so I will drop the frame. except the port the frame was received on
X (in the same VLAN)
Interface MAC address:
2222.2222.2222

PC2
 Layer 2 Forwarding – Known Unicast
SW1#show mac address-table
R1 Mac Address Table
-------------------------------------------
Interface MAC address:
aaaa.aaaa.aaaa Vlan Mac Address Type Ports
---- ----------- -------- -----
1 aaaa.aaaa.aaaa DYNAMIC Gi0/0
1 1111.1111.1111 DYNAMIC Gi0/1

Interface MAC address: G0/0 Interface MAC address:

1111.1111.1111 SW1 3333.3333.3333

PC1 G0/1 G0/3 PC3

Src: 1111.1111.1111
Dst: aaaa.aaaa.aaaa
G0/2
Known unicast = forward the frame out of
the appropriate port (if it is in the same VLAN
as the port the frame was received on)
Interface MAC address:
2222.2222.2222

PC2
 Layer 2 Forwarding – Broadcast
SW1#show mac address-table
R1 Mac Address Table
-------------------------------------------
Interface MAC address:
aaaa.aaaa.aaaa Vlan Mac Address Type Ports
---- ----------- -------- -----
1 aaaa.aaaa.aaaa DYNAMIC Gi0/0
1 1111.1111.1111 DYNAMIC Gi0/1
1 2222.2222.2222 DYNAMIC Gi0/2

Interface MAC address: G0/0 Interface MAC address:

1111.1111.1111 SW1 3333.3333.3333

PC1 G0/1 G0/3 PC3

G0/2
Broadcast = flood out of all ports except
Src: 2222.2222.2222 the port the frame was received on (in the
Dst: ffff.ffff.ffff
same VLAN)
Interface MAC address:
2222.2222.2222

PC2
 Layer 2 Forwarding
SW1#show mac address-table
R1 Mac Address Table
-------------------------------------------
Interface MAC address:
aaaa.aaaa.aaaa Vlan Mac Address Type Ports
---- ----------- -------- -----
1 aaaa.aaaa.aaaa DYNAMIC Gi0/0
1 1111.1111.1111 DYNAMIC Gi0/1
1 2222.2222.2222 DYNAMIC Gi0/2
1 3333.3333.3333 DYNAMIC Gi0/3
Interface MAC address: G0/0 Interface MAC address:
1111.1111.1111 SW1 3333.3333.3333

PC1 G0/1 G0/3 PC3

Src: 3333.3333.3333
Dst: 2222.2222.2222
G0/2

Interface MAC address:

2222.2222.2222

PC2
 Layer 2 Forwarding – Multicast
SW1#show mac address-table
R1 Mac Address Table
-------------------------------------------
Interface MAC address:
aaaa.aaaa.aaaa Vlan Mac Address Type Ports
---- ----------- -------- -----
1 aaaa.aaaa.aaaa DYNAMIC Gi0/0
1 1111.1111.1111 DYNAMIC Gi0/1
1 2222.2222.2222 DYNAMIC Gi0/2
1 3333.3333.3333 DYNAMIC Gi0/3
Interface MAC address: G0/0 Interface MAC address:
1111.1111.1111 SW1 3333.3333.3333

PC1 G0/1 G0/3 PC3

G0/2
Multicast = by default, flood out of all ports
Src: 2222.2222.2222 except the port the frame was received on (in
Dst: 0100.5ebb.bbbb
the same VLAN)
Interface MAC address: *multicast will be covered later in the course
2222.2222.2222

PC2
 MAC Address Table
JITL-SW1# show mac address-table
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports Multicast address for CDP, VTP, DTP, etc.
---- ----------- -------- -----
All 0100.0ccc.cccc STATIC CPU
All 0100.0ccc.cccd STATIC CPU Multicast address for PVST
All 0180.c200.0000 STATIC CPU
All 0180.c200.0001 STATIC CPU Multicast address for STP
All 0180.c200.0002 STATIC CPU
All 0180.c200.0003 STATIC CPU
All 0180.c200.0004 STATIC CPU
All 0180.c200.0005 STATIC CPU
All 0180.c200.0006 STATIC CPU
All 0180.c200.0007 STATIC CPU
!output omitted
All 0180.c200.000e STATIC CPU
All 0180.c200.000f STATIC CPU
All 0180.c200.0010 STATIC CPU
All ffff.ffff.ffff STATIC CPU
1 001c.7faf.a165 DYNAMIC Fa0/1
1 d8bb.c1cc.ff76 DYNAMIC Fa0/3
Total Mac Addresses for this criterion: 22
 MAC Address Table - Aging
JITL-SW1# show mac address-table aging-time
Default aging-time is 300 seconds (5 minutes).
Global Aging Time: 300 If a MAC address isn’t seen by the switch for 5
Vlan Aging Time minutes, its dynamic entry will be removed.
---- ----------

JITL-SW1# configure terminal

If the aging-time is set to 0, dynamic entries will
JITL-SW1(config)# mac address-table aging-time ? never be removed from the MAC address table
<0-0> Enter 0 to disable aging (unless manually removed).
<10-1000000> Aging time in seconds

JITL-SW1(config)# mac address-table aging-time 0 ?

routed-mac Set RM Aging interval The aging-time can be configured per VLAN.
vlan VLAN Keyword
<cr>

JITL-SW1(config)# mac address-table aging-time 0

JITL-SW1(config)# do show mac address-table aging-time

Global Aging Time: 0
Vlan Aging Time
---- ----------
 MAC Address Table - Learning
JITL-SW1# show mac address-table learning

VLAN Learning Status

---- ---------------
1 yes
10 yes Dynamic MAC address learning is enabled
on all VLANs by default.
11 yes
12 yes
13 yes
14 yes

JITL-SW1# conf t

JITL-SW1(config)# no mac address-table learning vlan 10,12-14

JITL-SW1(config)# do sh mac address-table learning

VLAN Learning Status

---- ---------------
1 yes
10 no
11 yes
12 no
13 no
14 no
 MAC Address Table – Static Configuration
JITL-SW1# show mac address-table
Mac Address Table
--------- ----------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 001c.7faf.a165 DYNAMIC Fa0/1
1 d8bb.c1cc.ff76 DYNAMIC Fa0/3 mac address-table static mac-address vlan vlan interface interface

JITL-SW1# conf t

JITL-SW1(config)# mac address-table static aaaa.aaaa.aaaa vlan 1 interface f0/1

JITL-SW1(config)# mac address-table static d8bb.c1cc.ff76 vlan 1 drop

JITL-SW1# show mac address-table

Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 001c.7faf.a165 DYNAMIC Fa0/1
1 aaaa.aaaa.aaaa STATIC Fa0/1
1 d8bb.c1cc.ff76 STATIC Drop
 MAC Address Table – Clearing dynamic addresses
JITL-SW1# show mac address-table dynamic
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 aaaa.aaaa.aaaa DYNAMIC Fa0/4
1 bbbb.bbbb.bbbb DYNAMIC Fa0/4
This command is entered in privileged exec mode.
JITL-SW1# clear mac address-table dynamic ?
address address keyword
interface interface keyword
vlan vlan keyword
<cr>
JITL-SW1# clear mac address-table dynamic

JITL-SW1# show mac address-table dynamic

Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----
 MAC Address Table – Count
JITL-SW1# show mac address-table
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- -----
All 0100.0ccc.cccc STATIC CPU
All 0100.0ccc.cccd STATIC CPU
All 0180.c200.0000 STATIC CPU
All 0180.c200.0001 STATIC CPU
All 0180.c200.0002 STATIC CPU
All 0180.c200.0003 STATIC CPU
All 0180.c200.0004 STATIC CPU
!some addresses omitted
All 0180.c200.000f STATIC CPU
All 0180.c200.0010 STATIC CPU
All ffff.ffff.ffff STATIC CPU
1 001c.7faf.a165 DYNAMIC Fa0/1
1 d8bb.c1cc.ff76 DYNAMIC Fa0/3
Total Mac Addresses for this criterion: 22

JITL-SW1# show mac address-table count

Mac Entries for Vlan 1:
---------------------------
Dynamic Address Count : 2
Static Address Count : 0
Total Mac Addresses : 2
Total Mac Address Space Available: 4061
 MAC Address Table – Filtering output
JITL-SW1# show mac address-table ?
address Address to lookup in the table
aging-time MAC address table aging parameters
count Number of MAC addresses in the table
dynamic List dynamic MAC addresses
interface List MAC adresses on a specific interface
learning Display learning on VLAN or interface
move MAC Move information
multicast List multicast MAC addresses
notification MAC notification parameters and history table
secure List secure MAC addresses
static List static MAC addresses
vlan List MAC addresses on a specific vlan
| Output modifiers
<cr>

JITL-SW1# show mac address-table dynamic ?

address Address to lookup in the table
interface List MAC adresses on a specific interface
vlan List MAC addresses on a specific vlan
| Output modifiers
<cr>
 Command Summary
SW1# show mac address-table
SW1# show mac address-table aging-time

SW1# show mac address-table learning

SW1# show mac address-table dynamic

SW1# show mac address-table count

SW1(config)# mac address-table aging-time time

SW1(config)# [no] mac address-table learning [vlan vlan]

SW1(config)# mac address-table static mac-address vlan vlan {interface interface | drop}

SW1# clear mac address-table dynamic

 Things we covered
●
OSI Model
●
Collision & Broadcast domains
●
Layer 2 Forwarding
●
MAC Address Table
 Quiz 1
How many collision domains are there in the network below?
 Quiz 1
How many collision domains are there in the network below?

= 8 collision domains
 Quiz 2
How many broadcast domains are there in the network below?
 Quiz 2
How many broadcast domains are there in the network below?

= 7 broadcast domains
 Quiz 3

Which of the following Ethernet header fields does a switch use to make a forwarding decision?

a) Source MAC address

b) Destination MAC address

c) Source IP address

d) Destination IP address
 Quiz 4

Which of the following message types is NOT flooded by a switch?

a) Broadcast

b) Multicast

c) Unknown unicast

d) Known unicast
 Quiz 5

Which of the following commands can be use to disable dynamic MAC address aging?

a) SW1(config)# no mac address-table aging-time

b) SW1(config)# mac address-table aging-time 0

c) SW1(config)# mac address-table aging-time disable

d) SW1(config)# mac address-table aging-time drop