Your online network engineer

Port-security on shared hub and err-disable auto recovery

2010-04-22T20:29:00.000-07:00

'
--------- ----------
| switch 1|----------| switch 2 |
--------- Fa0/16 ----------
|
PC1 = 00-0C-F1-xx-xx-xx
PC2 = 00-1D-09-yy-yy-yy

Step 1: (Base configuration)

Switch 2(Edge switch):

Uplink interface: Fa0/16

Fa0/16 config:
switchport access vlan 10
switchport mode access
speed 100
duplex full
spanning-tree portfast disable

Switch 1(Mobile switch):

Uplink interface: Fa0/16
Fa0/16 config:
switchport access vlan 10
switchport mode access
speed 100
duplex full

User interface for PC: Fa0/1, Fa0/2, Fa0/3
Config:
switchport access vlan 10
switchport mode access
speed 100
duplex full
spanning-tree portfast
spanning-tree bpduguard enable

Step 2: (Added port-security on uplink interface of Switch 2)

Added command below on Fa0/16
(config-if)#sw port-security
(config-if)#sw port-security violation shut
(config-if)#sw port-security mac-address sticky
(config-if)#sw port-security maximum 2

Switch 2(Edge switch):

Fa0/16 config:
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
speed 100
duplex full
spanning-tree portfast disable

Step 3: (Connect PC1 to Fa0/1 of Switch1)

PC1----------Fa0/1 Switch1

Findings:
Switch1:
1. Log shows that int Fa0/1 of Swtich1 change status to up
2. sh int status fa0/1 shows that the PC is connected
Switch2:
3. sh run int fa0/16 - added --> switchport port-security mac-address sticky 000c.f1xx.xxxx
4. sh port-security address
-------------------------------------------------------------------
Vlan    Mac Address       Type                Ports   Remaining Age
----    -----------       ----                -----   -------------
10    000c.f1xx.xxxx    SecureSticky        Fa0/16       -

5. sh port-security int fa0/16
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 2
Total MAC Addresses        : 1
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 1
Last Source Address        : 000c.f1xx.xxxx
Security Violation Count   : 0

Step 4: (Connect PC1 and PC2 on Fa0/1 and Fa0/2 respectively)

PC1----------Fa0/1 Switch1
PC2----------Fa0/2 Switch1

Findings:
Switch1:
1. Log shows that int Fa0/2 of Swtich1 change status to up
2. sh int status fa0/2 - shows that the PC is connected
Switch2:
3. sh run int fa0/16 - added --> switchport port-security mac-address sticky 001d.09yy.yyyy
4. sh port-security address
Vlan    Mac Address       Type                Ports   Remaining Age
----    -----------       ----                -----   -------------
10    000c.f1xx.xxxx    SecureSticky        Fa0/16       -
10    001d.09yy.yyyy    SecureSticky        Fa0/16       -
5. sh port-security int fa0/16
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 2
Total MAC Addresses        : 2
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 2
Last Source Address        : 001d.09yy.yyyy
Security Violation Count   : 0

Step 5: (Connect rouged PC with MAC = 00-1D-09-zz-zz-zz on Fa0/3 of Switch1)

PC1----------Fa0/1 Switch1
PC2----------Fa0/2 Switch1
PC3----------Fa0/3 Switch1

Findings:
Switch1:
1. Log shows that int Fa0/3 of Swtich1 change status to up
2. Log shows that int Fa0/16 of Swtich1 change status to down
3. sh int status fa0/3 - shows that the PC is connected
Switch2:
4. Log shows:
02:19:51: %PM-4-ERR_DISABLE: psecure-violation error detected on Fa0/16, putting Fa0/16 in err-disable state
02:19:51: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 001d.09zz.zzzz on port FastEthernet0/16.
02:19:52: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/16, changed state to down
02:19:53: %LINK-3-UPDOWN: Interface FastEthernet0/16, changed state to down

5. sh int fa0/16 status - Uplink interface goes to err-disabled state
Port Name Status Vlan Duplex Speed Type
Fa0/16 err-disabled 10 full 100 10/100BaseTX

Step 6: (Add errdisable auto recovery on switch2 then remove PC3)

(config)#errdisable recovery cause psecure-violation
(config)#errdisable recovery interval 30

Findings:
Switch1:
1. Log shows that int Fa0/3 of Swtich1 change status to down
2. Log shows that int Fa0/16 of Swtich1 change status to up
3. sh int status fa0/16 - shows that the PC is connected
Switch2:
4. Log shows:
02:29:07: %PM-4-ERR_RECOVER: Attempting to recover from psecure-violation err-di
sable state on Fa0/16
02:29:10: %LINK-3-UPDOWN: Interface FastEthernet0/16, changed state to up
02:29:11: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/16, chan
ged state to up

5. sh int fa0/16 status - Uplink interface goes to connected state
Port Name Status Vlan Duplex Speed Type
Fa0/16 connected 10 full 100 10/100BaseTX

-------------- ---------------

| switch 1|----------| switch 2 |

-------------- ---------------

PC1 = 00-0C-F1-95-08-73

PC2 = 00-1D-09-05-6A-CD

Step 1: (Base configuration)

Switch 2(Edge switch):

Uplink interface: Fa0/16

Fa0/16 config:

switchport access vlan 10

switchport mode access

speed 100

duplex full

spanning-tree portfast disable

Switch 1(Mobile switch):

Uplink interface: Fa0/16

Fa0/16 config:

switchport access vlan 10

switchport mode access

speed 100

duplex full

User interface for PC: Fa0/1, Fa0/2, Fa0/3

Config:

switchport access vlan 10

switchport mode access

speed 100

duplex full

spanning-tree portfast

spanning-tree bpduguard enable

++++++++++++++++++++++++++++++++++++

Step 2: (Added port-security on uplink interface of Switch 2)

Added command below on Fa0/16

(config-if)#sw port-security

(config-if)#sw port-security violation shut

(config-if)#sw port-security mac-address sticky

(config-if)#sw port-security maximum 2

Switch 2(Edge switch):

Fa0/16 config:

switchport access vlan 10

switchport mode access

switchport port-security

switchport port-security maximum 2

switchport port-security mac-address sticky

speed 100

duplex full

spanning-tree portfast disable

++++++++++++++++++++++++++++++++++++

Step 3: (Connect PC1 to Fa0/1 of Switch1)

PC1----------Fa0/1 Switch1

Findings:

Switch1:

1. Log shows that int Fa0/1 of Swtich1 change status to up

2. sh int status fa0/1 shows that the PC is connected

Switch2:

3. sh run int fa0/16 - added --> switchport port-security mac-address sticky 000c.f195.0873

4. sh port-security address

-------------------------------------------------------------------

Vlan Mac Address Type Ports Remaining Age

---- ----------- ---- ----- -------------

10 000c.f195.0873 SecureSticky Fa0/16 -

5. sh port-security int fa0/16

Port Security : Enabled

Port Status : Secure-up

Violation Mode : Shutdown

Aging Time : 0 mins

Aging Type : Absolute

SecureStatic Address Aging : Disabled

Maximum MAC Addresses : 2

Total MAC Addresses : 1

Configured MAC Addresses : 0

Sticky MAC Addresses : 1

Last Source Address : 000c.f195.0873

Security Violation Count : 0

++++++++++++++++++++++++++++++++++++

Step 4: (Connect PC1 and PC2 on Fa0/1 and Fa0/2 respectively)

PC1----------Fa0/1 Switch1

PC2----------Fa0/2 Switch1

Findings:

Switch1:

1. Log shows that int Fa0/2 of Swtich1 change status to up

2. sh int status fa0/2 - shows that the PC is connected

Switch2:

3. sh run int fa0/16 - added --> switchport port-security mac-address sticky 001d.0905.6acd

4. sh port-security address

Vlan Mac Address Type Ports Remaining Age

---- ----------- ---- ----- -------------

10 000c.f195.0873 SecureSticky Fa0/16 -

10 001d.0905.6acd SecureSticky Fa0/16 -

5. sh port-security int fa0/16

Port Security : Enabled

Port Status : Secure-up

Violation Mode : Shutdown

Aging Time : 0 mins

Aging Type : Absolute

SecureStatic Address Aging : Disabled

Maximum MAC Addresses : 2

Total MAC Addresses : 2

Configured MAC Addresses : 0

Sticky MAC Addresses : 2

Last Source Address : 001d.0905.6acd

Security Violation Count : 0

++++++++++++++++++++++++++++++++++++

Step 5: (Connect rouged PC with MAC = 00-1D-09-0D-C4-21 on Fa0/3 of Switch1)

PC1----------Fa0/1 Switch1

PC2----------Fa0/2 Switch1

PC3----------Fa0/3 Switch1

Findings:

Switch1:

1. Log shows that int Fa0/3 of Swtich1 change status to up

2. Log shows that int Fa0/16 of Swtich1 change status to down

3. sh int status fa0/3 - shows that the PC is connected

Switch2:

4. Log shows:

02:19:51: %PM-4-ERR_DISABLE: psecure-violation error detected on Fa0/16, putting Fa0/16 in err-disable state

02:19:51: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 001d.090d.c421 on port FastEthernet0/16.

02:19:52: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/16, changed state to down

02:19:53: %LINK-3-UPDOWN: Interface FastEthernet0/16, changed state to down

5. sh int fa0/16 status - Uplink interface goes to err-disabled state

Port Name Status Vlan Duplex Speed Type

Fa0/16 err-disabled 10 full 100 10/100BaseTX

++++++++++++++++++++++++++++++++++++

Step 6: (Add errdisable auto recovery on switch2 then remove PC3)

(config)#errdisable recovery cause psecure-violation

(config)#errdisable recovery interval 30

Findings:

Switch1:

1. Log shows that int Fa0/3 of Swtich1 change status to down

2. Log shows that int Fa0/16 of Swtich1 change status to up

3. sh int status fa0/16 - shows that the PC is connected

Switch2:

4. Log shows:

02:29:07: %PM-4-ERR_RECOVER: Attempting to recover from psecure-violation err-di

sable state on Fa0/16

02:29:10: %LINK-3-UPDOWN: Interface FastEthernet0/16, changed state to up

02:29:11: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/16, chan

ged state to up

5. sh int fa0/16 status - Uplink interface goes to connected state

Port Name Status Vlan Duplex Speed Type

Fa0/16 connected 10 full 100 10/100BaseTX

spanning-tree portfast default and spanning-tree portfast bpduguard default

2010-04-06T18:36:00.000-07:00

'
I was trying to simulate this two command:

spanning-tree portfast default
spanning-tree portfast bpduguard default

Before going into details let me give you a little background on this two command:

spanning-tree portfast default – It’s a global command to set all the switch interface to STP portfast. When you issue the command you will received a warning to disable manually portfast on interface connected to hub, bridge and switch, because if not this will cause a temporary bridging loop.

spanning-tree portfast bpduguard default – It’s a global command to set STP bpduguard on all interface configured with portfast.

Combining the two command it is similar to going to each switch interface and enable portfast and bpduguard.

Our problem at first is how to disable portfast? Do we go to the interface and issue a “no spanning-tree portfast” or “spanning-tree portfast disable”.

What I do is enable “debug spanning-tree events” and “debug spanning-tree pvst+”, this is the only debug spanning option I find relevant to what I'm doing. I first capture debug out without the portfast default command, second I issue the portfast default command and lastly I issue the “spanning-tree portfast disable” on trunk interfaces. I then compare the three output and I can’t seem to find the deference.

I then move forward and issue the “spanning-tree portfast bpduguard default” command. When I try to connect a switch on one of the access interface the switch then moved to err-disabled state. It means the two command are working, I then issue “spanning-tree portfast disable” then refresh the node and the interface switch moved to connected state.

I then conclude that if you use the two global commands above, it will be applied on all interface including trunks and to negate the portfast/bpduguard you need to issue the “spanning-tree portfast disable” on the interface to avoid temporary loop on your L2 network.

Interview w/ AT&T Singapore

2010-03-29T09:52:00.000-07:00

'
I was interviewed last Friday with AT&T Singapore. I was able to talk to Renato Gonzales the Manager and Avil Pinto Team Lead.

Renato first ask me how I’m doing and what I feel. I cordially reply that I’m a little bit nervous. He asks me to rate my self in L2, L3 and security. I said that I will put L2 on top of my list with 9, second will be L3 with 7 and Security with 6.

After that small introduction he introduces me to Avil for the technical interview. He started asking if I just stay at home and prepare for the interview or I go to work. I replied that I went to work since my shift is 6AM-3PM, I was able to work and still have enough time to went home for the interview. Avil throw the following questions below.

Describe VLAN and why it should be used?
How can you allow traffic to traverse from one VLAN to another?
What firewall policy should you create to allow this traffic?
What are the types of NAT?
How can I clear NAT table?
What are the types of Firewall?
Differentiate Firewall and Access List?
What are the STP port statuses?
What’s the STP membership process?
What’s the ARP process?
What’s the TCP connection process?
What layer DNS operates?
What does the OSPF multicast address?
Describe BGP?
If I have connectivity problem between my branch office going to my central office, how should you troubleshoot this issue?

We spent almost an hours for the entire interview. With the very bad telephone voice quality I was glad that finished without any major communication issue.

Renato ask me how do I feel and I laugh and said to him “to tell me how I should feel” then he replied that I’m doing okay. He then proceeds and ask me if I have any question for them. I just then said that I’ve done a few digging on the net and found out that they have many Filipino guys on their team and in fact they have considerable amount of people from Network Team Accenture Philippines and that I was able to find Avil’s Facebook account and able to browse his friend list. They then replied that I’m correct and Avil said that he also from Accenture in India.

I hope I get this job… with the money that I’ll be getting at the same time improve my experience drastically since I’ll be working on a big telecommunication company. I will be expose into a lot of technologies and gain a lot of knowledge and at t he same time be able to provide the needs of my family. Hopefully this job is for me…

Configure switch interface for VMPS DOT1X authentication

2010-03-23T03:23:00.000-07:00

'
PC(w/ Cisco Secure Services Client)--------EdgeSwitch----------ACS(TACACS)---------DomainControler

Edge switch interface configuration below depending on the Cisco Catalyst Switch Model.

For Cisco Catalyst Switch 4500 series:

interface Fa1/1
switchport mode access
switchport voice vlan <Voice VLAN>
speed 100
duplex full
qos trust cos
authentication event no-response action authorize vlan <Guest VLAN>
authentication host-mode multi-host
authentication port-control auto
authentication timer reauthenticate 60
dot1x pae authenticator
dot1x timeout quiet-period 5
dot1x max-req 10
storm-control broadcast level 20.00
storm-control action trap
no cdp enable
spanning-tree portfast
spanning-tree bpduguard enable
end

For Cisco Catalyst Switch 6500 series:
interface Fa1/1
switchport
switchport mode access
switchport voice vlan <Voice VLAN>
speed 100
duplex full
mls qos trust cos
dot1x pae authenticator
dot1x port-control auto
dot1x host-mode multi-host
dot1x timeout quiet-period 5
dot1x timeout reauth-period 60
dot1x max-req 10
dot1x guest-vlan <Guest VLAN>
storm-control broadcast level 20.00
spanning-tree portfast
spanning-tree bpduguard enable
end

Change trunk native VLAN from 1 to 2

2010-03-22T00:57:00.000-07:00

'
SwitchB |----------------trunk---------------|SwitchA

Current Trunk Configuration:

SwitchA:

SwitchA#sh int g0/1 trunk

Port        Mode         Encapsulation Status        Native vlan

Gi0/1       on           802.1q         trunking      1

Port      Vlans allowed on trunk

Gi0/1       1-4094

Port        Vlans allowed and active in management domain

Gi0/1       1-2,10,20,30

Port        Vlans in spanning tree forwarding state and not pruned

Gi0/1       1-2,10,20,30

SwitchB:

SwitchB#sh int g0/1 trun

Port        Mode         Encapsulation Status        Native vlan

Gi0/1       on           802.1q         trunking      1

Port      Vlans allowed on trunk

Gi0/1       1-4094

Port        Vlans allowed and active in management domain

Gi0/1       1-2,10,20,30

Port        Vlans in spanning tree forwarding state and not pruned

Gi0/1       1-2,10,20,30

Change Native VLAN on SwitchA:

SwitchA:

SwitchA#conf t

Enter configuration commands, one per line. End with CNTL/Z.

SwitchA(config)#int g0/1

SwitchA(config-if)#switchport trunk native vlan 2

SwitchA(config-if)#

23:32:19: %SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan i

d 1 on GigabitEthernet0/1 VLAN2.

23:32:19: %SPANTREE-2-BLOCK_PVID_PEER: Blocking GigabitEthernet0/1 on VLAN0001.

Inconsistent peer vlan.

23:32:19: %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet0/1 on VLAN0002.

Inconsistent local vlan.

SwitchB:

SwitchB#

23:32:58: %SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan i

d 2 on GigabitEthernet0/1 VLAN1.

23:32:58: %SPANTREE-2-BLOCK_PVID_PEER: Blocking GigabitEthernet0/1 on VLAN0002.

Inconsistent peer vlan.

23:32:58: %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet0/1 on VLAN0001.

Inconsistent local vlan.

Change Native VLAN on SwitchB:

SwitchA:

23:35:22: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking GigabitEthernet0/1 on VLA

N0001. Port consistency restored.

23:35:22: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking GigabitEthernet0/1 on VLA

N0002. Port consistency restored.

SwitchB:

SwitchB#conf t

SwitchB(config)#int g0/1

SwitchB(config-if)#switchport trunk native vlan 2

SwitchB(config-if)#

23:36:01: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking GigabitEthernet0/1 on VLA

N0002. Port consistency restored.

23:36:01: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking GigabitEthernet0/1 on VLA

N0001. Port consistency restored.

Final Trunk Status:

SwitchA:

SwitchA#sh int g0/1 trunk

Port        Mode         Encapsulation Status        Native vlan

Gi0/1       on           802.1q         trunking      2

Port      Vlans allowed on trunk

Gi0/1       1-4094

Port        Vlans allowed and active in management domain

Gi0/1       1-2,10,20,30

Port        Vlans in spanning tree forwarding state and not pruned

Gi0/1       1-2,10,20,30

SwitchB:

SwitchB#sh int g0/1 trunk

Port        Mode         Encapsulation Status        Native vlan

Gi0/1       on           802.1q         trunking      2

Port      Vlans allowed on trunk

Gi0/1       1-4094

Port        Vlans allowed and active in management domain

Gi0/1       1-2,10,20,30

Port        Vlans in spanning tree forwarding state and not pruned

Gi0/1       1-2,10,20,30

Analysis:

When you change the native end of the trunk’s native VLAN both switch will detect VLAN inconsistency (native VLAN mismatch) and put the interface on blocking state on both VLAN 1 and 2, I think other VLAN will continue forwarding data and will not be affected with the configuration. When you then move forward and configure the other end, then the switches detect that the native VLAN mach and consistent the switch then move and unblock the interface forward traffic.

Zenoss and Netscreen global policy training.

2010-03-10T10:41:00.000-08:00

'
My teammate Sherwin Hidalgo conducted a training about Zenoss and Netscreen global policy, during our weekly meeting. He is about to resign and this part of the resignation process.

Zenoss is an open source NMS (Network Management System) We are currently moving to this platform in exchange with our Cisco Works. Cisco's NMS is just unreliable it just sends a lot fo false positive alarms. We just waisted a lot of man hours setting it up and a lot of money for the licence.

Search option at the upper right corner of the window. Just put the device hostname and press enter then the device window page will display. Inside the device windows you have 7 tabs (Arrow Down, Status, OS, Hardware, Software, Events and Perf)
1. Arrow – Inside you can conduct connectivity test from the Zenoss server going to the device like ping and snmpwalk.
2. Status – you can check device basic information like IP address, MAC address etc.
3. OS – you check the device interfaces including the sub interfaces. Click the interface to see the interface utilization graph.
4. Events – you’ll be able to check the alerts generated.
5. Perf – you will be able to check the cpu and memory utilization.
Location option at the lower left corner of the window. Its one of the option under Browse By. Clicking the option menu you will be able to browse the devices by location groups.

Netscreen global policies will be check last on the policy check of the firewall. The order will be below.

Interzone – If the source and destination zones are different (e.g. trust to untrust).
Intrazone – If the source and destination zones are the same, the security device performs a policy lookup in this policy set list. Traffic will flow from one interface to another within the same zone.
Global – If the security device does not find a match, the device then checks the global policy list.

Global policy should be configured per Vsys. This should be used for policies that are common to the entire Vsys (e.g. Access to mail servers, shared internet access). You should place the “Deny Any Any” at the last portion and remove it from Interzone and Intrazone if not the Global policy will not be check.

Change STP VLAN priorities and implement STP root Guard

2010-03-09T05:30:00.000-08:00

'
I created the change below to correct our STP load balancing between the primary core switch and the secondary core switch. Previous implementation incorrectly set the VLAN STP priorities and we have to implement this change before we can add root STP root guard on all uplink ports going to the edge switches. This is done to project our core switches from taking over as the root of our STP domain from any one who will configure a switch connected to the edge with lower priority.

With this implementation we can make sure that only the two core switches (primary and secondary) can only be elected as the root bridge.

----------------------------------------------------
                    | CoreSW1001 | CoreSW1002
---------------+----------------+-----------------
Odd VLAN | 8192                 | 16384
---------------+----------------+-----------------
Even VLAN | 16384              | 8192
----------------------------------------------------

CoreSW1001:

conf t
spanning-tree vlan 215 priority 8192

spanning-tree vlan 202 priority 16384

CoreSW1002:

conf t
spanning-tree vlan 215 priority 16384

spanning-tree vlan 202 priority 8192

-------------------------
enabling STP Root Guard
-------------------------

CoreSW1001:

cont t
int r "all uplink interface"
spanning-tree guard root
end
wr mem

CoreSW1002:

conf t
int r "all uplink interface"
spanning-tree guard root
end
wr mem

Enabling Cisco device to authenticate locally to VTY/Con line

2010-03-05T23:58:00.000-08:00

'
My wife called me yesterday asking how to enable authentication on VTY line using the created local account. I try to walk her thru and ask her some details about the username command with are the command to create local account and password respectively. She said that they already done that part but when they try to remote the device the account and password is not accepted. So the next thing I ask is to check what the config they put inside the VTY line is. Cut the story short we end the call without resolving the issue and I told her that I will simulate this when I arrive at the office.

At round 6PM and I'm already free I decide to go with the simulation using the two catalyst Cisco switch on my cubicle. Setup the switch with the power cable and the console cable connection to my PC. I starting to configure the switch with "username deviceadmin privilege 15 secret 0 MyPasswd" then instead of using the VTY line I decided to use the con lines since I was already connected to it. I enter the con line then try to search the list of available commands, the only command that I find relevant to my problem is the login command with the parameter of local. I use the command save my config the reload the switch.

After the reload I was ask for the user and password so I enter the username information that I just created and it’s was a success. My newly created local account was used to authenticate access to my console. I move further and created another account with lesser privilege and again it was accepted with the limitation of not being able to enter configure terminal. For the complete command please check below.

Commands:

SW01#conf t

SW01(config)#username deviceadmin privilege 15 secret 0 MyPasswd

SW01(config)#exit

Sw01#line con 0

Sw01(config-line)#login local

STP VLAN root primary|secondary 2nd post

2010-03-04T09:17:00.000-08:00

'
I just find out today from my lead that we are not really using the command above as part of our VLAN creation steps instead we statically set VLAN priority to 8192 for the root bridge and 16384 for the secondary root bridge.
We just try to use the Cisco macro command root primary and root secondary because our boss insisted on using it. Now we know that this command give's/set 24576 and 28372 priority value to the root and the secondary root bridge respectively.
I don't really see any problem in using the macro command or setting the priority value by your self as long as your being consistent and not mix the two command in a single setup.

Job Interview with Lawson

2010-03-03T09:29:00.000-08:00

'
I went to Lawson office at Net2 bldg. Bonifacio Global City today for an interview for Network Administrator position. At about 10:30 my contact person from HR named Lara called my name and ask me to follow her on the interview room. She ask me HR stuff like why I'm applying? What am looking for a job? etc. After a short chat with her she endorse me to the technical guys for the technical interview.

Two guys arrived I believed from the network department of Lawson, I wasn't able to get the name of the other guy but the other one named Marku. When they arrive they start going through with my resume, since they only have one copy so i offered the copy that i brought. Marku start by asking me personal and HR type of question like, what i think i need to improve my self? I was caught off gourd with the questions because i was expecting a technical interview. I try to answer all the mushy question with the best of my ability and we get into a little argument when they told me that my answers are contradicting. When we finally went to the technical stuff they only ask me one scenario question and that's it, where done. I think that technical question is just formality they already maid up their mind that I'm not the guy, after the personal question that they thrown at me.

I guess I'm not that good with interview any more but with the questions that was thrown at me with those two BS I think they are not really looking for a technical savvy network engineer, they are more looking for someone to be their PA or something.

Will that's life, applying for a job really sucks all I want right now is to complete my CCNP and have a better chances of being pirated so that i wont have to undergo the whole recruitment process.

STP VLAN root primary|secondary

2010-03-02T05:20:00.000-08:00

'
I just was testing this on live network. We are trying to find out how this Cisco Macro command will be able to set the STP priority. We expect that we get a priority of 8192 for the primary root bridge and 16384 for the secondary root bridge, but after we created a new VLAN and implemented the commands on our primary core switch as the primary root and secondary core as the secondary root and we get the following setting below:

Core1:

Core1#sh run | i span

Spanning-tree vlan 999 priority 24576

Core2:

Core2#sh run | i span

Spanning-tree vlan 999 priority 28372

We really don’t know why this priority setting is deferent from the previous VLAN STP implementations done on the same core switches.

I’ll be posting the answers if I can find out the explanation behind this.