How can I diagnose a bridging (ethernet) loop?

You will probably have MAC addresses flapping between ports.. look for MAC_MOVE_NOTIFICATION (or similar) errors in:
sh logg

Now to find the port:
sh int g0/1 controller
look for out of ordinary Multicast and Broadcast numbers. Any collisions are a bad sign.

Last but not least, you can't log in, because the CPU is pwned :)
sh proc cpu
How is the switch doing here? If it's an L2 switch only, you don't want anything above ~10%



Enable storm control on the ports to limit broadcast

Distribution-Sw1(config)#int  range f0/21 - 24
Distribution-Sw1(config-if)#storm-control multicast level  5
Distribution-Sw1(config-if)#storm-control broadcast level  5

Drop broadcast o multicast level if they are more than 5% of the bandwidth

An alternative action could be  to shutdown the ports:
storm-control action shutdown

Facts to remember about LAN Switching

Etherchannel (Portchannel)

• Bundles individual links (up to 8) into a channel group to create a single logical link 
• All members have to share same features: speed, duplex mode, switchport mode (access, trunk)
• STP will treat it as a one single link, if one link fails there is no STP reconvergence
• Traffic is distributed between members of the port channel if one of them fails
• Etherchannel gives you more pipes for your data but does not increase your transfer speeds
• Established by LACP (active, pasive), PAgP (desirable, auto), Static ( on - persistent)
• Etherchannel verification "show etherchannel summary"

Configure SW1 and SW2 as a portchannel numbered 12, SW1 active mode, SW2 passive mode

SW1:
interface FastEthernet0/23
 channel-group 12 mode active
!
interface FastEthernet0/24
 channel-group 12 mode active

SW2:
interface FastEthernet0/23
 channel-group 12 mode passive
!
interface FastEthernet0/24
 channel-group 12 mode passive




Trunking

• Trunking verification "show interface trunk"

Configure SW1and SW2 portchannels as static 802.1q trunk links

SW1:
interface Port-channel12
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
SW2:
interface Port-channel12
 switchport trunk encapsulation dot1q
 switchport mode trunk

VTP

• VTP verification "show vtp status"

Configure SW1 as a VTP server in the domain CCIE., SW2 should be VTP client. Configure VLANs 21, 22, 121, 122, 124, 221, 222, and 239 on SW1. After that SW2 should learn these VLANs via VTP

SW1:
vtp domain CCIE                       
vtp mode server                       
!
vlan 21,22,121,122,124,221,222,239

SW2:
vtp mode client

Portfast 

• Skips listening and learning stages cause it is supposed these ports will be directly connected to end stations and not to another switch so they will not create bridging loops in the network
• It is also known as Edge port
• The switch will not generate TCNs (topology change notificactions) throughout the spanning-tree domain if interface goes down/up. BEWARE CAUSE TCN NOTIFICATIONS WILL CAUSE EVERY SWITCH IN RSTP FLUSH THEIR MAC ADDRESS TABLES AND RE-LEARNED THEM AGAIN
• If it receives a BPDU immediately loses its edge port status and becomes a normal spanning tree port
• It can be configured in access ports "spanning-tree portfast"or trunk ports "spanning-tree portfast trunk"
• Portfast can be enable by default at global level configuration

SW1:
spanning-tree portfast default
!

Spanning-Tree

• Enable Per-VLAN Rapid Spanning Tree on SW1, SW2
• Configure SW1 as the RPVST root bridge for all configured VLANs.
• Ensure that no topology change notifications are sent throughout the spanning-tree domain if SW1's FastEthernet0/1 interface goes down/up.

SW1:
spanning-tree mode rapid-pvst
spanning-tree vlan 1-4094 priority 0
!
interface FastEthernet0/1
 spanning-tree portfast trunk

SW2:
spanning-tree mode rapid-pvst

STP BPDU Guard

• It is used to enforce access layer security on the termination of the STP domain (access switch)
• When BPDU Guard enable interface receives a BPDU (STP packet), it is transitioned into err-disable state.
• This ensures that unauthorized switches cannot be plugged in to the network (man in the middle attack)
• If configured, the errdisable recovery feature can then be used to bring the interface out of err-disable state automatically after a configured interval
• To verify if bpdu guard is enable, interfaces in err-disable state and time interval "show errdisable recovery" 
• BPDU Guard can also be enabled by default, at the global level to work with Portfast

SW4:
default interface range FastEthernet0/23 - 24
!
interface range FastEthernet0/23 - 24
 channel-group 34 mode active
!
interface Port-channel34
 switchport mode access
 switchport access vlan 10
 spanning-tree bpduguard enable
!
errdisable recovery cause bpduguard
errdisable recovery interval 120

Enabled at global level by default with PorFast

SW4:
spanning-tree portfast bpduguard default 
spanning-tree portfast default

RootGuard

• Like "BPDU Guard", it blocks superior BPDUs (better cost to the root bridge)
• The interface is only logically disabled (via Root Inconsistent state).The switch automatically recovers the port from Root Inconsistent and starts negotiating the new port state and role, as soon as superior BPDUs are no longer received inbound.
• Is is not for access swicthes, It must be configured in all the ports of the ROOT BRIDGE cause all of them are designated ports
• It prevents a Designated port from becoming Non-Designated port
• It can be enabled only at the port level 
• Generally root guard is enable for all VLANS

SW1:
interface range FastEthernet0/19 - 20
 spanning-tree guard root

LoopGuard

• Loop Guard prevents a Non-Designated port from becoming Designated, thus it is the opposite of Root Guard; for this reason Root Guard and Loop Guard cannot be actively enabled at the same time on the same ports
• Blocking states ports can transition to the forwarding state if they don't receive BPDUs from designated ports ( maybe a unidirectional problem). LoopGuard prevents this transisition the port in Loop Inconsistent
• Switch will automatically recover the port from Loop Inconsistent state when it starts receiving BPDUs and the STP port state is re-negotiated.
• Just like Root Guard, although is enabled for a port, Loop Guard takes actions on a per-VLAN level; for example if a trunk port is in blocking state and stops receiving BPDUs for VLAN 2 from the designated port on the segment, it transitions the port into Loop Inconsistent only for VLAN 2
• It can be enabled at global configuration level or interface configuration level

SW1 - SW2:
spanning-tree loopguard default

SW3 - SW4:
interface range FastEthernet0/19 - 20
 spanning-tree guard loop

10 - Multiple spanning tree protocol

HOW DOES MST WORK
- MST works by decoupling VLAN and STP Instance
  - STP instance to VLAN mapping is user defined
  - Topology calculation is done by RSTP
- Result is higher scalability
  - (Rapid)PVST+ uses one instance per VLAN
  - As VLANS scale, control plane dies

MST Regions
- Devices that agree in these three parameters are in the same region
  - Instance name
  - Revision number
  - VLAN to STP instance mappings

Intra vs Inter Region
- Intra Region
   - Details of the region are known within the region
   - VLAN to STPIs are manually defined
   - Undefined VLANS fall into CIST (MST 0)
- Inter Region
  - details between regions are not known
  - Different regions see each other as virtual bridges
  - Result is simplified Inter-region calculation
  - Intra-region MSTIs are collapsed into CIST

MST Configuration
- Define the following in MST configuration mode
  - region name
  - revision number
  - vlan to instance mappings
- Enable MST globally
  - real deployment must start at Root and work out

MST Path Selection
- Same election process as CST/PVST
  - Root bridge
    - Lowest BID
- Root port
  - Lowest cost
  - Lowest upstream BID
  - Lowest port ID

Changing MST Root Bridge Election
- Manually change BID priority
  - spanning-tree mst (instance) priority
  - Lower is better
- use root bridge macro
  - spanning-tree mst (instance) root (primary|secondary)
  - sets local priority based on current root bridge
-Verification
 - show spanning-tree mst (instance)
 - show spanning-tree root

Changing an MST Port's Role
- Modify the port's cost
  - spanning-tree mst (instance) cost
  - bandwidth (bps)
- Modify the brdge ID
  - spanning-tree mst (instance) priority
- Modify the Port ID
  - spanning-tree mst (instance) port-priority
- Verification
  - show spanning-tree interface (int) detail
  - show spanning-tree mst (instance) detail

MST Interoperability
- MST is backwards compatible with legacy CST and PVST+
- behaves like inter-region MST
- CST Root must be within MST domain

9 - RAPID SPANNING TREE PROTOCOL

What is RSTP

- New standard originaly defined in IEEE 802.1w
- Now incorporated as IEEE 802.1D-2004
- Simplifies port sates
- Aditional port roles (alternate, backup, designated ports)
- Rapid convergence based on synchronization process
- Path calculation remains the same


RSTP port states

- Legacy STP uses
  - Disabled
  - Blocking
  - Listenning
  - Learning
  - Forwarding

- RSTP simplifies to
  - Discarding : Dropping frames
  - Learning   : Dropping frames but building the CAM
  - Forwarding : Normal forwarding


RSTP Port Roles

- Root Port & Designated Port (same as before)

- New Roles
  - Alternate
    - Equivalent to uplinkfast port
    - Fast root path recovery
    - Automatic doen't requeire uplink command
    - Operates in the discarding state
  - Backup
    - Backup Designated (downstream) port
    - Activates if the primary designated port fails
    - Operates in discarding stage
  - Edge
    - Equivalent of PVST+ Porfast enabled ports
    - Immediately transitions to forwarding
    - Do not generate TCN for state changes
    - Configured with spanning-tree portfast command for backwards compability
    - If BPDU received, remove age status and generate TCN

- RSTP link types
  - Non edge ports fall into two types:
    - Point to Point (direct connection between the 2 switches)
       full-duplex ports
    - Shared
      - half-duplex ports (connected to hub)
    - Only point-to-point designated ports use the sync process for rapid convergence

- RSTP sync process
  - when a bridge elects a root port it asumes all non-edge ports to be designated
    - all non-edge ports are discarding at this moment
  - bridge sends proposals out all designated ports
    - proposal has port role set to designated
    - proposal contains root bridge info (priority, cost, etc)
  - downstream bridges review this information
    - if thet don't have better paths to the root they agree
    - if they do have it they announce their information
  - when designated port receives agreement, it is unblocked
  - if downstream bridge sends better root information, local bridge changes root port
  - if downstream bridge agrees to upostream proposal then it
    - elects a local root port
    - blocks all non-edge designated ports
    - starts sync process on all designated ports
  - Port blocking is essential in preventing transient loops
  - Sync process ensures all bridges agree on the same root bridge

- RSTP Fault Detection
  - In Legacy STP, BPDU are only generated by the root bridge
    - All otghers bridges forward them on
  - In RSTP, each bridge generate BPDU every hello interval
    - 2 seconds by default
  - if 3 hellos are missed from a neighbor, reconverge begins
    - 6 seconds vs 20 seconds MaxAge
  - MaxAge is used as hop count
    - every bridge sends BPDU's on its own
    - age incremented by every bridge
    - maxAge also used on shared ports for legacy STP backwards compability
  - Faults can be detected faster by means of physical layer signaling


- RSTP Convergence
  - RSTP needs to re-converge when root port is lost
  - If there is an alternate port, it is selected in place of the old root port
    - new root port is then synchronized with downstream bridges
  - If there is no alternate ports and no better info
    - Declare itself as root bridge
    - synchronize this decision
    - possibly adapt to better information
  - RSTP converges slow in meshy and large topologies
  - Root bridges failures may cause slow convergence
  - To ensure fast convergence
    - keep topology small and avoid excessive redundancy
    - Realy on physical layer failure detection not the hellos BPDU's

- RSTP topology change
  - generated when link becomes forwarding
    - originated by the switch that detected the event
    - use special BPDU bit to signal topology change
    - flooded by all switches using reverse path forwarding
 - Flushes mac address table

- RSTP CONFIGURATION
  - Enable RSTP
    - spanning-tree mode rapid-pvst
    - automatically backwards compatible with legacy STP
  - Sync only occurs on P2P non-edge ports
    - Implies link-type must be accurate
    - spanning-tree link-type (point-to-point|shared)
    - spanning-tree portfast (trunk)
  - Path selection remains unchanged
    - root bridge election
    - root port & designated port elections


Notes

- It is a good pratice to put the command "spanning-tree portfast default" (global config), automatically
  recognizes which ports should be running as edge and which ones should be running as point-to-point

8 - Optional spanning-tree features

LEGACY CONVERGENGE OPTIMIZATIONS

- PortFast (also known as edge port)
  - Shouldn't be subject to forward delay
  - Affects TCN (topology change notificactions) generation
  -To enable portfast it has to be done at interface level
      spanning-tree portfast
  -To verify if an interface is portfast
      show spanning-tree int (interface) portfast
  -To enable portfast in all ports (global config) except the ones the switch receive bpdus (good practice)
      spanning-tree portfast default

- UplinkFast
  - Direct root port failure should reconverge inmediately if alternate port available
  - To enable uplink fast (global config)
       spanning-tree uplinkfast
  - One of the side effect of using uplink is the cost increment in the ports of the switch. So that will affect
    the path selecction in other switches

- Backbonefast
  - Indirect failures should start recalculating inmediately


STP FILTERS

- BPDU Filter
  - Filter bpdus in and out
- BPDU Guard
  - If BPDU is received shut port down
- Root Guard
  - Prevent the port advertising a superior BPDU to transition from designated (downstream) to root (upstream) port
  - If superior BPDU is received (better cost to the root bridge) shut port down
  - The difference with bpdu guard is that it shut port down only if receive superiot BPDU
- Filters can be configured globally in conjunction with PortFast


NOTES

- PortFast don't partipate in the spanning tree process so when the link flaps (shutdown), they will not generate
  topology change notificactions (TCN) which flush the cam table in all the switches and flood the network with traffic

7 - SPANNING TREE PROTOCOL

HOW STP WORKS
- Elect one root bridge
- Elect one root port per bridge
- Elect designated ports

ROOT BRIDGE ELECTION
- Switch with the lowest bridge ID in the network becomes the root bridge
- Bridge id contains:
  - Bridge Priority: 0-61440 in increments of 4096
  - System ID Extension 0-4095 (default is the vlan number)
  - MAC Address

CHANGE THE ROOT BRIDGE ELECTION
- Manually change BID priotity
  - spanning-tree vlan (vlan) priority
  - Lower is better
- Use root bridge macro
  - spanning-tree vlan (vlan) root (primary|secondary)
  - sets local priority based on current root bridge
- Verification
  -show spanning-tree vlan (vlan)
  -show spanning-tree root

ROOT PORT ELECTION

- Root port is upstream facing towards root bridge
- Elected based in the lowest root path cost
  - Cumulative cost of all links to get to the root
  - Higher bandwidth - lower the cost
- If tie in cost
  - choose lowest upstream BID
  - chosse lowest upstream port ID

DESIGNATED PORT ELECTION

- Designated port are downstream facing away fron root bridge
- Like root port, election based on
  - Lowest root path cost
  - Lowest BID
  - Lowest port ID
- All other ports go into blocking mode
  - Receive BPDU
  - Discard all other traffic
  - Cannot send traffic

CHANGING THE PORT'S ROLE

- Modify the port's cost
  - spanning-tree (vlan) cost
  - bandwidth
- Modify the bridge ID
  - spanning-tree vlan (vlan) priority
- Modify the port ID
  -spanning-tree val (vlan) port-priority
- Verification
  - show spanning-tree interface (int) detail
  - show spanning-tree vlan (vlan) detail

STP TIMERS

- Timers affect the transition between port states
  - Set only on the root bridge
- Hello
  - How often configuration BPDU's are sent
  - Default 2 seconds
- MaxAge
  - How long to wait in blocking state without hearing a BPDU
  - Default to 20 seconds
- Forward Delay
  - how long to wait in each the listening and learning phases
  - Default 15 seconds

CHANGING STP TIMERS

- Configuration
  - spanning-tree vlan (vlan) hello-time
  - spanning-tree vlan (vlan) forward-time
  - spanning-tree vlan (vlan) max-age
- Verification
  - show spanning-tree vlan (vlan)

Notes
- What ever root bridge is elected for vlan1 will also be the root brifdge for the others stp instances (vlans)
  cause when we advertise the bridge id, we offset the vlan number but the mac adddress remains the same. that means
  if the bridges have the default configuration then the switch with the lowest mac address will become the root bridge

- the root bridge will have all its ports in designated and forwarding state and it will not have root ports,
  we can check that with the command
                                     show spanning-tree

- Designated ports are downstream ports, away fromt the root bridge

- The root bridge set the timer in spanning tree, to check the timers use the command show spanning-tree detail

6 - Layer 2 EtherChannel configuration

ETHERCHANNEL CONFIGURATION

- Go into interface configuration or interface range configuration to group several interfaces an put this command
  channel-group (id) mode (depends on the protocol we will use)
  - modes:
    - active : initiate negotiaition (LACP)
    - auto   : waits for negociation (PAgP)
    - desirable: initiate negotiaition (PAgP)
    - on : Enable etherchannel only
    - pasive: waits for negociation (LACP)

- show etherchannel summary
  - show us the status of the channel, the port members, the negotiation protocol (LACP, PAgP, - (on))

- show etherchannel load-balance : show us the balance method (src-mac, src-ip, etc)
- port-channel load-balance (load balance method): set the load balance method (src-mac, src-ip, etc)
- show lacp neighbor: show us information about the port channel neighbors


TROUBLESHOOTING

- Maybe one of the members of the portchannel is connected to a different switch and bacause of that the portchannel is not coming up
  - Check with "show lacp neighbor" if all the menbers are connected to the same destination switch
  - This only applies if you are working with single chassis etherchannel
- To avoid loops use a portchannel protocol (the same on both sides), mode "on" will not detect loops

5 - Etherchannel

ETHERCHANNEL

HOW IT WORKS

- Two parts
  - Logical Interface representing the link bundle
  - Physical links    menber interfaces part of the link bundle
- Trick the STP so it doesn't see individual menbers but a single portchannel

PROS

- Cheap incremental upgrade solution
- Add link later redundancy

CONS

- Flow can't not be load balance between multiple members of the channel
  - Analogy: It is like adding links to the highway but the speed is the same
- Flows can get polirized to one member

MULTICHASSIS ETHERCHANNEL

- Resolves the single point of failure of having one switch (Single chassis Etherchannel)
- Multichassis forms a logical chassis between two physical switches
- Server thinks has two connections to the same switch
- Cisco proporse three solutions:
  - Stackwise: Can have more than two members limit depends on platform Ej: 9 on 3750-x
  - Vss and vPC are always a pair of switches

ETHERCHANNEL NEGOCIATION PROTOCOL

- Two forms of LAG negotition
  - Port Aggregation Protocol (PAgP): Cisco propietary, LACP pre-standard
  - Link Aggregation Control Protocol (LACP): IEEE standard 802.3ad
-  Static LAG negotiation is possible but not recommend (mode on)
   - If one of the sides is not properly configured can cause a loop
   - EtherChannel Guard mitigate this (part of the spanning tree process)

ETHERCHANNEL NEGOTIATION MODES

- On : No negotiation (the protocols PAgP and LACP are disabled)
- Desirable & auto : Initiate or listen for PAgP
- Actve & Passive  : Iniatiate or listen for LACP

ETHERCHANNEL MODE NEGOTIATION

- On - On  (will not negotiate)
- Desirable - Desirable (will negociate)
- Desirable - Auto (will negociate)
- Active - Active (will negociate)
- Active - Passive (will negociate)

ETHERCHANNEL LOAD BALANCING

- Available load balancing methods are per-platform as
  - source and destination mac address
  - source and destination ip address
  - source and destination layer 4
- Balancing method is locally significant and outbound
  - Mismatch on either end is ok
  - Adjustments are based on traffic patters to avoid polarization

LAYER 2 VS LAYER 3 ETHERCHANNEL

- LAG is independent of the port mode: access, trunk, tunnel, layer3 (no swithport) , etc
- Members ang LAG interface must agree on parameters
- Both members and LAG are layer 3 or layer 2 but no mix

COMMANDS

- channel-group (number) mode (mode)

4 - VTP version 3

VTP3 - ENHANCEMENTS

- Two new modes fix the overwrite problem: Primary and Secondary server
  - Primary server
    - it is the only one authorized to create o delete vlans
    - When you want to make un update promote a server to primary and after the change promote it to secondary
- New advertisments
  - Extended vlans
  - Private vlans
  - MST configuration
- Vtp can now be disabled globally or per link
- A client can't not be promoted to primary server, it has to be promoted to server firt
- You can now turn vtp server off


COMMANDS

- vtp primary mst : promote a switch to primary server in mst
- vtp primary vlan : promote a switch to primary server in mst
- show vtp status
  - Allows check vtp id
  - Allows check vtp id for vlan primary server
  - Allows check vtp id for vlan mst server
- vtp mode server : in vtp version 3 , this is a secondary server an it can't not make changes
- vtp mode off    : turn off vtp in vtp v3

THROUBLESHOOTING

- There can be only one primary server in the domain
- To solve the problem about send vtp pruning request without answer (that disables prunning in the switch allowing all vlans to be in the switch databse)
  you should put "no vtp" at the link level

3 - Vlan trunking protocol (VTP)

VLAN TRUNKING PROTOCOL

- Sincronize vlan creation between switches
- Its not a requirement of ethernet networks
- Doesn't define the broadcast domain
- it is for vlans administration, it has nothing to do with forwarding

VT1 & VT2 operation modeS

- VTP server: create vlans, advertises them (trunk links), installs vlans from other advertisements
- VTP client: no create vlans, advertises them (trunk links), installs vlans from other advertisements
- Transparent: create locally significant vlans, receive advertisement and forwards them,doesn't installs vlans from other advertisements

VTP configuration revision number

- Secuence number for the database
- Highest number wins
- Domain is synchronized when revision numbers are the same in each switch
- Wrong database can overwrite database in all switches if its revison number is the highest
- True for vtp servers and clients
- That's why vtp v1/v2 is rarely used in production

VTP PRUNNING

- Cuts down unnecasary broadcast, unicast, multicast
- Supported in server and client mode
- Vlans 2 -1001 are prune eligible
- Vlans not in the prune list can not be prunned

VTP AUTHENTICATION

- Used for vtp updates validation



COMMANDS

- show vtp status:
  - which versions supports
  - which version is running
  - vtp domain name
  - vtp operation mode (server,client, transparent)
  - Number of existing vlans
  - Let me see the hash

- vtp domain name: set the domain name
- vtp mode transparent :
  - Change the operation mode of the switch to transparent, it doesn't delete the vlans created
  - Change the revision number to 0, which means it doesn't listen for updates to install
  - To forward advertisements it has to be in the same vtp domain

- vtp pruning:
  - enable vtp pruning, only for clients and servers

- show interfaces prunning

- vtp password      : sets the update password in clients and servers

- show vtp password : Checks if password match i all switches


TROUBLESHOOTING

- Transparent mode will not forward advertisements for vlans not created in its local database
- Transparent mode will not forward advertisements when it doesn't have the same domain name
- When a switch doesn't receive a reply for a pruning request, it will install all the vlans in its datbase
  - It happens when the trunk port is connected to a non cisco device, cause vtp is cisco propietary
    - it can be solve manually indicating the vlans allowed in that trunk with the command "switchport       trunk allowed vlans"
- When using prunning make sure there is no transparent switches in the domain
- Sometimes authentication is broken even the passwords are the same
  - This happens cause the hash is different (show vtp status), this is because the hash generation        depends on the revision number
- Domain names are case sensitive

2 - VLANS and Trunking

-------------------------
TYPE OF VLANS
------------------------
STANDARD VLANS
* Range  1 - 1005
* VLAN 1 :
- If a trunk port receives a frame without a tag by default asumes is for vlan 1
- Do not delete it, it is use for exchange in the control plane for a lot of protocols
- VTP will not prune it you have to do it manually from trunks
- It is just for the control plane so don't assign it to any port
- It is a bad design practice use vlan 1 in a trunk
- All ports are assigned for default to vlan 1
* VLAN 1002 - 1005
- its is used in FDDI, Token Ring vlans
- Do not delete it, it is use for exchange in the control plane for a lot of protocols
- VTP will not prune it you have to do it manually from trunks
- It is just for the control plane so don't assign it to any port
- It is a bad design practice use vlan 1002 -1005 in a trunk

EXTENDED VLANS
* Range 1006 - 4094
* Used in VTP transparent mode or VTP version 3
  - VTP version 3 advertises extended vlans when you create them
  - VTP version 3 advertises private vlans
  - Vlans created in transparent mode are locally significant so they must be created in every switch
* There is an internal range which can't not be used but that depends on the platform
INTERNAL VLANS
* Reserverd for internal applications
* This internal range changes on each platform
* To see the numbers used in internal vlans use the command
  - show vlan internal use

---------------------------
CREATING VLANS
---------------------------
* A spanning-tree protocol and mac address table instance is created per each vlan you create
* To check the vlans created use the command "show vlan brief", "show spanning-tree vlan"
* A switch in client mode doesn't allow to create vlans..command "vtp mode client"

----------------------------------
ETHERNET PORT TYPES
----------------------------------

LAYER 2 SWTICHPORTS
* Access 
  - One vlan assigned to it
* Trunk
  - Carry multiple vlans
* Tunnel
  - A vlan into vlan encapsulation - transparent layer 2 VPN
* Dynamic
  - DTP negociate if the port is going to be a trunk or access port

------------------------------
LAYER 2 TRUNKING
-----------------------------

* 802.1Q
  - Open standard
  - Untagged frames are sent to native vlan
* DTP (Dynamic trunking protocol)
  - The switches negociate in a dynamic way which port wil be in trunk mode
* Commands to check trunk ports
  - Show interface trunk
  - Show interfaces switchport (detail information like: which vlan the port belongs, switchport (access, trunk), native vlan etc
  - Show spanning-tree (vlan|interface)

-----------------------
DTP Negociation
----------------------

* Enabled by default
* DTP desirable mode
  - Begins trunking negociation
  - commands:
    - switchport mode dynamic desirable (negociate encapsulation: 802.1Q or isl)
    - switchport mode trunk (encapsulation must be 802.1Q)
* DTP auto mode
  - Waits for trunking negociation
  - Commands : switchport mode dynamic auto

--------------------------------
Disable DTP Negociation
--------------------------------

* Commands:
  - switchport nonegociate
  - switchport mode access
  - switchport mode dot1q-tunnel
* Command to check DTP negociation
  - show interface switchport

------------------------------
Manual Trunk Prunning
------------------------------

* Why prunning?: When there is no vlans in common between the two switches to avoid innecesary broadcast or traffic
* All vlans (1 -4094) allowed to forward over the link
* Command for manual pruning
  - switchport trunk allowed vlan
* Command to check manual pruning
  - show interface trunk
  - show interface switchport

-----------------
Commands
-----------------

* show vlan brief (to check if vlans were created)
* show interface status (quick look of the links status)
* show interface switchport (detail link status)
* show interface trunk (encappsulation, dtp mode, vlans active and forwading)
* show spanning-tree (vlan | interface) (To check if traffic is going to flow out the interface)