October | 2016 | Miftah Rahman (Go)-Blog

Baru sadar…gw pernah posting MSTP, tapi config2 STP lain engga pernah dibahas wkwkwk

Theory here… , MSTP (and FlexLinks) here…

Yang kita bahas:

Changing Root Bridge ID (by modifying priority or value itself) (*)
Changing STP modes (-)
Tuning STP by STP Toolkits
- PortFast (and EdgePort) (*)
- BPDU Guard (*)
- UplinkFast & BackboneFast
- BPDU Filter
- Root Guard
- Loop Guard & UDLD
Err-Disable Recovery (*)
Changing STP Port Cost (-)
- Path Cost Method
Changing STP Port Priority (-)
Changing STP Link Type
Changing STP Timer
Changing STP Diameter

(*) = Lab-nya ada di Official Course CCNAv3

(-) = Only Theory Mentioned in Official Course CCNAv3

Lets start…here’s the initial topology

===========================

Changing Bridge ID

Digambar atas kita bisa liat bahwa SW1 bukan root bridge…how we change that

First Technique…changing root priority

Verifikasi

By default Root Bridge ID yang tadinya 32768 dirubah jadi 24576, klo pake command “root secondary“(buat backup primary) jadinya 28672

Disitu kok 24577 Man? Bridge ID + VLAN ID…24576 + 1 (nomor VLAN “1”) jadi 24577

Second Technique…changing the Bridge ID value itself

Hanya bisa diisi pake kelipatan 4096, why? Kelipatan 16

STP pake BPDU message yang isinya Root Bridge ID (8 byte) buat handle protocol STP, dimana 2 byte (16 bit) pertama buat bridge ID, 6 byte (48 bit) buat mac-address

1 byte = 8 bit, 2×8 = 16 bit…masa mesti gw ingetin juga

16 bit = nilainya bisa dari 0 sampe 65535, so…65536/4096 = 16…kelipatan 16 bit

Verifikasi topology

…kita liat bahwa SW1 sudah jadi root bridge (note: packet tracer v6 suka error GUI/display STP nya…kadang ijo semua X_X)

=============

Changing STP modes

Ada 3 mode yang bisa kita pilih: PVST (default), rapid-pvst, dan MST (packet tracer ga ada MST)

Sekarang kita rubah modenya jadi “spanning-tree mode rapid“, dan ketika kita show…

Spanning tree enabled protocol rstp…kok bukan rapid-pvst? Rapid itu maksudnya rapid pvst…

Klo PVST+ (default STP mode) tulisannya “spanning tree enabled protocol ieee”

================

PortFast

Biasanya ketika kita colok kabel ke port switch kan “oren” dulu tuh..baru “ijo”

Ini karena ada STP timer lg ngecek BPDU yang masuk, total “waiting time”-nya 50 detik (pake PVST biasa loh ya, bukan rapid…dia mah cepet)

Nah, kita bisa bikin STP ga ngecek BPDU, alias ga ada waiting time dari oren ke ijo…

Ada 2 cara:

Nah, Pake portfast itu bikin switch “skip” BPDU checking, makanya ada “caution”…jgn coba2 dipasang itu port ke switch lain…

Bisa juga di config secara global buat semua interface…

Tes colok aja sendiri…di packet tracer pun bisa

=============

BPDU Guard

Lalu klo port yang dipasang portfast tiba2 dicolok switch lain gimana? Bisa berabe tuh…

Pasang BPDU Guard, ada 2 cara:

Important note: klo di Rapid-PVST, BPDU Guard ini ga perlu, karena begitu port yang dipasang portfast nerima BPDU, maka status portfast-nya hilang, hence named: EDGEPORT (jadi klo di Rapid PVST lu cuma ngasih konfig portfast aja…ga perlu BPDU Guard)

Kita liat config int fa1/0/1-nya

Kesimpulannya klo kita pake PVST+, portfast sama bpdu guard pasti digandeng konfig-nya

Lets verify…gw pake Kali Linux, trus kirim BPDU kesana

Hasilnya…

Kita cek pake “show interface status”

Trus klo restorenya gimana? Klo ga sengaja gimana? Bisa auto recovery ga? Bisa

============

ErrDisable Recovery

Default interval untuk auto port recovery itu 300 detik, kita bisa change MINIMUM 30 detik

Apa aja yang bisa di recover selain bpduguard? Tiap seri switch mungkin beda2…

Coba ketik “show errdisable detect”

Kita bisa liat tipe error apa aja yang kita setting untuk auto recover

Nyok kita liat tipe error apa aja yang kita set auto recovery…

============

UplinkFast and BackboneFast

2 tool ini HANYA dipake di PVST untuk improve convergence (di RSTP udah built-in)

UplinkFast: biar klo link ijo mati, yang oren (alternate port) langsung ijo

Backbonefast: biar klo link ke ROOT BRIDGE mati, mereka langsung kirim BPDU ke alternate/blocked port trus sama switch penerima BPDU tersebut langsung ngirim RLQ (root link query) message untuk nyari siapa yang jadi Root Bridge selanjutnya (skip 20 second of max_age timer that cause other non-Root bridge become root-bridge itself)

Verification

===========

BPDU Filter

Simple…to prevent switch generating BPDU

Why disable? Isn’t dangerous? Take a look at this design…

============

Root Guard

This configuration is to prevent Root Bridge from being changed (changing Root Bridge can change STP topology, which switchport is blocked or which switchport is forwarding)

===========

Loop Guard and UDLD (Uni-Directional Link Detection)

What if switch on the other side not sending BPDU because software problem? Loop Guard is the answer

What if switch on the other side not sending BPDU because cable mis-wiring (typically in Optical Cable)? UDLD is the answer

Recommend? Enabled them both

Or enabled them globally

Bedanya apa udld biasa sama agresif? yang biasa hanya “nge-detect” alias Cuma ngasi informasi bahwa ini link uni-directional (undetermined port state), sedangkan yang agresif begitu detect uni-directional langsung coba attempt koneksi lagi (ngirim 8 frame per detik), klo switch tetangga ga respon juga maka akan dijadiin “errdisable” itu port

Best-practices? Aggressive mode…if distruptive (switch hang/lambat/not-responding), switch into normal state (enable state), ga kuat kayaknya dijadiin agresif wkwkw

And config on both side!! (udld beda mode gpp), biar sama2 bisa detect

============

STP Port Cost

STP Always calculated port cost first (baca: link bandwidth), lower the value the better priority

So…how can we change FastEthernet to lower it cost

Default cost dari STP ditentukan oleh IEEE (ya…hapalan mati…)

=================

STP Pathcost Method

1 Gbit dengan cost 4 itu pake STP short method (default), pake long-method 1 Gbit itu cost-nya 20,000

Kok bisa ada long sama short? Bandwidth makin lama makin gede value-nya…klo pake metode short…susah nanti yg 40gbit, 100gbit, atau 1terabit (short pake 16-bit, 16 bit max value kan 0-65355)

Kasus yang sama kek OSPF “auto-cost refrence-bandwidth”

Taken from cisco.com:

Gantinya gimana? On all-switch (if they have any link greater than 10gbit, long mode is a must)

Note: MST use long method by default, PVST use short method

===================

STP Port Priority

Lemme show you the picture

My Question…if we didn’t configure EtherChannel, how STP can decide which port to block? The port priority (jangan kebalik2 antara port cost sama port priority)

By default…the higher the port number is, the higher chance to be blocked

Here’s the pic from SW3:

How we change it? On SW4…to influence SW3 which port to be blocked (don’t do it in SW3)

SW4 interface fa0/2 konek ke SW3…change the priority there…

Kita juga bisa ketik “spanning-tree port-priority [value]” (without vlan) on interface configuration but packet tracer doesn’t have that command.

Lets see the effect

Lets see if port state changed or not

Previously on SW3 is Fa0/2 that blocked, let see now…

Fa0/1 blocked…because it heads to SW4 higher number priority number switch port

=============

STP Link Type

Theres 2 link type of STP: P2p (point-to-point) and Shr (shared)

STP determine what type of link depends on what kind of duplex other side is using

Full Duplex use P2p and Half Duplex use Shr (which is Hub kind of device)

How we can change it? For what impact we aim for?

Lets see the effect

According to Scott Morris #4713, RSTP hanya bisa “kerja cepat” klo link-nya point-to-point, jadi klo lo mau “maksa” link Shared untuk achieve rapid transition phase in RSTP environment…then do it

(Most of switches today is full duplex though)

=================

STP Timer

Hello-time: switch kirim BPDU by default tiap 2 detik, bisa kita tune jadi 1-10 detik

Forward-time: waktu yang dibutuhkan dari listening ke learning (default 15 detik), bisa kita tune jadi 4-30 detik

Max-Age: “masa hidup” BPDU yang disimpen diswitch, klo expired, dibuang…untuk hemat RAM (default 20 detik), bisa kita tune jadi 6-40 detik

But remember, Setting time too fast, although it ensure STP stability…it means more BPDU will be processed (lets say you tune STP hello from 2s into 1s), more CPU load

Set this timer in Root Bridge Switch only (all other switch will use timer from Root Bridge)

==============

STP Diameter

Biasa nge-lab STP paling 3 switch kan? Atau 4 switch?…pernah 7 ga?!? Nyambung semua jadi satu lingkaran wkwkwk

Kita bisa set maksimum “Luas” STP…max 7 switch (4 sampe 5 aja udah mabok…)