Yang kita
bahas:
- Changing Root Bridge ID (by modifying priority or value itself) (*)
- Changing STP modes (-)
- Tuning STP by STP Toolkits
- PortFast (and EdgePort) (*)
- BPDU Guard (*)
- UplinkFast & BackboneFast
- BPDU Filter
- Root Guard
- Loop Guard & UDLD
- Err-Disable Recovery (*)
- Changing STP Port Cost (-)
- Path Cost Method
- Changing STP Port Priority (-)
- Changing STP Link Type
- Changing STP Timer
- Changing STP Diameter
(*)
= Lab-nya ada di Official Course CCNAv3
(-)
= Only Theory Mentioned in Official Course CCNAv3
Lets
start…here’s the initial topology
===========================
Changing Bridge ID
Digambar atas
kita bisa liat bahwa SW1 bukan root bridge…how we change that
First Technique…changing root
priority
Verifikasi
By default Root
Bridge ID yang tadinya 32768 dirubah jadi 24576, klo pake command
“root secondary“(buat backup primary) jadinya 28672
Disitu
kok 24577 Man? Bridge ID +
VLAN ID…24576 + 1 (nomor VLAN “1”) jadi 24577
Second
Technique…changing the
Bridge ID value itself
Hanya
bisa diisi pake kelipatan 4096, why? Kelipatan 16
STP pake BPDU
message yang isinya Root Bridge ID (8 byte) buat handle protocol STP, dimana 2
byte (16 bit) pertama buat bridge ID, 6 byte (48 bit) buat mac-address
1 byte = 8 bit,
2×8 = 16 bit…masa mesti gw ingetin juga
16 bit =
nilainya bisa dari 0 sampe 65535, so…65536/4096 = 16…kelipatan 16 bit
Verifikasi
topology
…kita liat
bahwa SW1 sudah jadi root bridge (note: packet tracer v6 suka error GUI/display
STP nya…kadang ijo semua X_X)
=============
Changing STP modes
Ada 3 mode yang
bisa kita pilih: PVST (default), rapid-pvst, dan MST (packet tracer ga ada MST)
Sekarang kita
rubah modenya jadi “spanning-tree mode rapid“,
dan ketika kita show…
Spanning
tree enabled protocol rstp…kok bukan rapid-pvst? Rapid itu maksudnya rapid pvst…
Klo PVST+
(default STP mode) tulisannya “spanning tree enabled
protocol ieee”
================
PortFast
Biasanya ketika
kita colok kabel ke port switch kan “oren” dulu tuh..baru “ijo”
Ini karena ada
STP timer lg ngecek BPDU yang masuk, total “waiting time”-nya 50 detik (pake
PVST biasa loh ya, bukan rapid…dia mah cepet)
Nah, kita bisa
bikin STP ga ngecek BPDU, alias ga ada waiting time dari oren ke ijo…
Ada 2 cara:
Nah, Pake
portfast itu bikin switch “skip” BPDU checking, makanya ada “caution”…jgn coba2
dipasang itu port ke switch lain…
Bisa juga di
config secara global buat semua interface…
Tes colok aja
sendiri…di packet tracer pun bisa
=============
BPDU Guard
Lalu klo port
yang dipasang portfast tiba2 dicolok switch lain gimana? Bisa berabe tuh…
Pasang BPDU
Guard, ada 2 cara:
Important
note: klo di
Rapid-PVST, BPDU Guard ini ga perlu, karena begitu port yang dipasang portfast
nerima BPDU, maka status portfast-nya hilang, hence named: EDGEPORT (jadi klo di Rapid PVST lu cuma ngasih konfig
portfast aja…ga perlu BPDU Guard)
Kita liat
config int fa1/0/1-nya
Kesimpulannya
klo kita pake PVST+, portfast sama bpdu guard pasti digandeng konfig-nya
Lets verify…gw
pake Kali Linux, trus kirim BPDU kesana
Hasilnya…
Kita cek pake “show interface status”
Trus
klo restorenya gimana? Klo ga sengaja gimana?
Bisa auto recovery ga? Bisa
============
ErrDisable Recovery
Default
interval untuk auto port recovery itu 300 detik, kita bisa change MINIMUM 30
detik
Apa
aja yang bisa di recover selain bpduguard? Tiap seri switch mungkin beda2…
Coba ketik “show errdisable detect”
Kita bisa liat
tipe error apa aja yang kita setting untuk auto recover
Nyok kita liat
tipe error apa aja yang kita set auto recovery…
============
UplinkFast and BackboneFast
UplinkFast: biar klo link
ijo mati, yang oren (alternate port) langsung ijo
Backbonefast: biar klo link
ke ROOT BRIDGE mati, mereka langsung kirim BPDU ke alternate/blocked port trus
sama switch penerima BPDU tersebut langsung ngirim RLQ (root link query)
message untuk nyari siapa yang jadi Root Bridge selanjutnya (skip 20 second of
max_age timer that cause other non-Root bridge become root-bridge itself)
Verification
===========
BPDU Filter
Why
disable? Isn’t dangerous? Take a look at this design…
============
Root Guard
This
configuration is to prevent Root Bridge from being changed (changing Root
Bridge can change STP topology, which switchport is blocked or which switchport
is forwarding)
===========
Loop Guard and UDLD (Uni-Directional Link Detection)
What if switch
on the other side not sending BPDU because software problem? Loop Guard is
the answer
What if switch
on the other side not sending BPDU because cable
mis-wiring
(typically in Optical Cable)? UDLD is the answer
Recommend? Enabled them
both
Or enabled them
globally
Bedanya
apa udld biasa sama agresif? yang biasa hanya “nge-detect” alias Cuma ngasi
informasi bahwa ini link uni-directional (undetermined port state), sedangkan
yang agresif begitu detect uni-directional langsung coba attempt koneksi lagi
(ngirim 8 frame per detik), klo switch tetangga ga respon juga maka akan
dijadiin “errdisable” itu port
Best-practices? Aggressive
mode…if distruptive (switch hang/lambat/not-responding), switch into normal
state (enable state), ga kuat kayaknya dijadiin enable wkwkw
And config
on both side!! (udld beda mode gpp), biar sama2 bisa detect
============
STP Port Cost
STP Always
calculated port cost first (baca: link bandwidth), lower the value the better
priority
So…how can we
change FastEthernet to lower it cost
Default cost
dari STP ditentukan oleh IEEE (ya…hapalan mati…)
=================
STP Pathcost Method
1 Gbit dengan
cost 4 itu pake STP short
method
(default), pake long-method 1 Gbit itu cost-nya 20,000
Kok
bisa ada long sama short? Bandwidth makin lama makin gede value-nya…klo pake
metode short…susah nanti yg 40gbit, 100gbit, atau 1terabit (short pake 16-bit,
16 bit max value kan 0-65355)
Kasus yang sama
kek OSPF “auto-cost refrence-bandwidth”
Taken from
cisco.com:
Gantinya
gimana? On
all-switch (if they have any link greater than 10gbit, long mode is a must)
===================
STP Port Priority
Lemme show you
the picture
My Question…if
we didn’t configure EtherChannel, how STP can decide which port to block? The
port priority (jangan kebalik2 antara port cost sama port priority)
By default…the
higher the port number is, the higher chance to be blocked
Here’s the pic
from SW3:
How we change
it? On SW4…to influence SW3 which port to be blocked (don’t do it
in SW3)
SW4 interface
fa0/2 konek ke SW3…change the priority there…
Kita juga bisa
ketik “spanning-tree port-priority [value]”
(without vlan) on interface configuration but packet tracer doesn’t have that
command.
Lets see the
effect
Lets see if
port state changed or not
Previously on
SW3 is Fa0/2 that blocked, let see now…
Fa0/1 blocked…because
it heads to SW4 higher number priority number switch port
=============
STP Link Type
Theres 2 link
type of STP: P2p (point-to-point) and Shr (shared)
STP determine
what type of link depends on what kind of duplex other side is using
Full Duplex use
P2p and Half Duplex use Shr (which is Hub kind of device)
How we can
change it? For what impact we aim for?
Lets see the
effect
According to
Scott Morris #4713, RSTP hanya bisa “kerja cepat” klo link-nya point-to-point,
jadi klo lo mau “maksa” link Shared untuk achieve rapid transition phase in
RSTP environment…then do it
(Most of
switches today is full duplex though)
=================
STP Timer
Hello-time: switch kirim
BPDU by default tiap 2 detik, bisa kita tune jadi 1-10 detik
Forward-time: waktu yang
dibutuhkan dari listening ke learning (default 15 detik), bisa kita tune jadi
4-30 detik
Max-Age: “masa hidup”
BPDU yang disimpen diswitch, klo expired, dibuang…untuk hemat RAM (default 20
detik), bisa kita tune jadi 6-40 detik
But remember, Setting time
too fast, although it ensure STP stability…it means more BPDU will be processed
(lets say you tune STP hello from 2s into 1s), more CPU load
Set this timer
in Root Bridge Switch only (all other switch will use timer from Root Bridge)
==============
STP Diameter
Biasa nge-lab
STP paling 3 switch kan? Atau 4 switch?…pernah 7 ga?!? Nyambung semua jadi satu
lingkaran wkwkwk
Kita bisa set
maksimum “Luas” STP…max 7 switch (4 sampe 5 aja udah mabok…)
=============
