Vlan Trunking(VTP) and IP Access List Configuration in Cisco 3560 Layer 3 Switch

New Network Infra Setup - TTP

Requirements,

1. VLANS

2. One layer 3 switch

3. One layer two switch

4. VLANS

1. VLANS
192.168.10.0/24 - For RAD
192.168.20.0/24 - For LAN
192.168.30.0/24 - For Cisco
192.168.40.0/24 - For Old Lab
192.168.50.0/24 - For New Lab


Isolated VLAN's


192.168.40.0/24 - For Old Lab
192.168.50.0/24 - For New Lab

6-4: VLAN Trunking Protocol

• VTP sends messages between trunked switches to maintain VLANs on these switches in order to properly trunk.

• VTP is a Cisco proprietary method of managing VLANs between switches and runs across any type of trunking mechanism.

• VTP messages are exchanged between switches within a common VTP domain.

• VTP domains must be defined or VTP disabled before a VLAN can be created.

• Exchanges of VTP information can be controlled by passwords.

• VTP manages only VLANs 2 through 1002.

• VTP allows switches to synchronize their VLANs based on a configuration revision number.

• Switches can operate in one of three VTP modes: server, transparent, or client.

• VTP can prune unneeded VLANs from trunk links.

Enabling VTP for Operation

VTP exists to ensure that VLANs exist on the local VLAN database of switches in a trunked path. In addition to making sure the VLANs exist, VTP can further synchronize name settings and can be used to prune VLANs from trunk links that are destined for switches that do not have any ports active in that particular VLAN.

To manage and configure VTP, use the following steps.

1. Activate VTP on a switch.
1. Specify a VTP domain name:

COS	set vtp domain name
IOS	(privileged) vlan database (vlan_database) vtp domain name -OR- (global) vtp domain name

9. Enable the trunk:

COS	set trunk mod/port [auto | desirable | on |nonegotiate | off]
IOS	(global) interface type mod/port (interface) switchport mode dynamic [auto |desirable] (interface) switchport mode trunk (interface) switchport nonegotiate

VTP Perquisites,

1. Layer 3 switch should be in vtp server mode

2. Layer 2 client switch should be in vtp client mode

3. Both interfaces should be configured as trunk

4. Both switches are in same vtp domain

Layer 3 Interface Configuration

Trunk Port: Fast Ethernet 0/24

192.168.10.0/24 - For RAD - fa0/1 - fa0/4

192.168.20.0/24 - For LAN - fa0/5 - fa0/8

192.168.30.0/24 - For Cisco - fa0/9 - fa0/12

192.168.40.0/24 - For Old Lab - fa0/13 - fa0/16

192.168.50.0/24 - For New Lab - fa0/17 - fa0/20

IP Access Control list

IP-ACL Creation

1. Traffic coming into the switch is compared to IP-ACL filters based on the order that the filters occur in the switch. New filters are added to the end of the IP-ACL. The switch keeps looking until it has a match. If no matches are found when the switch reaches the end of the filter, the traffic is denied. For this reason, you should have the frequently hit filters at the top of the filter. There is an implied deny for traffic that is not permitted. A single-entry IP-ACL with only one deny entry has the effect of denying all traffic.

2. To configure an IP-ACL, you must complete the following tasks:

1. Create an IP-ACL by specifying a filter name and one or more access condition(s). Filters require the source and destination address to match a condition. Use optional keywords to configure finer granularity.

2. Apply the access filter to specified interfaces.

Note:

1. An ACL is a sequential collection of permit and deny conditions that apply to packets. 

2. An ACL contains an ordered list of access control entries (ACEs). Each ACE specifies permit or deny and a set of conditions the packet must satisfy in order to match the ACE. The meaning of permit or deny depends on the context in which the ACL is used.