Progress Update: VTP, Native VLANs, OSPF and DHCP

Over the last week, major changes have gone on with the project topology. I was able to finalize the VLAN and VTP configuration of the layer 2 LANs. This consisted of finalizing the VTP server selection, writing commands in preparation of configuring the devices as well as researching further into VTP across two separated LANs. I discussed VTP across two separated sites with my supervisor who informed me that it isn't industry practice to do this and the preferred approach would be to run separate VTP instances for each layer 2 segment.  This was a much easier problem to solve as it included configuring two VTP servers to suit each site as opposed to introducing VPN and L2TP tunnels.

VLAN Trunking Protocol (VTP)

Our project covers designing a new topology to cover a new faculty being implemented in a campus environment. So the VTP servers were configured to run within the domain "FACULTY". The commands listed below show how I configured the VLANs and VTP server for each site, and following that are the commands configured on the 'client' switches.

#CONFIGURING THE VTP SERVER

hostname BAS1
!
vlan 10
 name STUDENTS
!
vlan 20
 name STAFF
!
vlan 30
 name REGISTRY
!
vlan 35
 name PAYROLL
!
vlan 40
 name MANAGEMENT
!
vlan 50
 name GUESTWRLS
!
vlan 100
 name STAFFWRLS
!
vtp mode server
vtp domain FACULTY
vtp version 2
vtp password FACULTY
end

#CONFIGURING A VTP CLIENT

hostname BA1S 
!
vtp mode client
vtp domain FACULTY
vtp password FACULTY

Upon reloading the VTP clients, they will come back up with the VLANs from the VTP server filling it's own VLAN database. Any changes made to the server will be propagated to the clients, with the clients sharing the same database revision as the server.

To further the configuration of the layer 2 segment, the native VLANs used by the layer 2 etherchannel interfaces were changed from the default VLAN 1 to VLAN 40 which was named "MANAGEMENT". Separating the VLAN traffic from the default VLAN allows security for traffic traversing the LAN, where attackers would consider sniffing VLAN 1 without knowing which VLAN currently distributes trunking data. To configure an alternative native VLAN, it is best practice to shut down the ports/interfaces before configuring.

#CONFIGURING A NATIVE VLAN

hostname BA1S
!
interface port-channel1
 switchport trunk native vlan 40 #configuring native vlan as MANAGEMENT VLAN

OPEN SHORTEST PATH FIRST (OSPF)

A routing protocol is something that we haven't looked over for a few months as configuring the layer 2 LANs were paramount and routing across the backbone was as simple as adding three commands under the global configuration and it totally slipped my mind until today. The configuration has changed since this post and is currently configured as the following:

hostname CENS1
!
ip routing
!
router ospf 1
 network 10.0.2.0 0.0.0.63 area 1

Dynamic Host Configuration Protocol (DHCP)

In order to finalize the host computers connectivity with the rest of the network and allocate addressing without too much trouble, DHCP must be configured in order to dynamically allocate IP addresses from a pool amongst clients who request the addresses. At this time, we've only been able to configure a test server with a Cisco 2800 series router configured with a static route and plugged into CENS1's interface FastEthernet0/24. In order to continue with allocating the address amongst host computers on either sites, an IP helper address must be configured on the exit switches. Unfortunately Tavita and I haven't managed to get it working yet, but that is on the cards for tomorrow. So far our configuration for the DHCP server is as follows:

hostname DHCP-SERVER
!
ip dhcp pool STUDENTS
 network 10.2.0.0 255.254.0.0
 default-router 10.3.255.253 10.3.255.254
 domain-name STUDENTS
ip dhcp pool STAFF
 network 10.1.0.0 255.255.0.0
 default-router 10.1.255.253 10.1.255.254
 domain-name STAFF
ip dhcp pool REGISTRY
 network 10.0.0.0 255.255.255.128
 default-router 10.0.0.125 10.0.0.126
 domain-name REGISTRY
ip dhcp pool PAYROLL
 network 10.0.0.128 255.255.255.128
 default-router 10.0.0.253 10.0.0.254
 domain-name PAYROLL
ip dhcp pool GUEST
 network 10.100.0.0 255.255.0.0
 default-router 10.100.255.253 10.100.255.254
 domain-name GUEST
!
ip dhcp excluded-address 10.3.255.253 10.3.255.254
ip dhcp excluded-address 10.1.255.253 10.1.255.254
ip dhcp excluded-address 10.0.0.125 10.0.0.126
ip dhcp excluded-address 10.0.0.253 10.0.0.254
ip dhcp excluded-address 10.100.255.253 10.100.255.254
!
service dhcp

That's all for now. I will continue on regarding DHCP in a later post as currently, the above configuration isn't implemented or tested. However I will be testing it in the lab tomorrow and will confirm whether it's working.