Advanced Switching Concepts

Power over Ethernet

PoE, or Power over Ethernet, allows us to deliver power over the same cable that we deliver data over, and it can actually be delivered straight from the switch. We typically see small devices that may need a data connection into them and may also need power. We may have to plug the device into the wall to give it power, and now we have two cables running to that device, which can be cumbersome to deal with. But it also could be very tricky. For instance, some access points, and maybe some sort of IP b building IP system, are in a difficult to reach place. To get data there might be somewhat expensive, but to get power there could be quite a bit more. Dealing with high voltage lines to get power to a location can get very expensive. So what we can do is deliver power over our Ethernet cables, doing away with the need for a separate power line.

We typically see this with our smaller devices, such as wireless access points that can be in difficult to reach places, but it also could be your desk phone if it's a VoIP phone. You plug the cable into it, there is a discovery that happens between these two devices, and then the switch will deliver power to that device, so that device does not need to be plugged in. That's Power over Ethernet.

Segmentation and VLANs

There are times when you want to group up certain groups of people, or certain workstations, or certain objects within your network into separate networks, which is what's called segmentation. You want to move apart different areas of your network, maybe for some sort of security reason or for management of those services.

An example of this: maybe we have a couple of machines here at your company and they belong to the HR group, and you want your HR group to remain separate from some sales machines over here. Those are two different areas. What you may have to do is get two different switches to manage those two different networks, or we can implement something like VLANs. Another example is you might have devices out there like access points that you want part of a management VLAN that's not part of your regular VLANs. And then you also have a phone out here. We know that phone needs some sort of quality of service involved, so we may want to dump that onto a separate segment that's all by itself, that's not within the other networks, and that allows us to control that data separately. Once again, we could do that with separate switches, which could get very costly, or we can do it through the use of VLANs.

There's a lot to VLANs, and the idea here is just to have an upper level view of what VLANs might look like. Here we have a physical switch right here, and what I can do is say that even though it's one physical switch, I actually want to segment it, or break it into smaller components. So this right here could be a VLAN, or it could act as a separate switch. These four ports and maybe these four ports are separate. Perhaps I have a port right here that I want to be a part of the same VLAN as this port right here. So we can break it up differently, and we can assign these different ports to be part of different VLANs.

In my example, these are the HR ports and are going to connect to HR, versus these right here are the sales ports and are going to connect to sales. This could be an uplink port that connects to other equipment, and this could be what connects to our access point, and perhaps these are not assigned yet. So we have different ports that are assigned to segment that traffic and keep it separated. That's the idea of virtual LANs, or VLANs.

Port mirroring

One thing we may want to do on our networks is monitor the traffic that's going across it. Port mirroring is how to monitor traffic from another port. We've got a router that's connected here, and all devices have to go out that router to get out to the internet. Perhaps we want to monitor that traffic and make sure that there's nothing nefarious either going out or coming into our network. What we can do, if this is on let's say port 8 here, is set up a server on port 7 that mirrors all the traffic that's going out port 8. All of the traffic that's going out port 8 will also be sent to port 7. Then this server right here might have special software that takes that traffic, analyzes it, and starts looking for any kind of behavior that wouldn't be acceptable on the network.

One example of this: I used to work in schools, and any of the traffic that was going out to the internet would also be sent to a server that would take a look at what sites the students were going to. If they found that there was some sort of site that the student was going to that they weren't supposed to be going to, this server then would reply back to that client, that user, and say you're not supposed to be going to that site, that site is blocked. That's an example of port mirroring, where the traffic going out port 8 was also going out port 7 so that a server could monitor that traffic.

Port security

Another thing that can happen on your networks is somebody can take a device into your network, plug it into your switch, and start sniffing out your network, start discovering. In fact, I've actually had security companies that I've worked with give you a little device, and then you'll go and plug that device into your network and it will start scouring your network and looking for holes within your network. So there are devices out there that you don't want plugged into your network, and somehow you want to stop people from plugging those types of things into your network.

That's where port security comes in. For every port on my device, I can lock that port down to only allow a certain number of devices on there, or only allow certain devices that have certain MAC addresses on there, or some sort of authentication that happens per that port. So there are different ways to lock down that port, so that we limit the type of traffic or the type of clients that are going on there. We can somehow limit the traffic that's going to be coming into that port. That's port security. There are a lot of different ways that we can implement port security onto that switch, but somehow we are limiting who can actually connect into those devices and communicate across that switch.

Spanning tree protocol

As our networks grow, so does how complicated our networks can be. Here we have the three-tier core, distribution and access layers, and we have a lot of redundancy within our connections. The problem is that layer 2 doesn't like redundancy, not from an Ethernet standpoint at least. What can happen is you can get loops. As broadcasts happen, a broadcast could go out, could hit a switch, it gets broadcasted in all other directions, and from there you could get what's called a broadcast storm, where these broadcasts just start going in loops and start hitting your whole network. That can actually crumble your network. It could bring it down to its knees. So what you have to do is implement something like spanning tree protocol if you're going to have redundancy in your network.

What spanning tree protocol does is allow these different switches to communicate and find the fastest route to where it needs to go. There will be a lot of communication and it will elect something called a root bridge, and we'll go into all of that as we get further along. But the spanning tree protocol will allow a hierarchy to be established within your network, and then it will actually shut off some of these redundancy lines. However, if something gets severed and communication stops happening, then it will bring up those redundant lines. So it will stop these loops from happening but still allow you to have redundancy within your network.

One other example of STP, even in smaller networks, even when you're not in these big redundant networks: I've had access switches where at the end of the school year at a school, the generators will unplug all the equipment, and then when they go to plug all the equipment back in, a switch will get double plugged into each other, and these devices then will once again create this loop where it creates a broadcast storm and it will the whole network. Even though it's only isolated to a small section of the network, it will the whole network. What spanning tree protocol will do, once again, is recognize when something is plugged into itself and then go through the process of taking one of those lines down, so that you don't have this loop and have your network prone to these broadcast storms.

Maximum transmission unit and jumbo frames

Ethernet has a maximum transmission unit size. Equipment needs to know how big frames are going to come through it, and by default the payload of a frame can only be 1,500 bytes. So we've got a maximum size for that, so the equipment knows how to handle the data that's coming through it.

There are some cases where this is not necessarily the ideal, where we have some fragmentation going on, or we have some really large bytes of data going on. In my example here, I've got a data center that's plugged with top-of-the-rack switching. We've got our servers and we've got the storage. When things are connected into storage, it ends up being larger bytes of data that needs to be sent to these storage units. Because of that, it could be inefficient to have a maximum transmission unit of 1500.

So what we can do is go to those devices, to that network addressable storage, to those servers, to those switches, to all the devices within this local area network, and specify that we want to use jumbo frames. Jumbo frames brings that maximum transmission unit of 1,500 up to 9,000. What that will do is save you some traffic, some overhead, by allowing a much larger maximum transmission unit. So now as these servers are communicating with this storage, it can send much larger bytes.