System Maintenance tasks of Microsoft Fix IT solution center

Automatically diagnose and repair problems with files and folders in Windows.

Click Here

How to Setup VLAN Trunking Protocol (VTP) on Cisco Switches ?

In our last article about VLAN’s (Read ore about it on the What is a VLAN? How to Setup a VLAN on a Cisco Switch article), we learned about how VLAN’s provide greater performance and security for your LAN. Unfortunately, if you have more than a couple of switches, configuring VLAN’s can be a real pain. To make life easier, Cisco developed VLAN Trunking Protocol (VTP). Let’s find out what VTP can do for you.

How can VTP help me?

Say that you have 20 switches in your large office building. On each of these switches, you have four VLAN’s. Without VTP, you have to create each of these four VLANs on each of these switches. With VTP, you only have to create the four VLANs once, on one switch, and all other switches learn about the four VLANs.

In other words, the job of VTP is to distribute VLAN configuration information between all the switches.

How does it work?

The job of VTP is best explained from the perspective of the VTP server. All switches, by default, are VTP servers. The VTP server is where you would create, remove, or modify VLANs.

This VTP server sends an advertisement, across the domain, every 5 minutes or whenever a change is made in the VLAN database. That advertisement contains all the different VLAN names, VLAN numbers, what switches have ports in what VLANs, and a revision number. Whenever a switch receives an update with a larger revision number than the last one it applied, it applies that revision.

Keep in mind that VTP is a Cisco proprietary protocol. So, to use VTP between your switches, you must have all Cisco switches.

VTP Modes

VTP switches can be in three different modes. Those modes are:

• Server – the default where all VLAN adds, changes, and removals are allowed

• Client – where no changes can be made, only new revisions can be received from the VTP server switches.

• Transparent – where local VLAN information can be changed but that information is not sent out to other switches. Transparent switches also do not apply VTP advertisements from other switches but they do forward those advertisements on.

Usually, you would want a few of your core switches to be servers and all remaining remote or access layer switches to be clients. You would only make changes on the server switches and those changes would be propagated to the client switches.

What about pruning?

VTP pruning is the process of not sending IP broadcast traffic for certain VLANs to switches that do not have any ports in that VLAN. The switches that choose not to send these broadcasts know that they can not do this because of VTP. With VTP telling them what ports the other switches have, this switch knows that they don’t have to send them broadcast packets, because they know that the other switches don’t need them.

Pruning saves LAN bandwidth because broadcasts don’t have to be sent to switches that don’t need them.

How do you configure VTP?

To configure VTP, you use the vtp global configuration mode command. With this command you can specify the following:

• VTP domain – the name of the VTP domain. All switches communicating with VTP in the same domain, must have the same VTP domain name.

• VTP mode – either server, client, or transparent

• VTP password – a password to control who can and cannot receive VTP information

• VTP pruning – VTP pruning is either turned on or off

Here is a sample configuration:

To see what is going on with VTP, you can use show vtp status, like this:

Article Summary

In summary, here is what we have learned:

• VTP is used to distribute VLAN configuration information between switches

• VTP is Cisco proprietary and can only be used on Cisco switches.

• By using VTP, you can also prune your VLANs, saving bandwidth

• The command to configure VTP is the global configuration mode command, vtp

• The command to check status is the privileged mode command, show vtp status.

What is a VLAN? How to Setup a VLAN on a Cisco Switch ?

Have you ever wondered what a Virtual LAN (or VLAN) is or been unclear as to why you would want one? If so, I have been in your place at one time too. Since then, I have learned a lot about what a VLAN is and how it can help me. In this article, I will share that knowledge with you.

What is a LAN?

Okay, most of you already know what a LAN is but let’s give it a definition to make sure. We have to do this because, if you don’t know what a LAN is, you can’t understand what a VLAN is.

A LAN is a local area network and is defined as all devices in the same broadcast domain. If you remember, routers stop broadcasts, switches just forward them.

What is a VLAN?

As I said, a VLAN is a virtual LAN. In technical terms, a VLAN is a broadcast domain created by switches. Normally, it is a router creating that broadcast domain. With VLAN’s, a switch can create the broadcast domain.

This works by, you, the administrator, putting some switch ports in a VLAN other than 1, the default VLAN. All ports in a single VLAN are in a single broadcast domain.

Because switches can talk to each other, some ports on switch A can be in VLAN 10 and other ports on switch B can be in VLAN 10. Broadcasts between these devices will not be seen on any other port in any other VLAN, other than 10. However, these devices can all communicate because they are on the same VLAN. Without additional configuration, they would not be able to communicate with any other devices, not in their VLAN.

Are VLANs required?

It is important to point out that you don’t have to configure a VLAN until your network gets so large and has so much traffic that you need one. Many times, people are simply using VLAN’s because the network they are working on was already using them.

Another important fact is that, on a Cisco switch, VLAN’s are enabled by default and ALL devices are already in a VLAN. The VLAN that all devices are already in is VLAN 1. So, by default, you can just use all the ports on a switch and all devices will be able to talk to one another.

When do I need a VLAN?

You need to consider using VLAN’s in any of the following situations:

• You have more than 200 devices on your LAN
• You have a lot of broadcast traffic on your LAN
• Groups of users need more security or are being slowed down by too many broadcasts?
• Groups of users need to be on the same broadcast domain because they are running the same applications. An example would be a company that has VoIP phones. The users using the phone could be on a different VLAN, not with the regular users.
• Or, just to make a single switch into multiple virtual switches.

Why not just subnet my network?

A common question is why not just subnet the network instead of using VLAN’s? Each VLAN should be in its own subnet. The benefit that a VLAN provides over a subnetted network is that devices in different physical locations, not going back to the same router, can be on the same network. The limitation of subnetting a network with a router is that all devices on that subnet must be connected to the same switch and that switch must be connected to a port on the router.

With a VLAN, one device can be connected to one switch, another device can be connected to another switch, and those devices can still be on the same VLAN (broadcast domain).

How can devices on different VLAN’s communicate?

Devices on different VLAN’s can communicate with a router or a Layer 3 switch. As each VLAN is its own subnet, a router or Layer 3 switch must be used to route between the subnets.

What is a trunk port?

When there is a link between two switches or a router and a switch that carries the traffic of more than one VLAN, that port is a trunk port.

A trunk port must run a special trunking protocol. The protocol used would be Cisco’s proprietary Inter-switch link (ISL) or the IEEE standard 802.1q.

How do I create a VLAN?

Configuring VLAN’s can vary even between different models of Cisco switches. Your goals, no matter what the commands are, is to:

• Create the new VLAN’s
• Put each port in the proper VLAN

Let’s say we wanted to create VLAN’s 5 and 10. We want to put ports 2 & 3 in VLAN 5 (Marketing) and ports 4 and 5 in VLAN 10 (Human Resources). On a Cisco 2950 switch, here is how you would do it:

At this point, only ports 2 and 3 should be able to communicate with each other and ports 4 & 5 should be able to communicate. That is because each of these is in its own VLAN. For the device on port 2 to communicate with the device on port 4, you would have to configure a trunk port to a router so that it can strip off the VLAN information, route the packet, and add back the VLAN information.

What do VLAN’s offer?

VLAN’s offer higher performance for medium and large LAN’s because they limit broadcasts. As the amount of traffic and the number of devices grow, so does the number of broadcast packets. By using VLAN’s you are containing broadcasts.

VLAN’s also provide security because you are essentially putting one group of devices, in one VLAN, on their own network.

Article Summary

Here is what we have learned:

• A VLAN is a broadcast domain formed by switches
• Administrators must create the VLAN’s then assign what port goes in what VLAN, manually.
• VLAN’s provide better performance for medium and large LAN’s.
• All devices, by default, are in VLAN 1.
• A trunk port is a special port that runs ISL or 802.1q so that it can carry traffic from more than one VLAN.
• For devices in different VLAN’s to communicate, you must use a router or Layer 3 switch.
• Even if you've worked on Cisco networks for a while, be sure to check out TrainSignal's.

Disable Password Requirements in Windows Server 2003 Domains

Windows Server 2003 provides security policies that ensure that all users select strong passwords. Creating a password policy involves setting the following options in the Default Domain Group Policy object. These policies, with the exception of those settings related to password lifetime, are enforced on all users in a domain.

The default password filter (Passfilt.dll) included with Windows Server 2003 requires that a password:

• Is not based on the user’s account name.
• Contains at least six characters.
• Contains characters from three of the following four categories:
  • Uppercase alphabet characters (A–Z)
  • Lowercase alphabet characters (a–z)
  • Arabic numerals (0–9)
  • Nonalphanumeric characters (for example, !$#,%)

As stated above, this policy is enabled by default.

In some occasions, such as testing, lab-building, classes and so on, you might want to disable this built-in requirement.

Security Warning: Bare in mind that this setting can only be enabled/disabled at the domain level, and NOT on an OU level. Disabling the password requirement for an entire domain will lower your security configuration, and should only be done when absolutely necessary.

In order to disable this requirement you need to edit the Default Domain Policy for your domain.
Go to Administrative tools folder.
Double-click on the Default Domain Security Policy icon.
Note: If for any reason you don't see that icon you can still edit the Default Domain Group Policy from the AD Users and Computers snap-in, or from a GPMC window (if you have GPMC installed - Download GPMC).
Navigate to Security Settings > Account Policies > Password Policy.
Right-click on the Minimum Password Length option in the right pane and select Properties.

Keep the V on the Define Setting selected! Do not remove the V from that check-box. Removing the V will cause the GPO to revert to the default setting, which is what we are trying to remove in the first place.
Enter 0 (zero) for the number of minimum characters required in a password.

Now double-click on the Passwords Must Meet Complexity Requirements option in the right pane.

Again, do not remove the V from that check-box. Instead, select Disabled.
Click OK all the way out and close the GPO window.

In order to refresh the policy type the following command in a CMD window and click ENTER.

gpupdate /force

Done.

Exploring Windows Storage Technologies: DAS, NAS and SAN-Based Solutions

Microsoft Windows storage technologies have evolved over the years to take advantage of new offerings from storage vendors. Internal disk drives have advanced from a few hundred megabytes to over a terabyte. The traditional IDE drives have been joined by SCSI and SATA hard disks offering a variety of options when configuring Windows storage. This article will explore the major storage architectures including Direct Attached Storage (DAS), Storage Area Networks (SAN) and Network Attached Storage (NAS), discussing their benefits and tradeoffs.

When considering the different storage options, you need to keep several things in mind. First, how much storage capacity will you need? Will you be able to add additional storage on-demand? How about data availability – will nightly backups suffice or do you need redundant storage arrays? And finally, how much are you willing to pay for your storage solutions? The answers to these questions will help you to decide what Windows storage technology is right for you.

DAS (Direct Attached Storage):

When Windows servers leave the factory, they can be configured with several storage options. Most servers will contain 1 or more local disk drives which are installed internal to the server’s cabinet. These drives are typically used to install the operating system and user applications. If additional storage is needed for user files or databases, it may be necessary to configure Direct Attached Storage (DAS).

DAS is well suited for a small-to-medium sized business where sufficient amounts of storage can be configured at a low startup cost. The DAS enclosure will be a separate adjacent cabinet that contains the additional disk drives. An internal PCI-based RAID controller is typically configured in the server to connect to the storage. The SAS (Serial Attached SCSI) technology is used to connect the disk arrays as illustrated in the following example.

As mentioned, one of the primary benefits of DAS storage is the lower startup cost to implement. Managing the storage array is done individually as the storage is dedicated to a particular server. On the downside, there is typically limited expansion capability with DAS, and limited cabling options (1 to 4 meter cables). Finally, because the RAID controller is typically installed in the server, there is a potential single point of failure for the DAS solution.

SAN (Storage Area Networks):

With Storage Area Networks (SAN), we typically see this solution used with medium-to-large size businesses, primarily due to the larger initial investment. SANs require an infrastructure consisting of SAN switches, disk controllers, HBAs (host bus adapters) and fibre cables. SANs leverage external RAID controllers and disk enclosures to provide high-speed storage for numerous potential servers.

The main benefit to a SAN-based storage solution is the ability to share the storage arrays to multiple servers. This allows you to configure the storage capacity as needed, usually by a dedicated SAN administrator. Higher levels of performance throughput are typical in a SAN environment, and data is highly available through redundant disk controllers and drives. The disadvantages include a much higher startup cost for SANs, and they are inherently much more complex to manage. The following diagram illustrates a typical SAN environment.

NAS (Network Attached Storage):

A third type of storage solution exists that is a hybrid option called Network Attached Storage (NAS). This solution uses a dedicated server or “appliance” to serve the storage array. The storage can be commonly shared to multiple clients at the same time across the existing Ethernet network. The main difference between NAS and DAS and SAN is that NAS servers utilize file level transfers, while DAS and SAN solutions use block level transfers which are more efficient.

NAS storage typically has a lower startup cost because the existing network can be used. This can be very attractive to small-to-medium size businesses. Different protocols can be used for file sharing such as NFS for UNIX clients and CIF for Windows clients. Most NAS models implement the storage arrays as iSCSI targets that can be shared across the networks. Dedicated iSCSI networks can also be configured to maximize the network throughput. The following diagram shows how a NAS configuration might look.