The question from Wednesday is pretty straightforward in part because of the limited amount of detail about LAN switching that’s included in the CCENT (ICND1 exam) exam topics. In fact, I decided to show you this question first, just to make the point that switch forwarding questions for CCENT can be pretty simple – and then next week we’ll hit a CCNA-level switch forwarding question, which can frankly be quite a bit more complex.
Why so straightforward for CCENT? Well, Spanning Tree isn’t covered, and VLANs are only covered to a basic conceptual level, and VLAN trunking is not covered other than the basic concept. To make Wednesday’s question more CCENT-ish, I worded it to avoid STP, VLANs, VLAN trunks. So, let me take a few words to explain the answer to Wednesday’s question, and point out one significant gotcha to avoid for the CCENT (ICND1) exam.
First, a quick explanation of the right answer, which is answer D (3) for those of you who wanted to see the literal answer. More importantly, the concept is that we know the frame entered SW1 from PC1, and that the frame’s destination MAC address is 0200.4444.4444. All interfaces were stated to be “up”, so the incoming frame could be received and processed. Switches flood broadcast frames and unknown unicast frames, “unknown” meaning that the frame’s destination address is not in the MAC address table. On SW1, 0200.4444.4444 is unknown, so SW1 floods the frame. In this case, that means it forwards the frame out both Fa0/2 and Fa0/8. SW1 does not forward the frame out Fa0/1, because it never forwards frames, even broadcasts, out the interface in which the frame arrived. So, in regards to the question text, which asks for the number of interfaces OUT which the frame is forwarded, that’s 2 output interfaces.
Once the frame arrives at SW2, SW2 goes through the same logic of trying to forward the frame based on the destination MAC address. In this case, since 0200.4444.4444 is in SW2’s MAC table (called a known unicast frame), so SW2 forwards the frame out only that interface. That’s 1 more output interface, giving a total of 3 output interfaces for both switches combined. (That’s true regardless of my typo in the question from Wednesday’s question.)
Now, let’s just say that you had this same question on the exam, but it was a Simlet question. You only did the show mac address-table dynamic command on both switches, and saw the same output that I listed on Wednesday’s blog posting. The part that could’ve made you miss the question was port security, which based on how I interpret the ICND1 and ICND2 exam topics, is fair game on both exams.
Briefly, Port Security, makes the switch monitor the source MAC address of incoming frames. It can limit the number of MAC addresses, and it can permit traffic sourced by specific MAC addresses. For example, port security could be configured to limit an interface to have a single MAC address associated with in the MAC address table, and that specific MAC address can be configured – essentially telling the switch that the only frames allowed to come in an interface are frames with that configured MAC address. It can also be configured to either shutdown the interface when an offending frame arrives, or to just discard the offending frame, leaving the interface up.
So, there’s actually a couple of things you’d need to look for on this same question, worded the same way, but with a Simlet interface. First, MAC addresses configured with port security don’t show up in the output of the show mac address-table dynamic command. These entries are listed with the static MAC addresses, so just do the same command but leave off the “dynamic” keyword. For example, 0200.4444.4444 could have actually been in SW1’s MAC table, just not seen with the show mac address-table dynamic command. The other gotcha that could happen on questions like this is that port security just discarded the frame, without failing the interface.
Short version – for ICND1, for switch forwarding questions, be ready to keep an eye out for all MAC table entries (leave off the dynamic keyword), and also check for any port security – both of which could impact where and if a frame is forwarded.
Have a good weekend – next week, I’ll kick it up a notch, and look at an ICND2-level switch forwarding question.
