Configlet: Cisco 3850 Switch Stacking

In this configlet I'll show the few steps needed for a bare minimum switch stack.

A switch stack is when multiple switch are connected via a backplane (stackwise cables) and act as one larger switch. They share a common config and all the interfaces of all the switches are configured via a single running-config.

One of the switches has to be a "master". In this example I'm forcing one switch to be a master by making it's priority the highest value. There is an order that Cisco switches will try, to determine who should be the master, if you don't set any value's manually:

1. The switch that is currently the active switch.
2. The switch with the highest stack member priority value.
3. The switch with the shortest start-up time.
4. The switch with the lowest MAC address.

From Cisco's website:

Some resources from Cisco's website:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/hardware/installation/guide/b_c3850_hig/b_c3850_hig_chapter_010.html#concept_BACF415ABB244A479BB6C803B181560F

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/ha_stack_manager/configuration_guide/b_hastck_3se_3850_cg/b_hastck_3se_3850_cg_chapter_010.html#concept_6E38EA556E8A4A198FD7BBDC159F4B07

Before you begin:

• In this scenario I have 2 switches. 
• The switch I intend to be the master is powered on and running. It currently has an operational running-config.
• The switch I intend to be the non-master is powered off.
• I do NOT care about the configs on the non-master switch.

Check the current priority of the intended master:

Switch01#show switch Switch/Stack Mac Address : 0000.aaaa.aaaa - Local Mac Address Mac persistency wait time: Indefinite                                              H/W   Current Switch#   Role    Mac Address     Priority Version  State ------------------------------------------------------------ *1       Active   0000.aaaa.aaaa     1      V06     Ready

You can see from the above output the priority value is 1 (the lowest). I want this switch to become the master everytime so I will change it to the maximum value of 15 (the highest).

Change the priority on the intended master:

NOTE: These commands are from Privileged-Exec NOT Global Config. You cannot see these configurations in the running-config. Switch01#switch ?   <1-9>  Switch Number Switch01#switch 1 ?   priority  Set the priority of the specified switch   renumber  Renumber the specified switch number   stack     Stack port enable or disable Switch01#switch 1 priority ?   <1-15>  Switch Priority Switch01#switch 1 priority 15 ?   <cr> Switch01#switch 1 priority 15 WARNING: Changing the switchpriority may result in a configuration change for that switch. Do you want to continue?[y/n]y Switch01# Switch01# Switch01#

Verify the priority has changed for intended master:

Switch01#sho switch Switch/Stack Mac Address : 0000.aaaa.aaaa - Local Mac Address Mac persistency wait time: Indefinite                                              H/W   Current Switch#   Role    Mac Address     Priority Version  State ------------------------------------------------------------ *1       Active   0000.aaaa.aaaa     15     V06     Ready

Connect the StackWise cables and power up the second switch. You'll see some console messages similar to what is below.

Nov 11 01:14:07.116: %STACKMGR-1-STACK_LINK_CHANGE: 1 stack-mgr:  Stack port 2 on switch 1 is up Nov 11 01:14:26.152: %STACKMGR-6-SWITCH_ADDED: 1 stack-mgr:  Switch 2 has been added to the stack. Nov 11 01:14:37.742: %STACKMGR-6-SWITCH_READY: 1 stack-mgr:  Switch 2 is ready. Nov 11 01:14:37.748: Starting SWITCH-ADD sequence, switch 2 Nov 11 01:14:39.047: %NGWC_USB_CONSOLE-6-CONFIG_ENABLE: Switch 2: Console media-type changed to default Nov 11 01:14:42.836: %NGWC_PLATFORM_FEP-6-FRU_PS_OIR: Switch 2: FRU power supply A inserted Nov 11 01:14:42.837: %NGWC_PLATFORM_FEP-6-FRU_PS_OIR: Switch 2: FRU power supply B inserted Nov 11 01:15:01.239: SWITCH-ADD sequence complete, switch 2 Nov 11 01:15:03.832: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/1/1, changed state to down Nov 11 01:15:03.832: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/1/2, changed state to down Nov 11 01:15:03.832: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/1/3, changed state to down Nov 11 01:15:03.832: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/1/4, changed state to down Nov 11 01:15:03.833: %LINEPROTO-5-UPDOWN: Line protoc Switch01#ol on Interface TenGigabitEthernet2/1/1, changed state to down Nov 11 01:15:03.833: %LINEPROTO-5-UPDOWN: Line protocol on Interface TenGigabitEthernet2/1/2, changed state to down Nov 11 01:15:03.833: %LINEPROTO-5-UPDOWN: Line protocol on Interface TenGigabitEthernet2/1/3, changed state to down Nov 11 01:15:03.833: %LINEPROTO-5-UPDOWN: Line protocol on Interface TenGigabitEthernet2/1/4, changed state to down Nov 11 01:15:04.769: %PLATFORM_PM-6-FRULINK_INSERTED: 4x1G uplink module inserted in the switch 2 slot 1

The above syslog messages and 'convergence' takes a few minutes. After all the line protocol messages are finished you can from the master switch verify they are stacked.

Verify the Switch Stack:

Switch01#sho switch Switch/Stack Mac Address : 0000.aaaa.aaaa - Local Mac Address Mac persistency wait time: Indefinite                                              H/W   Current Switch#   Role    Mac Address     Priority Version  State ------------------------------------------------------------ *1       Active   0000.aaaa.aaaa     15     V06     Ready  2       Member   0000.bbbb.bbbb     1      V07     Ready Switch01#sho switch neighbors   Switch #    Port 1       Port 2   --------    ------       ------       1        None           2       2         1            None Switch01#sho switch detail Switch/Stack Mac Address : 0000.aaaa.aaaa - Local Mac Address Mac persistency wait time: Indefinite                                              H/W   Current Switch#   Role    Mac Address     Priority Version  State ------------------------------------------------------------ *1       Active   0000.aaaa.aaaa     15     V06     Ready  2       Member   0000.bbbb.bbbb     1      V07     Ready          Stack Port Status             Neighbors Switch#  Port 1     Port 2           Port 1   Port 2 --------------------------------------------------------   1       DOWN         OK             None       2   2         OK       DOWN               1      None Switch01#

VRF Aware IPSEC: IKEv2

This is a follow-up to a previous blog post: VRF Aware IPSEC: IKEv1

I highly recommend Kat Mac's VPN blog series. This lays it out in plan English. Well crafted and beautifully done: https://www.network-node.com/blog/2017/7/24/ccie-security-ipsec-vpn-overview

For the "configlet" we will use the topology below (same as the previous blog post). 2 Routers directly connected (via a swtich), each with a loopback. We want the traffic sourced from a loopback and destined for a loopback to be encrypted via IPSEC tunnels. All other traffic will route without encryption.

The below topology and initial configs are the same from the previous blog post: VRF Aware IPSEC: IKEv1.

CAVEAT: These templates are an example of VRF Aware IPSEC. Each router is using a VRF routing table, NOT THE GLOBAL ROUTING TABLE (GRT)!!!

Basic Initial Configs:

R1:

vrf definition client

 !

 address-family ipv4

 exit-address-family

interface Loopback1

 vrf forwarding client

 ip address 1.1.1.1 255.255.255.255

interface FastEthernet0/0

 vrf forwarding client

 ip address 10.1.1.1 255.255.255.252

ip route vrf client 100.1.1.1 255.255.255.255 10.1.1.2

R2:

vrf definition server

 !
 address-family ipv4
 exit-address-family

interface Loopback100

 vrf forwarding server

 ip address 100.1.1.1 255.255.255.255

interface FastEthernet1/0

 vrf forwarding server

 ip address 10.1.1.2 255.255.255.252

ip route vrf server 1.1.1.1 255.255.255.255 10.1.1.1

IPSEC (IKEv2) Configs:

R1:

access-list 100 permit ip host 1.1.1.1 host 100.1.1.1

crypto ikev2 proposal client

  enc aes-cbc-256

  inte sha256

  group 21

exit

crypto ikev2 policy client

  match fvrf client

  proposal client

exit

crypto ikev2 keyring KEYRING

 peer server

  address 10.1.1.2

  pre-shared-key local cisco

  pre-shared-key remote cisco

exit

crypto ikev2 profile client

 match fvrf client

 match address local interface FastEthernet0/0

 match identity remote address 10.1.1.2 255.255.255.255

 authentication remote pre-share

 authentication local pre-share

 keyring local KEYRING

 lifetime 28800

exit

crypto ipsec transform-set MYSET esp-aes esp-sha-hmac

mode tunnel

exit

crypto map MYMAP 10 ipsec-isakmp

 set peer 10.1.1.2

 set transform-set MYSET

 set ikev2-profile client

 match address 100

exit

int fa0/0

crypto map MYMAP

exit

R2:

access-list 100 permit ip host 100.1.1.1 host 1.1.1.1

crypto ikev2 proposal server

  enc aes-cbc-256

  inte sha256

  group 21

exit

crypto ikev2 policy server

  match fvrf server

  proposal server

exit

crypto ikev2 keyring SERVER_KEYRING

 peer client

  address 10.1.1.1

  pre-shared-key local cisco

  pre-shared-key remote cisco

exit

exit

crypto ikev2 profile server

 match fvrf server

 match address local interface FastEthernet1/0

 match identity remote address 10.1.1.1 255.255.255.255

 authentication remote pre-share

 authentication local pre-share

 keyring local SERVER_KEYRING

 lifetime 28800

exit

crypto ipsec transform-set MYSET esp-aes esp-sha-hmac

mode tunnel

exit

crypto map MYMAP_SERVER 10 ipsec-isakmp

 set peer 10.1.1.1

 set transform-set MYSET

 set ikev2-profile server

 match address 100

exit

int fa1/0

crypto map MYMAP_SERVER

exit

Verify:

R1:

ping vrf client 100.1.1.1 source 1.1.1.1

show crypto ikev2 sa fvrf client [detailed]

show crypto ipsec sa vrf client

R2:

ping vrf server 1.1.1.1 source 100.1.1.1

show crypto ikev2 sa fvrf server [detailed]

show crypto ipsec sa vrf server

Show Output:

R1#show crypto ikev2 sa fvrf client

 IPv4 Crypto IKEv2  SA

Tunnel-id Local                 Remote                fvrf/ivrf            Status

1         10.1.1.1/500          10.1.1.2/500          client/client        READY

      Encr: AES-CBC, keysize: 256, Hash: SHA256, DH Grp:21, Auth sign: PSK, Auth verify: PSK

      Life/Active Time: 28800/41 sec

 IPv6 Crypto IKEv2  SA

R1#show crypto ikev2 sa fvrf client detailed

 IPv4 Crypto IKEv2  SA

Tunnel-id Local                 Remote                fvrf/ivrf            Status

1         10.1.1.1/500          10.1.1.2/500          client/client        READY

      Encr: AES-CBC, keysize: 256, Hash: SHA256, DH Grp:21, Auth sign: PSK, Auth verify: PSK

      Life/Active Time: 28800/54 sec

      CE id: 1001, Session-id: 1

      Status Description: Negotiation done

      Local spi: 21E078A4CC7C3612       Remote spi: 42905DBF44368F78

      Local id: 10.1.1.1

      Remote id: 10.1.1.2

      Local req msg id:  2              Remote req msg id:  0

      Local next msg id: 2              Remote next msg id: 0

      Local req queued:  2              Remote req queued:  0

      Local window:      5              Remote window:      5

      DPD configured for 0 seconds, retry 0

      NAT-T is not detected

      Cisco Trust Security SGT is disabled

      Initiator of SA : Yes

R1#show crypto ipsec sa vrf client

interface: FastEthernet0/0

    Crypto map tag: MYMAP, local addr 10.1.1.1

[ ... OUTPUT REMOVED TO SAVE SPACE ... ]

   protected vrf: client

   local  ident (addr/mask/prot/port): (1.1.1.1/255.255.255.255/0/0)

   remote ident (addr/mask/prot/port): (100.1.1.1/255.255.255.255/0/0)

   current_peer 10.1.1.2 port 500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4

    #pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0

    #pkts not decompressed: 0, #pkts decompress failed: 0

    #send errors 0, #recv errors 0

     local crypto endpt.: 10.1.1.1, remote crypto endpt.: 10.1.1.2

     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0

     current outbound spi: 0x52F8B750(1392031568)

     PFS (Y/N): N, DH group: none

     inbound esp sas:

      spi: 0x522A72A4(1378513572)

        transform: esp-aes esp-sha-hmac ,

        in use settings ={Tunnel, }

        conn id: 2, flow_id: 2, sibling_flags 80000040, crypto map: MYMAP

        sa timing: remaining key lifetime (k/sec): (4179797/3586)

        IV size: 16 bytes

        replay detection support: Y

        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

      spi: 0x52F8B750(1392031568)

        transform: esp-aes esp-sha-hmac ,

        in use settings ={Tunnel, }

        conn id: 1, flow_id: 1, sibling_flags 80000040, crypto map: MYMAP

        sa timing: remaining key lifetime (k/sec): (4179797/3586)

        IV size: 16 bytes

        replay detection support: Y

        Status: ACTIVE(ACTIVE)

VRF Aware IPSEC: IKEv1

I would have included this in the TIWA(Today I Was Asked) series but this isn't actually a solution to a peers problem or an explanation of a solution.

This is more of a point of reference for myself and my peers.

I'm not going to go into a long winded explanation about the templates posted here, as there is already an overwhelming about of information out there already.

I highly recommend Kat Mac's VPN blog series. This lays it out in plan English. Well crafted and beautifully done: https://www.network-node.com/blog/2017/7/24/ccie-security-ipsec-vpn-overview

Now for the templates. We will use the topology below as a basic topology. 2 Routers directly connected (via a swtich), each with a loopback. We want the traffic sourced from a loopback and destined for a loopback to be encrypted via IPSEC tunnels. All other traffic will route without encryption.

CAVEAT: These templates are an example of VRF Aware IPSEC. Each router is using a VRF routing table, NOT THE GLOBAL ROUTING TABLE (GRT)!!!

Basic Initial Configs:

R1:

vrf definition client

 !

 address-family ipv4

 exit-address-family

interface Loopback1

 vrf forwarding client

 ip address 1.1.1.1 255.255.255.255

interface FastEthernet0/0

 vrf forwarding client

 ip address 10.1.1.1 255.255.255.252

ip route vrf client 100.1.1.1 255.255.255.255 10.1.1.2

R2:

vrf definition server

 !

 address-family ipv4

 exit-address-family

interface Loopback100

 vrf forwarding server

 ip address 100.1.1.1 255.255.255.255

interface FastEthernet1/0

 vrf forwarding server

 ip address 10.1.1.2 255.255.255.252

ip route vrf server 1.1.1.1 255.255.255.255 10.1.1.1

IPSEC (IKEv1) configs:

R1:

access-list 100 permit ip host 1.1.1.1 host 100.1.1.1

crypto keyring MY_KEYRING vrf client

  pre-shared-key address 10.1.1.2 255.255.255.255 key cisco

crypto isakmp policy 10

 authentication pre-share

crypto isakmp profile MY_PROFILE

   vrf client

   keyring MY_KEYRING

   match identity address 10.1.1.2 255.255.255.255 client

   local-address FastEthernet0/0

crypto ipsec transform-set MYSET ah-md5-hmac esp-aes esp-sha-hmac 

 mode tunnel

crypto map MYMAP local-address FastEthernet0/0

crypto map MYMAP 1 ipsec-isakmp 

 set peer 10.1.1.2

 set transform-set MYSET 

 set isakmp-profile MY_PROFILE

 match address 100

int FastEthernet0/0

 crypto map MYMAP

exit

R2:

access-list 100 permit ip host 100.1.1.1 host 1.1.1.1

crypto keyring MY_KEYRING_2 vrf server

  pre-shared-key address 10.1.1.1 255.255.255.255 key cisco

crypto isakmp policy 10

 authentication pre-share

crypto isakmp profile MY_PROFILE_2

   vrf server

   keyring MY_KEYRING_2

   match identity address 10.1.1.1 255.255.255.255 server

   local-address FastEthernet1/0

crypto ipsec transform-set MYSET ah-md5-hmac esp-aes esp-sha-hmac 

 mode tunnel

crypto map MYMAP_2 local-address FastEthernet1/0

crypto map MYMAP_2 1 ipsec-isakmp 

 set peer 10.1.1.1

 set transform-set MYSET

 set isakmp-profile MY_PROFILE_2

 match address 100

int FastEthernet1/0

 crypto map MYMAP_2

exit

Verify:

R1:

ping vrf client 100.1.1.1 source 1.1.1.1

show crypto isakmp sa vrf client

show crypto ipsec sa vrf client

R2:

ping vrf server 1.1.1.1 source 100.1.1.1

show crypto isakmp sa vrf server

show crypto ipsec sa vrf server