Implementing Cisco IP Switched Networks (SWITCH) Foundation Learning Guide: Campus Network Architecture
- Implementing VLANs and Trunks in Campus Environment
- VLAN Trunking Protocol
- Implementing EtherChannel in a Switched Network
- Study Tips
- Summary
- Review Questions
This chapter is from the book
This chapter is from the book
This chapter is from the book
This chapter covers the following topics:
- Implementing VLANs and trunks in campus switched architecture
- Understanding the concept of VTP and its limitation and configurations
- Implementing and configuring EtherChannel
This chapter covers the key concepts of VLANs, trunking, and EtherChannel to build the campus switched networks. Knowing the function of VLANs and trunks and how to configure them is the core knowledge needed for building a campus switched network. VLANs can span across the whole network, or they can be configured to remain local. Also, VLANs play a critical role in the deployment of voice and wireless networks. Even though you might not be a specialist at one of those two fields, it is important to understand basics because both voice and wireless often rely on a basic switched network.
Once VLANs are created, their names and descriptions are stored in a VLAN database, with the exception of specific VLANs such as VLANs in the extended range in Cisco IOS for the Catalyst 6500. A mechanism called VLAN Trunking Protocol (VTP) dynamically distributes this information between switches. However, even if network administrators do not plan to enable VTP, it is important to consider its consequences.
EtherChannel can be used to bundle physical links in one virtual link, thus increasing throughput. There are multiple ways traffic can be distributed over the physical link within the EtherChannel.
Implementing VLANs and Trunks in Campus Environment
Within the switched internetwork, VLANs provide segmentation and organizational flexibility. VLANs help administrators to have the end node or workstations group that are segmented logically by functions, project teams, and applications, without regard to the physical location of the users. In addition, VLANs allow you to implement access and security policies to particular groups of users and limit the broadcast domain.
In addition, the voice VLAN feature enables access ports to carry IP voice traffic from an IP phone. Because the sound quality of an IP phone call can deteriorate if the data is unevenly sent, the switch supports quality of service (QoS).
This section discusses in detail how to plan, implement, and verify VLAN technologies and address schemes to meet the given business and technical requirements along with constraints. This ability includes being able to meet these objectives:
- Describe the different VLAN segmentation models
- Identify the basic differences between end-to-end and local VLANs
- Describe the benefits and drawbacks of local VLANs versus end-to-end VLANs
- Configure and verify VLANs
- Implement a trunk in a campus network
- Configure and verify trunks
- Explain switchport mode interactions
- Describe voice VLANs
- Configure voice VLANs
VLAN Overview
A VLAN is a logical broadcast domain that can span multiple physical LAN segments. Within the switched internetwork, VLANs provide segmentation and organizational flexibility. A VLAN can exist on a single switch or span multiple switches. VLANs can include (hosts or endnotes) stations in a single building or multiple-building infrastructures. As shown in Figure 3-1, sales, human resources, and engineering are three different VLANs spread across all three floors.
)
Figure 3-1 VLAN Overview
The Cisco Catalyst switch implements VLANs by only forwarding traffic to destination ports that are in the same VLAN as the originating ports. Each VLAN on the switches implements address learning, forwarding, and filtering decisions and loop-avoidance mechanisms, just as though the VLAN were a separate physical switch.
Ports in the same VLAN share broadcasts. Ports in different VLANs do not share broadcasts, as illustrated in Figure 3-2, where a PC 3 and PC 4 cannot ping because they are in different VLANs, whereas PC 1 and PC 2 can ping each other because they are part of the same VLAN. Containing broadcasts within a VLAN improves the overall performance of the network. Because a VLAN is a single broadcast domain, campus design best practices recommend mapping a VLAN generally to one IP subnet. To communicate between VLANs, packets need to pass through a router or Layer 3 device.
)
Figure 3-2 VLAN Broadcast Domain
VLAN Segmentation
Larger flat networks generally consist of many end devices in which broadcasts and unknown unicast packets are flooded on all ports in the network. One advantage of using VLANs is the capability to segment the Layer 2 broadcast domain. All devices in a VLAN are members of the same broadcast domain. If an end device transmits a Layer 2 broadcast, all other members of the VLAN receive the broadcast. Switches filter the broadcast from all the ports or devices that are not part of the same VLAN.
In a campus design, a network administrator can design a campus network with one of two models: end-to-end VLANs or local VLANs. Business and technical requirements, past experience, and political motivations can influence the design chosen. Choosing the right model initially can help create a solid foundation upon which to grow the business. Each model has its own advantages and disadvantages. When configuring a switch for an existing network, try to determine which model is used so that you can understand the logic behind each switch configuration and position in the infrastructure.
End-to-End VLANs
The term end-to-end VLAN refers to a single VLAN that is associated with switch ports widely dispersed throughout an enterprise network on multiple switches. A Layer 2 switched campus network carries traffic for this VLAN throughout the network, as shown in Figure 3-3, where VLANs 1, 2, and 3 are spread across all three switches.
)
Figure 3-3 End to End VLAN
If more than one VLAN in a network is operating in the end-to-end mode, special links (Layer 2 trunks) are required between switches to carry the traffic of all the different VLANs.
An end-to-end VLAN model has the following characteristics:
- Each VLAN is dispersed geographically throughout the network.
- Users are grouped into each VLAN regardless of the physical location.
- As a user moves throughout a campus, the VLAN membership of that user remains the same, regardless of the physical switch to which this user attaches.
- Users are typically associated with a given VLAN for network management reasons. This is why they are kept in the same VLAN, therefore the same group, as they move through the campus.
- All devices on a given VLAN typically have addresses on the same IP subnet.
- Switches commonly operate in a server/client VTP mode.
Local VLANs
The campus enterprise architecture is based on the local VLAN model. In a local VLAN model, all users of a set of geographically common switches are grouped into a single VLAN, regardless of the organizational function of those users. Local VLANs are generally confined to a wiring closet, as shown in Figure 3-4. In other words, these VLANs are local to a single access switch and connect via a trunk to an upstream distribution switch. If users move from one location to another in the campus, their connection changes to the new VLAN at the new physical location.
)
Figure 3-4 Local VLANs
In the local VLAN model, Layer 2 switching is implemented at the access level, and routing is implemented at the distribution and core level, as shown in Figure 2-4, to enable users to maintain access to the resources they need. An alternative design is to extend routing to the access layer, and links between the access switches and distribution switches are routed links.
The following are some local VLAN characteristics and user guidelines:
- The network administrator should create local VLANs with physical boundaries in mind rather than the job functions of the users on the end devices.
- Generally, local VLANs exist between the access and distribution levels.
- Traffic from a local VLAN is routed at the distribution and core levels to reach destinations on other networks.
- Configure the VTP mode in transparent mode because VLANs on a given access switch should not be advertised to all other switches in the network, nor do they need to be manually created in any other switch VLAN databases.
- A network that consists entirely of local VLANs can benefit from increased convergence times offered via routing protocols, instead of a spanning tree for Layer 2 networks. It is usually recommended to have one to three VLANs per access layer switch.
Comparison of End-to-End VLANs and Local VLANs
This subsection describes the benefits and drawbacks of local VLANs versus end-to-end VLANs.
Because a VLAN usually represents a Layer 3 segment, each end-to-end VLAN enables a single Layer 3 segment to be dispersed geographically throughout the network. The following could be some of the reasons for implementing the end-to-end design:
- Grouping users: Users can be grouped on a common IP segment, even though they are geographically dispersed. Recently, the trend has been moving toward virtualization. Solutions such as those from VMware need end-to-end VLANs to be spread across segments of the campus.
- Security: A VLAN can contain resources that should not be accessible to all users on the network, or there might be a reason to confine certain traffic to a particular VLAN.
- Applying quality of service (QoS): Traffic can be a higher- or lower-access priority to network resources from a given VLAN. Note that QoS may also be applied without the use of VLANs.
- Routing avoidance: If much of the VLAN user traffic is destined for devices on that same VLAN, and routing to those devices is not desirable, users can access resources on their VLAN without their traffic being routed off the VLAN, even though the traffic might traverse multiple switches.
- Special-purpose VLAN: Sometimes a VLAN is provisioned to carry a single type of traffic that must be dispersed throughout the campus (for example, multicast, voice, or visitor VLANs).
- Poor design: For no clear purpose, users are placed in VLANs that span the campus or even span WANs. Sometimes when a network is already configured and running, organizations are hesitant to improve the design because of downtime or other political reasons.
The following list details some considerations that the network administrators should consider when implementing end-to-end VLANs:
- Switch ports are provisioned for each user and associated with a given VLAN. Because users on an end-to-end VLAN can be anywhere in the network, all switches must be aware of that VLAN. This means that all switches carrying traffic for end-to-end VLANs are required to have those specific VLANs defined in each switch’s VLAN database.
- Also, flooded traffic for the VLAN is, by default, passed to every switch even if it does not currently have any active ports in the particular end-to-end VLAN.
- Finally, troubleshooting devices on a campus with end-to-end VLANs can be challenging because the traffic for a single VLAN can traverse multiple switches in a large area of the campus, and that can easily cause potential spanning-tree problems.
Based on the data presented in this section, there are many reasons to implement end-to-end VLANs. The main reason to implement local VLANs is simplicity. Local VLAN configures are quick and easy for small-scale networks.
Mapping VLANs to a Hierarchical Network
In the past, network designers have attempted to implement the 80/20 rule when designing networks. The rule was based on the observation that, in general, 80 percent of the traffic on a network segment was passed between local devices, and only 20 percent of the traffic was destined for remote network segments. Therefore, network architecture used to prefer end-to-end VLANs. To avoid the complications of end-to-end VLANs, designers now consolidate servers in central locations on the network and provide access to external resources, such as the Internet, through one or two paths on the network because the bulk of traffic now traverses a number of segments. Therefore, the paradigm now is closer to a 20/80 proportion, in which the greater flow of traffic leaves the local segment; so, local VLANs have become more efficient.
In addition, the concept of end-to-end VLANs was attractive when IP address configuration was a manually administered and burdensome process; therefore, anything that reduced this burden as users moved between networks was an improvement. However, given the ubiquity of Dynamic Host Configuration Protocol (DHCP), the process of configuring an IP address at each desktop is no longer a significant issue. As a result, there are few benefits to extending a VLAN throughout an enterprise (for example, if there are some clustering and other requirements).
Local VLANs are part of the enterprise campus architecture design, as shown in Figure 3-4, in which VLANs used at the access layer should extend no further than their associated distribution switch. For example, VLANs 1, 10 and VLANs 2, 20 are confined to only a local access switch. Traffic is then routed out the local VLAN as to the distribution layer and then to the core depending on the destination. It is usually recommended to have two to three VLANs per access block rather than span all the VLANs across all access blocks. This design can mitigate Layer 2 troubleshooting issues that occur when a single VLAN traverses the switches throughout a campus network. In addition, because Spanning Tree Protocol (STP) is configured for redundancy, the switch limits the STP to only the access and distribution switches that help to reduce the network complexity in times of failure.
Implementing the enterprise campus architecture design using local VLANs provides the following benefits:
- Deterministic traffic flow: The simple layout provides a predictable Layer 2 and Layer 3 traffic path. If a failure occurs that was not mitigated by the redundancy features, the simplicity of the model facilitates expedient problem isolation and resolution within the switch block.
- Active redundant paths: When implementing Per-VLAN Spanning Tree (PVST) or Multiple Spanning Tree (MST) because there is no loop, all links can be used to make use of the redundant paths.
- High availability: Redundant paths exist at all infrastructure levels. Local VLAN traffic on access switches can be passed to the building distribution switches across an alternative Layer 2 path if a primary path failure occurs. Router redundancy protocols can provide failover if the default gateway for the access VLAN fails. When both the STP instance and VLAN are confined to a specific access and distribution block, Layer 2 and Layer 3 redundancy measures and protocols can be configured to failover in a coordinated manner.
- Finite failure domain: If VLANs are local to a switch block, and the number of devices on each VLAN is kept small, failures at Layer 2 are confined to a small subset of users.
- Scalable design: Following the enterprise campus architecture design, new access switches can be easily incorporated, and new submodules can be added when necessary.
Implementing a Trunk in a Campus Environment
A trunk is a point-to-point link that carries the traffic for multiple VLANs across a single physical link between the two switches or any two devices. Trunking is used to extend Layer 2 operations across an entire network, such as end-to-end VLANs, as shown in Figure 3-5. PC 1 in VLAN 1 can communicate with the host in VLAN 21 on another switch over the single trunk link, the same as a host in VLAN 20 can communicate with a host in another switch in VLAN 20.
)
Figure 3-5 Trunk Overview
As discussed earlier in this chapter, to allow a switch port that connects two switches to carry more than one VLAN, it must be configured as a trunk. If frames from a single VLAN traverse a trunk link, a trunking protocol must mark the frame to identify its associated VLAN as the frame is placed onto the trunk link. The receiving switch then knows the frame’s VLAN origin and can process the frame accordingly. On the receiving switch, the VLAN ID (VID) is removed when the frame is forwarded on to an access link associated with its VLAN.
A special protocol is used to carry multiple VLANs over a single link between two devices. There are two trunking technologies:
- Inter-Switch Link (ISL): A Cisco proprietary trunking encapsulation
- IEEE 802.1Q: An industry-standard trunking method
When configuring an 802.1Q trunk, a matching native VLAN must be defined on each end of the trunk link. A trunk link is inherently associated with tagging each frame with a VID. The purpose of the native VLAN is to enable frames that are not tagged with a VID to traverse the trunk link. Native VLAN is discussed in more detail in a later part of this section.
Because the ISL protocol is almost obsolete, this book focuses only on 802.1Q. Figure 3-6 depicts how ISL encapsulates the normal Ethernet frame. Currently, all Catalyst switches support 802.1Q tagging for multiplexing traffic from multiple VLANs onto a single physical link.
)
Figure 3-6 ISL Frame
IEEE 802.1Q trunk links employ the tagging mechanism to carry frames for multiple VLANs, in which each frame is tagged to identify the VLAN to which the frame belongs. Figure 3-7 shows the layout of the 802.1Q frame.
)
Figure 3-7 802.1Q Frame
The IEEE 802.1Q/802.1p standard provides the following inherent architectural advantages over ISL:
- 802.1Q has smaller frame overhead than ISL. As a result, 802.1Q is more efficient than ISL, especially in the case of small frames. 802.1Q overhead is 4 bytes, whereas ISL is 30 bytes.
- 802.1Q is a widely supported industry standard protocol.
- 802.1Q has the support for 802.1p fields for QoS.
The 802.1Q Ethernet frame header contains the following fields:
- Dest: Destination MAC address (6 bytes)
- Src: Source MAC address (6 bytes)
Tag: Inserted 802.1Q tag (4 bytes, detailed here)
- EtherType(TPID): Set to 0x8100 to specify that the 802.1Q tag follows.
- PRI: 3-bit 802.1p priority field.
- CFI: Canonical Format Identifier is always set to 0 for Ethernet switches and to 1 for Token Ring-type networks.
- VLAN ID: 12-bit VLAN field. Of the 4096 possible VLAN IDs, the maximum number of possible VLAN configurations is 4094. A VLAN ID of 0 indicates priority frames, and value 4095 (FFF) is reserved. CFI, PRI, and VLAN ID are represented as Tag Control Information (TCI) fields.
- Len/Etype: 2-byte field specifying length (802.3) or type (Ethernet II)
- Data: Data itself
- FCS: Frame check sequence (4 bytes)
IEEE 802.1Q uses an internal tagging mechanism that modifies the original frame (as shown by the X over FCS in the original frame in Figure 3-7), recalculates the cyclic redundancy check (CRC) value for the entire frame with the tag, and inserts the new CRC value in a new FCS. ISL, in comparison, wraps the original frame and adds a second FCS that is built only on the header information but does not modify the original frame FCS.
IEEE 802.1p redefined the three most significant bits in the 802.1Q tag to allow for prioritization of the Layer 2 frame.
If a non-802.1Q-enabled device or an access port receives an 802.1Q frame, the tag data is ignored, and the packet is switched at Layer 2 as a standard Ethernet frame. This allows for the placement of Layer 2 intermediate devices, such as unmanaged switches or bridges, along the 802.1Q trunk path. To process an 802.1Q tagged frame, a device must enable a maximum transmission unit (MTU) of 1522 or higher.
Baby giants are frames that are larger than the standard MTU of 1500 bytes but less than 2000 bytes. Because ISL and 802.1Q tagged frames increase the MTU beyond 1500 bytes, switches consider both frames as baby giants. ISL-encapsulated packets over Ethernet have an MTU of 1548 bytes, whereas 802.1Q has an MTU of 1522 bytes.
Understanding Native VLAN in 802.1Q Trunking
The IEEE 802.1Q protocol allows operation between equipment from different vendors. All frames, except native VLAN, are equipped with a tag when traversing the link, as shown in Figure 3-8.
)
Figure 3-8 Native VLAN in 802.1Q
A frequent configuration error is to have different native VLANs. The native VLAN that is configured on each end of an 802.1Q trunk must be the same. If one end is configured for native VLAN 1 and the other for native VLAN 2, a frame that is sent in VLAN 1 on one side will be received on VLAN 2 on the other. VLAN 1 and VLAN 2 have been segmented and merged. There is no reason this should be required, and connectivity issues will occur in the network. If there is a native VLAN mismatch on either side of an 802.1Q link, Layer 2 loops may occur because VLAN 1 STP BPDUs are sent to the IEEE STP MAC address (0180.c200.0000) untagged.
Cisco switches use Cisco Discovery Protocol (CDP) to warn of a native VLAN mismatch. On select versions of Cisco IOS Software, CDP may not be transmitted or will be automatically turned off if VLAN 1 is disabled on the trunk.
By default, the native VLAN will be VLAN 1. For the purpose of security, the native VLAN on a trunk should be set to a specific VID that is not used for normal operations elsewhere on the network.
Switch(config-if)# switchport trunk native vlan vlan-id
Understanding DTP
All recent Cisco Catalyst switches, except for the Catalyst 2900XL and 3500XL, use a Cisco proprietary point-to-point protocol called Dynamic Trunking Protocol (DTP) on trunk ports to negotiate the trunking state. DTP negotiates the operational mode of directly connected switch ports to a trunk port and selects an appropriate trunking protocol. Negotiating trunking is a recommended practice in multilayer switched networks because it avoids network issues resulting from trunking misconfigurations for initial configuration, but best practice is when the network is stable, change to permanent trunk.
Cisco Trunking Modes and Methods
Table 3-1 describes the different trunking modes supported by Cisco switches.
Table 3-1 Trunking Modes
Mode in Cisco IOS |
Function |
Access |
Puts the interface into permanent nontrunking mode and negotiates to convert the link into a nontrunk link. The interface becomes a nontrunk interface even if the neighboring interface does not agree to the change. |
Trunk |
Puts the interface into permanent trunking mode and negotiates to convert the link into a trunk link. The interface becomes a trunk interface even if the neighboring interface does not agree to the change. |
Nonegotiate |
Prevents the interface from generating DTP frames. You must configure the local and neighboring interface manually as a trunk interface to establish a trunk link. Use this mode when connecting to a device that does not support DTP. |
Dynamic desirable |
Makes the interface actively attempt to convert the link to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode. |
Dynamic auto |
Makes the interface willing to convert the link to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk or desirable mode. This is the default mode for all Ethernet interfaces in Cisco IOS. |
Figure 3-9 shows the combination of DTP modes between the two links. A combination of DTP modes can either make the port as an access port or trunk port.
)
Figure 3-9 Output from the SIMPLE Program
VLAN Ranges and Mappings
ISL supports VLAN numbers in the range of 1 to 1005, whereas 802.1Q VLAN numbers are in the range of 1 to 4094. The default behavior of VLAN trunks is to permit all normal and extended-range VLANs across the link if it is an 802.1Q interface and to permit normal VLANs in the case of an ISL interface.
VLAN Ranges
Cisco Catalyst switches support up to 4096 VLANs depending on the platform and software version. Table 3-2 illustrates the VLAN division for Cisco Catalyst switches. Table 3-3 shows VLAN ranges.
Table 3-2 VLAN Support Matrix for Catalyst Switches
Type of Switch |
Maximum Number of VLANs |
VLAN ID Range |
Catalyst 2940 |
4 |
1–1005 |
Catalyst 2950/2955 |
250 |
1–4094 |
Catalyst 2960 |
255 |
1–4094 |
Catalyst 2970/3550/3560/3750 |
1005 |
1–4094 |
Catalyst 2848G/2980G/4000/4500 |
4094 |
1–4094 |
Catalyst 6500 |
4094 |
1–4094 |
Table 3-3 VLAN Ranges
VLAN Range |
Range Usage |
Propagated via VTP |
0, 4095 |
Reserved for system use only. You cannot see or use these VLANs. |
— |
1 |
Normal Cisco default. You can use this VLAN, but you cannot delete it. |
Yes |
2–1001 |
Normal For Ethernet VLANs. You can create, use, and delete these VLANs. |
Yes |
1002–1005 |
Normal Cisco defaults for FDDI and Token Ring. You cannot delete VLANs 1002–1005. |
Yes |
1006–1024 |
Reserved for system use only. You cannot see or use these VLANS. |
— |
1025–4094 |
Extended for Ethernet VLANs only. |
Not supported in VTP Versions 1 and 2. The switch must be in VTP transparent mode to configure extended-range VLANS. This range is only supported in Version 3. |
Configuring, Verifying, and Troubleshooting VLANs and Trunks
This section provides the configuration, verification, and troubleshooting steps for VLANs and trunking.
To create a new VLAN in global configuration mode, follow these steps:
Step 1. Enter global configuration mode:
Switch# configure terminal
Step 2. Create a new VLAN with a particular ID number:
Switch(config)# vlan vlan-id
Step 3. (Optional.) Name the VLAN:
Switch(config-vlan)# name vlan-name
Example 3-1 shows how to configure a VLAN in global configuration mode.
Example 3-1 Creating a VLAN in Global Configuration Mode in Cisco IOS
Switch# configure terminal Switch(config)# vlan 5 Switch(config-vlan)# name Engineering Switch(config-vlan)# exit
To delete a VLAN in global configuration mode, delete the VLAN by referencing its ID number:
Switch(config)# no vlan vlan-id
Example 3-2 demonstrates deletion of a VLAN in global configuration mode.
Example 3-2 Deleting a VLAN in Global Configuration Mode
Switch# configure terminal Switch(config)# no vlan 3 Switch(config)# end
To assign a switch port to a previously created VLAN, follow these steps:
Step 1. From global configuration mode, enter the configuration mode for the particular port you want to add to the VLAN:
Switch(config)# interface interface-id
Step 2. Specify the port as an access port:
Switch(config-if)# switchport mode access Switch(config-if)# switchport host
Step 3. Remove or place the port in a particular VLAN:
Switch(config-if)# [no] switchport access vlan vlan-id
Example 3-3 illustrates configuration of an interface as an access port in VLAN 200.
Example 3-3 Assigning an Access Port to a VLAN
Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# interface FastEthernet 5/6 Switch(config-if)# description PC A Switch(config-if)# switchport Switch(config-if)# switchport host Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 200 Switch(configif)# no shutdown Switch(config-if)# end
Verifying the VLAN Configuration
As previously discussed, after you configure the VLANs, one of the important steps is to be able to verify the configuration. To verify the VLAN configuration of a Catalyst switch, use show commands. The show vlan command from privileged EXEC mode displays information about a particular VLAN. Table 3-4 documents the fields displayed by the show vlan command.
Table 3-4 show vlan Field Descriptions
Field |
Description |
VLAN |
VLAN number |
Name |
Name, if configured, of the VLAN |
Status |
Status of the VLAN (active or suspended) |
Ports |
Ports that belong to the VLAN |
Type |
Media type of the VLAN |
SAID |
Security association ID value for the VLAN |
MTU |
Maximum transmission unit size for the VLAN |
Parent |
Parent VLAN, if one exists |
RingNo |
Ring number for the VLAN, if applicable |
BridgNo |
Bridge number for the VLAN, if applicable |
Stp |
Spanning Tree Protocol type used on the VLAN |
BrdgMode |
Bridging mode for this VLAN |
Trans1 |
Translation bridge 1 |
Trans2 |
Translation bridge 2 |
AREHops |
Maximum number of hops for All-Routes Explorer frames |
STEHops |
Maximum number of hops for Spanning Tree Explorer frames |
Example 3-4 displays information about a VLAN identified by number in Cisco IOS.
Example 3-4 Displaying Information About a VLAN by Number in Cisco IOS
SW1#show vlan id 3 VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 3 VLAN0003 active Et1/1 VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------ 3 enet 100003 1500 - - - - - 0 0 Primary Secondary Type Ports ------- --------- ----------------- ------------------------------------------ SW1#
Example 3-5 displays information about a VLAN identified by name in Cisco IOS.
Example 3-5 Displaying Information About a VLAN by Name in Cisco IOS
SW1# show vlan name VLAN0003 VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 3 VLAN0003 active Et1/1 VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------ 3 enet 100003 1500 - - - - - 0 0 Primary Secondary Type Ports ------- --------- ----------------- ------------------------------------------ SW1#
To display the current configuration of a particular interface, use the show running-config interface interface-type slot/port command. To display detailed information about a specific switch port, use the show interfaces command. The command show interfaces interface-type slot/port with the switchport keyword displays not only a switch port’s characteristics but also private VLAN and trunking information. The show mac address-table interface interface-type slot/port command displays the MAC address table information for the specified interface in specific VLANs. During troubleshooting, this command is helpful in determining whether the attached devices are sending packets to the correct VLAN.
Example 3-6 displays the configuration of a particular interface. Example 3-6 shows that the interface Ethernet 5/6 is configured with the VLAN 200 and in an access mode so that the port does not negotiate for trunking.
Example 3-6 Displaying Information About the Interface Config
Switch# show running-config interface FastEthernet 5/6 Building configuration... ! Current configuration :33 bytes interface FastEthernet 5/6 switchport access vlan 200 switchport mode access end
Example 3-7 displays detailed switch port information as the port VLAN and operation modes. As shown in Example 3-7, the Ethernet port 4/1 is configured as the switch port means Layer 2 port, working as an access port in VLAN 2.
Example 3-7 Displaying Detailed Switch Port Information
BXB-6500-10:8A# SW1# show int ethernet 4/1 switchport Name: Et4/1 Switchport: Enabled Administrative Mode: static access Operational Mode: static access Administrative Trunking Encapsulation: negotiate Operational Trunking Encapsulation: native Operational Dot1q Ethertype: 0x8100 Negotiation of Trunking: Off Access Mode VLAN: 200 (Inactive) Trunking Native Mode VLAN: 1 (default) Administrative Native VLAN tagging: enabled Operational Native VLAN tagging: disabled Voice VLAN: none Administrative private-vlan host-association: none Administrative private-vlan mapping: none Operational private-vlan: none Trunking VLANs Enabled: ALL Pruning VLANs Enabled: 2-1001 Capture Mode Disabled Capture VLANs Allowed: ALL Voice VLAN: none (Inactive) Appliance trust: none
Example 3-8 displays the MAC address table information for a specific interface in VLAN 1.
Example 3-8 Displaying MAC Address Table Information
Switch# show mac-address-table interface GigabitEthernet 0/1 vlan 1
SW1# show mac address-table interface Gigabitethernet 0/1
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 aabb.cc01.0600 DYNAMIC Gi0/1
Total Mac Addresses for this criterion: 1
To configure the VLANs on switches SW1 and SW2 and enable trunking between the switches, use the topology shown in Figure 3-10.
)
Figure 3-10 Topology to Configure VLAN and Trunking
Table 3-5 outlines the IP addressing scheme that will be used for this topology.
Table 3-5 IP Addressing
Device |
Device IP |
Device Interface |
Device Neighbor |
Interface on the Neighbor |
PC1 |
192.168.1.100 |
Eth0/0 |
SW1 |
Eth0/1 |
PC2 |
192.168.20.101 |
Eth0/0 |
SW1 |
Eth0/2 |
PC3 |
192.168.1.110 |
Eth0/0 |
SW2 |
Eth0/1 |
PC4 |
192.168.20.110 |
Eth0/0 |
SW2 |
Eth0/2 |
Configuring VLANs and Trunks
To configure a port to belong to a certain VLAN, you have the following two options:
- Static VLAN configuration
- Dynamic VLAN configuration
With static VLAN configuration, switch ports are assigned to a specific VLAN. End devices become members in a VLAN based on the physical port to which they are connected. The end device is not even aware that a VLAN exists. Each port that is assigned to a VLAN receives a port VLAN ID (PVID).
With dynamic VLAN configuration, membership is based on the MAC address of the end device. When a device is connected to a switch port, the switch must query a database to figure out what VLAN needs to be configured. With dynamic VLANs, you need to assign a user’s MAC address to VLAN in the database of a VLAN Management Policy Server (VMPS). With dynamic VLANs, users can connect to any port on the switch, and they will be automatically assigned into the VLAN they belong to.
Step 1. Create VLAN 20 on both switches.
SW1(config)# vlan 20 SW1(config-vlan)# exit % Applying VLAN changes may take few minutes. Please wait...SW1(config)#
Step 2. As shown in Figure 3-10, on SW1 configure port Ethernet 0/2 to be an access port and assign it to VLAN 20. By default, it is part of VLAN 1:
SW1(config)# interface ethernet 0/2 SW1(config-if)# switchport mode access SW1(config-if)# switchport access vlan 20
The switchport mode access command explicitly tells the port to be assigned only a single VLAN, providing connectivity to an end user. When you assign a switch port to a VLAN using this method, it is known as a static access port.
Step 3. On SW1, verify membership of port Ethernet 0/2.
Use the show vlan command to display information on all configured VLANs. The command displays configured VLANs, their names, and the ports on the switch that are assigned to each VLAN:
SW1# show vlan VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Et0/0, Et0/1, Et0/3, Et1/0 Et1/2, Et1/3, Et2/0, Et2/1 Et2/2, Et2/3, Et3/0, Et3/1 Et3/2, Et3/3, Et4/0, Et4/1 Et4/2, Et4/3, Et5/0, Et5/1 Et5/2, Et5/3 20 IT active Et0/2 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------ 1 enet 100001 1500 - - - - - 0 0 20 enet 100020 1500 - - - - - 0 0 1002 fddi 101002 1500 - - - - - 0 0 1003 tr 101003 1500 - - - - - 0 0 1004 fdnet 101004 1500 - - - ieee - 0 0 1005 trnet 101005 1500 - - - ibm - 0 0 Primary Secondary Type Ports ------- --------- ----------------- ------------------------------------------In the show vlan output, you can see that VLAN 20, named IT, is created. Also notice that Ethernet 0/2 is assigned to VLAN 20.
Use the show vlan id vlan-number or the show vlan name vlan-name command to display information about a particular VLAN.
Step 4. Ping from PC 1 to PC 3. The ping should be successful:
PC1# ping 192.168.1.110 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.1.110, timeout is 2 seconds: ..!!! Success rate is 60 percent (3/5), round-trip min/avg/max = 1/1/1 ms
First few pings might fail because of the Address Resolution Protocol (ARP) process.
PC 1 and PC 3 belong to the same VLAN. The configuration on the two ports that connect switches SW1 and SW2 is default; both ports belong to VLAN 1. So PCs 1 and 3 belong to the same LAN-Layer 2 network.
Step 5. Ping from PC 2 to PC 4. The ping should not be successful.
The ping should not be successful because the link between SW1 and SW2 is an access link and carries only data for VLAN 1:
PC2# ping 192.168.20.110 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.20.110, timeout is 2 seconds: ..... Success rate is 0 percent (0/5)
Step 6. Configure ports that connect SW1 and SW2 as trunks. Use the dot1Q encapsulation. Allow only VLANs 1 and 20 to traverse the trunk link.
Trunk configuration on SW1:
SW1(config)# interface Ethernet 1/1 SW1(config-if)# switchport trunk encapsulation dot1q SW1(config-if)# switchport trunk allowed vlan 1,20 SW1(config-if)# switchport mode trunk
Trunk configuration on SW2:
SW2(config)# interface Ethernet 1/2 SW2(config-if)# switchport trunk encapsulation dot1q SW2(config-if)# switchport trunk allowed vlan 1,20 SW2(config-if)# switchport mode trunk
If you do not explicitly allow VLANs to traverse the trunk, all traffic will be allowed to cross the link. This includes broadcasts for all VLANs, using unnecessary bandwidth.
Step 7. Verify that Ethernet 1/1 on SW1 is now trunking:
SW1# show interfaces trunk Port Mode Encapsulation Status Native vlan Et1/1 on 802.1q trunking 1 Port Vlans allowed on trunk Et1/1 1,20 Port Vlans allowed and active in management domain Et1/1 1,20 Port Vlans in spanning tree forwarding state and not pruned Et1/1 1,20
Also notice that only VLANs 1 and 20 are allowed on the trunk.
Step 8. Issue a ping from PC2 to PC4. The ping should be successful.
You have configured the link between SW1 and SW2 to carry data for both VLAN 1 and VLAN 20:
PC2# ping 192.168.20.110 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.20.110, timeout is 2 seconds: ..!!! Success rate is 60 percent (3/5), round-trip min/avg/max = 1/1/1 ms
Best Practices for VLANs and Trunking
Usually, network designers design and implement the VLANs and their components depending on the business needs and requirements, but this section provides general best practices for implementing VLAN in a campus network.
Following are some of the practices for VLAN design:
- For the Local VLANs model, it is usually recommended to have only one to three VLANs per access module and, as discussed, limit those VLANs to a couple of access switches and the distribution switches.
- Avoid using VLAN 1 as the black hole for all unused ports. Use any other VLAN except 1 to assign all the unused ports to it.
- Try to always have separate voice VLANs, data VLANs, management VLANs, native VLANs, black hole VLANs, and default VLANs (VLAN 1).
- In the local VLANs model, avoid VTP; it is feasible to use manually allowed VLANs in a network on trunks.
- For trunk ports, turn off DTP and configure it manually. Use IEEE 802.1Q rather than ISL because it has better support for QoS and is a standard protocol.
- Manually configure access ports that are not specifically intended for a trunk link.
- Prevent all data traffic from VLAN 1; only permit control protocols to run on VLAN 1 (DTP, VTP, STP bridge protocol data units [BPDUs], Port Aggregation Protocol [PAgP], Link Aggregation Control Protocol [LACP], Cisco Discovery Protocol [CDP], and such.).
- Avoid using Telnet because of security risks; enable Secure Shell (SSH) support on management VLANs.
In a hierarchical design, access layer switches connect to distribution layer switches. This is where the trunks are implemented, as illustrated in Figure 3-11, where the links from each access switch to the distribution switches are the trunk links because they must carry two VLANs from each switch. Links between distribution and core layers are usually Layer 3. Also, to avoid spanning-tree problems, it is usually recommended not to link the two distribution switches as Layer 2 trunk links or have no link between them. In this way, the access layer switches are configured as a spanning-tree, loop-free V topology if one distribution link fails, using the Hot Standby Router Protocol (HSRP) or Virtual Router Redundancy Protocol (VRRP) for creating a virtual default gateway. Spanning tree, HSRP, and VRRP are discussed more in later chapters.
Figure 3-11 Trunk Implementations
- DTP is useful when the status of the switch on the other end of the link is uncertain or might be changing over time. When the link is to be set to trunk in a stable manner, changing both ends to trunk nonegotiate accelerates the convergence time, saving up to 2 seconds upon boot time. We recommend this mode on stable links between switches that are part of the same core infrastructure.
- On trunk links, it is recommended to manually prune the VLANs that are not used. You can use VTP pruning if VTP is in use, but manual pruning (using a switchport trunk allowed VLAN) is a secure way of allowing only those VLANs that are expected and allowed on the link. In addition to this, it is also a good practice to have an unused VLAN as a native VLAN on the trunk links to prevent DTP spoofing.
- If trunking is not used on a port, you can disable it with the interface level command switchport host. This command is a macro that sets the port to access mode (switchport mode access) and enables portfast.
)
Voice VLAN Overview
Some Cisco Catalyst switches offer a unique feature called voice VLAN, which lets you overlay a voice topology onto a data network. You can segment phones into separate logical networks even though the data and voice infrastructure are physically the same.
The voice VLAN feature places the phones into their own VLANs without any end-user intervention. These VLAN assignments can be seamlessly maintained even if the phone is moved to a new location.
The user simply plugs the phone into the switch, and the switch provides the phone with the necessary VLAN information. By placing phones into their own VLANs, network administrators gain the advantages of network segmentation and control. Furthermore, network administrators can preserve their existing IP topology for the data end stations. IP phones can be easily assigned to different IP subnets using standards-based DHCP operation.
With the phones in their own IP subnets and VLANs, network administrators can more easily identify and troubleshoot network problems. In addition, network administrators can create and enforce QoS or security policies.
With the voice VLAN feature, Cisco enables network administrators to gain all the advantages of physical infrastructure convergence while maintaining separate logical topologies for voice and data terminals. This ability offers the most effective way to manage a multiservice network.
Multiservice switches support a new parameter for IP telephony support that makes the access port a multi-VLAN access port. The new parameter is called a voice or auxiliary VLAN. Every Ethernet 10/100/1000 port in the switch is associated with two VLANs:
- A native VLAN for data service that is identified by the PVID
- A voice VLAN that is identified by the voice VLAN ID (VVID)
During the initial CDP exchange with the access switch, the IP phone is configured with a VVID.
The IP phone is also supplied with a QoS configuration using CDP.
Data packets between the multiservice access switch and the PC or workstation are on the native VLAN. All packets going out on the native VLAN of an IEEE 802.1Q port are sent untagged by the access switch. The PC or workstation connected to the IP phone usually sends untagged packets, as shown in Figure 3-12, whereas a PC VLAN that connected directly to the phone sends untagged packets because this considers the native VLAN and voice VLAN as VVID 110. The IP phone tags voice packets based on the CDP information from the access switch.
)
Figure 3-12 Voice VLAN Overview
The multi-VLAN access ports are not trunk ports, even though the hardware is set to the dot1Q trunk. The hardware setting is used to carry more than two VLANs, but the port is still considered an access port that is able to carry one native VLAN and the voice VLAN.
The switchport host command can be applied to a multi-VLAN access port on the access switch.
As shown in Figure 3-13, interface Fa0/1 is configured to set data devices in data VLAN 10 and VoIP devices in voice VLAN 110.
)
Figure 3-13 Voice VLAN Configuration
When you run the show vlan command, both the voice and the data VLAN are seen applied to the interface Fa0/1 as demonstrated in Example 3-9.
Example 3-9 show vlan Command Output Provides Information About the Voice and Data VLAN
Switch# show vlan VLAN Name Status Ports ---- -------------------------------- --------- ----------------- 1 default active Fa0/6,Fa0/7,Fa0/8,Fa0/9,Fa0/10 10 VLAN0010 active Fa0/1 110 VLAN0110 active Fa0/1 <... output omitted ...>
Verify the switchport mode and the voice VLAN by using the show interface interface-slot/number switchport command.
Switch Configuration for Wireless Network Support
Cisco offers the following two WLAN implementations:
- The standalone WLAN solution is based on autonomous (standalone) access points (APs).
- The controller-based WLAN solution is based on controller-based APs and WLCs (Wireless LAN Controllers).
In the autonomous (or standalone) solution, each AP operates independently and acts as a transition point between the wireless media and the 802.3 media. The data traffic between two clients flows via the Layer 2 switch when on the same subnet from a different AP infrastructure. As the AP converts the IEEE 802.11 frame into an 802.3 frame, the wireless client MAC address is transferred to the 802.3 headers and appears as the source for the switch. The destination, also a wireless client, appears as the destination MAC address. For the switch, the APs are relatively transparent, as illustrated in Figure 3-14.
)
Figure 3-14 Wireless Configurations Options
In a controller-based solution, management, control, deployment, and security functions are moved to a central point: the wireless controller, as shown in Figure 3-14. Controllers are combined with lightweight APs that perform only the real-time wireless operation. Controllers can be standalone devices, integrated into a switch, or a WLC can be virtualized.
Both standalone and lightweight APs connect to a switch. It is common that the switch is Power over Ethernet (PoE)-able and so APs get power and data through the Ethernet cable. This makes the wireless network more scalable and easier to manage.
To implement a wireless network, APs and switches need to be configured. APs can be configured directly (autonomous APs) or through a controller (lightweight APs). Either way, configuring APs is a domain of the WLAN specialist. On the switch side, just configure VLANs and trunks on switches to support WLAN.