{"id":68,"date":"2014-06-22T06:32:49","date_gmt":"2014-06-22T06:32:49","guid":{"rendered":"http:\/\/feralpacket.org\/?p=68"},"modified":"2015-01-03T11:19:51","modified_gmt":"2015-01-03T11:19:51","slug":"v5-written-and-lab-vlans","status":"publish","type":"post","link":"https:\/\/feralpacket.org\/?p=68","title":{"rendered":"v5 Written and Lab: VLAN Notes"},"content":{"rendered":"

v5 Written: 2.1.c Implement and troubleshoot VLAN
\n2.1.c [i] Access ports
\n2.1.c [ii] VLAN database
\n2.1.c [iii] Normal, extended VLAN, voice VLAN<\/code><\/p>\n

v5 Lab: 1.1.c Implement and troubleshoot VLAN
\n1.1.c [i] Access Ports
\n1.1.c [ii] VLAN database
\n1.1.c [iii] Normal, extended VLAN, voice VLAN<\/p>\n

Documents:<\/p>\n

Catalyst 3750-X and 3560-X Software Configuration Guide, Release 15.0(1)SE,
\nChapter 15: Configuring VLANs, pgs. 15-1 to 15-14<\/p>\n

Catalyst 3750-X and 3560-X Software Configuration Guide, Release 15.0(1)SE,
\nChapter 17: Configuring Voice VLAN, pgs. 17-1 to 17-8<\/p>\n

Catalyst 3750-X and 3560-X Software Configuration Guide, Release 15.0(1)SE,
\nChapter 14: Configuring Interface Characteristics, pgs. 14-1 to 14-52<\/p>\n

LAN Switching Configuration Guide, Cisco IOS Release 15M&T,
\nChapter 3: Configuring Routing Between VLANs, pgs. 119 – 192<\/p>\n

Books:<\/p>\n

Cisco LAN Switching; Chapter 5: VLANs, pgs. 112 – 152<\/p>\n

CCIE Routing and Switching Exam Certification Guide 4th Ed; Chapter 2 Virtual LANs and VLAN<\/p>\n

Trunking, pgs. 31 – 48<\/p>\n

INE:<\/p>\n

A VLAN is a switched network that is logically segmented<\/p>\n

Packets destined for systems that do not belong to the VLAN must be forwarded through a<\/p>\n

router or a switch supporting fallback bridging<\/p>\n

VLANs are often associated with IP subnetworks<\/p>\n

Interface VLAN membership is configured manually on an interface-by-interface basis<\/p>\n

A switch can route traffic between VLANs by using siwtch virtual interfaces (SVIs)<\/p>\n

An SVI must be assigned an IP address to route traffic between VLANs<\/p>\n

A switch supports VLANs in VTP client, server, and transparent modes
\n– there must be at least one trunk port to participate in VTP<\/p>\n

Normal-range VLANs: 1 – 1005
\n– 1002 – 1005 are reserved for TOken Ring and FDDI VLANs
\n– VTP version 1 and 2<\/p>\n

Extended-range VLANs: 1006 – 4094
\n– in VTP versions 1 and 2, VTP transparent mode must be configured<\/p>\n

VTP version 3 supports the entire VLAN range (1 – 4094)
\n– supported in both VTP server and transparent modes<\/p>\n

IP base or IP Services feature set
\n– supports a total of 1005 VLANs
\n– routed ports count toward the total number of VLANs<\/p>\n

LAN base feature set
\n– supports a total of 255 VLANs
\n– routed ports count toward the total number of VLANs<\/p>\n

Switches support PVST+ or rapid-PVST+ with a maximum of 128 spanning-tree instances
\n– STP will be disabled on any VLANs over 128
\n– STP is enabled on extended-range VLANs by default<\/p>\n

VLAN port membership modes:
\n– static-access
\n– trunk
\n– dynamic access
\n– voice VLAN<\/p>\n

Static-access:
\n– one VLAN
\n– manually configured
\n– VTP not required<\/p>\n

Trunk:
\n– ISL or 802.1Q
\n– member of all VLANs by default, including the extended-range VLANs
\n– VTP recommended but not required<\/p>\n

Dynamic access:
\n– belong to one VLAN and is dynamically assigned by a VMPS (VLAN Membership Policy Server)
\n– VTP is required
\n– configure the VMPS and the client with the same VTP domain name<\/p>\n

Voice VLAN:
\n– used with Cisco IP Phones
\n– a port can be configured for one voice VLAN and one data VLAN
\n– VTP is not required<\/p>\n

Configurations for VLAN IDs 1 – 1005 are written to a file vlan.dat
\n– VLAN database
\n– stored in flash
\n– flash:\/vlan.dat<\/p>\n

In VTP transparent mode, the VTP and VLAN configurations are also saved in the running-<\/p>\n

config
\n– also called VTP disabled
\n– extended-range VLANs are not saved in the VLAN database and are not propogated<\/p>\n

VLAN types:
\n– ethernet
\n– FDDI
\n– token ring
\n– token ring-net
\n– TrBRF
\n– TrCRF<\/p>\n

Parameters that can be set for a normal-range VLAN:
\n– VLAN ID
\n– VLAN name
\n– VLAN type
\n– VLAN state (active or suspended)
\n– MTU
\n– Security Association Identifier (SAID)
\n– Bridge indentification number for TrBRF VLANs
\n– Ring number for FDDI and TrCRF VLANs
\n– Parent VLAN number for TrCRF VLANs
\n– STP type for TrCRF VLANs
\n– VLAN number to used when translating from one VLAN type to another<\/p>\n

To create a VLAN, the switch must be in VTP server or transparent mode<\/p>\n

VTP server mode, the VTP domain must be configured for VTP to function<\/p>\n

Since the switch supports Ethernet interfaces exclusively, only FDDI and Tolken Ring<\/p>\n

media-specific characteristics are supported for VTP global advertisements to other<\/p>\n

switches<\/p>\n

conf t
\nvlan 20
\nname test20<\/p>\n

show vlan<\/p>\n

Deleting a VLAN in VTP server mode, the VLAN is removed from the VLAN database for all<\/p>\n

switches in the VTP domain<\/p>\n

Deleting a VLAN in VTP transparent mode, the VLAN is deleted only from that switch<\/p>\n

When a VLAN is deleted, any ports assigned to that VLAN become inactive.<\/p>\n

conf t
\nno vlan 20<\/p>\n

sh vlan brief<\/p>\n

If a VLAN is configured on an interface and the VLAN does not exist, the new VLAN is<\/p>\n

created<\/p>\n

conf t
\nint fa0\/1
\nswitchport mode access
\nswithport access vlan 20<\/p>\n

show run int fa0\/1
\nshow int fa0\/1 switchport<\/p>\n

To return an interface to it’s default configuration:<\/p>\n

conf t
\ndefault int fa0\/1<\/p>\n

Each routed port on the switch creates an internal VLAN for use. These internal VLANs use<\/p>\n

extended-range VLAN numbers. This internal VLAN cannot be configured for an extended-range<\/p>\n

VLAN.<\/p>\n

conf t
\nint fa0\/1
\nno switchport
\nip address 1.1.1.1 255.255.255.252<\/p>\n

show vlan internal usage<\/p>\n

To change the behavior of internal VLANs, whether they start at 1006 and ascend or start at<\/p>\n

4094 and descend, use:<\/p>\n

conf t
\nvlan internal allocation policy ascending<\/p>\n

Or:<\/p>\n

vlan internal allocation policy descending<\/p>\n

If necessary, the routed port can be shutdown, which frees up the internal VLAN. The<\/p>\n

Extended-range VLAN can then be created using that VLAN ID. Then re-enable the port.<\/p>\n

Routed ports count toward the total number of VLANs on the switch. If the total number of<\/p>\n

VLANs is reached, an error message is created<\/p>\n

Before creating an extended-range VLAN, use:<\/p>\n

show vlan internal usage<\/p>\n

Entended-range VLANs:<\/p>\n

conf t
\nvtp mode transparent
\nvlan 200
\nname test<\/p>\n

show vlan id 200<\/p>\n

To delete an extended-range VLAN:<\/p>\n

conf t
\nno vlan 200<\/p>\n

Switches running the LAN Base feature set support only static routing on SVIs.<\/p>\n

The voice VLAN enables access ports to carry IP voice traffic from an IP phone<\/p>\n

The IP phone sends voice traffic with:
\n– Layer 3 IP precedence; default value of 5
\n– Layer 2 class of service (CoS); default value of 5<\/p>\n

The switch can be configured to trust or override the traffic priority assigned by the IP<\/p>\n

phone<\/p>\n

The IP phone has an integrated 3 port switch
\n– Port 1 connects to the switch
\n– Port 2 is an internal interface
\n– Port 3 connects to a PC or other device<\/p>\n

An access port can be configured for one voice VLAN and one data VLAN<\/p>\n

CDP must be enabled on the switch port<\/p>\n

CDP is used to configure the IP phone to send voice traffic in any of these ways:
\n– voice VLAN tagged with Layer 2 CoS priority value
\n– access VLAN tagged with Layer 2 CoS priority value
\n– access VLAN untagged and no Layer 2 CoS priority value<\/p>\n

Voice traffic Layer 3 IP precedence
\n– voice traffic, default value of 5
\n– voice control traffic, default value of 3<\/p>\n

CDP is used to configure the IP phone’s access port
\n– trusted mode, all traffic received passes through unchanged
\n– untrusted mode, all 802.1Q and 802.1p frames receive a configured Layer 2 CoS value;
\n– the default CoS value is 0
\n– untrusted mode is the default
\n– untagged traffic passes through the phone unchanged, regardless of the trust state of<\/p>\n

the access port on the phone<\/p>\n

Do not configure a voice VLAN on a private VLAN port<\/p>\n

Power over Ethernet (PoE) switches are capable of automatically providing power to devices
\n– Cisco pre-standard
\n– 802.3af compliant<\/p>\n

It is recommended to enable QoS on switches before enabling a voice VLAN
\n– mls qos; global configuration
\n– mls qos trust cos; interface configuration
\n– the auto-QoS feature configures both<\/p>\n

The Port Fast feature is automatically enabled when the voice VLAN is configured
\n– when the voice VLAN is disabled, the Port Fast feature is not automatically disabled<\/p>\n

If the IP phone and the device attached to the phone are in the same VLAN, they must be in<\/p>\n

the same IP subnet<\/p>\n

Voice VLAN can be configured on the following port types:
\n– dynamic access port
\n– IEEE 802.1X authenticated port
\n– protected port
\n– the source or destination of a SPAN or RSPAN session
\n– secure port<\/p>\n

Port security
\n– You must set the maximum allowed addresses on the port 2, plus the number allowed on the<\/p>\n

access VLAN
\n– the MAC address of the IP phone may be learned on both the voice and access VLANs<\/p>\n

conf t
\nint fa0\/1
\nmls qos trust cos
\nswitchport voice {detect cisco-phone [full-duplex] | vlan {vlan-id | dot1p | none |<\/p>\n

untagged}}<\/p>\n

switchport voice vlan dot1p
\n– configures the switch to access voice and data IEEE 802.1p priority frames tagged with<\/p>\n

VLAN ID 0 (the native VLAN)
\n– by default, the switch drops all voice and data traffic tagged with VLAN 0<\/p>\n

sh int fa0\/1 switchport<\/p>\n

conf t
\nint fa0\/1
\nswitchport priority extend {cos | trust}<\/p>\n

On a router, VLANs need to be configured on subinterfaces.<\/p>\n

conf t
\nip routing
\nint fa0\/1.2
\nencapsulation dot1q 2
\nip address 1.1.1.1 255.255.255.0<\/p>\n

conf t
\nint fa0\/1.2
\nencapsulation dot1q 2 native
\nip address 1.1.1.1 255.255.255.0<\/p>\n

Configuring a VLAN for a Bridge Group<\/p>\n

conf t
\nint fa0\/1.2
\nencapsulation dot1q 2
\nbridge-group 2<\/p>\n

Each VLAN has its own MAC address table<\/p>\n

Switch ports are Layer 2-only interafaces associated with a physical port
\n– a switch port can be an access port, a trunk port, or a tunnel port
\n– switch ports do not handle routing or bridging<\/p>\n

If an access port receives a tagged packet (ISL or dot1q), the packet is dropped<\/p>\n

Port VLAN ID (PVID)<\/p>\n

Tunnel ports are used in 802.1Q tunneling to segregate the traffic of customers in a<\/p>\n

service-provider network from other customers who are using the same VLAN number<\/p>\n

A routed port is a physical port that acts like a port on a router
\n– behaves like a regular router interface, except that it does not support VLAN<\/p>\n

subinterfaces<\/p>\n

A switched virtual interface (SVI) represents a VLAN of switch ports as one interface to<\/p>\n

the routing and bridging functions in the system
\n– only one SVI can be associated with a VLAN
\n– must be configured to route between VLANs or use fallback-bridging for nonroutable<\/p>\n

protocols between VLANs
\n– by default, an SVI is created for VLAN 1
\n– the SVI for VLAN 1 cannot be deleted
\n– the SVI does not become active until it is associated with a physical port and that port<\/p>\n

is up up state<\/p>\n

SVI autostate exclusion
\n– configures a port to not be included in the calculation to determine whether the VLAN is<\/p>\n

up
\n– if the port configured for SVI autostate exclusion is the only port state is up in the<\/p>\n

VLAN, the SVI will be in the down state<\/p>\n

conf t
\nint gi0\/1
\nswitchport autostate exclude<\/p>\n

show run int gi0\/1
\nshow int gi0\/1 switchport<\/p>\n

10-Gigabit Ethernet interfaces only operate in the full-duplex mode<\/p>\n

PoE capable switch ports automatically supply power to connected devices for:
\n– Cisco pre-standard powered devices (Cisco IP Phones)
\n– IEEE 802.3af compliant powered devices
\n– IEEE 802.3at compliant powered devices<\/p>\n

The switch uses these protocols to support PoE:
\n– CDP with power consumption
\n– Cisco intelligent power management
\n– IEEE 802.3af
\n– IEEE 802.3at – POE+<\/p>\n

Power management modes
\n– auto
\n– static
\n– never<\/p>\n

Macros can be used to define interface ranges<\/p>\n

conf t
\ndefine interface-range ALL_PORTS fa0\/1 – 24
\nint range macro ALL_PORTS<\/p>\n

show run | in define<\/p>\n

Management port
\n– a Layer 3 host port used to connect a PC
\n– by default, the management port is enabled
\n– the switch cannot route packets from the management port to a routed port
\n– the switch cannot route packets from a routed port to the management port
\n– routing protocols can be enabled on the port<\/p>\n

If the management port and routed port are associated to the same routing process
\n– the routes from the management port are propogated through the routed ports
\n– the routes from the routed ports are propogated through the management port<\/p>\n

Supported features on the management port:
\n– Express Setup
\n– Network Assitant
\n– telnet
\n– TFTP
\n– SSH
\n– DHCP
\n– SNMP
\n– IP ping
\n– CDP
\n– DHCP relay agent
\n– IPv4 and IPv6 ACLs
\n– routing protocols<\/p>\n

If the management port LED is amber, the switch failed POST<\/p>\n

TFTP and the management port
\n– arp
\n– mgmt_clr
\n– mgmt_init
\n– mgmt_show
\n– ping
\n– boot tftp:\/
\n– copy tftp:\/<\/p>\n

Default Layer 2 Ethernet Interface Configuration
\n– Operating mode: Layer 2 (switchport)
\n– Allowed VLAN range: 1 – 4094
\n– Default VLAN: VLAN 1
\n– Native VLAN: VLAN 1
\n– VLAN trunking: switchport mode dynamic auto (supports DTP)
\n– Port enabled state: all ports are enabled
\n– Port description: none defined
\n– Speed: autonegotiate
\n– Duplex mode: autonegotiate
\n– Flow control: set to receive off
\n– EtherChannel (PAgP): disabled on all ports
\n– port blocking (unknown multicast and unknown unicast): disabled
\n– Broadcast, multicast, unicast storm: disabled
\n– Portected port: disabled
\n– Port security: disabled
\n– Port fast: disabled
\n– Auto-MDIX: enabled
\n– Power over Ethernet: enabled<\/p>\n

Interface speed and duplex mode
\n– 10 Mb\/s ports normally operate in half-duplex mode
\n– Gigabit Ethernet ports operating at 1000 Mb\/s do not support half-duplex mode
\n– SFP ports (1000BASE-x, where x is -BX, -CWDM, -LX, -SX, or -ZX) support the nonegotiate<\/p>\n

and speed interface commands
\n– SFP ports (1000BASE-x, where x is -BX, -CWDM, -LX, -SX, or -ZX) do not support duplex<\/p>\n

options
\n– SFP ports (1000BASE-T) support speed and duplex options<\/p>\n

Changing the interface speed and duplex mode might shut down and re-enable the interface<\/p>\n

conf t
\nint gi0\/1
\nspeed { 10 | 100 | 1000 | auto | nonegotiate }
\nduplex { auto | full | half }<\/p>\n

show int gi0\/1<\/p>\n

IEEE 802.3x flow control
\n– enables connected port to control traffic rates during congestion
\n– node sends pause link operation to the other end
\n– 3750-X and 3560-X ports can receive, but do not send pause frames<\/p>\n

conf t
\nint gi0\/1
\nflowcontrol { on | off | desired }<\/p>\n

show int gi0\/1<\/p>\n

Auto-MDIX
\n– Automatic Medium-Dependent Interface Crossover
\n– allows either a straight through or crossover cable to be connected
\n– enabled by default
\n– the interface speed and duplex must be set to auto
\n– not supported on 1000BASE-SX or -LX SFPs<\/p>\n

conf t
\nint gi0\/1
\nspeed auto
\nduplex auto
\nmdix auto<\/p>\n

show controllers ethernet-controller gi0\/1 phy<\/p>\n

PoE management on an interface<\/p>\n

conf t
\nint gi0\/1
\npower inline { auto | never | static }<\/p>\n

show power inline<\/p>\n

The switch supports these types of Layer 3 interfaces
\n– SVIs
\n– Routed ports
\n– Layer 3 EhterChannel ports<\/p>\n

All Layer 3 interfaces require an IP address to route traffic<\/p>\n

conf t
\nint gi0\/1
\nno switchport
\nip add 1.1.1.1 255.255.255.0
\nno shut<\/p>\n

show int gi0\/1
\nshow ip int gi0\/1<\/p>\n

System MTU
\n– the default maximum transmission unit (MTU) size for frames received and sent on all<\/p>\n

interfaces si 1500 bytes
\n– jumbo frames can be configured on Gigabit and 10-Gigabit ethernet ports
\n– system mtu jumbo
\n– system routing MTU applies only to routed packets on all routed ports
\n– system mtu routing
\n– the switch does not support MTU settings on a per-interface bassis
\n– the command “system mtu ” can be configured on a 3750-X, but the<\/p>\n

setting only applies to 3750 switches in the switch stack
\n– after changing MTU settings, the switch must be reset to take effect
\n– the system MTU settings is saved in the switch environmental variable in NVRAM
\n– the system MTU settings are not saved in the configuration file
\n– the maximum MTU size varies depending on if there are 3750 switches present in the<\/p>\n

switch stack<\/p>\n

conf t
\nsystem mtu jumbo 9198
\nsystem mtu routing 9198
\nsystem mtu 1998<\/p>\n

reload<\/p>\n

show system mtu<\/p>\n

Monitoring Interface Status<\/p>\n

show env power switch
\nshow env ps
\nshow int gi0\/1
\nshow int gi0\/1 status
\nsh int status
\nshow int gi0\/1 status err-disabled
\nshow int gi0\/1 switchport
\nshow int gi0\/1 description
\nshow ip int gi0\/1
\nshow ip int brief
\nshow int gi0\/1 stats
\nshow int transceiver dom-supported-list
\nshow int transceiver properties
\nshow controllers ethernet-controller gi0\/1
\nshow power inline
\nshow power inline consumption
\nshow power inline police<\/p>\n

Clearing and resetting interface counters<\/p>\n

clear counters gi0\/1
\nclear int gi0\/1
\nclear line vty 1
\nclear line console<\/p>\n","protected":false},"excerpt":{"rendered":"

v5 Written: 2.1.c Implement and troubleshoot VLAN 2.1.c [i] Access ports 2.1.c [ii] VLAN database 2.1.c [iii] Normal, extended VLAN, voice VLAN v5 Lab: 1.1.c Implement and troubleshoot VLAN 1.1.c [i] Access Ports 1.1.c [ii] VLAN database 1.1.c [iii] Normal, extended VLAN, voice VLAN Documents: Catalyst 3750-X and 3560-X Software Configuration Guide, Release 15.0(1)SE, Chapter […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[30,11,19],"class_list":["post-68","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-ccie","tag-route-switch","tag-vlan"],"_links":{"self":[{"href":"https:\/\/feralpacket.org\/index.php?rest_route=\/wp\/v2\/posts\/68","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/feralpacket.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/feralpacket.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/feralpacket.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/feralpacket.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=68"}],"version-history":[{"count":5,"href":"https:\/\/feralpacket.org\/index.php?rest_route=\/wp\/v2\/posts\/68\/revisions"}],"predecessor-version":[{"id":231,"href":"https:\/\/feralpacket.org\/index.php?rest_route=\/wp\/v2\/posts\/68\/revisions\/231"}],"wp:attachment":[{"href":"https:\/\/feralpacket.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=68"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/feralpacket.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=68"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/feralpacket.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=68"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}