Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1032
  • Last Modified:

Cisco Vlan Configuration Commands

I have the following configuration on my Cisco 3560 switch.  

interface FastEthernet0/5
 description WLS_Scanner_AP
 switchport trunk encapsulation dot1q
  switchport trunk allowed vlan 801
 switchport mode trunk
 srr-queue bandwidth share 1 20 40 40
 priority-queue out
 mls qos vlan-based
 no snmp trap link-status
 no mdix auto
 spanning-tree portfast
 spanning-tree bpduguard enable

I connected a PC on that port with a static IP from vlan 801.  When I try to get a mac address from that port, nothing shows up even though the port shows up/up.  It’s only when I add the command ‘switchport trunk native vlan 801” that it works.  
When I configure the switchport as just trunk without any other additional configuration, the PC does not work until I configure the native vlan as 801.  It seems strange; shouldn’t it work with just trunk? The only other way it works is if I configure the port as access port and to access a specific vlan.

 Can someone explain to me why it doesn’t work without that command; the port is a trunk.  

I also read an article that recommends not using the default vlan as native vlan for security.  The article recommends to use a native vlan not used anywhere on the LAN to prevent vlan hopping.  Anytime I try using a native vlan not used, nothing works on the port.  What am I missing?
0
donemore2003
Asked:
donemore2003
3 Solutions
 
Matt VCommented:
Why are you putting the port in trunk mode if you only have 1 pc with 1 vlan assigned to it?

Trunk mode is for routers and switches.
0
 
The_KirschiCommented:
Mattvmotas is right. Here are the commands:

switchport mode access
switchport access vlan 801

0
 
Matt VCommented:
If you have a valid reason for trunking that is different, like a VMware server or something similar.  But that technically falls under the category of router :)
0
Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
donemore2003Author Commented:
To all

My question is why those configurations don't work when the port is configured as a trunk.  Why is it necessary to configure a native vlan for the PC to work?  I understand configuring access ports as i indicated in my question.

Plus what about the second part of my question; using a native vlan that i snot used?

Thanks
0
 
Matt VCommented:
When the port is configured in trunk mode, it does not parse the vlan tagging.  The device you plug into the port is expected to parse the tag.

By assigning a native vlan, you are asking it to watch for tags for that vlan.

Cisco does recommend not using VLAN 1 as the native VLAN, but I have seen plenty of networks that use it.

It is a recommended best practice which is usually good advice.
0
 
lanboyoCommented:
When you configured the port as a trunk with dot1q, it added an 8 bit vlan tag to every ethernet frame, and in turn expects an 8 bit vlan tag on every ethernet frame it revcieves.

If you configure native vlan it will send ethernet frames in that vlan without the vlan tag and any incoming packet without a vlan tag will be treated as incoming on the native vlan. Without special configuration that many operating systems are not capable of, dot1q framed ethernet packets can not be sent or understood by most workstations or devices.

The article is telling you not to use vlan 1 for native vlan. There are some security issues that native vlan on vlan 1 being enabled may allow.

The vlan you set as native vlan needs to be the same throughout the network. If you set a n arbritrary vlan as native, and no other devices or trunks are on that vlan then the device can not talk to anything. Also, since is 801 is the only vlan permitted on the trunk, the native vlan must be vlan 801, or you must permit the new native vlan.

Setting vlan 801 as native is ok as far as the article is concerned.
0
 
jjmartineziiiCommented:
the native vlan command tags untagged frames into the specific vlan. if you don't specify a vlan, they are tagged with vlan 1.

You don't have to put the native vlan command if you NIC supports vlan tagging.
0
 
Don JohnstonInstructorCommented:
It seems strange; shouldn’t it work with just trunk?

With the configuration:

1 switchport trunk encapsulation dot1q
2 switchport trunk allowed vlan 801
3 switchport mode trunk

Command 1 says that IF the port is a trunk, it will be an 802.1q trunk... Not an ISL trunk.

Command 2 says that IF the port is a trunk, only allows VLAN801 traffic in/out the port.

Command 3 is forcing the port to be a trunk. Which means the traffic from all VLANs are allowed in/out the port. The traffic from non-native VLANs will be tagged. The native VLAN (VLAN 1) will be untagged. However, command 2 is overriding the "all VLANs are allowed" part.

So when you connect a plain old PC to this port, it is sending out plain old ethernet frames (no tags). When the switch receives these untagged frames, they are assumed to be in the NATIVE VLAN (VLAN 1). But you're not allowing VLAN 1 traffic. So it's discarded.

But when you add the command "switchport trunk native vlan 801", you are redefining the native VLAN (untagged) to VLAN 801. So now when an untagged frame arrives on the port, the switch assumes that frame is in VLAN 801 (which is allowed) so it works.

Now, if you're only allowing one VLAN on a port, there's no reason for it to be a trunk in the first place.

>Anytime I try using a native vlan not used, nothing works on the port.  What am I missing?

Can you be more specific? Any VLAN can be the native VLAN. But it does have to exist.

0
 
donemore2003Author Commented:
I just hadn't had a chance to get back at the site.  I appreciate all the support I get on this site
0
 
donemore2003Author Commented:
Your support is greatly appreciated.  I have learned more since I became a member.  Thanks to all
0
 
donemore2003Author Commented:
No objection
0
 
donemore2003Author Commented:
No objection
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
This question has been classified as abandoned and is being closed as part of the Cleanup Program.  See my comment at the end of the question for more details.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now