Posts Tagged ‘vlan tagging’

Basic Cisco Configuration Steps for Absolute Beginners

Friday, October 24th, 2008

Thought I would write a post for those of you who are not yet evil Cisco Jedi masters with a black belt containing a network swizz army knife, with a sharp firewall slicer and a port opener.

Setting the hostname

Switch#configure terminal
Switch(config)#hostname SuperSwitch
SuperSwitch(config)#

As you can see, the hostname change happened immediately.

Configuring a VLAN with an IP on two ports
To get the list of interfaces on the Switch

Switch# show interfaces description

To create a new Layer 2 VLAN on the switch

! configure terminal enters configuration mode
Switch#configure terminal
! vlan 10 creates the layer 2 vlan on the switch, this is actually
! usually done by the switch when the first port is set to access vlan 10
Switch(config)#vlan 10
Switch(config-vlan)#exit
! Enter interface configuration
Switch(config)#interface GigabitEthernet1/0/1
! Sets the port to mode access
Switch(config-if)#switchport mode access
! Sets the port to access vlan 10
Switch(config-if)#switchport access vlan 10
! No shutdown turns on the port
Switch(config-if)#no shutdown
!
! Enter interface configuration of the second port and do all the same
! You can enter more interfaces at the time with the range command
! for example: interface range GigabitEthernet1/0/1 – 2
! In that way you wouldn’t have to do this twice.
Switch(config-if)#interface GigabitEthernet1/0/2
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#no shutdown
Switch(config-if)#exit
!
! Now create the layer 3 interface on vlan 10
!
Switch(config)#interface vlan 10
!
! Sets the IP address 10.0.0.1 and unshuts the interface
Switch(config-if)#ip address 10.0.0.1 255.255.255.0
Switch(config-if)#no shutdown
Switch(config-if)#end
Switch#

The computers on port GigabitEthernet 1/0/1 and 1/0/2 should now be able to ping 10.0.0.1 when they are configured with those IP settings.

Configuring a trunk port
A trunk port is a port that can carry several VLANs in one port, it is done with 802.1q or ISL, the first one is mostly prefered because it is not proprietary so several vendors supports it.

To configure a trunk port, you will have to issue this configuration on the trunk port on both switches:

Switch#configure terminal
Switch(config)#interface GigabitEthernet 1/0/10
Switch(config-if)#switchport trunk encapsulation dot1q
Switch(config-if)#switchport mode trunk
Switch(config-if)#no shut
Switch(config-if)#end
Switch#

This will create a trunk, per default it will accept any vlan tags, so if you do not want the network you connected to access any of your private vlans you will need an access list of which VLAN tags to accept on this port.

switchport trunk allowed vlan 10

By issuing this command on the port, you will only allow vlan 10 to flow through it.

If you now want to give for example port 9 on the second switch access to that 10.0.0.1

Switch#configure terminal
Switch(config)#interface GigabitEthernet 1/0/9
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#no shutdown
Switch(config-if)#end
Switch#

This is how to setup basic vlans and trunking on Cisco.
Read my other posts for more advanced configuration examples!

Configuring 802.1Q Trunk Links in Cisco IOS

Monday, September 22nd, 2008

This is CCNA level stuff, here is an insight article about trunk links.

What is a trunk link?
A port in trunking mode can carry multiple vlans with two types of encapsulation, either ISL or 802.1Q.
Multiple vendors support 802.1Q, and that makes it my choice for a trunking protocol.

How does 802.1Q work?
It works by inserting a 4-byte tag in the original frame header, this contains the VLAN identification along with some other information.

Bits 16 3 1 12
TPID PRIORITY CFI VID

The TPID is the Tag Protocol Identifier, this should be set to 0x8100 for 802.1Q.
The PRIORITY is a 3-bit priority, ranges from 0 – 7.
The CFI is the Canonical Format Idicator, which means that it is used to identify if the MAC address is in canonical format or not, if it is set to 0 the address is in canonical format.

The tag is 4 bytes long, and with a 12-bit VLAN ID field, it can hold 2^12 = 4096 Vlans.
The switch will also recompute the FCS-field, since the frame is altered.

Configuration of a trunk link
Now, to configure a trunk link between two switches the following code should be suitable:

Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# exit
Switch(config) vlan 500

The encapsulation will define the encapsulation of the trunk link to either ISL or 802.1Q.
The mode trunk will force the port into a trunking mode, where you can also choose dynamic to make switches negotiate the mode. I force all ports to their mode, always.
The vlan 500 command will create the vlan 500, this should automatically be trunked when configured on both sides.

Disallow some vlans
Sometimes we don’t wanna make a mess and let some vlans over some trunk links.
Imagine spanning a customers vlan from US to Spain by accident, or worse..
Imagine delivering layer 2 connectivity between a set of location for a customer on different vlan ID’s, delivered on a trunk link. If you aren’t careful you can end up letting private vlan traffic leak between customers.

Switch(config)# interface Gig1/0/1
Switch(config-if)# switchport trunk allowed vlan 500

This will make sure that only vlan 500 is allowed over this trunk link, even if the other side tries to negotiate another vlan from you.

Pitfalls
Make sure to use the add statement if you are adding more vlans to a trunk link.

Switch(config-if)# switchport trunk allowed vlan add 200

Or else the configuration will overwrite the old vlans you might have configured on a link.

Verification
To verify your trunk links, you can for example do this:

Switch#show interfaces trunk

Port Mode Encapsulation Status Native vlan
Gi1/0/1 auto 802.1q trunking 1

Port Vlans allowed on trunk
Gi1/0/1 500

Port Vlans allowed and active in management domain
Gi1/0/1 500

Port Vlans in spanning tree forwarding state and not pruned
Gi1/0/1 500

Here you can see that port Gi1/0/1 is trunking, and that vlan 500 is allowed and active over the trunk.

You can also use show vlan id;

Switch# show vlan id 500

VLAN Name Status Ports
—- ——————————– ——— ——————————-
500 VLAN500 active Gi1/0/1, Gi1/0/2

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
—- —– ———- —– —— —— ——– —- ——– —— ——
500 enet 101545 1500 – – – – – 0 0

Remote SPAN VLAN
—————-
Disabled

Primary Secondary Type Ports
——- ——— —————– ——————————————

Switch#

Here you can see that vlan 500 is configured on the trunk link Gigabit ethernet 1/0/1 and also on 1/0/2.

That’s a little insight in 802.1Q trunking vlan links!