- Objectives
- Key Terms
- Introduction (3.0.1.1)
- VLAN Segmentation (3.1)
- VLANs in a Multiswitched Environment (3.1.2)
- VLAN Implementations (3.2)
- VLAN Trunks (3.2.2)
- Dynamic Trunking Protocol (3.2.3)
- Troubleshoot VLANs and Trunks (3.2.4)
- VLAN Security and Design (3.3)
- Design Best Practices for VLANs (3.3.2)
- Summary (3.4)
- Practice
- Class Activities
- Labs
- Packet Tracer Activities
- Check Your Understanding Questions
This chapter is from the book
This chapter is from the book
This chapter is from the book
VLAN Implementations (3.2)
VLANs allow multiple networks to exist on one or more switches. Companies commonly use VLANs to separate a user network from other networks such as a voice network, printer/copier network, and guest network.
VLAN Ranges on Catalyst Switches (3.2.1.1)
Different Cisco Catalyst switches support various numbers of VLANs. The number of supported VLANs is large enough to accommodate the needs of most organizations. For example, the Catalyst 2960 and 3560 Series switches support more than 4000 VLANs. Normal range VLANs on these switches are numbered 1 to 1005 and extended range VLANs are numbered 1006 to 4094. Figure 3-13 illustrates the available VLAN IDs on a Catalyst 2960 switch running Cisco IOS Release 15.x.
)
Figure 3-13 Normal VLAN ID Range
Normal Range VLANs
Used in small- and medium-sized business and enterprise networks.
- Identified by a VLAN ID between 1 and 1005.
- IDs 1002 through 1005 are reserved for Token Ring and FDDI VLANs.
- IDs 1 and 1002 to 1005 are automatically created and cannot be removed.
- Configurations are stored within a VLAN database file, called vlan.dat. The vlan.dat file is located in the flash memory of the switch.
- The VLAN Trunking Protocol (VTP) is a Cisco-proprietary Layer 2 protocol used to manage VLAN configurations between switches; VTP can learn and store only normal range VLANs.
Extended Range VLANs
- Enable service providers to extend their infrastructure to a greater number of customers. Some global enterprises could be large enough to need extended range VLAN IDs.
- Are identified by a VLAN ID between 1006 and 4094.
- Configurations are not written to the vlan.dat file.
- Support fewer VLAN features than normal range VLANs.
- Are, by default, saved in the running configuration file.
- VTP does not learn extended range VLANs.
Creating a VLAN (3.2.1.2)
When configuring normal range VLANs, the configuration details are stored in flash memory on the switch in a file called vlan.dat. Flash memory is persistent and does not require the copy running-config startup-config command. However, because other details are often configured on a Cisco switch at the same time that VLANs are created, it is good practice to save running configuration changes to the startup configuration.
Table 3-1 displays the Cisco IOS command syntax used to add a VLAN to a switch and give it a name.
Table 3-1 Commands Used to Create a VLAN
|
Enter global configuration mode. |
S1# configure terminal |
|
Create a VLAN with a valid VLAN ID number. |
S1(config)# vlan vlan-id |
|
Specify a unique name to identify the VLAN. |
S1(config-vlan)# name vlan-name |
|
Return to the privileged EXEC mode. |
S1(config-vlan)# end |
Figure 3-14 shows how the student VLAN (VLAN 20) is configured on switch S1. In the topology example, the student computer (PC1) has not been associated with a VLAN yet, but it does have an IP address of 172.17.20.22.
)
Figure 3-14 Sample VLAN Configuration
Activity 3.2.1.2: VLAN Creation and Verification
Go to the online course and click on the third graphic to use the Syntax Checker to create a VLAN and use the show vlan brief command to display the contents of the vlan.dat file.
In addition to entering a single VLAN ID, a series of VLAN IDs can be entered separated by commas, or a range of VLAN IDs separated by hyphens using the vlan vlan-id command. For example, use the following command to create VLANs 100, 102, 105, 106, and 107:
S1(config)# vlan 100,102,105-107
Assigning Ports to VLANs (3.2.1.3)
After creating a VLAN, the next step is to assign ports to the VLAN. An access port can belong to only one VLAN at a time; one exception to this rule is that of a port connected to an IP phone, in which case, there are two VLANs associated with the port: one for voice and one for data.
Table 3-2 displays the syntax for defining a port to be an access port and assigning it to a VLAN. The switchport mode access command is optional, but strongly recommended as a security best practice. With this command, the interface changes to permanent access mode.
Table 3-2 Commands Used to Assign Ports to VLANs
|
Enter global configuration mode. |
S1# configure terminal |
|
Enter interface configuration mode for a particular port number. |
S1(config)# interface interface_id |
|
Set the port to access mode. |
S1(config-if)# switchport mode access |
|
Assign the port to a particular VLAN. |
S1(config-if)# switchport access vlan vlan-id |
|
Return to the privileged EXEC mode. |
S1(config-if)# end |
In Figure 3-15, VLAN 20 is assigned to port F0/18 on switch S1; therefore, the student computer (PC2) is in VLAN 20. When VLAN 20 is configured on other switches, the network administrator knows to configure the other student computers to be in the same subnet as PC2 (172.17.20.0/24).
)
Figure 3-15 Sample VLAN Interface Configuration
Activity 3.2.1.3: Assign Ports to a VLAN and Verify
Go to the online curriculum to the third graphic and use the Syntax Checker to assign a VLAN to a particular interface and use the show vlan brief command to display the contents of the vlan.dat file.
The switchport access vlan command forces the creation of a VLAN if it does not already exist on the switch. For example, VLAN 30 is not present in the show vlan brief output of the switch. If the switchport access vlan 30 command is entered on any interface with no previous configuration, then the switch displays the following:
% Access VLAN does not exist. Creating vlan 30
Changing VLAN Port Membership (3.2.1.4)
There are a number of ways to change VLAN port membership. Table 3-3 shows the syntax for changing a switch port to VLAN 1 membership with the no switchport access vlan interface configuration mode command.
Table 3-3 Remove VLAN Configuration Commands
|
Enter global configuration mode. |
S1# configure terminal |
|
Enter interface configuration mode for a particular port number. |
S1(config)# interface interface_id |
|
Assign the port to a particular VLAN. |
S1(config-if)# no switchport access vlan vlan-id |
|
Return to the privileged EXEC mode. |
S1(config-if)# end |
Interface F0/18 was previously assigned to VLAN 20. The no switchport access vlan command is entered for interface F0/18. Examine the output in the show vlan brief command that immediately follows as shown in Figure 3-16. The show vlan brief command displays the VLAN assignment and membership type for all switch ports. The show vlan brief command displays one line for each VLAN. The output for each VLAN includes the VLAN name, status, and switch ports.
)
Figure 3-16 Sample Interface Removal of a VLAN
VLAN 20 is still active, even though no ports are assigned to it. The show interfaces fa0/18 switchport output verifies that the access VLAN for interface F0/18 has been reset to VLAN 1.
S1# show interfaces fa0/18 switchport
Name: Fa0/18
Switchport: Enabled
Administrative Mode: static access
Operational Mode: down
Administrative Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
<output omitted>
A port can easily have its VLAN membership changed. It is not necessary to first remove a port from a VLAN to change its VLAN membership. When an access port has its VLAN membership reassigned to another existing VLAN, the new VLAN membership simply replaces the previous VLAN membership. In the following output, port F0/11 is assigned to VLAN 20.
S1# config t
S1(config)# interface fastethernet0/11
S1(config-if)# switchport mode access
S1(config-if)# switchport access vlan 20
% Access VLAN does not exist. Creating vlan 20
S1(config-if)# end
S1# show vlan brief
VLAN Name Status Ports
---- ---------------------- --------- --------------------------
1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/4
Fa0/5, Fa0/6, Fa0/7, Fa0/8
Fa0/9, Fa0/10, Fa0/12, Fa0/13
Fa0/14, Fa0/15, Fa0/16, Fa0/17
Fa0/18, Fa0/19, Fa0/20, Fa0/21
Fa0/22, Fa0/23, Fa0/24, Gig1/1
Gig1/2
20 VLAN0020 active Fa0/11
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
Activity 3.2.1.4: Changing VLAN Port Membership
Go to the online curriculum and click on the fifth graphic to use the Syntax Checker to change VLAN port membership.
Deleting VLANs (3.2.1.5)
In Figure 3-17, the no vlan vlan-id global configuration mode command is used to remove VLAN 20 from the switch. Switch S1 had a minimal configuration with all ports in VLAN 1 and an unused VLAN 20 in the VLAN database. The show vlan brief command verifies that VLAN 20 is no longer present in the vlan.dat file after using the no vlan 20 command.
)
Figure 3-17 Deleting a VLAN
Alternatively, the entire vlan.dat file can be deleted using the delete flash:vlan.dat privileged EXEC mode command. The abbreviated command version (delete vlan.dat) can be used if the vlan.dat file has not been moved from its default location. After issuing this command and reloading the switch, the previously configured VLANs are no longer present. This effectively places the switch into its factory default condition concerning VLAN configurations.
Verifying VLAN Information (3.2.1.6)
After a VLAN is configured, VLAN configurations can be validated using Cisco IOS show commands.
Table 3-4 shows common show vlan command options.
Table 3-4 The show vlan Command Options
|
show vlan [brief | id vlan-id | name vlan-name | summary] |
|
|
Display one line for each VLAN with the VLAN name, status, and associated ports. |
brief |
|
Display information about a single VLAN identified by the VLAN ID number, which can be a number between 1 and 4094. |
id vlan-id |
|
Display information about a single VLAN identified by a VLAN name. The VLAN name is an ASCII string from 1 to 32 characters. |
name vlan-name |
|
Display VLAN summary information. |
summary |
Table 3-5 shows common show interfaces command options.
Table 3-5 The show interfaces Command Options
|
show interfaces [interface-id | vlan vlan-id] | switchport |
|
|
Valid interfaces include physical ports (including type, module, and port number) and port channels. The port-channel range is 1 to 6. |
interface-id |
|
VLAN identification, which is a number from 1 to 4094. |
vlan vlan-id |
|
Display the administrative and operational status of a switch port,including port blocking and port protection settings. |
switchport |
In Figure 3-18, the show vlan name student command produces output that is not easily interpreted. The preferable option is to use the show vlan brief command. The show vlan summary command displays the count of all configured VLANs. The output in Figure 3-18 shows seven VLANs.
)
Figure 3-18 Using the show vlan Command
The show interfaces vlan vlan-id command displays details that are beyond the scope of this course. The important information appears on the second line in the output, indicating that VLAN 20 is up.
S1# show interfaces vlan 20Vlan 20 is up, line protocol is down Hardware is EtherSVI, address is 001c.57ec.0641 (bia 001c.57ec.0641) MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Last input never, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts (0 IP multicast) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 interface resets 0 output buffer failures, 0 output buffers swapped out <output omitted>
Activity 3.2.1.6: Using the show interfaces Command
Go to the online curriculum and select the fourth graphic to use the Syntax Checker to display the switch port information using the show interfaces interface-id switchport command. This command can be used to verify VLAN assignments and mode.
Packet Tracer Activity 3.2.1.6: Configuring VLANs
VLANs are helpful in the administration of logical groups, allowing members of a group to be easily moved, changed, or added. This activity focuses on creating and naming VLANs, and assigning access ports to specific VLANs.