- Objectives
- Key Terms
- Introduction (3.0.1.1)
- VLAN Segmentation (3.1)
- VLANs in a Multiswitched Environment (3.1.2)
- VLAN Implementations (3.2)
- VLAN Trunks (3.2.2)
- Dynamic Trunking Protocol (3.2.3)
- Troubleshoot VLANs and Trunks (3.2.4)
- VLAN Security and Design (3.3)
- Design Best Practices for VLANs (3.3.2)
- Summary (3.4)
- Practice
- Class Activities
- Labs
- Packet Tracer Activities
- Check Your Understanding Questions
This chapter is from the book
This chapter is from the book
This chapter is from the book
Troubleshoot VLANs and Trunks (3.2.4)
When first learning about switches, students have trouble knowing where to start troubleshooting. Pay particular attention to the show commands in this section to verify your configurations using the described techniques instead of simply using the show running-configuration command.
IP Addressing Issues with VLAN (3.2.4.1)
Each VLAN must correspond to a unique IP subnet. If two devices in the same VLAN have different subnet addresses, they cannot communicate. This is a common problem, and it is easy to solve by identifying the incorrect configuration and changing the subnet address to the correct one.
In Figure 3-22, PC1 cannot connect to the web/TFTP server shown.
)
Figure 3-22 IP Issue Within a VLAN
A check of the IP configuration settings of PC1 shown in Figure 3-23 reveals the most common error in configuring VLANs: an incorrectly configured IP address. PC1 is configured with an IP address of 172.172.10.21, but it should have been configured with 172.17.10.21.
)
Figure 3-23 Incorrect IP Address Problem
The PC1 Fast Ethernet configuration dialog box shows the updated IP address of 172.17.10.21. In Figure 3-24, the output on the bottom reveals that PC1 has regained connectivity to the web/TFTP server found at IP address 172.17.10.30.
)
Figure 3-24 Change PC IP Address
Missing VLANs (3.2.4.2)
If there is still no connection between devices in a VLAN, but IP addressing issues have been ruled out, see the flowchart in Figure 3-25 to troubleshoot.
)
Figure 3-25 Missing VLAN Flowchart
As shown in Figure 3-25, use the show vlan command to check whether the port belongs to the expected VLAN. If the port is assigned to the wrong VLAN, use the switchport access vlan command to correct the VLAN membership on a particular port. Use the show mac address-table command to check which addresses were learned on a particular port of the switch and to which VLAN that port is assigned, as shown in the following output.
S1# show mac address-table interface fastethernet 0/1 Mac Address Table --------------------------------------- Vlan Mac Address Type Ports ---- -------------- ------- -----10000c.296a.a21c DYNAMICFa0/110 000f.34f9.9181 DYNAMIC Fa0/1 Total MAC addresses for this criterion: 2Total Mac Addresses for this criterion: If the VLAN to which the port is assigned is deleted, the port becomes inactive. Use the show vlan or show interfaces switchport command to verify whether a VLAN is active.
S1# show interfaces fastethernet0/1 switchport Name: Fa0/1 Switchport: Enabled Administrative Mode: static access Operational Mode: static access Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: native Negotiation of Trunking: Off Access Mode VLAN: 10 (
Inactive) Trunking Native Mode VLAN: 1 (default) Administrative Native VLAN tagging: enabled <output omitted>
In the previous example of a MAC address table, the output shows the MAC addresses that were learned on the F0/1 interface. It can be seen that MAC address 000c.296a.a21c was learned on interface F0/1 in VLAN 10. If this number is not the expected VLAN number, change the port VLAN membership using the switchport access vlan command.
Introduction to Troubleshooting Trunks (3.2.4.3)
A common task of a network administrator is to troubleshoot trunk link formation or links incorrectly behaving as trunk links. Sometimes a switch port may behave like a trunk port even if it is not configured as a trunk port. For example, an access port might accept frames from VLANs different from the VLAN to which it is assigned. This is called VLAN leaking, which is caused by a mismatched native VLAN or misconfigured trunk.
Figure 3-26 displays a flowchart of general trunk troubleshooting guidelines.
)
Figure 3-26 Trunk Troubleshooting Flowchart
To troubleshoot issues when a trunk is not forming or when VLAN leaking is occurring, proceed as follows:
- Use the show interfaces trunk command to check whether the local and peer native VLANs match. If the native VLAN does not match on both sides, VLAN leaking occurs.
- Use the show interfaces trunk command to check whether a trunk has been established between switches. Statically configure trunk links whenever possible. Cisco Catalyst switch ports use DTP by default and attempt to negotiate a trunk link.
To display the status of the trunk, determine the native VLAN used on that trunk link and verify trunk establishment using the show interfaces trunk command. The following output shows that the native VLAN on one side of the trunk link was changed to VLAN 2. If one end of the trunk is configured as native VLAN 99 and the other end is configured as native VLAN 2, a frame sent from VLAN 99 on one side is received on VLAN 2 on the other side. VLAN 99 leaks into the VLAN 2 segment.
SW1# show interfaces f0/1 trunk Port Mode Encapsulation Status Native vlan Fa0/1auto802.1qtrunking 2<output omitted>
CDP displays a notification of a native VLAN mismatch on a trunk link with this message:
*Mar 1 06:45:26.232: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on FastEthernet0/1 (2), with S2 FastEthernet0/1 (99).
Connectivity issues occur in the network if a native VLAN mismatch exists. Data traffic for VLANs, other than the two native VLANs configured, successfully propagates across the trunk link, but data associated with either of the native VLANs does not successfully propagate across the trunk link.
Common Problems with Trunks (3.2.4.4)
Trunking issues are usually associated with incorrect configurations, shown in Table 3-9.
Table 3-9 Common Problems with Trunks
|
Problem |
Result |
Example |
|
Native VLAN mismatch |
Poses a security risk and creates unintended results |
One port is defined as native VLAN 99 and the opposite trunk end is defined as native VLAN 100. |
|
Trunk mode mismatch |
Causes loss of network connectivity |
One end of the trunk is configured as trunk mode "off" and the other as trunk mode "on." |
|
Allowed VLANs on trunks |
Causes unexpected traffic or no traffic to be sent over the trunk |
The list of allowed VLANs does not support current VLAN trunking requirements. |
When configuring VLANs and trunks on a switched infrastructure, the following types of configuration errors are the most common:
- Native VLAN mismatches: Trunk ports are configured with different native VLANs. This configuration error generates console notifications, and causes control and management traffic to be misdirected. This poses a security risk.
- Trunk mode mismatches: One trunk port is configured with trunk mode off and the other with trunk mode on. This configuration error causes the trunk link to stop working.
- Allowed VLANs on trunks: The list of allowed VLANs on a trunk has not been updated with the current VLAN trunking requirements. In this situation, unexpected traffic or no traffic is sent over the trunk.
If an issue with a trunk is discovered and if the cause is unknown, start troubleshooting by examining the trunks for a native VLAN mismatch. If that is not the cause, check for trunk mode mismatches, and finally check for the allowed VLAN list on the trunk. The next two sections examine how to fix the common problems with trunks.
Trunk Mode Mismatches (3.2.4.5)
Trunk links are normally configured statically with the switchport mode trunk command. Cisco Catalyst switch trunk ports use DTP to negotiate the state of the link. When a port on a trunk link is configured with a trunk mode that is incompatible with the neighboring trunk port, a trunk link fails to form between the two switches.
In Figure 3-27, PC4 cannot connect to the internal web server. The topology indicates a valid configuration. Why is there a problem?
)
Figure 3-27 Trunk Scenario Topology
Check the status of the trunk ports on switch S1 using the show interfaces trunk command. The following output reveals that interface Fa0/3 on switch S1 is not currently a trunk link. Examining the F0/3 interface reveals that the switch port is actually in dynamic auto mode.
Output from Switch S1:
S1# show interfaces trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 99
Port Vlans allowed on trunk
Fa0/1 10,99
Port Vlans allowed and active in management domain
Fa0/1 10,99
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 10,99
S1# show interfaces f0/3 switchport
Name: Fa0/3
Switchport: Enabled
Administrative Mode: dynamic auto
<output omitted>
An examination of the trunks on switch S3 reveals that there are no active trunk ports. Further checking reveals that the Fa0/3 interface is also in dynamic auto mode. This explains why the trunk is down as shown in the output.
Output from Switch S3:
S3# show interfaces trunk
S3#
S3# show interfaces f0/3 switchport
Name: Fa0/3
Switchport: Enabled
Administrative Mode: dynamic auto
<output omitted>
To resolve the issue, reconfigure the trunk mode of the F0/3 ports on switches S1 and S3, as shown in the following output. After the configuration change, the output of the show interfaces command indicates that the port on switch S1 is now in trunking mode. The output from PC4 indicates that it has regained connectivity to the Web/TFTP server found at IP address 172.17.10.30.
Output from Switch S1:
S1# config terminal
S1(config)# interface fastethernet0/3
S1(config-if)# switchport mode trunk
S1(config-if)# end
S1# show interfaces fa0/3 switchport
Name: Fa0/3
Switchport: Enabled
Administrative Mode: trunk
<output omitted>
Output from Switch S3:
S3# config terminal S3(config)# interface fastethernet0/3 S3(config-if)# switchport mode trunk S3(config-if)# end S3# show interfaces fa0/3 switchport Name: Fa0/3 Switchport: Enabled Administrative Mode: trunk <output omitted> S3# show interfaces trunk Port Mode Encapsulation Status Native vlan Fa0/3 on 802.1q trunking 99 Port Vlans allowed on trunk Fa0/3 10,99 Port Vlans allowed and active in management domain Fa0/3 10,99 Port Vlans in spanning tree forwarding state and not pruned Fa0/3 10,99
Output from Computer PC4:
Pc4> ping 172.17.10.30 Pinging 172.17.10.30 with 32 bytes of data: Reply from 172.17.10.30: bytes=32 time=147ms TTL=128 <output omitted>
Incorrect VLAN List (3.2.4.6)
For traffic from a VLAN to be transmitted across a trunk, it must be allowed on the trunk. To do so, use the switchport trunk allowed vlan vlan-id command.
In Figure 3-28, VLAN 20 (Student) and PC5 have been added to the network. The documentation has been updated to show that the VLANs allowed on the trunk are 10, 20, and 99. In this scenario, PC5 cannot connect to the student email server.
)
Figure 3-28 Incorrect VLAN List Scenario Topology
Check the trunk ports on switch S3 using the show interfaces trunk command as shown in the output that follows.
Output from Switch S3:
S3# show interfaces trunk Port Mode Encapsulation Status Native vlan Fa0/3 on 802.1q trunking 99 Port Vlans allowed on trunkFa0/310,20,99Port Vlans allowed and active in management domain Fa0/3 10,20,99 Port Vlans in spanning tree forwarding state and not pruned Fa0/3 10,20,99
The command reveals that the interface F0/3 on switch S3 is correctly configured to allow VLANs 10, 20, and 99 as shown in the output.
An examination of the F0/3 interface on switch S1 reveals that interfaces F0/1 and F0/3 allow only VLANs 10 and 99. Someone updated the documentation but forgot to reconfigure the ports on the S1 switch, as shown in the output.
Output from Switch S1:
S1# show interfaces trunk Port Mode Encapsulation Status Native vlan Fa0/1 on 802.1q Fa0/3 on 802.1q trunking 99 Port Vlans allowed on trunk Fa0/1 10,99Fa0/310,99<output omitted>
Reconfigure F0/1 and F0/3 on switch S1 using the switchport trunk allowed vlan 10,20,99 command as shown in the following output. The output shows that VLANs 10, 20, and 99 are now added to the F0/1 and F0/3 ports on switch S1. The show interfaces trunk command is an excellent tool for revealing common trunking problems.
Output from Switch S1:
S1# config terminal S1(config)# interface f0/1 S1(config-if)# switchport trunk allowed vlan 10,20,99 S1(config-if)# interface f0/3 S1(config-if)# switchport trunk allowed vlan 10,20,99 S1# show interface trunk Port Mode Encapsulation Status Native vlan Fa0/1 on 802.1q Fa0/3 on 802.1q trunking 99 Port Vlans allowed on trunk Fa0/1 10,20,99Fa0/310,20,99<output omitted>
PC5 has regained connectivity to the student email server found at IP address 172.17.20.10.
Output from Computer PC5:
PC5> ping 172.17.20.10 Pinging 172.17.20.10 with 32 bytes of data: Reply from 172.17.20.10: bytes=32 time=147ms TTL=128 <output omitted>
Packet Tracer Activity 3.2.4.7: Troubleshooting a VLAN Implementation: Scenario 1
In this activity, you will troubleshoot connectivity problems between PCs on the same VLAN. The activity is complete when PCs on the same VLAN can ping each other. Any solution you implement must conform to the Addressing Table.
Packet Tracer Activity 3.2.4.8: Troubleshooting a VLAN Implementation: Scenario 2
In this activity, you will troubleshoot a misconfigured VLAN environment. The initial network has errors. Your objective is to locate and correct the errors in the configurations and establish end-to-end connectivity. Your final configuration should match the Topology diagram and Addressing Table. The native VLAN for this topology is VLAN 56.
Lab 3.2.4.9: Troubleshooting VLAN Configurations
In this lab, you will complete the following objectives:
Part 1: Build the Network and Configure Basic Device Settings
Part 2: Troubleshoot VLAN 10
Part 3: Troubleshoot VLAN 20