10-VLAN Configuration
Chapters Download (126.54 KB)
Table of Contents
Configuring Basic VLAN Settings
Configuring Basic Settings of a VLAN Interface
Introduction to Port-Based VLAN
Assigning an Access Port to a VLAN
Assigning a Trunk Port to a VLAN
Assigning a Hybrid Port to a VLAN
When configuring VLAN, go to these sections for information you are interested in:
l Configuring Basic VLAN Settings
l Configuring Basic Settings of a VLAN Interface
l Port-Based VLAN Configuration
l Displaying and Maintaining VLAN
Ethernet is a network technology based on the Carrier Sense Multiple Access/Collision Detect (CSMA/CD) mechanism. As the medium is shared, collisions and excessive broadcasts cannot be avoided on an Ethernet. To address the issue, virtual LAN (VLAN) was introduced.
The idea is to break a LAN down into separate VLANs, that is, Layer 2 broadcast domains whereby frames are switched between ports assigned to the same VLAN. VLANs are isolated from each other at Layer 2. A VLAN is a bridging domain, and all broadcast traffic is contained within it, as shown in Figure 1-1.
A VLAN is logically divided on an organizational basis rather than on a physical basis. For example, all workstations and servers used by a particular workgroup can be connected to the same LAN, regardless of their physical locations.
VLAN technology delivers the following benefits:
2) Confining broadcast traffic within individual VLANs. This reduces bandwidth waste and improves network performance.
3) Improving LAN security. By assigning user groups to different VLANs, you can isolate them at Layer 2. To enable communication between VLANs, routers or Layer 3 switches are required.
4) Flexible virtual workgroup creation. As users from the same workgroup can be assigned to the same VLAN regardless of their physical locations, network construction and maintenance is much easier and more flexible.
To enable a network device to identify frames of different VLANs, a VLAN tag field is inserted into the data link layer encapsulation.
The format of VLAN-tagged frames is defined in IEEE 802.1Q issued by IEEE in 1999.
In the header of a traditional Ethernet data frame, the field after the destination MAC address and the source MAC address is the Type field indicating the upper layer protocol type, as shown in Figure 1-2.
Figure 1-2 The format of a traditional Ethernet frame
IEEE 802.1Q inserts a four-byte VLAN tag after the DA&SA field, as shown in Figure 1-3.
Figure 1-3 The position and format of VLAN tag
A VLAN tag comprises four fields: tag protocol identifier (TPID), priority, canonical format indicator (CFI), and VLAN ID.
l The 16-bit TPID field with a value of 0x8100 indicates that the frame is VLAN-tagged.
l The 3-bit priority field indicates the 802.1p priority of the frame. For information about frame priority, refer to QoS Configuration in the QoS Volume.
l The 1-bit CFI field specifies whether the MAC addresses are encapsulated in the standard format when packets are transmitted across different media. Value 0 indicates that MAC addresses are encapsulated in the standard format; value 1 indicates that MAC addresses are encapsulated in a non-standard format. The filed is 0 by default.
l The 12-bit VLAN ID field identifies the VLAN the frame belongs to. The VLAN ID range is 0 to 4095. As 0 and 4095 are reserved by the protocol, a VLAN ID actually ranges from 1 to 4094.
When receiving a frame, a network device handles the frame depending on whether the frame is VLAN tagged and the value of the VLAN tag, if any. For more information, refer to section Introduction to Port-Based VLAN.
l The Ethernet II encapsulation format is used here. Besides the Ethernet II encapsulation format, other encapsulation formats, including 802.2 LLC, 802.2 SNAP, and 802.3 raw, are also supported by Ethernet. The VLAN tag fields are also added to frames encapsulated in these formats for VLAN identification.
l For a frame with multiple VLAN tags, the device handles it according to its outer-most VLAN tag and transmits its inner VLAN tags as payload.
You can implement VLAN based on:
l Port
l MAC address
l Protocol
l IP subnet
l Policy
l Other criteria
This chapter covers port-based VLAN.
Follow these steps to configure basic VLAN settings:
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Create VLANs |
vlan { vlan-id1 [ to vlan-id2 ] | all } |
Optional Use this command to create VLANs in bulk. |
|
Enter VLAN view |
vlan vlan-id |
Required If the specified VLAN does not exist, this command creates the VLAN first. By default, only the default VLAN (that is, VLAN 1) exists in the system. |
|
Configure a name for the current VLAN |
name text |
Optional By default, the name of a VLAN is its VLAN ID, VLAN 0001 for example. |
|
Configure the description of the current VLAN |
description text |
Optional VLAN ID is used by default, VLAN 0001 for example. |
l As the default VLAN, VLAN 1 cannot be created or removed.
l You cannot manually create or remove VLANs reserved for special purposes.
l Dynamic VLANs cannot be removed with the undo vlan command.
l A VLAN with a QoS policy applied cannot be removed.
l A VLAN operating as a probe VLAN for remote port mirroring or an RRPP protected VLAN cannot be removed with the undo vlan command. To do that, remove the remote mirroring VLAN or RRPP protected VLAN configuration from it first.
For hosts of different VLANs to communicate, you must use a router or Layer 3 switch to perform layer 3 forwarding. To achieve this, VLAN interfaces are used.
VLAN interfaces are virtual interfaces used for Layer 3 communication between different VLANs. They do not exist as physical entities on devices. For each VLAN, you can create one VLAN interface. You can assign the VLAN interface an IP address and specify it as the gateway of the VLAN to forward traffic destined for an IP network segment different from that of the VLAN.
Follow these steps to configure basic settings of a VLAN interface:
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Create a VLAN interface and enter VLAN interface view |
interface vlan-interface vlan-interface-id |
Required If the VLAN interface already exists, you enter its view directly. |
|
Assign an IP address to the VLAN interface |
ip address ip-address { mask | mask-length } [ sub ] |
Optional No IP address is assigned to any VLAN interface by default. |
|
Configure the description of the VLAN interface |
description text |
Optional VLAN interface name is used by default, for example, Vlan-interface1 Interface. |
|
Bring up the VLAN interface |
undo shutdown |
Optional By default, a VLAN interface is in the up state. In this case, the VLAN interface is up so long as one port in the VLAN is up and goes down if all ports in the VLAN go down. An administratively shut down VLAN interface however will be in the down state until you bring it up, regardless of how the state of the ports in the VLAN changes. |
Before creating a VLAN interface for a VLAN, create the VLAN first.
Port-based VLANs group VLAN members by port. A port forwards traffic for a VLAN only after it is assigned to the VLAN.
You can configure the link type of a port as access, trunk, or hybrid. The three link types use different VLAN tag handling methods. When configuring the link type of a port, note that:
l An access port can belong to only one VLAN. Usually, ports directly connected to PCs are configured as access ports.
l A trunk port can carry multiple VLANs to receive and send traffic for them. Except traffic of the default VLAN, traffic passes through a trunk port will be VLAN tagged. Usually, ports connecting network devices are configured as trunk ports to allow members of the same VLAN to communicate with each other across multiple network devices.
l Like a trunk port, a hybrid port can carry multiple VLANs to receive and send traffic for them. Unlike a trunk port, a hybrid port allows traffic of all VLANs to pass through VLAN untagged. You can configure a port connected to a network device or user terminal as a hybrid port for access link connectivity or trunk connectivity.
By default, VLAN 1 is the default VLAN for all ports. You can configure the default VLAN for a port as required.
Use the following guidelines when configuring the default VLAN on a port:
l Because an access port can join only one VLAN, its default VLAN is the VLAN to which it belongs and cannot be configured.
l Because a trunk or hybrid port can join multiple VLANs, you can configure a default VLAN for the port.
l You can use a nonexistent VLAN as the default VLAN for a hybrid or trunk port but not for an access port. Therefore, after you remove the VLAN that an access port resides in with the undo vlan command, the default VLAN of the port changes to VLAN 1. The removal of the VLAN specified as the default VLAN of a trunk or hybrid port, however, does not affect the default VLAN setting on the port.
l You are recommended to set the same default VLAN ID for the local and remote ports.
l Ensure that a port is assigned to its default VLAN. Otherwise, when the port receives frames tagged with the default VLAN ID or untagged frames (including protocol packets such as STP BPDUs), the port filters out these frames.
Ports of different link types handle frames as follows:
|
Port type |
Actions (in the inbound direction) |
Actions (in the outbound direction) |
|
|
Untagged frame |
Tagged frame |
||
|
Access |
Tag the frame with the default VLAN tag. |
l Receive the frame if its VLAN ID is the same as the default VLAN ID. l Drop the frame if its VLAN ID is different from the default VLAN ID. |
Remove the default VLAN tag and send the frame. |
|
Trunk |
Check whether the default VLAN is permitted on the port: l If yes, tag the frame with the default VLAN tag. l If not, drop the frame. |
l Receive the frame if its VLAN is carried on the port. l Drop the frame if its VLAN is not carried on the port. |
l Remove the tag and send the frame if the frame carries the default VLAN tag. l Send the frame without removing the tag if its VLAN is carried on the port but is different from the default one. |
|
Hybrid |
Send the frame if its VLAN is carried on the port. The frame is sent with the VLAN tag removed or intact depending on your configuration with the port hybrid vlan command. This is true of the default VLAN. |
||
You can assign an access port to a VLAN in VLAN view, interface view, or port group view.
1) In VLAN view
Follow these steps to assign one or multiple access ports to a VLAN in VLAN view:
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Enter VLAN view |
vlan vlan-id |
Required If the specified VLAN does not exist, this command creates the VLAN first. |
|
Assign one or a group of access ports to the current VLAN |
port interface-list |
Required By default, all ports belong to VLAN 1. |
In VLAN view, you only assign the access ports to the current VLAN.
2) In interface or port group view
Follow these steps to assign an access port (in interface view) or multiple access ports (in port group view) to a VLAN:
|
To do… |
Use the command… |
Remarks |
|
|
Enter system view |
system-view |
— |
|
|
Enter interface view or port group view |
Enter Ethernet interface view |
interface interface-type interface-number |
Required Use either command. l In Ethernet interface view, the subsequent configurations apply to the current port. l In port group view, the subsequent configurations apply to all ports in the port group. l In Layer-2 aggregate interface view, the subsequent configurations apply to the Layer-2 aggregate interface and all its member ports. |
|
Enter Layer-2 aggregate interface view |
interface bridge-aggregation interface-number |
||
|
Enter port group view |
port-group manual port-group-name |
||
|
Configure the link type of the port or ports as access |
port link-type access |
Optional The link type of a port is access by default. |
|
|
Assign the current access port(s) to a VLAN |
port access vlan vlan-id |
Optional By default, all access ports belong to VLAN 1. |
|
Before assigning an access port to a VLAN, create the VLAN first.
A trunk port can carry multiple VLANs. You can assign it to a VLAN in interface view or port group view.
Follow these steps to assign a trunk port to one or multiple VLANs:
|
To do… |
Use the command… |
Remarks |
|
|
Enter system view |
system-view |
— |
|
|
Enter interface view or port group view |
Enter Ethernet interface view |
interface interface-type interface-number |
Required Use either command. l In Ethernet interface view, the subsequent configurations apply to the current port. l In port group view, the subsequent configurations apply to all ports in the port group. l In Layer-2 aggregate interface view, the subsequent configurations apply to the Layer-2 aggregate interface and all its member ports. |
|
Enter Layer-2 aggregate interface view |
interface bridge-aggregation interface-number |
||
|
Enter port group view |
port-group manual port-group-name |
||
|
Configure the link type of the port or ports as trunk |
port link-type trunk |
Required |
|
|
Assign the trunk port(s) to the specified VLAN(s) |
port trunk permit vlan { vlan-id-list | all } |
Required By default, a trunk port carries only VLAN 1. |
|
|
Configure the default VLAN of the trunk port(s) |
port trunk pvid vlan vlan-id |
Optional VLAN 1 is the default VLAN by default. |
|
l To change the link type of a port from trunk to hybrid or vice versa, you must set the link type to access first.
l After configuring the default VLAN for a trunk port, you must use the port trunk permit vlan command to configure the trunk port to allow packets from the default VLAN to pass through, so that the egress port can forward packets from the default VLAN.
A hybrid port can carry multiple VLANs. You can assign it to a VLAN in interface view or port group view.
Follow these steps to assign a hybrid port to one or multiple VLANs:
|
To do… |
Use the command… |
Remarks |
|
|
Enter system view |
system-view |
— |
|
|
Enter interface view or port group view |
Enter Ethernet interface view |
interface interface-type interface-number |
Required Use either command. l In Ethernet interface view, the subsequent configurations apply to the current port. l In port group view, the subsequent configurations apply to all ports in the port group. l In Layer-2 aggregate interface view, the subsequent configurations apply to the Layer-2 aggregate interface and all its member ports. |
|
Enter Layer-2 aggregate interface view |
interface bridge-aggregation interface-number |
||
|
Enter port group view |
port-group manual port-group-name |
||
|
Configure the link type of the port(s) as hybrid |
port link-type hybrid |
Required |
|
|
Assign the hybrid port(s) to the specified VLAN(s) |
port hybrid vlan vlan-id-list { tagged | untagged } |
Required By default, a hybrid port allows only packets of VLAN 1 to pass through untagged. |
|
|
Configure the default VLAN of the hybrid port |
port hybrid pvid vlan vlan-id |
Optional VLAN 1 is the default by default. |
|
l To change the link type of a port from trunk to hybrid or vice versa, you must set the link type to access first.
l Before assigning a hybrid port to a VLAN, create the VLAN first.
l After configuring the default VLAN for a hybrid port, you must use the port hybrid vlan command to configure the hybrid port to allow packets from the default VLAN to pass through, so that the egress port can forward packets from the default VLAN.
|
To do... |
Use the command… |
Remarks |
|
Display VLAN information |
display vlan [ vlan-id1 [ to vlan-id2 ] | all | dynamic | reserved | static ] |
Available in any view |
|
Display VLAN interface information |
display interface vlan-interface [ vlan-interface-id ] |
Available in any view |
|
Display hybrid ports or trunk ports on the device |
display port { hybrid | trunk } |
Available in any view |
|
Clear statistics on a port |
reset counters interface [ interface-type [ interface-number ] ] |
Available in user view |
The reset counters interface command can be used to clear statistics on a VLAN interface. For more information, refer to Ethernet Interface Commands in the Access Volume.
l Device A connects to Device B through a trunk port GigabitEthernet 1/0/1;
l The default VLAN ID of GigabitEthernet 1/0/1 is 100;
l GigabitEthernet 1/0/1 allows packets from VLAN 2, VLAN 6 through VLAN 50, and VLAN 100 to pass through.
Figure 1-4 Network diagram for port-based VLAN configuration
1) Configure Device A
# Create VLAN 2, VLAN 6 through VLAN 50, and VLAN 100.
<DeviceA> system-view
[DeviceA] vlan 2
[DeviceA-vlan2] quit
[DeviceA] vlan 100
[DeviceA-vlan100] vlan 6 to 50
Please wait... Done.
# Enter GigabitEthernet 1/0/1 interface view.
[DeviceA] interface GigabitEthernet 1/0/1
# Configure GigabitEthernet 1/0/1 as a trunk port and configure its default VLAN ID as 100.
[DeviceA-GigabitEthernet1/0/1] port link-type trunk
[DeviceA-GigabitEthernet1/0/1] port trunk pvid vlan 100
# Configure GigabitEthernet 1/0/1 to deny the packets of VLAN 1 (by default, the packets of VLAN 1 are permitted to pass through on all the ports).
[DeviceA-GigabitEthernet1/0/1] undo port trunk permit vlan 1
# Configure GigabitEthernet 1/0/1 to permit packets from VLAN 2, VLAN 6 through VLAN 50, and VLAN 100 to pass through.
[DeviceA-GigabitEthernet1/0/1] port trunk permit vlan 2 6 to 50 100
Please wait... Done.
[DeviceA-GigabitEthernet1/0/1] quit
[DeviceA] quit
2) Configure Device B as you configure Device A.
Verifying the configuration on Device A is similar to that of Device B. So only Device A is taken for example here.
# Display the information about GigabitEthernet 1/0/1 of Device A to verify the above configurations.
<DeviceA> display interface GigabitEthernet 1/0/1
GigabitEthernet1/0/1 current state: UP
IP Packet Frame Type: PKTFMT_ETHNT_2, Hardware Address: 0000-5600-0000
Description: GigabitEthernet1/0/1 Interface
Loopback is not set
Media type is twisted pair, Port hardware type is 1000_BASE_T
Unknown-speed mode, unknown-duplex mode
Link speed type is autonegotiation, link duplex type is autonegotiation
Flow-control is not enabled
The Maximum Frame Length is 1500
Broadcast MAX-ratio: 100%
Unicast MAX-ratio: 100%
Multicast MAX-ratio: 100%
Allow jumbo frame to pass
PVID: 100
Mdi type: auto
Link delay is 0(sec)
Port link-type: trunk
VLAN passing : 2, 6-50, 100
VLAN permitted: 2, 6-50, 100
Trunk port encapsulation: IEEE 802.1q
Port priority: 0
Last 300 seconds input: 0 packets/sec 0 bytes/sec
Last 300 seconds output: 0 packets/sec 0 bytes/sec
Input (total): 0 packets, 0 bytes
0 broadcasts, 0 multicasts
Input (normal): 0 packets, 0 bytes
0 broadcasts, 0 multicasts
Input: 0 input errors, 0 runts, 0 giants, 0 throttles
0 CRC, 0 frame, 0 overruns, 0 aborts
0 ignored, 0 parity errors
Output (total): 0 packets, 0 bytes
0 broadcasts, 0 multicasts, 0 pauses
Output (normal): 0 packets, 0 bytes
0 broadcasts, 0 multicasts, 0 pauses
Output: 0 output errors, 0 underruns, 0 buffer failures
0 aborts, 0 deferred, 0 collisions, 0 late collisions
0 lost carrier, 0 no carrier
The output above shows that:
l The port (GigabitEthernet 1/0/1) is a trunk port.
l The default VLAN of the port is VLAN 100.
l The port permits packets of VLAN 2, VLAN 6 through VLAN 50, and VLAN 100 to pass through.
Therefore, the configuration is successful.
