02-Layer 2-LAN Switching Configuration Guide

HomeSupportResource CenterSwitchesS12500R SeriesS12500R SeriesTechnical DocumentsConfigure & DeployConfiguration GuidesH3C S12500R Switch Router Series Configuration Guides(R3606)-6W10002-Layer 2-LAN Switching Configuration Guide
06-VLAN configuration
Title Size Download
06-VLAN configuration 154.20 KB

Configuring VLANs

About VLANs

The Virtual Local Area Network (VLAN) technology divides a physical LAN into multiple logical LANs. It has the following benefits:

·     Security—Hosts in the same VLAN can communicate with one another at Layer 2, but they are isolated from hosts in other VLANs at Layer 2.

·     Broadcast traffic isolation—Each VLAN is a broadcast domain that limits the transmission of broadcast packets.

·     Flexibility—A VLAN can be logically divided on a workgroup basis. Hosts in the same workgroup can be assigned to the same VLAN, regardless of their physical locations.

VLAN frame encapsulation

To identify Ethernet frames from different VLANs, IEEE 802.1Q inserts a four-byte VLAN tag between the destination and source MAC address (DA&SA) field and the Type field.

Figure 1 VLAN tag placement and format

 

A VLAN tag includes the following fields:

·     TPID—16-bit tag protocol identifier that indicates whether a frame is VLAN-tagged. By default, the hexadecimal TPID value 0x8100 identifies a VLAN-tagged frame. A device vendor can set the TPID to a different value. For compatibility with a neighbor device, set the TPID value on the device to be the same as the neighbor device.

·     Priority—3-bit long, identifies the 802.1p priority of the frame. For more information, see ACL and QoS Configuration Guide.

·     CFI—1-bit long canonical format indicator that indicates whether the MAC addresses are encapsulated in the standard format when packets are transmitted across different media. Available values include:

¡     0 (default)—The MAC addresses are encapsulated in the standard format.

¡     1—The MAC addresses are encapsulated in a non-standard format.

This field is always set to 0 for Ethernet.

·     VLAN ID—12-bit long, identifies the VLAN to which the frame belongs. The VLAN ID range is 0 to 4095. VLAN IDs 0 and 4095 are reserved, and VLAN IDs 1 to 4094 are user configurable.

The way a network device handles an incoming frame depends on whether the frame has a VLAN tag and the value of the VLAN tag (if any).

Ethernet supports encapsulation formats Ethernet II, 802.3/802.2 LLC, 802.3/802.2 SNAP, and 802.3 raw. The Ethernet II encapsulation format is used here. For information about the VLAN tag fields in other frame encapsulation formats, see related protocols and standards.

For a frame that has multiple VLAN tags, the device handles it according to its outermost VLAN tag and transmits its inner VLAN tags as the payload.

VLAN types

The following VLAN types are available:

·     Port-based VLAN.

Port-based VLANs

Port-based VLANs group VLAN members by port. A port forwards packets from a VLAN only after it is assigned to the VLAN.

Port link type

You can set the link type of a port to access, trunk, or hybrid. The port link type determines whether the port can be assigned to multiple VLANs. The link types use the following VLAN tag handling methods:

·     Access—An access port can forward packets only from one VLAN and send these packets untagged. An access port is typically used in the following conditions:

¡     Connecting to a terminal device that does not support VLAN packets.

¡     In scenarios that do not distinguish VLANs.

·     Trunk—A trunk port can forward packets from multiple VLANs. Except packets from the port VLAN ID (PVID), packets sent out of a trunk port are VLAN-tagged. Ports connecting network devices are typically configured as trunk ports.

·     Hybrid—A hybrid port can forward packets from multiple VLANs. The tagging status of the packets forwarded by a hybrid port depends on the port configuration. In one-to-two VLAN mapping, hybrid ports are used to remove SVLAN tags for downlink traffic. For more information about one-to-two VLAN mapping, see "Configuring VLAN mapping."

PVID

The PVID identifies the default VLAN of a port. Untagged packets received on a port are considered as the packets from the port PVID.

An access port can join only one VLAN. The VLAN to which the access port belongs is the PVID of the port. A trunk or hybrid port supports multiple VLANs and the PVID configuration.

How ports of different link types handle frames

Actions

Access

Trunk

Hybrid

In the inbound direction for an untagged frame

Tags the frame with the PVID tag.

·     If the PVID is permitted on the port, tags the frame with the PVID tag.

·     If not, drops the frame.

In the inbound direction for a tagged frame

·     Receives the frame if its VLAN ID is the same as the PVID.

·     Drops the frame if its VLAN ID is different from the PVID.

·     Receives the frame if its VLAN is permitted on the port.

·     Drops the frame if its VLAN is not permitted on the port.

In the outbound direction

Removes the VLAN tag and sends the frame.

·     Removes the tag and sends the frame if the frame carries the PVID tag and the port belongs to the PVID.

·     Sends the frame without removing the tag if its VLAN is carried on the port but is different from the PVID.

Sends the frame if its VLAN is permitted on the port. The tagging status of the frame depends on the port hybrid vlan command configuration.

 

Layer 3 communication between VLANs

Hosts of different VLANs use VLAN interfaces to communicate at Layer 3. VLAN interfaces are virtual interfaces that do not exist as physical entities on devices. For each VLAN, you can create one VLAN interface and assign an IP address to it. The VLAN interface acts as the gateway of the VLAN to forward packets destined for another IP subnet at Layer 3.

Protocols and standards

IEEE 802.1Q, IEEE Standard for Local and Metropolitan Area Networks: Virtual Bridged Local Area Networks

Restrictions and guidelines: VLAN configuration

·     As the system default VLAN, VLAN 1 cannot be created or deleted.

·     Before you delete a dynamic VLAN or a VLAN locked by an application, you must first remove the configuration from the VLAN.

Creating VLANs

1.     Enter system view.

system-view

2.     Create one or multiple VLANs.

¡     Create a VLAN and enter its view.

vlan vlan-id

¡     Create multiple VLANs and enter VLAN view.

Create VLANs.

vlan { vlan-id1 to vlan-id2 | all }

Enter VLAN view.

vlan vlan-id

By default, only the system default VLAN (VLAN 1) exists.

3.     (Optional.) Set a name for the VLAN.

name text

By default, the name of a VLAN is VLAN vlan-id. The vlan-id argument specifies the VLAN ID in a four-digit format. If the VLAN ID has fewer than four digits, leading zeros are added. For example, the name of VLAN 100 is VLAN 0100.

4.     (Optional.) Configure the description for the VLAN.

description text

By default, the description of a VLAN is VLAN vlan-id. The vlan-id argument specifies the VLAN ID in a four-digit format. If the VLAN ID has fewer than four digits, leading zeros are added. For example, the default description of VLAN 100 is VLAN 0100.

Configuring port-based VLANs

Restrictions and guidelines for port-based VLANs

·     When you use the undo vlan command to delete the PVID of a port, either of the following events occurs depending on the port link type:

¡     For an access port, the PVID of the port changes to VLAN 1.

¡     For a hybrid or trunk port, the PVID setting of the port does not change.

You can use a nonexistent VLAN as the PVID for a hybrid or trunk port, but not for an access port.

·     As a best practice, set the same PVID for a local port and its peer.

·     To prevent a port from dropping untagged packets or PVID-tagged packets, assign the port to its PVID.

Assigning an access port to a VLAN

About this task

You can assign an access port to a VLAN in VLAN view or interface view.

Assigning one or multiple access ports to a VLAN in VLAN view

1.     Enter system view.

system-view

2.     Enter VLAN view.

vlan vlan-id

3.     Assign one or multiple access ports to the VLAN.

port interface-list

By default, all ports belong to VLAN 1.

Assigning an access port to a VLAN in interface view

1.     Enter system view.

system-view

2.     Enter interface view.

¡     Enter Layer 2 Ethernet interface view.

interface interface-type interface-number

¡     Enter Layer 2 aggregate interface view.

interface bridge-aggregation interface-number

3.     Set the port link type to access.

port link-type access

By default, all ports are access ports.

4.     Assign the access port to a VLAN.

port access vlan vlan-id

By default, all access ports belong to VLAN 1.

Assigning a trunk port to a VLAN

About this task

A trunk port supports multiple VLANs. You can assign it to a VLAN in interface view.

Restrictions and guidelines

To change the link type of a port from trunk to hybrid, set the link type to access first.

To enable a trunk port to transmit packets from its PVID, you must assign the trunk port to the PVID by using the port trunk permit vlan command.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

¡     Enter Layer 2 Ethernet interface view.

interface interface-type interface-number

¡     Enter Layer 2 aggregate interface view.

interface bridge-aggregation interface-number

3.     Set the port link type to trunk.

port link-type trunk

By default, all ports are access ports.

4.     Assign the trunk port to the specified VLANs.

port trunk permit vlan { vlan-id-list | all }

By default, a trunk port permits only VLAN 1.

5.     (Optional.) Set the PVID for the trunk port.

port trunk pvid vlan vlan-id

The default setting is VLAN 1.

Assigning a hybrid port to a VLAN

About this task

A hybrid port supports multiple VLANs. You can assign it to the specified VLANs in interface view. Make sure the VLANs have been created.

Restrictions and guidelines

To change the link type of a port from trunk to hybrid, set the link type to access first.

To enable a hybrid port to transmit packets from its PVID, you must assign the hybrid port to the PVID by using the port hybrid vlan command.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

¡     Enter Layer 2 Ethernet interface view.

interface interface-type interface-number

¡     Enter Layer 2 aggregate interface view.

interface bridge-aggregation interface-number

3.     Set the port link type to hybrid.

port link-type hybrid

By default, all ports are access ports.

4.     Assign the hybrid port to the specified VLANs.

port hybrid vlan vlan-id-list { tagged | untagged }

By default, the hybrid port is an untagged member of the VLAN to which the port belongs when its link type is access.

5.     (Optional.) Set the PVID for the hybrid port.

port hybrid pvid vlan vlan-id

By default, the PVID of a hybrid port is the ID of the VLAN to which the port belongs when its link type is access.

Configuring VLAN interfaces

Restrictions and guidelines

You cannot create VLAN interfaces for sub-VLANs. For more information about sub-VLANs, see "Configuring super VLANs."

VLAN interfaces configuration tasks at a glance

To configure VLAN interfaces, perform the following tasks:

1.     Creating a VLAN interface

2.     (Optional.) Restoring the default settings for the VLAN interface

Prerequisites

Before you create a VLAN interface for a VLAN, create the VLAN first.

Creating a VLAN interface

1.     Enter system view.

system-view

2.     Create a VLAN interface and enter its view.

interface vlan-interface interface-number

3.     Assign an IP address to the VLAN interface.

ip address ip-address { mask | mask-length } [ sub ]

By default, no IP address is assigned to a VLAN interface.

4.     (Optional.) Configure the description for the VLAN interface.

description text

The default setting is the VLAN interface name. For example, Vlan-interface1 Interface.

5.     (Optional.) Set the MTU for the VLAN interface.

mtu size

By default, the MTU of a VLAN interface is 1500 bytes.

6.     (Optional.) Set a MAC address for the VLAN interface.

mac-address mac-address

By default, no MAC address is set for a VLAN interface.

7.     (Optional.) Set the expected bandwidth for the interface.

bandwidth bandwidth-value

By default, the expected bandwidth (in kbps) is the interface baud rate divided by 1000.

8.     Bring up the VLAN interface.

undo shutdown

By default, a VLAN interface is down.

Restoring the default settings for the VLAN interface

Restrictions and guidelines

CAUTION

CAUTION:

This feature might interrupt ongoing network services. Make sure you are fully aware of the impact of this feature when you use it on a live network.

 

This feature might fail to restore the default settings for some commands for reasons such as command dependencies or system restrictions. Use the display this command in interface view to identify these commands, and then use their undo forms or follow the command reference to restore their default settings. If your restoration attempt still fails, follow the error message instructions to resolve the problem.

Procedure

1.     Enter system view.

system-view

2.     Enter a VLAN interface view.

interface vlan-interface interface-number

3.     Restore the default settings for the VLAN interface.

default

Display and maintenance commands for VLANs

Execute display commands in any view and reset commands in user view.

 

Task

Command

Display VLAN interface information.

display interface [ vlan-interface [ interface-number ] ] [ brief [ description | down ] ]

Display VLAN information.

display vlan [ vlan-id1 [ to vlan-id2 ] | all | dynamic | reserved | static ]

Display brief VLAN information.

display vlan brief

Display hybrid ports or trunk ports on the device.

display port { hybrid | trunk }

Clear statistics on a port.

reset counters interface [ vlan-interface [ interface-number ] ]

 

VLAN configuration examples

Example: Configuring port-based VLANs

Network configuration

As shown in Figure 2:

·     Host A and Host C belong to Department A. VLAN 100 is assigned to Department A.

·     Host B and Host D belong to Department B. VLAN 200 is assigned to Department B.

Configure port-based VLANs so that only hosts in the same department can communicate with each other.

Figure 2 Network diagram

 

Procedure

IMPORTANT

IMPORTANT:

·     By default, interfaces on the device are disabled (in ADM or Administratively Down state). To have an interface operate, you must use the undo shutdown command to enable that interface.

·     The physical interfaces in this example operate in Layer 2 mode. By default, physical interfaces on the device operate in Layer 3 mode. To switch the interface operating mode for an interface, execute the port link-mode command on the interface.

1.     Configure Device A:

# Create VLAN 100, and assign HundredGigE 1/0/1 to VLAN 100.

<DeviceA> system-view

[DeviceA] vlan 100

[DeviceA-vlan100] port hundredgige 1/0/1

[DeviceA-vlan100] quit

# Create VLAN 200, and assign HundredGigE 1/0/2 to VLAN 200.

[DeviceA] vlan 200

[DeviceA-vlan200] port hundredgige 1/0/2

[DeviceA-vlan200] quit

# Configure HundredGigE 1/0/3 as a trunk port, and assign the port to VLANs 100 and 200.

[DeviceA] interface hundredgige 1/0/3

[DeviceA-HundredGigE1/0/3] port link-type trunk

[DeviceA-HundredGigE1/0/3] port trunk permit vlan 100 200

Please wait... Done.

2.     Configure Device B in the same way Device A is configured. (Details not shown.)

3.     Configure hosts:

a.     Configure Host A and Host C to be on the same IP subnet. For example, 192.168.100.0/24.

b.     Configure Host B and Host D to be on the same IP subnet. For example, 192.168.200.0/24.

Verifying the configuration

# Verify that Host A and Host C can ping each other, but they both fail to ping Host B and Host D. (Details not shown.)

# Verify that Host B and Host D can ping each other, but they both fail to ping Host A and Host C. (Details not shown.)

# Verify that VLANs 100 and 200 are correctly configured on Device A.

[DeviceA-HundredGigE1/0/3] display vlan 100

 VLAN ID: 100

 VLAN type: Static

 Route interface: Not configured

 Description: VLAN 0100

 Name: VLAN 0100

 Tagged ports:

    HundredGigE1/0/3

 Untagged ports:

    HundredGigE1/0/1

[DeviceA-HundredGigE1/0/3] display vlan 200

 VLAN ID: 200

 VLAN type: Static

 Route interface: Not configured

 Description: VLAN 0200

 Name: VLAN 0200

 Tagged ports:

    HundredGigE1/0/3

 Untagged ports:

    HundredGigE1/0/2


Configuring super VLANs

About super VLANs

Hosts in a VLAN typically use IP addresses in the same subnet. For Layer 3 interoperability with other VLANs, you can create a VLAN interface for the VLAN and assign an IP address to it. This requires a large number of IP addresses.

The super VLAN feature was introduced to save IP addresses. A super VLAN is associated with multiple sub-VLANs. These sub-VLANs use the VLAN interface of the super VLAN (also known as a super VLAN interface) as the gateway for Layer 3 communication.

You can create a VLAN interface for a super VLAN and assign an IP address to it. However, you cannot create a VLAN interface for a sub-VLAN. You can assign a physical port to a sub-VLAN, but you cannot assign a physical port to a super VLAN. Sub-VLANs are isolated at Layer 2.

To enable Layer 3 communication between sub-VLANs, perform the following tasks:

1.     Create a super VLAN and the VLAN interface for the super VLAN.

2.     Enable local proxy ARP or ND on the super VLAN interface as follows:

¡     In an IPv4 network, enable local proxy ARP on the super VLAN interface. The super VLAN can then process ARP requests and replies sent from the sub-VLANs.

¡     In an IPv6 network, enable local proxy ND on the super VLAN interface. The super VLAN can then process the NS and NA messages sent from the sub-VLANs.

Restrictions and guidelines: Super VLAN configuration

·     Do not configure a VLAN as both a super VLAN and a sub-VLAN.

·     Layer 2 multicast configuration for super VLANs does not take effect because they do not have physical ports.

Super VLAN tasks at a glance

To configure a super VLAN, perform the following tasks:

1.     Creating a sub-VLAN

2.     Configuring a super VLAN

3.     Configuring a super VLAN interface

Creating a sub-VLAN

1.     Enter system view.

system-view

2.     Create a sub-VLAN.

vlan vlan-id

By default, only the system default VLAN (VLAN 1) exists.

Configuring a super VLAN

1.     Enter system view.

system-view

2.     Enter VLAN view.

vlan vlan-id

3.     Configure the VLAN as a super VLAN.

supervlan

By default, a VLAN is not a super VLAN.

4.     Associate the super VLAN with the sub-VLANs.

subvlan vlan-id-list

Make sure the sub-VLANs already exist before associating them with a super VLAN.

Configuring a super VLAN interface

Restrictions and guidelines

As a best practice, do not configure VRRP for a super VLAN interface because the configuration affects network performance. For more information about VRRP, see High Availability Configuration Guide.

Procedure

1.     Enter system view.

system-view

2.     Create a VLAN interface and enter its view.

interface vlan-interface interface-number

The value for the interface-number argument must be the super VLAN ID.

3.     Configure an IP address for the super VLAN interface.

¡     Configure an IPv4 address.

ip address ip-address { mask-length | mask } [ sub ]

¡     Configure an IPv6 address.

ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length }

By default, no IP address is configured for a VLAN interface.

4.     Configure Layer 3 communication between sub-VLANs.

¡     Enable local proxy ARP for devices that run IPv4 protocols.

local-proxy-arp enable

¡     Enable local proxy ND for devices that run IPv6 protocols.

local-proxy-nd enable

By default:

¡     Sub-VLANs cannot communicate with each other at Layer 3.

¡     Local proxy ARP or ND is disabled.

For more information about local proxy ARP and ND, see Layer 3—IP Services Configuration Guide.

Display and maintenance commands for super VLANs

Execute display commands in any view.

 

Task

Command

Display information about super VLANs and their associated sub-VLANs.

display supervlan [ supervlan-id ]

 

Super VLAN configuration examples

Example: Configuring a super VLAN

Network configuration

As shown in Figure 3:

·     HundredGigE 1/0/1 and HundredGigE 1/0/2 are in VLAN 2.

·     HundredGigE 1/0/3 and HundredGigE 1/0/4 are in VLAN 3.

·     HundredGigE 1/0/5 and HundredGigE 1/0/6 are in VLAN 5.

To save IP addresses and enable sub-VLANs to be isolated at Layer 2 but interoperable at Layer 3, perform the following tasks:

·     Create a super VLAN and assign an IP address to its VLAN interface.

·     Associate the super VLAN with VLANs 2, 3, and 5.

Figure 3 Network diagram

Procedure

IMPORTANT

IMPORTANT:

·     By default, interfaces on the device are disabled (in ADM or Administratively Down state). To have an interface operate, you must use the undo shutdown command to enable that interface.

·     The physical interfaces in this example operate in Layer 2 mode. By default, physical interfaces on the device operate in Layer 3 mode. To switch the interface operating mode for an interface, execute the port link-mode command on the interface.

# Create VLAN 10.

<DeviceA> system-view

[DeviceA] vlan 10

[DeviceA-vlan10] quit

# Create VLAN-interface 10, and assign IP address 10.1.1.1/24 to it.

[DeviceA] interface vlan-interface 10

[DeviceA-Vlan-interface10] ip address 10.1.1.1 255.255.255.0

# Enable local proxy ARP.

[DeviceA-Vlan-interface10] local-proxy-arp enable

[DeviceA-Vlan-interface10] quit

# Create VLAN 2, and assign HundredGigE 1/0/1 and HundredGigE 1/0/2 to the VLAN.

[DeviceA] vlan 2

[DeviceA-vlan2] port hundredgige 1/0/1 hundredgige 1/0/2

[DeviceA-vlan2] quit

# Create VLAN 3, and assign HundredGigE 1/0/3 and HundredGigE 1/0/4 to the VLAN.

[DeviceA] vlan 3

[DeviceA-vlan3] port hundredgige 1/0/3 hundredgige 1/0/4

[DeviceA-vlan3] quit

# Create VLAN 5, and assign HundredGigE 1/0/5 and HundredGigE 1/0/6 to the VLAN.

[DeviceA] vlan 5

[DeviceA-vlan5] port hundredgige 1/0/5 hundredgige 1/0/6

[DeviceA-vlan5] quit

# Configure VLAN 10 as a super VLAN, and associate sub-VLANs 2, 3, and 5 with the super VLAN.

[DeviceA] vlan 10

[DeviceA-vlan10] supervlan

[DeviceA-vlan10] subvlan 2 3 5

[DeviceA-vlan10] quit

[DeviceA] quit

Verifying the configuration

# Display information about super VLAN 10 and its associated sub-VLANs.

<DeviceA> display supervlan

 Super VLAN ID: 10

 Sub-VLAN ID: 2-3 5

 VLAN ID: 10

 VLAN type: Static

 It is a super VLAN.

 Route interface: Configured

 Ipv4 address: 10.1.1.1

 Ipv4 subnet mask: 255.255.255.0

 Description: VLAN 0010

 Name: VLAN 0010

 Tagged ports:   None

 Untagged ports: None

 VLAN ID: 2

 VLAN type: Static

 It is a sub VLAN.

 Route interface: Configured

 Ipv4 address: 10.1.1.1

 Ipv4 subnet mask: 255.255.255.0

 Description: VLAN 0002

 Name: VLAN 0002

 Tagged ports:   None

 Untagged ports:

    HundredGigE1/0/1

    HundredGigE1/0/2

 VLAN ID: 3

 VLAN type: Static

 It is a sub VLAN.

 Route interface: Configured

 Ipv4 address: 10.1.1.1

 Ipv4 subnet mask: 255.255.255.0

 Description: VLAN 0003

 Name: VLAN 0003

 Tagged ports:   None

 Untagged ports:

    HundredGigE1/0/3

    HundredGigE1/0/4

 VLAN ID: 5

 VLAN type: Static

 It is a sub VLAN.

 Route interface: Configured

 Ipv4 address: 10.1.1.1

 Ipv4 subnet mask: 255.255.255.0

 Description: VLAN 0005

 Name: VLAN 0005

 Tagged ports:   None

 Untagged ports:

    HundredGigE1/0/5

    HundredGigE1/0/6

 

 

  • Cloud & AI
  • InterConnect
  • Computing
  • Security
  • SMB Products
  • Intelligent Terminal Products
  • Product Support Services
  • Technical Service Solutions
All Services
  • Resource Center
  • Policy
  • Online Help
All Support
  • Become a Partner
  • Partner Resources
  • Partner Business Management
All Partners
  • Profile
  • News & Events
  • Online Exhibition Center
  • Contact Us
All About Us
新华三官网