- Preface
- New and Changed Information
- Overview
- Configuring VLANs
- Configuring Private VLANs
- Configuring Access and Trunk Interfaces
- Configuring Enhanced Virtual Port Channels
- Configuring Rapid PVST+
- Configuring Multiple Spanning Tree
- Configuring STP Extensions
- Configuring Flex Links
- Configuring LLDP
- Configuring MAC Address Tables
- Configuring IGMP Snooping
- Configuring MVR
- Configuring Traffic Storm Control
- Configuring the Fabric Extender
- Index
Configuring VLANs
This chapter contains the following sections:
Information About VLANs
Understanding VLANs
A VLAN is a group of end stations in a switched network that is logically segmented by function, project team, or application, without the limitation to the physical locations of the users. VLANs have the same attributes as physical LANs, but you can group end stations even if they are not physically located on the same LAN segment.
Any port can belong to a VLAN; all unicast, broadcast, and multicast packets are forwarded and flooded only to end stations in that VLAN. Each VLAN is considered a logical network. If a packet destination address does not belong to the VLAN, it must be forwarded through a router.
The following figure shows VLANs as logical networks. In this diagram, the stations in the engineering department are assigned to one VLAN, the stations in the marketing department are assigned to another VLAN, and the stations in the accounting department are assigned to yet another VLAN.
VLANs are usually associated with IP subnetworks. For example, all the end stations in a particular IP subnet belong to the same VLAN. To communicate between VLANs, you must route the traffic.
By default, a newly created VLAN is operational. To disable the VLAN use the shutdown command. Additionally, you can configure VLANs to be in the active state (passing traffic), or the suspended state (in which the VLANs are not passing packets). By default, the VLANs are in the active state and pass traffic.
Note | The VLAN Trunking Protocol (VTP) mode is OFF. VTP BPDUs are dropped on all interfaces of the switch. This process has the effect of partitioning VTP domains if other switches have VTP turned on. |
A VLAN can also be configured as a switched virtual interface (SVI). In this case, the switch ports in the VLAN are represented by a virtual interface to a routing or bridging system. The SVI can be configured for routing, in which case it supports Layer 3 protocols for processing packets from all switch ports associated with the VLAN, or for in-band management of the switch.
Understanding VLAN Ranges
The Cisco Nexus device supports VLAN numbers 1 to 4094 in accordance with the IEEE 802.1Q standard. These VLANs are organized into ranges. The switch is physically limited in the number of VLANs it can support. The hardware also shares this available range with its VSANs. For information about VLAN and VSAN configuration limits, see the configuration limits documentation for your device.
The following table describes the details of the VLAN ranges.
Note | You cannot configure the internally allocated VLANs (reserved VLANs). |
Note | VLANs 3968 to 4049 and 4094 are reserved for internal use; these VLANs cannot be changed or used. |
Cisco NX-OS allocates a group of 82 VLAN numbers for those features, such as multicast and diagnostics, that need to use internal VLANs for their operation. By default, the system allocates VLANs numbered 3968 to 4049 for internal use. VLAN 4094 is also reserved for internal use by the switch.
You cannot use, modify, or delete any of the VLANs in the reserved group. You can display the VLANs that are allocated internally and their associated use.
Creating, Deleting, and Modifying VLANs
VLANs are numbered from 1 to 4094. All configured ports belong to the default VLAN when you first bring up the switch. The default VLAN (VLAN1) uses only default values. You cannot create, delete, or suspend activity in the default VLAN.
You create a VLAN by assigning a number to it. You can delete VLANs as well as move them from the active operational state to the suspended operational state. If you attempt to create a VLAN with an existing VLAN ID, the switch goes into the VLAN submode but does not create the same VLAN again.
Newly created VLANs remain unused until ports are assigned to the specific VLAN. All the ports are assigned to VLAN1 by default.
Depending on the range of the VLAN, you can configure the following parameters for VLANs (except the default VLAN):
When you delete a specified VLAN, the ports associated to that VLAN are shut down and no traffic flows. However, the system retains all the VLAN-to-port mapping for that VLAN, and when you reenable, or recreate, the specified VLAN, the system automatically reinstates all the original ports to that VLAN.
Note | Commands entered in the VLAN configuration submode are immediately executed. VLANs 3968 to 4049 and 4094 are reserved for internal use; these VLANs cannot be changed or used. |
About the VLAN Trunking Protocol
VLAN Trunking Protocol (VTP) is a distributed VLAN database management protocol that synchronizes the VTP VLAN database across domains. A VTP domain includes one or more network switches that share the same VTP domain name and are connected with trunk interfaces.
-
Server mode—Allows users to perform configurations, manage the VLAN database version, and store the VLAN database.
-
Client mode—Does not allow users to perform configurations and relies on other switches in the domain to provide configuration information.
-
Off mode—Allows users to access the VLAN database (VTP is enabled) but does not participate in VTP.
-
Transparent mode—Does not participate in VTP, uses local configuration, and relays VTP packets to other forward ports. VLAN changes affect only the local switch. A VTP transparent network switch does not advertise its VLAN configuration and does not synchronize its VLAN configuration based on received advertisements.
Guidelines and Limitations for VTP
VTP has the following configuration guidelines and limitations:
-
When a switch is configured as a VTP client, you cannot create VLANs on the switch in the range of 1 to 1005.
-
VLAN 1 is required on all trunk ports used for switch interconnects if VTP is supported in the network. Disabling VLAN 1 from any of these ports prevents VTP from functioning properly.
-
If you enable VTP, you must configure either version 1 or version 2. On the Cisco Nexus device, 512 VLANs are supported. If these switches are in a distribution network with other switches, the limit remains the same.
On the Cisco Nexus device, 512 VLANs are supported. If these switches are in a distribution network with other switches, the VLAN limit for the VTP domain is 512. If a Cisco Nexus device client/server receives additional VLANs from a VTP server, they transition to transparent mode.
-
If system vlan long-name knob is enabled, then VTP configurations will come up in OFF mode and users can change the mode to Transparent. However, changing the mode to Server or Client is not allowed.
-
The show running-configuration command does not show VLAN or VTP configuration information for VLANs 1 to 1000.
-
When deployed with vPC, both vPC switches must be configured identically.
-
VTP advertisements are not sent out on Cisco Nexus Fabric Extender ports.
-
Private VLANs (PVLANs) are supported only when the switch is in transparent mode.
-
When a switch is configured in VTP client or server mode, VLANs 1002 to1005 are reserved VLANs.
-
VTP pruning is not supported.
-
You must enter the copy running-config startup-config command followed by a reload after changing a reserved VLAN range. For example:
switch(config)# system vlan 2000 reserve This will delete all configs on vlans 2000-2081. Continue anyway? (y/n) [no] y
After the switch reload, VLANs 2000 to 2081 are reserved for internal use, which requires that you enter the copy running-config startup-config command before the switch reload. Creating VLANs within this range is not allowed.
Configuring a VLAN
Creating and Deleting a VLAN
You can create or delete all VLANs except the default VLAN and those VLANs that are internally allocated for use by the switch. Once a VLAN is created, it is automatically in the active state.
Note | When you delete a VLAN, ports associated to that VLAN shut down. The traffic does not flow and the packets are dropped. |
1. switch# configure terminal
2.
switch(config)#
vlan
{vlan-id |
vlan-range}
3.
switch(config-vlan)#
no
vlan {vlan-id |
vlan-range}
DETAILED STEPS
This example shows how to create a range of VLANs from 15 to 20:
switch# configure terminal switch(config)# vlan 15-20
Note | You can create and delete VLANs in the VLAN configuration submode. |
Changing the Range of Reserved VLANs
1.
config t
2.
system vlan
start-vlan
reserve
3.
copy
running-config startup-config
4.
reload
5.
(Optional)
show system
vlan reserved
DETAILED STEPS
switch# configuration terminal switch(config)# system vlan 1006 reserve This will delete all configs on vlans 1006-1087. Continue anyway? (y/n) [no] yes Note: After switch reload, VLANs 1006-1087 will be reserved for internal use. This requires copy running-config to startup-config before switch reload. Creating VLANs within this range is not allowed. switch(config)# copy running-config startup-config switch(config)# reload switch(config)# show system vlan reserved
Note | You must reload the device for this change to take effect. |
Configuring a VLAN
To configure or modify the VLAN for the following parameters, you must be in the VLAN configuration submode:
-
Name
Note
VLAN name can be either a short name (up to 32 characters) or long name (up to 128 characters). To configure VLAN long-name of up to 128 characters, you must enable system vlan long-name command. -
Shut down
Note | You cannot create, delete, or modify the default VLAN or the internally allocated VLANs. Additionally, some of these parameters cannot be modified on some VLANs. |
1. switch# configure terminal
2.
switch(config)#
vlan
{vlan-id |
vlan-range}
3.
switch(config-vlan)#
name
vlan-name
4.
switch(config-vlan)#
state
{active |
suspend}
5.
(Optional)
switch(config-vlan)#
no
shutdown
DETAILED STEPS
Command or Action | Purpose | |
---|---|---|
Step 1 | switch# configure terminal |
Enters global configuration mode. |
Step 2 |
switch(config)#
vlan
{vlan-id |
vlan-range}
|
Enters VLAN configuration submode. If the VLAN does not exist, the system first creates the specified VLAN. |
Step 3 |
switch(config-vlan)#
name
vlan-name
|
Names the VLAN. You can enter up to 32 alphanumeric characters to name the VLAN. You cannot change the name of VLAN1 or the internally allocated VLANs. The default value is VLANxxxx where xxxx represents four numeric digits (including leading zeroes) equal to the VLAN ID number. |
Step 4 |
switch(config-vlan)#
state
{active |
suspend}
|
Sets the state of the VLAN to active or suspend. While the VLAN state is suspended, the ports associated with this VLAN are shut down, and that VLAN does not pass any traffic. The default state is active. You cannot suspend the state for the default VLAN or VLANs 1006 to 4094. |
Step 5 |
switch(config-vlan)#
no
shutdown
| (Optional)
Enables the VLAN. The default value is no shutdown (or enabled). You cannot shut down the default VLAN, VLAN1, or VLANs 1006 to 4094. |
This example shows how to configure optional parameters for VLAN 5:
switch# configure terminal
switch(config)# vlan 5
switch(config-vlan)# name accounting
switch(config-vlan)# state active
switch(config-vlan)# no shutdown
Adding Ports to a VLAN
After you have completed the configuration of a VLAN, assign ports to it.
1. switch# configure terminal
2.
switch(config)# interface {ethernet
slot/port | port-channel
number}
3.
switch(config-if)# switchport
access vlan
vlan-id
DETAILED STEPS
Command or Action | Purpose | |
---|---|---|
Step 1 | switch# configure terminal |
Enters global configuration mode. |
Step 2 |
switch(config)# interface {ethernet
slot/port | port-channel
number}
|
Specifies the interface to configure, and enters the interface configuration mode. The interface can be a physical Ethernet port or an EtherChannel. |
Step 3 |
switch(config-if)# switchport
access vlan
vlan-id
|
Sets the access mode of the interface to the specified VLAN. |
This example shows how to configure an Ethernet interface to join VLAN 5:
switch# configure terminal
switch(config)# interface ethernet 1/13
switch(config-if)# switchport access vlan 5
Verifying the VLAN Configuration
Use one of the following commands to verify the configuration:
Command |
Purpose |
---|---|
switch# show running-config vlan [vlan_id | vlan_range] |
Displays VLAN information. |
switch# show vlan [brief | id [vlan_id | vlan_range] | name name | summary ] |
Displays selected configuration information for the defined VLAN(s). |
switch# show system vlan reserved | Displays the system reserved VLAN range. |