Understanding and Configuring VLANs

This chapter describes VLANs on Catalyst 4500 series switches. It also provides guidelines, procedures, and configuration examples.

This chapter includes the following major sections:

•Overview of VLANs

•VLAN Configuration Guidelines and Restrictions

•VLAN Default Configuration

•Configuring VLANs

Note For complete syntax and usage information for the switch commands used in this chapter, look at the Cisco Catalyst 4500 Series Switch Command Reference and related publications at this location:

http://www.cisco.com/en/US/products//hw/switches/ps4324/index.html

If the command is not found in the Catalyst 4500 Command Reference, it will be found in the larger Cisco IOS library. Refer to the Catalyst 4500 Series Switch Cisco IOS Command Reference and related publications at this location:

http://www.cisco.com/en/US/products/ps6350/index.html

Overview of VLANs

A VLAN is a group of devices on one or more LANs that are configured to communicate as if they were attached to the same wire, when in fact they are located on a number of different LAN segments. Because VLANs are based on logical instead of physical connections, they are extremely flexible.

VLANs define broadcast domains in a Layer 2 network. A broadcast domain is the set of all devices that will receive broadcast frames originating from any device within the set. Broadcast domains are typically bounded by routers because routers do not forward broadcast frames. Layer 2 switches create broadcast domains based on the configuration of the switch. Switches are multiport bridges that allow you to create multiple broadcast domains. Each broadcast domain is like a distinct virtual bridge within a switch.

You can define one or many virtual bridges within a switch. Each virtual bridge you create in the switch defines a new broadcast domain (VLAN). Traffic cannot pass directly to another VLAN (between broadcast domains) within the switch or between two switches. To interconnect two different VLANs, you must use routers or Layer 3 switches. See the "Overview of Layer 3 Interfaces" section on page 21-1 for information on inter-VLAN routing on Catalyst 4500 series switches.

Figure 8-1 shows an example of three VLANs that create logically defined networks.

Figure 8-1 Sample VLANs

VLANs are often associated with IP subnetworks. For example, all of the end stations in a particular IP subnet belong to the same VLAN. Traffic between VLANs must be routed. You must assign LAN interface VLAN membership on an interface-by-interface basis (this is known as interface-based or static VLAN membership).

You can set the following parameters when you create a VLAN in the management domain:

•VLAN number

•VLAN name

•VLAN type

•VLAN state (active or suspended)

•Maximum transmission unit (MTU) for the VLAN

•Security Association Identifier (SAID)

•VLAN number to use when translating from one VLAN type to another

Note When the software translates from one VLAN type to another, it requires a different VLAN number for each media type.

VLAN Configuration Guidelines and Restrictions

Follow these guidelines and restrictions when creating and modifying VLANs in your network:

•Before creating a VLAN, put the Catalyst 4500 series switch in VTP server mode or VTP transparent mode. If the Catalyst 4500 series switch is a VTP server, you must define a VTP domain. For information on configuring VTP, see Chapter 25, "Understanding and Configuring VTP."

•The Cisco IOS end command is not supported in VLAN database mode.

•You cannot use Ctrl-Z to exit VLAN database mode.

VLAN Ranges

Note You must enable the extended system ID to use 4094 VLANs. See the "Understanding the Bridge ID" section on page 12-2.

With Cisco IOS Release 12.2(20)EWA and later, Catalyst 4500 series switches support 4096 VLANs in compliance with the IEEE 802.1Q standard. These VLANs are organized into three ranges: reserved, normal, and extended.

Some of these VLANs are propagated to other switches in the network when you use the VLAN Trunking Protocol (VTP). The extended-range VLANs are not propagated, so you must configure extended-range VLANs manually on each network device.

Table 8-1 describes the uses for VLAN ranges.

Table 8-1 VLAN Ranges

VLANs
Range
Usage
Propagated
by VTP

0, 4095

Reserved

For system use only. You cannot see or use these VLANs.

N/A

1

Normal

Cisco default. You can use this VLAN but you cannot delete it.

Yes

2-1001

Normal

Used for Ethernet VLANs; you can create, use, and delete these VLANs.

Yes

1002-1005

Normal

Cisco defaults for FDDI and Token Ring. You cannot delete VLANs 1002-1005.

Yes

1006-4094

Extended

For Ethernet VLANs only. When configuring extended-range VLANs, note the following:

•Layer 3 ports and some software features require internal VLANs. Internal VLANs are allocated from 1006 and up. You cannot use a VLAN that has been allocated for such use. To display the VLANs used internally, enter the show vlan internal usage command.

•Switches running Catalyst product family software do not support configuration of VLANs 1006-1024. If you configure VLANs 1006-1024, ensure that the VLANs do not extend to any switches running Catalyst product family software.

•You must enable the extended system ID to use extended range VLANs. See the "Enabling the Extended System ID" section on page 12-8.

No


Configurable Normal-Range VLAN Parameters

Note Ethernet VLANs 1 and 1006 through 4094 use only default values.

You can configure the following parameters for VLANs 2 through 1001:

•VLAN name

•VLAN type

•VLAN state (active or suspended)

•SAID

•STP type for VLANs

VLAN Default Configuration

Table 8-2 shows the default VLAN configuration values.

Table 8-2 Ethernet VLAN Defaults and Ranges 

Parameter
Default
Valid Values

VLAN ID

1

1-4094

VLAN name

VLANx, where x is a number assigned by the software.

No range

802.10 SAID

100,001

1-4,294,967,294

MTU size

1500

1500-18,190

Translational bridge 1

1002

0-1005

Translational bridge 2

1003

0-1005

VLAN state

active

active; suspend; shutdown


Note Catalyst 4500 series switches do not support Token Ring or FDDI media. The switch does not forward FDDI, FDDI-NET, TrCRF, or TrBRF traffic, but it does propagate the VLAN configuration via VTP. The software reserves parameters for these media types, but they are not truly supported.

Configuring VLANs

Note Before you configure VLANs, you must use VLAN Trunking Protocol (VTP) to maintain global VLAN configuration information for your network. For complete information on VTP, see Chapter 25, "Understanding and Configuring VTP."

Note VLANs support a number of parameters that are not discussed in detail in this section. For complete information, refer to the Catalyst 4500 Series Switch Cisco IOS Command Reference.

Note The VLAN configuration is stored in the vlan.dat file, which is stored in nonvolatile memory. You can cause inconsistency in the VLAN database if you manually delete the vlan.dat file. If you want to modify the VLAN configuration or VTP, use the commands described in the following sections and in the Catalyst 4500 Series Switch Cisco IOS Command Reference.

These sections describe how to configure VLANs:

•Configuring VLANs in Global Configuration Mode

•Configuring VLANs in VLAN Database Mode

•Assigning a Layer 2 LAN Interface to a VLAN

Configuring VLANs in Global Configuration Mode

If the switch is in VTP server or transparent mode (see the "Configuring VTP" section on page 25-6), you can configure VLANs in global and VLAN configuration modes. When you configure VLANs in global and config-vlan configuration modes, the VLAN configuration is saved in the vlan.dat files, not the running-config or startup-config files. To display the VLAN configuration, enter the show vlan command.

If the switch is in VLAN transparent mode, use the copy running-config startup-config command to save the VLAN configuration to the startup-config file. After you save the running configuration as the startup configuration, the show running-config and show startup-config commands display the VLAN configuration.

Note When the switch boots, if the VTP domain name and VTP mode in the startup-config and vlan.dat files do not match, the switch uses the configuration in the vlan.dat file.

You use the interface configuration command mode to define the port membership mode and add and remove ports from a VLAN. The results of these commands are written to the running-config file, and you can display the contents of the file by entering the show running-config command.

User-configured VLANs have unique IDs from 1 to 4094. To create a VLAN, enter the vlan command with an unused ID. To verify whether a particular ID is in use, enter the show vlan id ID command. To modify a VLAN, enter the vlan command for an existing VLAN.

See the "VLAN Default Configuration" section for the list of default parameters that are assigned when you create a VLAN. If you do not use the media keyword when specifying the VLAN type, the VLAN is an Ethernet VLAN.

To create a VLAN, perform this task:

 
Command
Purpose

Step 1  

Switch# configure terminal

Enters global configuration mode.

Step 2  

Switch(config)# vlan vlan_ID 

Switch(config-vlan)#

Adds an Ethernet VLAN.

Note You cannot delete the default VLANs for these media types: Ethernet VLAN 1 and FDDI or Token Ring VLANs 1002 to 1005.
When you delete a VLAN, any LAN interfaces configured as access ports assigned to that VLAN become inactive. They remain associated with the VLAN (and thus inactive) until you assign them to a new VLAN.

You can use the no keyword to delete a VLAN.

When the prompt reads Switch(config-vlan)#, you are in vlan-configuration mode. If you wish to change any of the parameters for the newly created VLAN, use this mode.

Step 3  

Switch(config-vlan)# end

Returns to enable mode from vlan-configuration mode.

Step 4  

Switch# show vlan [id | name] vlan_name

Verifies the VLAN configuration.

When you create or modify an Ethernet VLAN, note the following:

•Because Layer 3 ports and some software features require internal VLANs allocated from 1006 and up, configure extended-range VLANs starting with 4094 and work downward.

•You can configure extended-range VLANs only in global configuration mode. You cannot configure extended-range VLANs in VLAN database mode.

•Layer 3 ports and some software features use extended-range VLANs. If the VLAN you are trying to create or modify is being used by a Layer 3 port or a software feature, the switch displays a message and does not modify the VLAN configuration.

This example shows how to create an Ethernet VLAN in global configuration mode and verify the configuration: 

Switch# configure terminal

Switch(config)# vlan 3 

Switch(config-vlan)# end 

Switch# show vlan id 3 

VLAN Name                             Status    Ports

---- -------------------------------- --------- -------------------------------

3    VLAN0003                         active 

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

3    enet  100003     1500  -      -      -        -    -        0      0 

Primary Secondary Type              Interfaces

------- --------- ----------------- -------------------------------------------

Switch#

Configuring VLANs in VLAN Database Mode

When the switch is in VTP server or transparent mode, you can configure VLANs in the VLAN database mode. When you configure VLANs in VLAN database mode, the VLAN configuration is saved in the vlan.dat file, not the running-config or startup-config files. To display the VLAN configuration, enter the show running-config vlan command.

User-configurable VLANs have unique IDs from 1 to 4094. Database mode supports configuration of IDs from 1 to 1001, but not the extended addresses from 1006 to 4094. To create a VLAN, enter the vlan command with an unused ID. To verify whether a particular ID is in use, enter the show vlan id ID command. To modify a VLAN, enter the vlan command for an existing VLAN.

See the "VLAN Default Configuration" section for a listing of the default parameters that are assigned when you create a VLAN. If you do not use the media keyword when specifying the VLAN type, the VLAN is an Ethernet VLAN.

To create a VLAN, perform this task:

 
Command
Purpose

Step 1  

Switch# vlan database

Enters VLAN database mode.

Step 2  

Switch(vlan)# vlan vlan_ID

Adds an Ethernet VLAN.

Note You cannot delete the default VLANs for these media types: Ethernet VLAN 1 and FDDI or Token Ring VLANs 1002 to 1005.
When you delete a VLAN, any LAN interfaces configured as access ports assigned to that VLAN become inactive. They remain associated with the VLAN (and thus inactive) until you assign them to a new VLAN.

You can use the no keyword to delete a VLAN.

Step 3  

Switch(vlan)# exit

Returns to enable mode.

Step 4  

Switch# show vlan [id | name] vlan_name

Verifies the VLAN configuration.

This example shows how to create an Ethernet VLAN in VLAN database mode and verify the configuration: 

Switch# vlan database 

Switch(vlan)# vlan 3 

VLAN 3 added:

    Name: VLAN0003

Switch(vlan)# exit 

APPLY completed.

Exiting....

Switch# show vlan name VLAN0003 

VLAN Name                             Status    Ports

---- -------------------------------- --------- ---------------------

3    VLAN0003                         active

 

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- ------ ------

3    enet  100003     1500  -      -      -        -    0      0

Switch#

Assigning a Layer 2 LAN Interface to a VLAN

A VLAN created in a management domain remains unused until you assign one or more LAN interfaces to the VLAN.

Note Makes sure you assign LAN interfaces to a VLAN of the proper type. Assign Fast Ethernet and Gigabit Ethernet interfaces to Ethernet-type VLANs.

To assign one or more LAN interfaces to a VLAN, complete the procedures in the "Configuring Ethernet Interfaces for Layer 2 Switching" section on page 10-5.