VLAN Configuration in Cisco Switches
In the previous article, we have discussed the normal and extended-range VLANs. Normal range VLAN configuration is stored in vlan.dat file, which is located in flash memory on the switch. Flash memory does not need the copy running-config startup-config or write command.
But, other details are usually configured on a Cisco switch at the same time when VLANs are created; it is best to save running configuration changes to the startup configuration. The figure below illustrates the Cisco IOS command syntax used to add a VLAN to a Cisco switch and give it a name. Naming each VLAN is the best practice in VLAN configuration.
Vlan <vlan ID>
Name <Name of the VLAN>
The figure below illustrates the topology where Sw-1 has already been configured with VLAN 10 and 20. We can check using the Syntax Checker show vlan brief command in user exec mode to display the contents of the vlan.dat file. Now we should create some VLANs including VLAN-10 and VLAN-20 on Sw-2.
So, we can create VLANs one by one, using a series of VLAN IDs and using a range. The IDs can be entered separated by commas and the range of VLAN IDs can be separated by hyphens for example “vlan vlan-id”. Use the following command to create VLANs 10, 20, 30, 40, and VLANs 50-60.
Sw-2(config)# vlan 10, 20, 30, 40
Sw-2(config)# vlan 50-60
Assigning Ports to VLAN
Once VLAN configuration is done, then the next step is assigning ports to the VLAN. Port in access mod can belong to only one VLAN at a time. Only in one case when the access port is connected to an IP phone, there are two VLAN associated with this port, one for voice and one for data. Following is the syntax for defining a port to be an access port and assigning it to a VLAN.
Enter into Global Configuration Mode | Sw-2# configure Terminal |
Enter into interface Configuration Mode | Sw-2(Config)# interface interface_id |
Set the Port to access Mode | Sw-2(Config-if)# switchport mode access |
Assign Ports to VLAN | Sw-2(Config-if)# switchport access vlan vlan-id |
Return to the Privileged EXEC Mode | Sw-2(Config-if)#end |
The command switch port mode access is optional, although this command is strongly recommended for security. This command changes the switch interface permanently to access mode. To execute the command for more than one interface we can use the interface range command.
In the Figure below, VLAN 10 is assigned to port Fa0/1 on switch1 as a result, the PC4 became a member of VLAN 10 and VLAN-20 are assigned port fa 0/2 and fa0/3, so PC5 and PC6 is the part of VLAN 20. We can use the Syntax Checker “show vlan brief” command to display the contents of the vlan.dat file.
If VLAN does not exist the switchport access vlan command forces the creation of a VLAN on the switch. For example, VLAN 100 does not exist in the output of the show vlan brief command. If the switchport access vlan 30 commands entered on an interface without any prior configuration, then the will display the following:
% Access VLAN does not exist. Creating VLAN 100
Now we can show the vlan.dat file using show vlan brief command.
Changing VLAN Port Membership
There are several ways to change the VLAN port association. The table below shows the syntax for changing a switch port membership to VLAN 1 with the no switchport access vlan interface configuration mode command.
VLAN 10 has assigned interface Fa0/1. The no switchport access vlan command is entered for interface Fa0/1 in interface configuration mode, now check the output in the show vlan brief command that instantly follows as shown in Figure below.
The show vlan brief command displays the VLAN association and type for all switch ports. The show vlan brief command shows one line for every VLAN. The output for every VLAN includes the name, status, and switch ports.
Enter into Global Configuration Mode | Sw-2# configure Terminal |
Enter into interface Configuration Mode | Sw-2(Config)# interface interface_id |
Delete Ports to VLAN | Sw-2(Config-if)# no switchport access vlan vlan-id |
Return into the Privileged EXEC Mode | Sw-2(Config-if)#end |
VLAN 10 is still active, but there are no ports in the VLAN. The command show interfaces f0/1 switchport verify that the access VLAN for Fa0/1 interface has been reset to VLAN 1. It is not required to first remove a port from a VLAN for changing its membership. Now we can again assign these ports to any VLAN.
Verifying VLAN Information
After a VLAN configuration or some changes in the VLAN configuration, we must validate the configuration using the Cisco IOS show commands. The command syntax is the following:-
- Show vlan [ brief | id vlan-id | name vlan-name | summary]
- Brief – it displays one line for every VLAN with the name of VLAN, status, and ports.
- Id vlan-id – This parameter displays the information about a specific VLAN with VLAN ID number.
- name vlan-name – Display the information of a specific VLAN with the name of VLAN.
- Show interfaces [interface-id | vlan vlan-name | switchport]
- Interface-id – this is a valid interface id included a module, port numbers, and port channel. The port-channel range is between 1 to 6.
- Id vlan-id – This parameter displays the information about a specific VLAN with VLAN ID number. The range of VLAN id is 1 to 4096.
- switchport – This parameter displays the operational and administrative status of a switch port, including blocking of the port and port protection settings.
Now we are going to use the show VLAN command with a different parameter. The “show vlan name IT” command output is not easy to understand. The figure below illustrates the output of this command. The output parameter will be discussed in the coming articles.
The recommended command for VLAN verification is “show vlan brief” and also “show vlan summary” These commands display the count of all configured VLANs. We can also use the “show interfaces” command with different parameters. For examples “show interfaces fastEthernet 0/1 switchport“.
This will display all information about the switchport fastethernet 0/1. If we enter command “show interfaces switchport” It will display all existing switchport information. We can also use “show interfaces vlan <vlan ID>” command to display the vlan interface informations. This command will show the IP address information of this VLAN.
Deleting VLAN
We can delete VLAN with “no vlan vlan-id” command in global configuration mode. For example, “ no vlan 10 “ in global configuration mode will delete VLAN 10 from switch Sw-2 database. The ports of VLAN 10 is not the member of any VLAN now. You can verify it with “show vlan brief” command that VLAN 10 is no longer present in the vlan.dat file after using the no vlan 10 commands.
Best practice before deleting VLAN is reassigning to all member ports to a different VLAN because any port that is not moved to an active VLAN are unable to communicate with other hosts after the deleting VLAN and until they are assigned to an active VLAN.
We can delete the entire vlan.dat file using the “delete flash:vlan.dat” command in privileged EXEC. The abbreviated command is “delete vlan.dat”. We can also use this to delete a vlan.dat file if the file is stored in its default location.
After executing this command and restarting the switch, the formerly configured VLANs are no longer present. This places the switch into its factory default condition for VLAN configurations.
Conclusion
Configuring VLANs on Cisco switches is an essential aspect of network management. Proper naming, assignment of ports, and verification of VLAN configurations are crucial steps. Regularly using show commands helps ensure the correct setup of VLANs, and caution should be exercised when deleting VLANs to avoid network disruptions. Following best practices and utilizing recommended commands contribute to a secure and well-organized network infrastructure.
FAQs
- Why is naming each VLAN considered a best practice in VLAN configuration?
Naming each VLAN provides clarity and documentation for network administrators, making it easier to identify the purpose or function of a specific VLAN. - Can VLANs be created on a Cisco switch individually and in a range?
Yes, VLANs can be created on a Cisco switch individually by specifying VLAN IDs, or in a range using hyphens. For example, the command vlan 10, 20, 30, 40 creates VLANs 10, 20, 30, and 40, while vlan 50-60 creates VLANs 50 through 60. - What is the purpose of the ‘switchport mode access’ command in VLAN configuration?
The switchport mode access command is optional but recommended for security. It permanently sets the switch interface to access mode, ensuring that the port can only belong to one VLAN. This command helps prevent unauthorized VLAN hopping. - How can I assign ports to a VLAN after VLAN configuration?
Ports can be assigned to a VLAN by entering the interface configuration mode and using the switchport access vlan [VLAN ID] command. This associates the specified VLAN with the port. - What happens if a VLAN does not exist when assigning it to a port?
If the VLAN does not exist, the switchport access vlan [VLAN ID] command forces the creation of the VLAN on the switch. For example, if VLAN 100 does not exist, entering the command will create VLAN 100. - How can I verify VLAN information on a Cisco switch?
VLAN information can be verified using the show vlan command with various parameters, such as brief, id [VLAN ID], name [VLAN Name], or summary. Additionally, the show interfaces command can be used to display information about switch ports and VLAN assignments. - What is the recommended command for VLAN verification?
The recommended commands for VLAN verification are show vlan brief and show vlan summary. These commands provide a concise overview of all configured VLANs. - How can I delete a VLAN on a Cisco switch?
To delete a VLAN, use the no vlan [VLAN ID] command in global configuration mode. Before deleting a VLAN, it’s advisable to reassign member ports to a different VLAN to ensure uninterrupted communication.
Is it possible to delete the entire vlan.dat file on a Cisco switch?
Yes, the delete flash:vlan.dat command in privileged EXEC mode can be used to delete the entire vlan.dat file. This action, followed by a switch restart, restores the switch to its factory default condition for VLAN configurations.
Trunk Links Common Problem and Troubleshooting » Networkustad
August 18, 2019 @ 11:55 am
[…] occurs, the connectivity issues start in the network. So, data traffic for other VLAN except native VLAN will successfully propagate across the network. Native VLAN mismatch doesn’t keep trunk […]