EtherChannel and Vlan trunk

I am trying to have 3 group of 4 GigE ports on the 3560G as a etherchannel and connect to 4 dells.
On gi0/7 - 10 the trunk config seems to work but I am not able to route between the switches. Here is the config ...
Can anyone take a look tell me what's missing? Much appreciated!
Building configuration...
Current configuration : 3422 bytes
! Last configuration change at 00:35:24 UTC Sat Jul 9 2005
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
hostname cisco_switch_b
enable secret xxxx
enable password xxx
ip subnet-zero
ip routing
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
interface Port-channel1
switchport access vlan 5
switchport trunk encapsulation dot1q
switchport mode trunk
interface GigabitEthernet0/1
description To Internet Router
no switchport
ip address 10.1.1.2 255.255.255.0
ip helper-address 10.1.1.8
interface GigabitEthernet0/2
interface GigabitEthernet0/3
interface GigabitEthernet0/4
interface GigabitEthernet0/5
interface GigabitEthernet0/6
interface GigabitEthernet0/7
description To Dell_switch_1
switchport access vlan 5
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode on
spanning-tree portfast
interface GigabitEthernet0/8
switchport access vlan 5
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode on
spanning-tree portfast
interface GigabitEthernet0/9
switchport access vlan 5
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode on
spanning-tree portfast
interface GigabitEthernet0/10
switchport access vlan 5
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode on
spanning-tree portfast
interface GigabitEthernet0/11
description To Dell_switch_2
switchport access vlan 6
spanning-tree portfast
interface GigabitEthernet0/12
switchport access vlan 6
spanning-tree portfast
interface GigabitEthernet0/13
switchport access vlan 6
spanning-tree portfast
interface GigabitEthernet0/14
switchport access vlan 6
spanning-tree portfast
interface GigabitEthernet0/15
description To Dell_switch_3
switchport access vlan 7
switchport mode access
spanning-tree portfast
interface GigabitEthernet0/16
switchport access vlan 7
switchport mode access
spanning-tree portfast
interface GigabitEthernet0/17
switchport access vlan 7
switchport mode access
spanning-tree portfast
interface GigabitEthernet0/18
switchport access vlan 7
switchport mode access
spanning-tree portfast
interface GigabitEthernet0/19
interface GigabitEthernet0/20
interface GigabitEthernet0/21
interface GigabitEthernet0/22
interface GigabitEthernet0/23
interface GigabitEthernet0/24
interface GigabitEthernet0/25
interface GigabitEthernet0/26
interface GigabitEthernet0/27
interface GigabitEthernet0/28
interface Vlan1
no ip address
shutdown
interface Vlan5
ip address 10.1.5.1 255.255.255.0
interface Vlan6
ip address 10.1.6.1 x.x.255.0
ip helper-address 10.1.5.7
interface Vlan7
ip address 10.1.7.1 x.x.x.0
ip helper-address 10.1.5.7
ip default-gateway 10.1.1.1
ip classless
ip http server
access-list 100 permit ip host 0.0.0.0 host 255.255.255.255
access-list 100 permit udp host 10.1.5.1 host 10.1.5.7 eq bootps
access-list 100 permit udp host 10.1.5.1 host 10.1.5.7 eq bootpc
access-list 100 permit udp host 10.1.5.7 host 10.1.5.1 eq bootps
access-list 100 permit udp host 10.1.5.7 host 10.1.5.1 eq bootpc
access-list 100 permit ip host 0.0.0.0 host 255.255.255.0
control-plane
line con 0
exec-timeout 0 0
line vty 0 4
password xxx
no login
line vty 5 15
password xxx
no login
ntp server 10.1.5.7
end

Here is an example to configure EtherChannel:
Cisco Catalyst 3560 Switch Configuration
Set MDIX automatic To enable cisco catalyst to accept cross cable and straight cable connection
# config t
# int range g0/1 28
# switchport mode access - Configure Cisco catalyst to normal switch port
# speed auto
# duplex auto
# mdix auto
# end
# show controllers Ethernet-controller
# copy running-config startup-config
Configure Etherchannels support redundancy and network load balancing
# config t
# int range g0/23 24
# switchport mode access
# switchport mode vlan 1
# channel-group 5 mode active
# exit
Configure Etherchannels load balancing
# config t
# port-channel load-balance src-dst-mac
# exit
Configure IP Address:
# config t
# int vlan 1
# ip address 10.xx.xx.xx 255.255.252.0
# ip default-gateway 10.xx.xx.1
# config t
# int range g0/19-20
# channel-group 2 mode active
# config t
# int range g0/17-18
# channel-group 3 mode active
# channel-group mode 3 desirable
# int port-channel 3
# switchport mode access
# config t
# int range g0/15-16
# channel-group 4 mode active
# show etherchannel summary to check Etherchannel port status
Regards,
Junhan
IT Specialist

Similar Messages

Private Vlan, Etherchannel and Isolated Trunk on Nexus 5010

I'm not sure if I'm missing something basic here however i though that I'd ask the question. I recieved a request from a client who is trying to seperate traffic out of a IBM P780 - one set of VIO servers/clients (Prod) is tagged with vlan x going out LAG 1 and another set of VIO server/clients (Test) is tagged with vlan y and z going out LAG 2. The problem is that the management subnet for these devices is on one subnet.
The infrastructure is the host device is trunked via LACP etherchannel to Nexus 2148TP(5010) which than connects to the distribution layer being a Catalyst 6504 VSS. I have tried many things today, however I feel that the correct solution to get this working is to use an Isolated trunk (as the host device does not have private vlan functionality) even though there is no requirement for hosts to be segregated. I have configured:
1. Private vlan mapping on the SVI;
2. Primary vlan and association, and isolated vlan on Distribution (6504 VSS) and Access Layer (5010/2148)
3. All Vlans are trunked between switches
4. Private vlan isolated trunk and host mappings on the port-channel interface to the host (P780).
I haven't had any luck. What I am seeing is as soon as I configure the Primary vlan on the Nexus 5010 (v5.2) (vlan y | private-vlan primary), this vlan (y) does not forward on any trunk on the Nexus 5010 switch, even without any other private vlan configuration. I believe this may be the cause to most of the issues I am having. Has any one else experienced this behaviour. Also, I haven't had a lot of experience with Private Vlans so I might be missing some fundamentals with this configuration. Any help would be appreciated.

Hello Emcmanamy, Bruce,
Thanks for your feedback.
Just like you, I have been facing the same problematic last months with my customer.
Regarding PVLAN on FEX, and as concluded in Bruce’s previous posts I understand :
You can configure a host interface as an isolated or community access port only.
We can configure “isolated trunk port” as well on a host interface. Maybe this specific point could be updated in the documentation.
This ability is documented here =>
http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/layer2/513_N2_1/b_Cisco_n5k_layer2_config_gd_rel_513_N2_1_chapter_0101.html#task_1170903
You cannot configure a host interface as a promiscuous port.
You cannot configure a host interface as a private VLAN trunk port.
Indeed a pvlan is not allowed on a trunk defined on a FEX host interface.
However since NxOS 5.1(3)N2(1), the feature 'PVLAN on FEX trunk' is supported. But a command has to be activated before => system private-vlan fex trunk . When entered a warning about the presence of ‘FEX isolated trunks’ is prompted.
http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/layer2/513_N2_1/b_Cisco_n5k_layer2_config_gd_rel_513_N2_1_chapter_0101.html#task_16C0869F1B0C4A68AFC3452721909705
All these conditions are not met on a N5K interface.
Best regards.
Karim

Port Channel and VLAN trunking

When configuring trunking of VLANS accross a Port Channel, do we need to configure vlan pruning on both the port-Channel port and the physical ports ???
E.g. do I need to apply the "switchport trunk allowed vlan add " command under each physical port and the port channel port ? Or only under the port channel port ?
Thanks

In short, yes. Configure the port channel interface exactly as you do the physical interfaces and both ends should be an exact match. otherwise you will have problems getting the channel to come up or stay up.
-Mark

Ubr7200 (7246) and VLAN Trunks

Has anyone successfully setup a VLAN subinterface on a ubr7200? All of the documents I have seen on TAC state I should use the encapsulation command but it is not available. I want to do something like:
interface gig 2/0.500
encapsulation dot1q 500
ip address x.x.x.x y.y.y.y
uBR7246VXR (NPE300) 13.3(17a)BC
1 FastEthernet/IEEE 802.3 interface(s)
1 Gigabit Ethernet/IEEE 802.3 interface(s)
1 ATM network interface(s)
1 Cable Modem network interface(s)

I thought I had tried an IP+ feature this weekend out of desperation. I downloaded it but I guess I didn't copy it to flash. Is there a decent chart that shows the differences? I kind of got burned on something similiar when I ordered a 3750. I was assured the base install was sufficient for my needs. A few weeks later and before the 3750 came in (I had the delivery pushed for budget reasons), I was discussing adding some additional equipment, the VAR sales rep suddenly realized I needed the enterprise version. My CFO was not happy about the unexpected expenditure. At least this router isn't in my cost center and instead belongs to an engineering department.

Pvlan etherchannel and trunk

Hi all,
one simple question: is it possible to trunk a cat 6500 to a cat 4500 with an etherchannel and transport a private vlan (in my case 1 isolated lan) ?
Thanks in advance.

I don't think this is possible

VLAN Trunking and GVRP

Decided we'd give the Cisco 300 series switches a try and see
what we think about them compared to our Cisco Catalyst 2960 switches.
I'm already stumped on setting up VLAN trunking between 4 switches. Do I have to manually setup all the VLAN's on each switch? I set them up on the first switch and was expecting GVRP would propagate them to the others like VTP.
Denny

Decided we'd give the Cisco 300 series switches a try and see
what we think about them compared to our Cisco Catalyst 2960 switches.
I'm already stumped on setting up VLAN trunking between 4 switches. Do I have to manually setup all the VLAN's on each switch? I set them up on the first switch and was expecting GVRP would propagate them to the others like VTP.
Denny

MIBS to Monitor Etherchannel and trunks via SNMP

I would like to monitor the status of etherchannel and trunk configurations in 6500 Catalyst switches running both CATOS and IOS. I would like to understand the specific mibs/OIDS that should be monitored for etherchannels and trunks. I am trying to get a better handle on tracking the etherchannels and trunk dynamically and then understanding when the ports are having issues (up/down and errors). I need to understand how to differentiate these type of ports from regular access ports.
Thanks,
Tim

Hi Tim,
what exactly do you want to query via SNMP?
For an (PAgP) Etherchannel, the member-interfaces might be interesting:
https://supportforums.cisco.com/message/3957914#3957914
For a trunk, you could start with the operational mode, depending on the platform you can use:
vlanTrunkPortDynamicStatus (CISCO-VTP-MIB):
vlanTrunkPortDynamicStatus.49 = notTrunking
vlanTrunkPortDynamicStatus.50 = trunking
vlanPortIslOperStatus (CISCO-STACK-MIB):
vlanPortIslOperStatus.13.43 = notTrunking
vlanPortIslOperStatus.13.44 = trunking
Hope that helps
Rolf

VLAN trunking from Cisco Catalyst 3750 to Cisco SF300-48P issue and related

Hello expert,
I'm having difficulties to configure VLAN trunking between Cisco Catalyst 3750 switch with Cisco SF300-48P switch and my workstation unable to get any DHCP IP from our DHCP server via Cisco SF300-48P switch. Below is the snippet of configuration on both switches:
[Cisco Catalyst 3750 Switch]
interface GigabitEthernet1/0/45
description NCC-CC-1stFlr
no switchport trunk encapsulation dot1q
no switchport trunk allowed vlan 101-103
spanning-tree portfast
[Cisco SF300-48P Switch]
interface fastethernet48
spanning-tree link-type point-to-point
switchport trunk allowed vlan add 101-103
macro description switch
!next command is internal.
macro auto smartport dynamic_type switch
interface fastethernet29
switchport mode general
switchport general allowed vlan add 103 tagged
switchport general pvid 103
Are these are correct? Kindly advice!
Thank you very much!
Regards,
Alex

Hi Alex,
for the trunk port on Catalyst on port GE 1/0/45, we need to enable the trunk and for on encapsulation dot1q because this catalyst model is ISL capable also and the SF300 working only with Dot1q Encapsultion
The configuration on catalyst should :
#config terminal
#interface Gi 1/0/45
# switchport encapsulation
#switchport trunk encapsulation dot1q
#switchport mode trunk
#switchport trunk allowed vlan 101-103
#spanning-tree portfast
For SF300 the port trunk it looks fine but for the port where the PC should receive an IP address
#interface fastethernet29
#switchport mode access
#switchport ccess vlan 103
Please let me know after this configuration
Thanks
Mehdi
Please rate or mark as answered to help other Cisco Customers

VLAN trunking to server and security

I have a question concerning interserver security.
I have a cat6513 and the port connected to a w2k3 server (single NIC) is in trunking mode carrying 2 VLANS a "customer" VLAN and "backup" VLAN. We serve multiple customers,each on their own specific VLAN, but all customers use the same generic backup service in a generic backup VLAN. Customers VLANS are separated by a FWSM but with this setup all the servers can connect to other servers on the backup VLAN.
What would be the best way to make sure that on the backup VLAN the servers can only connect to the backupserver and not ervers from oher customers.
We tried private VLAN's (which I think won't work because the port is a trunk)ad access-list but can't get it to work.
Any help or directions on how to solve this in well designed manner would be appreciated.
This is the config of a port in which vlan 11 is the backup vlan and vlan 31 the customer VLAN.
interface GigabitEthernet12/17
description
no ip address
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 11,31
switchport mode trunk

Hello,
my first thought would be to use protected ports ('switchport protected' interface command), which would prohibit ports configured with that command from talking to each other. The drawback is that this only works for ports on the same switch...
Regards,
GP

Etherchannel for fallover trunks

I was told that it is a good idea to run etherchannel on my trunk links so if one interface goes down it will still work, is this true and how would i configure it ?

Hi!
It is indeed a good idea to do that. The resiliency is better. It is upto you whether to configure a Layer 2 or a Layer 3 etherchannel. Although in your case I believe a Layer 2 etherchannel should suffice.
For configuring etherchannel, you need to enter the following commands:
- enable
- configure terminal
- interface 'type' 'no'
- switchport mode access trunk
- switchport access vlan 'no'|
- channel-group 'channel-group no' mode desirable
You need to enter these commands for every interface you want to be as part of etherchannel.
For more, please refer the following link -->
http://www.cisco.com/en/US/products/hw/switches/ps646/products_configuration_guide_chapter09186a00801f0a49.html#1033981
Hope that helps.
Regards,
AbhisheK
Please rate all posts!

How do I add a Subnet and vlan with a catalyst 3550 and RV120

Hello Friends.
I have a scenario that i'm hoping i can get some help with. I'll be as detailed and descriptive as i can.
This is for a business with 100 employees nodes and 100 camera nodes all needing IP internet through private addressing and public gateway.
I have a business class gateway with a private range of 12 public addresses. Ther modem does nothing but act as a gateway since i have disabled the firewall and DHCP.
In place of the firewall and DCHP from the modem i have installed a RV120 Firewall with VPN. When installing i replicated the IP scheme of the modem as to not disturb and distrup the devices assigned addresses from that scheme from the modem. I did this because the owner could not have any down time or any disruption to the business operations.
The RV120 now acts as firewall , DHCP , and VPN. I'll address the subnet first. I's using 10.0.0.0/24 subnet range.
DHCP is assigning 10.1.10.50 - 10.1.10.100 the rest are static and i plan to use static DHCP with the IP and MAC assigned to each static DHCP address.
There are 100 cameras with static IP addresses in the range of 10.1.10.11 - 10.1.10.40, and 10.1.0.1.101 - 10.1.10.170.
VPN uses PPTP assigned address 10.1.10.6 - 10.1.10.10.
There are no layer 3 switches that i know of. Just a layer two that is the primary swith and ports have run out, and various out of the box switches and wireless access points connected to the primary switch.
I want to implement subnets into the network and VLANS as well on a new Layer 3 switche from cisco. Thinking 3550 from Cisco or one of the older layer 2 switches with layer three capabilities.
I also want to introduce a 192.168.0.0/24 IP range for the existing wireless network and segment the traffic from the rest of the traffic on other ranges.
I want to replace the 10.0.0.0/24 DHCP alltogether and the static addresses for end user nodes on the same network, but keep that range just for camera nodes segmented.
I want to implement a NEW end user IP range and VLAN for employee/guest networks using the 172.16.0.0/24 range.
Iv'e thought of replacing all the wireless nodes with RV120's and use VLAN. Dont know if that strategy works. Need to think it through.
I want the 192.168.0.0/24 IP range comunicate to with the 172.16.0.0/24 and possibly the 10.0.0.0/24 range.
Any advice on how to do this?
As a side note the next step after this is to install a server domain controller as all the computers are all stand alones in their own workgroups. It's a simultaneous project that will introdue a DCHP, WINS, DNS server.

Hi Omid, it sounds like you're proposing the 3550 switch but you're not decided yet. The 3550 switch is a pretty old device and needs enhanced multilayer image. It may be more prudent to use a more current switch such as small business SG300 or SG500 as the feature set is more rich and it supports around 480 LAN connections.
To answer the inquiry, the RV120W, when you create a VLAN it will automatically create an IP interface. From this you may assign subnet as you like along with 'enable or disable' for inter vlan routing. Since the RV120W has this feature, a layer 3 switch is not required unless you are looking to keep the routing load smaller by routing locally with the switch.
With Catalyst or a small business switch you would need to create a VLAN. After creating the VLAN, on a Catalyst you can simply issue "switchport trunk encapsulation dot1q" on the desired interface and all VLAN will passage without issue. For a port connecting a user "switchport mode access" "native vlan xx" This will assign the port as untag member of the desired VLAN.
If using a small business switch, it is slightly different, you still create the VLAN but the command issue is a bit different "switchport trunk allowed vlan add xx" for the link to the router, where xx = the VLAN ID to tag to the router. For access client it remains the same as Catalyst.

Does the 8540 support VLAN Trunking

I would like to VLAN trunk four VLANs(8540 bridge-groups) from an 8540 switch router to a Cat 5000. I have not seen in Cisco's documentation anything that indicates that the 8540 supports VLAN trunking.

8540 supports both ISL and 802.1q VLAN trunking
http://www.cisco.com/univercd/cc/td/doc/product/atm/c8540/12_1/pereg_1/quick_cg/layer3.htm#39775

Changing VTP Setting and VLANs on CatOS

Greetings to all...
I'm working replacing our old 5505 Core switches running CatOS with 6509s running IOS with a new VLAN structure (VLAN 100 (5505) will be 400 (6509)). The down stream switches are 2948s running CatOS.
My problem is that everytime I either change SC0 or port 2/1 to the new VLAN, I lose my connectivity. Anyone know of a hot command that will change both at the same time?
Thanks,
Tom

Do I understand that port 2/1 is the uplink port? If so, it should not be difficult. It is not necessary for the management and the trunk native VLAN to be the same, so your should be able to do them in sequence. In fact, I have just changed the management VLAN of our 20 Cat4000 CatOS switches remotely without any problem.
However, you will get cut off at the moment that you change the SC0, but this has nothing to do with the port 2/1 (assuming that the trunk is carrying both old and new management VLANs).
The way I did it was to start with the management station and all the switches on the old management VLAN. On your router (or L3 switch), create the new management VLAN, give its L3 interface a junk IP address, and enable ip proxy-arp on both old and new management VLANs. Note that the router is still routing the old management subnet, say 192.168.2.0/24, to the old management VLAN.
Now pick on an address which will be the router's IP address on the new management VLAN, say 192.168.2.254. Go into your access switch, and configure that address as the default gateway, set ip route default 192.168.2.254. Then reconfigure the SC0 interface to its new VLAN. At that point, your telnet session will get cut off because the management function of the 2948 is on the new VLAN. So, go to your router at set a host route for the access switch to the new VLAN, ip route 192.168.2.2 255.255.255.255 VLAN400. You should now be able telnet to the switch from your management station. Packets from the management station to the switch will be routed by the host route. Packets from the switch to the management station will be routed courtesy of the proxy-arp.
Repeat this for each access switch, and once they are all done you can move your management station and give the router its proper address 192.168.2.254 on the new VLAN. You can then remove the proxy ARP and/or change the native VLAN of the trunks at your leisure. If you are changing the native VLAN of the trunks, do the remote end first ;-).
Hope I have understood your question correctly, and hope this helps.
Kevin Dorrell
Luxembourg

Encrypting vlan-trunk traffic between switches

Hi,
Can anyone guide me to some papers or other resources on how to encrypt traffic between 2 switches. The switchces will be connected with fiber and use dot-1q tagging. And I wan't to encrypt all of the trunked traffic.
I was thinking of L2TP, but I haven't found any good description on how to implement this. I have two 3750 switches I thought I might use.
Thanks for any input,
Regards,
Oyvind Mathiesen
mnemonic
Norway

Hi,
Thanks for the response. I had a look at MACsec and it looks good. I would have liked to employ something P2P though, to also limit the ammount of MAC addresses broadcasted on the "wire". But let me first give you an understanding of the task:
We have two sites, connected via fibre and we want to create a VLAN trunk across and order to expand the broadcast domains to te other site.
The IDIOT carrier, has a limitation on the number of MAC addresses they allow on the fibre service, 100.
We also need to encrypt the datatraversing this connectivity.
MACsec wuold work 100% exept the source and dstination MAC addresses are still sent (at least according to https://docs.google.com/viewer?a=v&q=cache:LEf2qOmYZyYJ:www.ieee802.org/1/files/public/docs2011/bn-hutchison-macsec-sample-packets-0511.pdf+&hl=en&gl=za&pid=bl&srcid=ADGEESgmAHXpDOY0RBAE-Rv1HDpu_C_gkeSPN4cv6NGgyP0M1aXVu0UqzCfxo8t_P41ep6J37k4OLKnjfp1M9hoTDHxY22WGz2h7yB7YRLyPvRUbGS8TICzvEMlG92xqbhy6RWFugmnj&sig=AHIEtbTfu0LQIJejdYidE6yzq4lpPifxjQ
And that would cause me to eat into the 100 MAC limit.
Ridiculous I know, but we are looking for an out-of-the-norm plan...
Thanks

Cisco VLAN Trunking Protocol Vulnerability

I have got a cisco 2821 model router with a c2800nm-advipservicesk9-mz.151-2.T4 IOS, and was reported with 'Cisco VLAN Trunking Protocol Vulnerability'.
Though the device is in server mode, I do not have any domain name or trunk port configured.
Is my device really vulnerable? If yes, whats next?

Hi Alex,
for the trunk port on Catalyst on port GE 1/0/45, we need to enable the trunk and for on encapsulation dot1q because this catalyst model is ISL capable also and the SF300 working only with Dot1q Encapsultion
The configuration on catalyst should :
#config terminal
#interface Gi 1/0/45
# switchport encapsulation
#switchport trunk encapsulation dot1q
#switchport mode trunk
#switchport trunk allowed vlan 101-103
#spanning-tree portfast
For SF300 the port trunk it looks fine but for the port where the PC should receive an IP address
#interface fastethernet29
#switchport mode access
#switchport ccess vlan 103
Please let me know after this configuration
Thanks
Mehdi
Please rate or mark as answered to help other Cisco Customers

EtherChannel and Vlan trunk

Similar Messages

Maybe you are looking for