Routed port configured as native vlan

I have attached a diagram with this discussion. First please have a look at it.
The thing is; I had seen on design recently. There was more than 20 sub interfaces with IP address assigned in a router which was connected to
a switch. The port was obviously a trunk port as it was supposed to make a flow for more than 20 vlans. The confusion part for me is: there
was IP address in the actual physical interface too. I didn't understand why its there in the first place.
Would somebody share me the scoop??
Thank You in advance.

Hi Ganesh.,
To be frank I dont see any reason to have the ip address on the main interface. It is just like having native vlan concept.
Please find below testing:
Example:
I have router connecting to the Switch.
Router---F0/1--------------------F0/1---Switch
Router f0/1- ip address 50.0.0.1 /24---
f0/.1---ip address 10.0.0.2/24
f0/.2--ip address 20.0.0.2/24
f0/.3- ip address 30.0.0.3/24
Switch
F0/1--Switch port mode trunk----switch trunk encap dot1q --Switch trunk native vlan 50.>>> configuring native vlan as 50.
vlan 10--ip address 10.0.0.1/24
vlan 20---ip address 20.0.0.1/24
vlan 30 -ip address 30.0.0.1/24
vlan 50--ip address 50.0.0.2/24
Now you will have reachability to all the network. Were in Vlan 50 is your native vlan now.
HTH
Regards
Inayath.

Similar Messages

Router Configuration Using Native Vlan

Hi,
I'm studying for CCENT Certification.
I've a question about the native vlan [Example 16-3 of ICND1 100-101]:
interface gigabitethernet 0/0
ip address 10.1.10.1 255.255.255.0
interface gigabitethernet 0/0.20
encapsulation dot1q 20
ip address 10.1.20.1 255.255.255.0
Why the native vlan is 10???

(If this thread is still being subscribed to) I am creating the English VLAN page and would appreciate your input. There is already one for Русский so feel free to mix them together.

Is it better to use router port versus vlan member port?

Hi CSC,
This is more of a philosophical or "best practices" question.
I have a Cisco 3550 at the home office. Connected to the 3550 is a number of branch offices by way of T1 circuits or VDSL modems. They all come to the home office, where we have a central internet connection and server farm for our entire organization.
Except for one special case branch office, we don't forsee the need for appearances of the home office vlan at the branch office sites. In that case, we bring it into a trunk port at the home office, and at the special case branch office we have a dell 3024 switch and tag some ports as vlan 18 (the home office) or vlan 27 (the special case branch office).
We also do not forsee a need for the vlan from one branch office to appear at another branch office.
They are all (except for the special case mentioned above) currently configured something like this:
interface FastEthernet0/1
description home office
switchport access vlan 18
switchport mode access
interface FastEthernet0/2
description t1 to branch office 1
switchport access vlan 19
switchport mode access
interface Vlan18
description subnet for home office
ip address 192.168.18.1 255.255.255.0
interface Vlan19
description subnet for branch office 1
ip address 192.168.19.1 255.255.255.0
Is it better, in terms of reduced network complexity or performance on my 3550, to do something like this instead?
That is, to make the interfaces router ports as opposed to vlan member ports?
Of course, if we ever DID need to have appearances of the home office vlan at branch office sites, or appearances of one branch office's vlan at another branch office, we would lose that flexibility.
interface FastEthernet0/1
description home office
switchport access vlan 18
switchport mode access
interface FastEthernet0/2
description t1 to branch office 1
ip address 192.168.19.1 255.255.255.0
interface Vlan18
description subnet for home office
ip address 192.168.18.1 255.255.255.0
no vlan 19

Hello,
In my opinion there is no 100% right answer here. I think it depends also about network forecast. I'll try to add here some thoughts:
- if you use trunk interfaces from home to branch and SVI for L3 connection, in terms of scalability is much easier to expand (you have now only one p2p L3 link, but in future you'll need another one; if the port is a trunk one, you just configure another SVI interface, allow vlan on trunk and your good to go)
- trunk interfaces involve more configuration (L2 interface and SVI L3 interface)
- if you add in the home office another switch to existing one, and for some reason you have misconfiguration in STP / VTP, then you can run into problems like loops, vlan database modification (e.g. VTP server mode and the new added switch has a higher revision number than existing one)
- L3 physical interfaces are easier to configure and less complex, but in case you want to scale to additional p2p link will be harder
- L3 configuration is easier to troubleshoot as you avoid the L2 complexity
- in terms of packet exchange a L3 interface will exchange less packets than a L2 trunk with SVI (I'm talking here about control traffic, not user traffic)
- with L2 trunk you can have other problems like if somebody is "smart enough" to add a new switch into the existing switch (if you have a switch there) at the branch location; imagine that the new switch due to misconfigurated STP became root bridge; you have a large STP domain.
As I said, there is no good or bad approach. You have to guide yourself about forecasts in your network. For example if you know that a branch location will not be extended in the next 2 years, then go ahead with L3 interface and that's it. On the other hands if you have doubts you can add for another location L2 trunk with SVI. You can mix this two solution to obtain the best results for your network characteristics.
Cheers,
Calin

The difference between IEEE802.1Q Native VLAN sub-interface and Physical interface?

Hello
I think the following topologies are supported for Cisco Routers
And the Physical interface also can be using as Native VLAN interface right?
Topology 1.
R1 Gi0.1 ------ IEEE802.1Q Tunneling L2SW ------ Gi0 R2
R1 - configuration
interface GigabitEthernet0.1
encapsulation dot1Q 1 native
ip address 10.0.0.1 255.255.255.0
Topology 2.
R1 Gi0 ------ IEEE802.1Q Tunneling L2SW ------ Gi0 R2
interface GigabitEthernet0
ip address 10.0.0.1 255.255.255.0
And is it ok to use the physical interface and sub-interface with dynamic routing such as EIGRP or OSPF etc?
R1 Gi 0 ---- Point to Multipoint EIGRP or OSPF ---- Gi0 R2 / R3
Gi 0.20--- Point to Point EIGRP or OSPF --- Gi0.10 R4 (same VLAN-ID)
R1 - configuration
interface GigabitEthernet0
ip address 10.0.0.1 255.255.255.0
interface GigabitEthernet8.20
encapsulation dot1Q 20
ip address 20.0.0.1 255.255.255.0
Any information is very appreciated. but if there is any CCO document please let me know.
Thank you very much and regards,
Masanobu Hiyoshi

Hello,
The diagram is helpful.
If I am getting you correctly, you have three routers interconnected by a switch, and you want them to operate in a hub-and-spoke fashion even though the switch is capable of allowing direct communication between any of these routers.
Your first scenario is concerned with all three routers being in the same VLAN, and by using neighbor commands, you force these routers to establish targeted EIGRP adjacencies R1-R2 and R1-R3, with R1 being the hub.
Your second scenario is concerned with creating one VLAN per spoke, having subinterfaces for each spoke VLAN created on R1 as the router, and putting each spoke just in its own VLAN.
Your scenarios are not really concerned with the concept of native VLAN or the way it is configured, to be honest. Whether you use a native VLAN in either of your scenarios, or whether you configure the native VLAN on a subinterface or on the physical interface makes no difference. There is simply no difference to using or not using a native VLAN in any of your scenarios, and there is no difference to the native VLAN configuration being placed on a physical interface or a subinterface. It's as plain as that. Both your scenarios will work.
My personal opinion, though, is that forcing routers on a broadcast multi-access segment such as Ethernet to operate in a hub-and-spoke fashion is somewhat artificial. Why would you want to do this? Both scenarios have drawbacks: in the first scenario, you need to add a neighbor statement for each spoke to the hub, limiting the scalability. In the second scenario, you waste VLANs and IP subnets if there are many spokes. The primary question is, though: why would you want an Ethernet segment to operate as a hub-and-spoke network? Sure, these things are done but they are motivated by specific needs so I would like to know if you have any.
Even if you needed your network to operate in a hub-and-spoke mode, there are more efficient means of achieving that: Cisco switches support so-called protected ports that are prevented from talking to each other. By configuring the switch ports to spokes as protected, you will prevent the spokes from seeing each other. You would not need, then, to configure static neighbors in EIGRP, or to waste VLANs for individual spokes. What you would need to do would be deactivating the split horizon on R1's interface, and using the ip next-hop-self eigrp command on R1 to tweak the next hop information to point to R1 so that the spokes do not attempt to route packets to each other directly but rather route them over R1.
I do not believe I have seen any special CCO documents regarding the use of physical interfaces or subinterfaces for native VLAN or for your scenarios.
Best regards,
Peter

Native vlan prblm

why the native vlan should be same on both side of the trunk???

A trunk link can carry multiple vlans. So lets say on each switch you have vlans 5,6 & 7. If sw1 sends a frame for vlan 6 to sw2 how does sw2 know which vlan that packet is in ? It knows because sw1 adds a vlan tag to the frame header and sw2 reads this vlan tag and sees that the packet is in vlan 6.
The native vlan is the vlan that is not tagged. So lets say in the above example vlan 5 is the native vlan. When sw1 sends a packet for vlan 5 there is no vlan tag added to the frame. So when sw2 receives the frame there is no vlan tag to read. So it must agree on the native vlan otherwise it wouldn't know which vlan the frame is meant to be in. If sw2 had the native vlan set to 7 for example then it would think the frame it just received was in vlan 7. This would be bad because now you have just "joined" two vlans together.
If you do configure different native vlans on either end of the trunk and you are running CDP then you would get CDP Native vlan mismatch errors in your log.
Note that the native vlan must only agree per trunk link so you could if you wanted have different native vlans per trunk link as long as each trunk link agreed on either end but in practice you generally use the same native vlan across all trunk links.
Finally, by default the native vlan is vlan 1 on all Cisco switches. It is recommended to change this to another vlan. The native vlan should have no ports assigned to it and it does not need an SVI because there is never a need to route native vlan.
Jon

Trunk Native VLAN

Don't configure a native VLAN unless you have to. You're increasing you attack surface with the potential of VLAN hopping (Dot1q hopping some call it).
http://packetlife.net/blog/2010/feb/22/experimenting-vlan-hopping/
https://en.wikipedia.org/wiki/VLAN_hopping
Edit:Spelling

Hello,
I'm trying to understand better native vlan trunking. Maybe someone can please help explain? I understand trunking and vlans and I know that on the trunked port I can allow whatever vlans I want to and I know that the native vlan carries non tagged frames.
So for example, if I have say 3 vlans and a native vlan
vlan 10, vlan 20, vlan 30 and I have the command on the trunked port "switchport trunk allowed vlan 10,20,30"
so all those vlans will pass on the trunk correct? And native vlan 1 will pass all the telnet, cdp, traffic etc, correct?
Also how do I change the native vlan?
Thanks.
This topic first appeared in the Spiceworks Community

Voice Vlan and Native Vlan

Dear all,
I am now reading some information regarding the setup of Voip Phone. It mentioned that the Phone is actually a 3-ports switch:
Port 1: Connect to upstream switch
Port 2: Transfer Phone traffic
Port 3: Connect to a PC
Actually, what should i configure on the upstream switch port? Should it be a trunk port containing both the voice traffic vlan and pc data vlan?
Or something else?
Also, there is a term called 'Voice Vlan', is there any different between 'Voice vlan' and ordinary Vlan ?
Is there any special usage of 'Native' Vlan in implementing Voip?
Thanks.
Br,
aslnet

Thanks.
How about if the PC data should be tagged as another vlan (e.g., Vlan 10)? Then I should change the native vlan to vlan 10?
But from my understanding, Native Vlan should be the same in the whole network, then I need to change the whole network native vlan? If there are different vlans should be assigned to different PCs that behind different VoIP-phone, then how to do it?
From my guessing, is it i can assign individual native vlan (vlan10) on that port (connect to voip-phone), and then keep the switch's uplink port as original native vlan (vlan1).
Therefore, PC data traffic would be untagged when entering from voip to the switch, and then tagged as vlan10 when leaving the switch to other uplink switch, right?
Thanks.

Native Vlan Missmatch message

Hi All,
I am connecting 2950 switch port to 6505 switch port, both ports are in trunking mode and allowing only one vlan on the both.
On 6505 switch I set as follows:-
enable> set trunk 2/23 700
enable> set trunk 2/23 nonegotiate dot1q.
On 2950 I set it as follows:
(conf)int f0/23
switchport mode trunk
switchport trunk Native vlan 700
switchport nonegotiate.
when I issue the show logging, I noticed the (Native Vlan missmatch).
when I chang the switch port config on 2950 to the following it doesn't work:-
int f0/23
switchport mode trunk
switchport trunk allowed vlan 700
switchport nonegotiate
when I did the above, the traffic is discarded and subnets 0n the Core 6505 couldn't access subnets on their remote locations.
Could any body tell me the reason of that, and why I am getting Native Message? as well as why it works only if I set 2950 swith port to (trunk Native vlan ,,,, or ,,,, access mode).
thanks...

Hi Friend,
On cat6k though you have configured it as trunk and allowed only vlan 700 but still the native vlan is 1 by default.
And you have configured on 2950 native vlan as 700.
So what I will suggest you is to change the native vlan on cat6k switch also to vlan 700
How you can do this on catos is
set vlan 700 2/23
Now what this will do is on cat6k it will make vlan 700 as native on trunk and you can keep the conig on 2950 same
(conf)int f0/23
switchport mode trunk
switchport trunk Native vlan 700
switchport nonegotiate.
or if you just waan a get rid of the error message and keep the config as it was earlier you can also disable CDP on the interface level.
HTH, if yes please rate the post.
Ankur

Q-in-Q w/o Native VLAN tag question

Let's assume that we have Q-in-Q setup between 2 service provider switches. To run Q-in-Q we want to terminate a trunk into each tunnel port and enable native VLAN tagging to ensure that all customer VLAN's are tagged. In some cases we may have a customer that wants to connect their own equipment into the tunnel port on our switch, so it wouldn't actually be a trunk - it would be an access port. If this occurs then there is no inner VLAN tag, only an outer VLAN tag. Will tunnelling still function properly in this scenario?

actually this is not true... sorry Kishore
Tunneling still works and traffic within the SP core will be singled tagged (with the SP tag only).
However when you do this you need to be extremely careful specially if you use dot1q trunks in the core with native vlan within the customer range. You might end up in unexpected result in this case.
See an exmple of a possible issue you might see in this case:
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_58_se/configuration/guide/swtunnel.html#wp1008635
The solution would be to tag native vlan in the SP core or use ISL trunks or use native vlans outside customer range or (logically) use trunk ports on CE device (still paying attention to native vlan though).
Riccardo

About the Native Vlan and Management Vlan.

I wanted to know that Management vlan and Native vlan can be different vlan id or both should be same vlan id. Why should not be native vlan 1.

The use of a native VLAN is generally frowned upon now as there are some well known security exploits that leverage this untagged VLAN. Cisco often recommends setting the Native VLAN to an unused VLAN in your infrastructure in order to render it useless for attacks.
It is also recommended that you create a separate VLAN for your Management traffic and that this VLAN be tagged (therefore not a Native VLAN).
Native Vlan is the vlan which will be sent untagged even in Trunk links. Consider a Trunk link configured between two switches SWA and SWB, if a system in vlan1 of SWA is sending a frame via SWB, then this frame will be received as untagged by SWB, then switch B decides that the untagged frame is from native vlan 1 and handles accordingly. By default native vlan is 1, this can also be changed as per requirement.
Example: In the below figure if a IP phone and system are connected toa switch port as below, the the Phones will send its frames tagged with vlan 10 where as the frames sent by system will be untagged. So here the the corresponding switch port should be configured as native vlan 20. So that it can recognise and handle the frames from system and IP phone properly.
a
Management vlan is different, it means that this vlan will be used for management purposes like Logging into the switch for management, Monitoring the switch,collecting Syslog ans SNMP traps, etc will be done by management vlan IP. This also by default vlan 1 in cisco. So as Antony said the it is always a Best practice and security measure to not use the default vlan and use custom vlans.
Hope this helps !

Option "Native VLAN ID" doesn't show up

Hi all:
I'm configuring several AP in a WLC 5508. All of them are in FlexConnect with VLAN Mapping and the most are 1131 and I can configure Native VLAN and VLAN mapping option. However, I just added a 2702 AP to the WLC and I found out the "Native VLAN ID" option under FlexConnect tab is missing (attach screenshoot). Is it because of the model of the AP or config issue?.
As you can see in the screenshoot, AP is in a FlexConnect Group. In it I can't configure Native VLAN for the APs.
Thanks all
Francisco

This issue is bug# CSCus64073 - 1700/2700 APs native vlan
field missing in Flex tab
• The workaround is to “untick vlan support (in the Advanced tab) and tick it back,
then field will show again”
• If this is unsuccessful, configure the native vlan through the cli with the
following commands:
- config ap disable ap <AP_Name>
- config ap flexconnect vlan native 8 <AP_Name>
- config ap enable ap <AP_Name>
- show ap config general <AP_Name> should show correct native vlan

Does it need add the native vlan to allowed vlan list ?

If I confiured the port like this "
switchport trunk native vlan 10
switchport trunk allowed vlan 11,12"
does the vlan 10 allowed passing ? or it still need add vlan 10 to the allowed vlan list like "
switchport trunk native vlan 10
switchport trunk allowed vlan 10,11,12"
Thanks

Yes you can remove the native VLAN from the list, and it does prevent the native VLAN from traversing the trunk. That is, if you look at the Spanning Tree for the native VLAN, the trunk will be absent from the list of ports on the VLAN.
The question of untagged frames is a different one. There are some control protocols, particularly link-local ones, that are sent untagged, and these will traverse the trunk regardless. However, they are not considered as part of the native VLAN Spanning Tree as such.
But beware: there is a bug in earlier IOS and in all CatOS switches! If you use a non-1 VLAN as your trunk native VLAN, and you disallow it from the trunks, and there are no other ports carrying that native VLAN, then the Spanning Tree for that VLAN shut down. That is fair enough. But the bug is that the Spanning Tree for VLAN 1 also breaks down, sending your network into meltdown.
Kevin Dorrell
Luxembourg

SVI vs Routed port

Hi all
If i have Layer3 devices connected between them. I want to routing and speaking with ip address so i have 2 choices between i create svi and setup configure as routed port (no switchport). How could i choose between them to the most efficiency
thanks

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
Yes, often all you need to do a Catalyst switch that supports routed ports is use the "no switchport" command. (BTW: I recall default differs across different Catalyst switches. For example, 3750s default to switchports, and I believes 6500s default to routed ports.)
Also yes, you would than assign a routed port an IP address.
How the switch recognizes the status of the port is how the port is configured, either explicitly or by default.
What's the differerence? As noted in other posts, routed port configuration is a bit different and it automatically suppresses some L2 traffic.

How one Switch identify the Native vlan mismatch

Dear All,
I am using two cisco L2 switches. Both are connected by a trunk link. Unfortunately I configured different native vlan between two switches. Suddenly I got an error that native vlan mismatch. When I changed the configuration Now it's working fine. My question is that how one switch identify that native vlan mismatch(either by Bpdu, cdp or packet). Please mention which of the following used by switch to identify native Vlan mismatch.
Regards,
Sanjib

Sanjib, Karsten,
It's CDP.
Yes, and STP as well if you run a trunk between the two switches. PVST+ and RPVST+ BPDUs have a TLV in their trailer that carries the VLAN number for which the BPDU was originated. If the BPDU is received in a different VLAN (caused by a native VLAN mismatch), the receiving switch will be able to detect it.
Wireshark 1.12.x will be capable of displaying this TLV field in captured PVST+ and RPVST+ BPDUs. Until 1.12.x is released, you may want to try daily builds from:
http://www.wireshark.org/download/automated/
They already incorporate the enhancement.
Best regards,
Peter

Native VLAN on ASR9K with XR 4.2.3

Is there a way to configure a native VLAN on an ASR with XR 4.2.3?
We found documentation indicating it can be accomplished but receive a commit failure. The console output is below.
RP/0/RSP0/CPU0:3901-ASR (config)# int Te0/0/0/10.144
RP/0/RSP0/CPU0:3901-ASR(config-subif)#encapsulation untagged
RP/0/RSP0/CPU0:3901-ASR(config-subif)#commit
Thu Jan 30 05:57:00.129 CST
% Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed' from this session to view the errors
RP/0/RSP0/CPU0:3901-ASR(config-subif)#
RP/0/RSP0/CPU0:3901-ASR(config-subif)#show configuration failed
Thu Jan 30 05:58:02.583 CST
!! SEMANTIC ERRORS: This configuration was rejected by
!! the system due to semantic errors. The individual
!! errors with each failed configuration command can be
!! found below.
interface TenGigE0/0/0/11.144 l2transport
encapsulation untagged
!!% 'Ethernet Infra' detected the 'warning' condition 'Cannot pop more tags than are matched on ingress'
end
RP/0/RSP0/CPU0:3901-ASR (config)# int Te0/0/0/10.144
RP/0/RSP0/CPU0:3901-ASR(config-subif)#encapsulation dot1q 144 , untagged
RP/0/RSP0/CPU0:3901-ASR(config-subif)#commit
Thu Jan 30 06:02:17.728 CST
% Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed' from this session to view the errors
RP/0/RSP0/CPU0:3901-ASR(config-subif)#show configuration failed
Thu Jan 30 06:02:22.489 CST
!! SEMANTIC ERRORS: This configuration was rejected by
!! the system due to semantic errors. The individual
!! errors with each failed configuration command can be
!! found below.
interface TenGigE0/0/0/11.144 l2transport
encapsulation dot1q 144 , untagged
!!% 'Ethernet Infra' detected the 'warning' condition 'Cannot pop more tags than are matched on ingress'
end
Please let me know if you need our full configuration or any other information.
Thanks!

Hello,
Looks like you still have 'rewrite ingress tag pop' configuration under that interface. Remove that config also in your changes.
Example of what i did in my lab:
RP/0/RSP0/CPU0:ASR9010-B(config)#interface Bundle-Ether11.285 l2transport
RP/0/RSP0/CPU0:ASR9010-B(config-subif)#encapsulation untagged
RP/0/RSP0/CPU0:ASR9010-B(config-subif)#commit
Thu Jan 30 16:33:22.544 EST
% Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed' from this session to view the errors
RP/0/RSP0/CPU0:ASR9010-B(config-subif)#show configuration failed
Thu Jan 30 16:33:26.533 EST
!! SEMANTIC ERRORS: This configuration was rejected by
!! the system due to semantic errors. The individual
!! errors with each failed configuration command can be
!! found below.
interface Bundle-Ether11.285 l2transport
encapsulation untagged
!!% 'Ethernet Infra' detected the 'warning' condition 'Cannot pop more tags than are matched on ingress'
end
RP/0/RSP0/CPU0:ASR9010-B(config-subif)#
Uncommitted changes found, commit them before exiting(yes/no/cancel)? [cancel]:no
RP/0/RSP0/CPU0:ASR9010-B#show run int bundle-ether 11.285
Thu Jan 30 16:33:38.296 EST
interface Bundle-Ether11.285 l2transport
description TEST
encapsulation dot1q 285
rewrite ingress tag pop 1 symmetric
RP/0/RSP0/CPU0:ASR9010-B#conf
Thu Jan 30 16:33:47.077 EST
RP/0/RSP0/CPU0:ASR9010-B(config)#interface bundle-ether 11.285 l2transport
RP/0/RSP0/CPU0:ASR9010-B(config-subif)#no rewrite ingress tag pop 1 symmetric
RP/0/RSP0/CPU0:ASR9010-B(config-subif)#encapsulation untagged
RP/0/RSP0/CPU0:ASR9010-B(config-subif)#commit
Thu Jan 30 16:34:23.228 EST
RP/0/RSP0/CPU0:ASR9010-B(config-subif)#
thanks,
rivalino

Routed port configured as native vlan

Similar Messages

Maybe you are looking for