TRUNK PORTS (HELP URGENT)

Dear all
Last night I configured the trunk ports between all my switches, Its a redundant circuit. I did the last one that plugs back into the core switch and it took all of my building out, I could not get to any other switch, For some reason spanning tree blocked the trunk ports that I set up on the last switch !!!!
When setting up trunks between switches I presume you have to set 2 trunks per switch ? i.e 1 trunk to previous switch and another to the next switch !!!!
I have never been so scared !!!!

here are the configs,
here is the backbone
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
hostname TK-BACKBONE-3550
enable secret xxxx
enable password xxx
ip subnet-zero
spanning-tree mode pvst
spanning-tree extend system-id
interface GigabitEthernet0/1
switchport mode dynamic desirable
interface GigabitEthernet0/2
switchport mode dynamic desirable
interface GigabitEthernet0/3
switchport mode dynamic desirable
interface GigabitEthernet0/4
switchport mode dynamic desirable
interface GigabitEthernet0/5
switchport mode dynamic desirable
interface GigabitEthernet0/6
switchport mode dynamic desirable
interface GigabitEthernet0/7
switchport trunk encapsulation dot1q
switchport mode dynamic desirable
interface GigabitEthernet0/8
switchport mode dynamic desirable
interface GigabitEthernet0/9
switchport mode dynamic desirable
interface GigabitEthernet0/10
switchport mode dynamic desirable
interface GigabitEthernet0/11
switchport mode dynamic desirable
interface GigabitEthernet0/12
switchport mode dynamic desirable
interface Vlan1
ip address 10.1.2.30 255.0.0.0
interface Vlan200
no ip address
ip default-gateway 10.1.1.1
ip classless
ip http server
snmp-server community public RO
line con 0
line vty 0 4
password xxx
login
line vty 5 15
password xxx
login
end
here is the last switch in the circuit
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
hostname BCR-2950-2
enable secret xxxx
enable password xxx
ip subnet-zero
no ip finger
interface FastEthernet0/1
interface FastEthernet0/2
interface FastEthernet0/3
interface FastEthernet0/4
interface FastEthernet0/5
interface FastEthernet0/6
interface FastEthernet0/7
interface FastEthernet0/8
interface FastEthernet0/9
interface FastEthernet0/10
interface FastEthernet0/11
interface FastEthernet0/12
interface FastEthernet0/13
interface FastEthernet0/14
interface FastEthernet0/15
interface FastEthernet0/16
interface FastEthernet0/17
interface FastEthernet0/18
interface FastEthernet0/19
spanning-tree portfast
interface FastEthernet0/20
interface FastEthernet0/21
interface FastEthernet0/22
interface FastEthernet0/23
interface FastEthernet0/24
interface GigabitEthernet0/1
interface GigabitEthernet0/2
interface Vlan1
ip address 10.1.2.24 255.0.0.0
no ip route-cache
ip default-gateway 10.1.1.1
no ip http server
snmp-server engineID local xxxx
snmp-server community private RW
snmp-server community public RO
line con 0
exec-timeout 0 0
transport input none
line vty 0 4
password parker2710
login
line vty 5 15
password parker2710
login
end
hope this helps
Carl

Similar Messages

Port protected on trunk ports

I have a router to a 3550 switch feeding in a star toplogy one 2950 off each port. I have port protprected on the ports of each of the 2950s. The question is can I do port protected on all my trunk ports except the uplink port on the 3550? I am wanting to stop any user on the network from seeing another. My other option is to do a vlan per switch but would perfer not to bring down the network as it is already live and in heavy usage.
Thank you for your help in advance.

Yes, you can enable protected mode on trunk ports
Configuring Protected Ports
Some applications require that no traffic be forwarded between ports on the same switch so that one neighbor does not see the traffic generated by another neighbor. In such an environment, the use of protected ports ensures that there is no exchange of unicast, broadcast, or multicast traffic between these ports on the switch.
Protected ports have these features:
•A protected port does not forward any traffic (unicast, multicast, or broadcast) to any other port that is also a protected port. Data traffic cannot be forwarded between protected ports at Layer 2; only control traffic, such as PIM packets, is forwarded because these packets are processed by the CPU and forwarded in software. All data traffic passing between protected ports must be forwarded through a Layer 3 device.
•Forwarding behavior between a protected port and a nonprotected port proceeds as usual.
•Protected ports are supported on 802.1Q trunks.
link:
http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_20_ea2/configuration/guide/swtrafc.html#wp1158863
HTH

Can't apply ALC to trunk port

Hi,
I'm trying to configure a Cisco Catalyst 6500 switch to not allow traffic from our traffic generators to go over the trunk link to the rest of the network. Currently I have multiple VLANs that correspond to different lab setups, each having traffic generators on them. The trunk port is used to connect VMs to each of the setups (on different VLANs) but I'm seeing that the traffic generators sometimes flood the trunk link and cause management be unusable.
I want to configure a port-based ACL to block traffic from the traffic generators from going over the trunk port but I don't see the "ip access-group" command available on this interface.
Here's the config for my trunk interface:
CATALYST2#show run int gi1/1
Building configuration...
Current configuration : 124 bytes
interface GigabitEthernet1/1
switchport
switchport trunk encapsulation dot1q
switchport mode trunk
no ip address
end
When I go into config mode and try to tie an ACL to the interface, the command isn't available:
CATALYST2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
CATALYST2(config)#int gi1/1
CATALYST2(config-if)#ip access-group ?
% Unrecognized command
Any idea why? I need a way to block this traffic (either via IP or MAC ACLs). My understanding is that trunk ports are able to have port-based ACLs applied to them that will act on all VLANs but I can't seem to do it.
Thanks for your help in advance!

After some more research, I noticed that to configure a PACL on a trunk port, you must first configure port prefer mode. The command to put a trunk port in port prefer mode is "access-group mode prefer port" on the interface. Unfortunately that command isn't available in my CLI either... Still stuck.

Prime Infrastructure 2.2 - Wired Clients and Trunk Ports

We have our VMWare ESX hosts connected to our server access switches via trunk ports. Prime doesn't seem to track clients on trunk ports (to avoid showing clients on uplink ports between switches, I'm sure). Since these are not switch-to-switch connections, is there a way to enable Prime to track wired clients on these specific trunk ports so we have MAC/IP client info in Prime for our virtual environment?

Hi,
PI discards all the MAC table entries that are on trunk ports for a switch. This enhancement was added from PI 2.1 & later.
- Ashok
Please rate the useful post or mark as correct answer as it will help others looking for similar information

Multiple trunk ports on switch

How many ports on a 2950 can be configured as dot1q trunks? I need to place an intermediary switch in my network to pass trunk data beween 10 other Cisco switches and therefore need to configure 10 ports as trunk ports. Is this possible or would a different switch work better for this purpose?

Hi Scott,
There's no limitation on the number of trunk ports you can configure. However, there is a switch-wide limitation of 64 instances of Spanning Tree. In other words, you can only have 64 active VLANs on the switch.
See:
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/12119ea1/2950scg/swstp.htm#1150172
HTH,
Bobby
*Please rate helpful posts.

"Multicast" Across a Trunk port

I have a pair of Nokia firewalls connected to two 4006 switches running 7.6.3 code. The firewalls have a multicast virutal address that doesn't seem to pass across an etherchannel trunk between the switches even though the vlan they are in is being forwarded across the trunk. Do you know if a dot1q trunk would block a multicast packet from a Nokia firewall from passing ?

Hi :
Basically , by default multicast is only forwarded to the router ports or where an IGMP request is received. Now you have a Cat4000 and it has CGMP turned on by default . As long as it does not detect any router ports , multicast should basically be flooded in the entire vlan. In your case , multicast not being flooded makes me think the switch is detecting a multicast router at some other port other then the trunk port and certainly not receiving a CGMP join from that router for this particular group.
Here is a hack that you can use.
set multicast router
where mod/port is a trunk port .
Second thing is youc an disable CGMP only if you do not have other multicast traffic in your network and only traffic is this low volume keepalive traffic between the firewalls so that this traffic will be flooded in the entire vlan on both switches.
set cgmp disable
Hope this helps.
Salman Z.

Authenticating Trunk Ports - VLAN list

I have a requirement to authenticate trunk ports to wireless access-points on our Cisco switch, By default all ports are access ports and we run MAB authentication. I have managed to change the port to a trunk using Cisco-av-pair attribute in ACS (cisco-av-pair = deivce-traffic-class=switch)
My problem now is that I need to add a VLAN allowed list on the port once it has changed to a trunk port (switchport trunk allowed vlan x,y,z). ideally we would not want to statically assign the VLAN's on each port as an AP could be on any port and may wish to authenticate other trunk ports using different VLAN's in the future. Below is the configuration used on the ports.
cisp enable
interface FastEthernet0/2
description *** Client Device ***
switchport access vlan 2
switchport mode access
no logging event link-status
authentication event fail action next-method
authentication event server dead action reinitialize vlan 3
authentication event server alive action reinitialize
authentication order mab dot1x webauth
authentication priority mab dot1x webauth
authentication port-control auto
authentication fallback GUEST_FALLBACK
mab eap
dot1x pae authenticator
dot1x timeout tx-period 3
dot1x timeout supp-timeout 10
dot1x max-reauth-req 1
dot1x timeout auth-period 600
no cdp enable
spanning-tree portfast
Any help will be greatly appreciated.
Thanks
John

Hello
I would suggest the following:
>> Arrange for some physical enclosure (locked) or any other physical security control to ensure authorized access to the device. Any technical work-around or band-aid solution should only be temporary. What is someone just switches of your switches? DOS attack!! This could also be done by mistake, resulting in an unstructred threat.
>> Enable monitoring for these switches (ICMP,SNMP) so that you are alerted when they are unplugged.
>> Change the NATIVE VLAN from the default (VLAN 1)
>> Disable Trunk negotiation (ON mode)
Regards
Farrukh

Configure trunk port between 2 SG500 switches

Hi all,
I'm trying to do what seems to be a simple task but cannot get it to work. I've very familiar with the Cisco commands on 2900 all the way up to 6500 series switches. The SG500 has me stumped. I have 3 switches, sw1, sw2, sw3. sw1 and sw2 are stacked. sw3 is standalone and in a different part of the building, maybe 25ft away. All I want to do is set up a trunk port between the stack and the standalone. In going by past experience, I would set the port as :
- switchport mode trunk
- switchport trunk allowed vlan 2,3,4
The SG makes me specify tagged or untagged - which is fine. So any vlan I want to move across the trunk i tag, obviously. I do everything as I've done for years and it doesn't work. VLAN1 is untagged, all VLANs I want to flow are allowed and tagged.
I'm quickly realizing I should have bucked up and just bought what I'm used to but I didn't have a choice in the matter.
Any help would be great!
Shawn

Hi Shawn, something is the matter if the switch is asking you for tagged or untagged. The only reason it should be requesting a tag or untag statement is from a general port mode.
The command syntax for the function is exactly the same as an IOS switch
switchport mode trunk
switchport trunk allowed vlan add 2,3,4
Just like a Catalyst, if you use switchport trunk allowed vlan x,x,x it won't take the command as insufficient privilege or whatever the error it gives, suffice it say it doesn't really do anything without the add(or remove).
-Tom
Please mark answered for helpful posts

Dedicated VLAN ID's on trunk ports

I was reading the SAFE:Security Blueprint for Enterprise Networks. This document addresses in its "Switches are targets" section on Page 6 that "Always use a dedicated VLAN ID for all trunk ports"...
I am trying to understand this concept fully.
If I consider my trunk ports, most are physical fiber "links" that interconnect the switches. Some trunk links connect Distribution L to Access L; some Distribution to Core.
Where do I put the VLAN ID on thes?? Should I translate this to mean that on Gig0/0 on SW.1 i place this interface in VLAN 23 and on the switch on the other end of the link I also place the Gig0/0 in VLAN 23 as well??
Also I am not sure why this helps secure the switch. Can someone pls assist. I am grateful.

Hi,
This is not actually the VLAN pruning.This is just specifically allowing some vlans on the trunk ports and removing other unwanted vlans.
Prunning works in a diff way and it will save the bandwidth on the trunk links by prunning the unwanted broadcast on the trunks for a particular vlan if no host is active on that vlan on a particular switch. I.e If you dont have any active host on a vlan on a particular switch and if there is a broadcast on that vlan which will come over the trunk so if no host is active that broadcast is prunned on the trunk where no host is active on the switch.
HTH,
-amit singh

Enable BPDUGuard on Spanning-tree Portfast Trunk Port: Yes or No?

Hello to all the Cisco Experts,
I have been searching around to get a confirmed answer as per my subject, but yet unable to come into any conclusion that could help me.
This is all started when I configured the switchport configuration for my ESXi Server which is a dot1q trunk port. The reference will be as below URL:
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1006628
The configuration of the switchport will be as below:
interface GigabitEthernet1/0/1
description ESXi
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 11,15
switchport mode trunk
spanning-tree portfast trunk
end
The catch is, I had the bpduguard enabled on the global level in my switch = spanning-tree portfast bpduguard default.
This will enable the bpduguard on the trunk port above due to the switchport is in portfast (the command: spanning-tree portfast trunk).
Some of the guys in this forum mentioned that it is not recommended to have bpduguard on trunk port and some mentioned it is okay to have this.
So, what do you all think on this? Any real life experience dealing with this kind of situtation that can be shared to us over here?
Thank you in advance.

Hi Leo,
First of all, I would never, ever, consider any comment of yours as being offensive so don't worry, none taken. :)
Enabling portfast on a trunk is so "yesterday", in my opinion. If a trunk port(s) or an etherchannel is configured correctly, there's a significant chance portfast is irrelevant. The speed to get the ports to go from down to passing traffic is really boils down to one or two seconds.
Perhaps this is at the core of our different views. To my best knowledge, without the PortFast, a trunk - be it a single port or an EtherChannel - will become forwarding 30 seconds after entering the up/up state, not less. This is valid for STP, RSTP, and MSTP. In addition, if a new VLAN is created or added to the list of enabled VLANs on the trunk, it may take additional 30 seconds for that VLAN to become operational (forwarding) on that trunk. There is nothing besides PortFast and Proposal/Agreement that can cut down this time: the STP must go over the Listening-Learning-Forwarding sequence, and RSTP/MSTP must go through the Discarding-Learning-Forwarding sequence. The "one or two seconds" you have mentioned is perhaps the combined delay incurred by autonegotiation, LACP/PAgP, and DTP, but STP will take its own time and will not be deterred by any of these mechanisms.
I see no benefit but mischief when you enable BPDU Guard on an inter-switch link.
Absolutely agree. That is why it doesn't make any sense to put a BPDU Guard on an inter-switch link, and I have never suggested doing that. The original post, however, deals with enabling PortFast on a trunk link that does not go to another switch but rather connects to an ESXi server on which, obviously, different virtual machines are bridged onto different VLANs.
So what is the reaction of the port if you do happen to enable portfast and BPDU guard on an inter-switch link? Wouldn't the two be a "Jekyll & Hyde", wouldn't it?
It would be just the same as enabling PortFast and BPDU Guard on an access port that happens to be connected to another switch. Upon link-up, the port would become forwarding immediately, and after receiving a BPDU, it would be shot down to err-disabled. The fact the port is an access port or a trunk port makes no difference here. Just as before, I stress that this kind of configuration simply isn't meant to be used on inter-switch links. However, on trunks connected directly to routers, servers, autonomous APs supporting several SSIDs mapped to different VLANs, even to IP phones (remember the mini-trunk config used on old switches on which the switchport voice vlan command only instructed CDP to advertise the voice VLAN but did not cause the port to accept tagged frames in the voice VLAN so it had to be configured as a trunk?) - in all these situations, the PortFast can be beneficial. The BPDU Guard is a natural protective companion to the PortFast - wherever PortFast is eligible to be configured, the BPDU Guard is a natural additional protection to be activated as well.
But given the complexity of interconnection of different switches to various stuff going around, we're happy with leaving portfast on a trunk port disabled.
No argument here - but again, this is about trunks between switches on which I would never suggest using the PortFast or the BPDU Guard. The original post is talking about trunks to end hosts (i.e. edge trunk ports if we extend the terminology a little).
Best regards,
Peter

Username and password- Need help urgently!

Hi
1) First of all, i have received an email stating that my account under Removed personal information to comply withCommunity GuidelinesandTerms and Conditions of Use.
is being banned as there is multiple obsence post. I need to clarify that i have never used my account to post in BBM forum before. Even if i did, is when i need help urgently for my BBM application. Currently i am holding 4 bbms now. Have never came across this issue. Pls check and advise
2) I urgently need to setup my email accounts. But this time round, when i logged in, they required for my email id and password. And yes my email id is Removed personal information to comply withCommunity GuidelinesandTerms and Conditions of Use. all the while for the past 4 years. I am unable to log in. I tried all kinds of password but unable to log into my mobile settings
Verfiy Blackberry ID
This application requires u to verify ur blackberry id to continue.
blackberry ID username:
Removed personal information to comply withCommunity GuidelinesandTerms and Conditions of Use.
password:
I went to the forget password option, unfortunately as i have never retrieved my password before, i am unable to remember the security question as i did not use it for the past 4 years.
Pls advise.
Urgent and thanks

Hi,
I have been trying this technique for the past 4 days. It doesnt work no matter how i change the password at the link that u gave me. Even though it's being reset accordingly, i am still unable to log in the password at my mobile. i am 100% sure that i have entered the correct password at my mobile. ( verify blackberry id) . I want to setup new email accounts under "setup" . Upon me clicking " email accounts", it prompt for the one key password. I have never faced this issue before. I am very very sure that my password is correct. Pls advise as i need to add email accounts. Other programs are working fine without any password required being prompt. ie. blackberry world
This is very very urgent to be resolved. Pls help.

PASSWORD FOR FLODERS PLEAse HELP URGENT

HI ALL
please tell me the method of implementing password
provision for some folders/files in the system.
it should ask for password authentification before
opening when i click on the folder.
please help urgent
thanks
belur

Hi Swaroopba,
It can be very well done thru Form based Authentication.
For eg let me explain with respect to Tomcat.
Go to
$TOMCAT_HOME/webapps/examples/WEB-INF directory.
Please add the following code in it.
<security-constraint>
<web-resource-collection>
<web-resource-name>Protected Area </web-resource-name>

<url-pattern>/jsp/security/protected</url-pattern>
</web-resource-collection>
</security-constraint>
Please add the following code in it. And you have to specify the roles for it.
I hope this will be helpful for you.
Or if you want it in an application, please let me know.
Thanks
Bakrudeen

Access to trunk port clarification

Hello-
I am looking to clarify a point of confusion for myself regrading connecting an access port to a trunk port. Consider the following switchport config on switch1:
Switch#1
interface GigabitEthernet0/5
switchport
switchport access vlan 6
....and the corresponding config on it's neighbor:
Switch#2
Interface GigabitEthernet10/8
switchport
switchport mode trunk
switchport trunk allowed vlan 1,6,100
My first question is- Is this a valid configuration? Secondly, what would the expected results be? I am curious about what vlans would be allowed to pass through..
Thanks in advance-
Brian

This would work fine but not recommended.
Also the traffic between the switches would be only Native Vlan and vlan 6 will pass through.
SW1-----F0/1----------f0/1----SW2
SW1#sh int trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 auto n-802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1-1005
Port Vlans allowed and active in management domain
Fa0/1 1,6
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 1,6
SW1#
SW2
SW2#sh int trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1,6,100
Port Vlans allowed and active in management domain
Fa0/1 1,6,100
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 1,6,100
SW2#
2) Part of this config is that any vlans which are been configured under the SW1 would be allowed through that access port.
ex:
SW1#sh int trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 auto n-802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1-1005
Port Vlans allowed and active in management domain
Fa0/1 1,6,10,20,30,40,50,60,70,80,90,100
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 1,6,10,20,30,40,50,60,70,80,90,100 ...>>>>>>>>>>all vlans are allowed here.
b)
Were as on Switch 2 if you create all these vlans and u dont allow that to go through the trunk interface which you have configured those vlans would nt be flowing through.
eg;
SW2#sh int tr
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1,6,100
Port Vlans allowed and active in management domain
Fa0/1 1,6,100
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 1,6,100>>>>>>>>>>>>>>>.Only 3 vlans would be flowing through due to explicit defined. but if you defined allowed all then all vlans would be shown here.
i created all the vlans above on sw2 but you can see only 3 vlans are allowd as you have explicitly defined it.
Hope this clarifies your query.
Regards
Inayath
*************Plz dont forget to rate posts***********

Need help urgently with OS X and Windows 7

I need help urgently.
I installed Windows 7 on my macbook pro with OS X Lion. After installing Windows7, I accidently converted the basic volumes to dynamic volumes and now i can't even boot to OS X.
Please help me how to recover my OS X Lion. If I have to delete Windows and bootcamp partitions, it is OK.
I just want to get back my OS X bootable.
Thanks

thihaoo wrote:
Sorry
I can't even see the OS X partition when I hold down the "Option" key.
I could see OS X and Windows partitions if I hold down Option key before changing the partitions to Dynamic partitions from Basic in Windows 7.
Now can't see OS X partiton and only see Winodws partition but when I tried to boot onto Windows7 , I got BSOD and macbook pro restart.
Please help
The usual reason for the OSX partition to be invisible under these circumstances is that it has been trashed by Windows.
Do you have a backup?

I want to buy an in-app purchase but i don`t remember my security questions and i cant access my recovery email either, what can i do? i have 100$ on my account and cant use it because of that problem, please help URGENT

I want to buy an in-app purchase but i don`t remember my security questions and i cant access my recovery email either, what can i do? i have 100$ on my account and cant use it because of that problem, please help URGENT

If you have a rescue email address on your account then you can use that - follow steps 1 to 5 half-way down this page will give you a reset link on your account : http://support.apple.com/kb/HT5312
If you don't have a rescue email address (you won't be able to add one until you can answer your questions) then you will need to contact Support in your country to get the questions reset : http://support.apple.com/kb/HT5699

TRUNK PORTS (HELP URGENT)

Similar Messages

Maybe you are looking for