Vlan x traffic block on trunk

Hi ,
Can someone please explain me why a trunk link, between two cisco switch, not allow a vlan x traffic if vlan x is not locally configured ?
In my lab I have three switch (2950 but it is the same with 2960 3750 etc).
Switch 1 is connected by trunk to switch 2 and switch 2 is connected by trunk to switch 3.
Switch 1 and switch 3 has configured vlan 10 and interfaces vlan 10 instead Switch 2 has not configured vlan 10
Vtp is disabled (transparent mode) in all switch
Switch 2 not permit switch1 to ping switch3 until I not configure vlan 10.
2950#sh int fa 0/9 status
Port      Name               Status       Vlan       Duplex Speed Type
Fa0/9                        connected    trunk      a-full a-100 10/100BaseTX
2950#sh int fa 0/9 trun
Port        Mode         Encapsulation Status        Native vlan
Fa0/9       on           802.1q         trunking      1
Port      Vlans allowed on trunk
Fa0/9       1-4094
Port        Vlans allowed and active in management domain
Fa0/9       1-2,11,101
Port        Vlans in spanning tree forwarding state and not pruned
Fa0/9       1-2,11,101
2950#sh vtp status
VTP Version                     : 2
Configuration Revision          : 0
Maximum VLANs supported locally : 128
Number of existing VLANs        : 8
VTP Operating Mode              : Transparent
VTP Domain Name                 : daniele
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x63 0x6C 0xF9 0xF6 0xB9 0xDC 0xBE 0xF3
Configuration last modified by 192.168.0.103 at 0-0-00 00:00:00
2950#
It seem that vlan 10 is pruned but I don't understand why (vtp is disabled)
Thanks a lot for you help
Daniele

Hi lnrdnl78d,
so will give this ago not quite sure how a uploaded images looks,
i have mocked up what i have understood from your explanation so feel free to correct me if i have got this wrong :)
however assuming in this situation that VTP is enabled (which i know you have disabled in yours, but hoping this helps)
in this situation client 1 sends a broadcast to client two.
with VTP pruning enable switch 2 will learn that switch 4 has no ports connected to VLAN 2
so the trunk link to Switch 4 will have VLAN 2 pruned from the trunk link
but 2 and 3 will receive the broadcast and switch 3 will be the only one to forward it out the connected port
from my understanding this is what you have configured in your lab apart from switch 4 but added it to fit the example
does this help demonstrate it at all or am i way off ?

Similar Messages

Traffic on interfaces trunk - Network Ingraestructure

I wanted to know if it is normal that all traffic on my network this through all trunk ports of switches
I set a sniffer and a switch connected without any connection trunk only to validate, the sniffer see that you are getting all network traffic through the trunk.
What can be causing this behavior and what considerations should be taken apart filtering vlans?
Regards.

Now I might have misunderstood your concern but I'll give it a shot:
Trunks carry traffic for multiple vlans and with no filtering in place they carry traffic for all vlans configured, normally you will see broadcasts e.g. DHCP or ARP requests going through all the trunk ports on a switch (that are not STP Blocking). This is normal behaviour.
However if your sniffer is picking up a lot of packets that are meant for unicast destinations going out all trunk ports and also being captured by your sniffer over some time, then could be something else. CAM Overflows result in the switch flooding packets out all ports that are in the same vlan and out all trunk ports on which the vlan is allowed. This would result in the behaviour you observed. you can use the show mac address-table count to verify mac address space.
Hope this helps

VLAN routing to different tengig trunk

Hello.
I am sure my question has been answered somewhere in this forum.
So I apologize if I am asking something that has been asked/answered before. I did not see it in my search results.
We have two 3750s. One is doing ip routing (L3). The same VLANs are created on each switch. The other switch is L2 only.
-The L3 has a 10 GB link to the L2 (vlan192 and vlan 10 trunked;aka port 1) and a 10 GB link to a storage device (vlan 10 only trunked;aka port 2).
-The L2 has a 10 GB link to the L3 (vlan192 and vlan 10 trunked;aka port 1) and a 10 GB link to a storage device (vlan 10 only trunked;aka port 1)
There are other pieces in play as well, but this is what I think only needs to be brought up.
My question is this?
On the L2 we want all vlan 192 to go across port 1. We want all vlan 10 traffic to go across aka port 2. HOWEVER if port 2 goes down we want vlan 10 traffic to be sent over port 1. If both ports are operational I want 192 to port 1 and 10 to port 2.
Is there anything I need to do to make this happen? If so can you point me in the right direction?
Thanks
Brian

Hi Brain ,
Simple solution for requirement load balance between trunk link using STP . Its assured during normal operation only appropriate traffic is passed to appropriate switch port (L2 we want all vlan 192 to go across port 1. We want all vlan 10 traffic to go across aka port 2) and vice versa during failover condition (port 2 goes down we want vlan 10 traffic to be sent over port 1)
http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10555-15.html
when you do port-channel , both ports will forward traffic for both VLAN simultaneously .during failover one link will carry both VLAN traffic.
HTH
Sandy

Vlan mismatch on a non-trunk port?

I have a 6500, running CatOS 7.6(2), directly connected to a 3500xl (running IOS 12.0(5)) with Cat5. I am *not* trunking between them. Each port is running under a different native VLANs, which I wouldn't think was an issue since they aren't trunking. The connection works fine, and packets flow between them as expected, but my 6500 complains about a native VLAN mismatch on that port. Is this a bug on the CatOS side? The 3500xl doesn't seem to complain about the native vlans being different.

Yes, these are CDP messages:
%CDP-4-NVLANMISMATCH:Native vlan mismatch detected on port 4/39
I am sure the port is not trunking:
Commons_6506_1> show trunk 4/39
Port Mode Encapsulation Status Native vlan
4/39 off dot1q not-trunking 54
Each port is in a different access VLAN. I just thought it odd that the 6500 cared about the native vlans since there was no trunking, and thus, no native vlan (just the active vlan).

How much VLAN traffic on .1Q trunk

Hi guys, we have two 6509 connecting to each other with eight L2 links which are .1q trunks. There are VLAN interfaces on both 6509 for vlan10 and vlan20. My question is how to find out how much vlan10 and vlan20 traffic going through on link1? I know we can get the stat on vlan interface, but are there any other ways to check it out on trunk interface?
6509 - eight .1Q trunks - 6509
Thanks. Leo

Hi rapper36,
From:
http://blogs.catapultsystems.com/cfuller/archive/2012/06/22/opsmgr-2012-resource-requirements-and-usage-recommendations-for-agent-and-agentless-monitoring-scom.aspx
OpsMgr 2012 Agentless Monitoring resource requirements:
Processor: < 1% average increase in processor utilization
Disk: < 1 average increase in pages per second
Disk: < 1 MB data (as there is no %programfiles%\System Center Operations Manager folder created)
Network: < 1 MB data sent and received to the system during installation
Memory: 14 MB less available memory
Time to Deploy to Monitored state: 2.5 minutes
After the agent was appearing as monitored the performance counters gathered prior to the installation were compared to those gathered after installation. The results indicate additional overhead associated with the Operations Manager 2012 agentless monitoring
after the agent was appearing as monitored.
Processor: < 1% average increase in processor utilization
Disk: < 1 average increase in pages per second
Disk: < 10 MB
Network: < 1 MB/min additional traffic
Memory: < 1 MB less available memory
Natalya
### If my post helped you, please take a moment to Vote as Helpful and\or Mark as an Answer

Only system vlans forward traffic on 1000v

I am trying to migrate to a Nexus 1000v vDS but only VM's in the system VLAN can forward traffic. I do not want to make my voice vlan a system VLAN but that is the only way I can get a VM in that VLAN to work properly. I have a host with its vmk in the L3Control port group. From the VSM, a show module shows the VEM 3 with an "ok" status. I currently only have 1 NIC under the vDS control. My VM's using the VM_Network port group work fine and can forward traffic normally. When I put a VM in the Voice_Network port group I lose communication with it. If I add vlan 5 as a system vlan to my Uplink port profile then the VM's in the Voice_Network work properly. I thought you shouldn't create system vlans for each vlan and only use it for critical management functions so I would rather not make it a system vlan. Below is my n1k config. The upstream switch is a 2960X with the "switchport mode trunk" command. Am I missing something that is not allowing VLAN 5 to communicate over the Uplink port profile?
port-profile type ethernet Unused_Or_Quarantine_Uplink
vmware port-group
shutdown
description Port-group created for Nexus1000V internal usage. Do not use.
state enabled
port-profile type vethernet Unused_Or_Quarantine_Veth
vmware port-group
shutdown
description Port-group created for Nexus1000V internal usage. Do not use.
state enabled
port-profile type vethernet VM_Network
vmware port-group
switchport mode access
switchport access vlan 1
no shutdown
system vlan 1
max-ports 256
description VLAN 1
state enabled
port-profile type vethernet L3-control-vlan1
capability l3control
vmware port-group L3Control
switchport mode access
switchport access vlan 1
no shutdown
system vlan 1
state enabled
port-profile type ethernet iSCSI-50
vmware port-group "iSCSI Uplink"
switchport mode trunk
switchport trunk allowed vlan 50
switchport trunk native vlan 50
mtu 9000
channel-group auto mode active
no shutdown
system vlan 50
state enabled
port-profile type vethernet iSCSI-A
vmware port-group
switchport access vlan 50
switchport mode access
capability iscsi-multipath
no shutdown
system vlan 50
state enabled
port-profile type vethernet iSCSI-B
vmware port-group
switchport access vlan 50
switchport mode access
capability iscsi-multipath
no shutdown
system vlan 50
state enabled
port-profile type ethernet Uplink
vmware port-group
switchport mode trunk
switchport trunk allowed vlan 1,5
no shutdown
system vlan 1
state enabled
port-profile type vethernet Voice_Network
vmware port-group
switchport mode access
switchport access vlan 5
no shutdown
max-ports 256
description VLAN 5
state enabled

Below is the output you requested. Thank you.
~ # vemcmd show card
Card UUID type 2: 4c4c4544-004c-5110-804a-b9c04f564831
Card name: synergvm5
Switch name: synergVSM
Switch alias: DvsPortset-0
Switch uuid: 7d e9 0d 50 b3 3b 25 47-64 14 61 c0 3f c0 7b d9
Card domain: 4094
Card slot: 3
VEM Tunnel Mode: L3 Mode
L3 Ctrl Index: 49
L3 Ctrl VLAN: 1
VEM Control (AIPC) MAC: 00:02:3d:1f:fe:02
VEM Packet (Inband) MAC: 00:02:3d:2f:fe:02
VEM Control Agent (DPA) MAC: 00:02:3d:4f:fe:02
VEM SPAN MAC: 00:02:3d:3f:fe:02
Primary VSM MAC : 00:50:56:aa:70:b9
Primary VSM PKT MAC : 00:50:56:aa:70:bb
Primary VSM MGMT MAC : 00:50:56:aa:70:ba
Standby VSM CTRL MAC : 00:50:56:aa:70:b6
Management IPv4 address: 172.30.2.64
Management IPv6 address: 0000:0000:0000:0000:0000:0000:0000:0000
Primary L3 Control IPv4 address: 172.30.100.1
Secondary VSM MAC : 00:00:00:00:00:00
Secondary L3 Control IPv4 address: 0.0.0.0
Upgrade : Default
Max physical ports: 32
Max virtual ports: 216
Card control VLAN: 1
Card packet VLAN: 1
Control type multicast: No
Card Headless Mode : No
       Processors: 16
Processor Cores: 8
Processor Sockets: 2
Kernel Memory:   62904468
Port link-up delay: 5s
Global UUFB: DISABLED
Heartbeat Set: True
PC LB Algo: source-mac
Datapath portset event in progress : no
Licensed: Yes
~ # vemcmd show port
LTL   VSM Port Admin Link State PC-LTL SGID Vem Port Type
   24     Eth3/8     UP   UP    FWD       0          vmnic7
   49      Veth1     UP   UP    FWD       0            vmk1
   50      Veth2     UP   UP    FWD       0        XP-Voice.eth0
   51      Veth3     UP   UP    FWD       0        synergPresence.eth0
~ # vemcmd show port vlans
                          Native VLAN   Allowed
LTL   VSM Port Mode    VLAN    State* Vlans
   24     Eth3/8   T          1   FWD    1
   49      Veth1   A          1   FWD    1
   50      Veth2   A          1   FWD    1
   51      Veth3   A          5   FWD    5
* VLAN State: VLAN State represents the state of allowed vlans.
~ # vemcmd show bd
Number of valid BDS: 10
BD 1, vdc 1, vlan 1, swbd 1, 5 ports, ""
Portlist:
BD 2, vdc 1, vlan 3972, swbd 3972, 0 ports, ""
Portlist:
BD 3, vdc 1, vlan 3970, swbd 3970, 0 ports, ""
Portlist:
BD 4, vdc 1, vlan 3969, swbd 3969, 2 ports, ""
Portlist:
      8
      9
BD 5, vdc 1, vlan 3968, swbd 3968, 3 ports, ""
Portlist:
      1 inban
      5 inband port securit
     11
BD 6, vdc 1, vlan 3971, swbd 3971, 2 ports, ""
Portlist:
     14
     15
BD 7, vdc 1, vlan 5, swbd 5, 1 ports, ""
Portlist:
     51 synergPresence.eth0
BD 8, vdc 1, vlan 50, swbd 50, 0 ports, ""
Portlist:
BD 9, vdc 1, vlan 77, swbd 77, 0 ports, ""
Portlist:
BD 10, vdc 1, vlan 199, swbd 199, 0 ports, ""
Portlist:
~ #

Traffic prioritisation on trunked switch port

Good afternoon all. I am looking into traffic policing and shaping and neither seem to do what I need to do. Basically on a trunked switch port, I would like to prioritise traffic coming into a port by it's VLAN tag, the trunk connects to an ESX host.
The above options seem to be more about prioritising certain traffic for passing on to downstream devices. Can anyone shed any light on whether this is possible please? I am thinking it would need to be done on the ESX host at the moment...
Thanks!

Hi Colhignett,
Hope the below link might help your query.
http://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/vlntgqos.html#wp1049430
Regards
Karthik

VLANs and traffic shapping

Hi, I have:
Cisco 2800 with HWIC 4ESW module (4 port FE switch), IOS 13.3(8)T8, Feature Set IP. 10 VLANs are defined, 2 assigned directly to 2 4ESW ports, 2 port are trunk.
How to configure traffic shapping on VLANs? I need shape 10Mbits from one Giga port to 10x 1Mbits for every VLAN.
When I use this configuration, Giga interface is shapping, but VLAN running without shape.
It is possible?
Thank you.
Libor
access-list 111 permit ip any any
class-map match-all class11
match access-group 111
policy-map policy11
class class11
shape average 1000000
interface GigabitEthernet0/0
ip address 192.168.0.222 255.255.255.0
ip nbar protocol-discovery
service-policy output policy11
duplex auto
speed auto
interface FastEthernet0/0/0
switchport access vlan 11
no ip address
interface Vlan11
ip address 10.11.12.1 255.255.255.248
ip nbar protocol-discovery
service-policy output policy11

Hi, put the service-policy command under the FE0/0/0 directly. Since there is only 1 VLAN defined there, you should otain the expected result.
HTH

ISCSI & Server LAN Traffic in Same Trunk Port

Hi,
I plan to use a Cisco UCS Rack mountable C200 server with a dual port PCIe card with TOE iSCSI. Is it acceptable to:
To use just one dual port PCIe card for both iSCSI storage traffic and server LAN traffic - separated by VLANs? - With the ports connected two upstream swtches (for redundancy) and the switch ports configured as Trunks for both iSCSI & data VLANs??
To use 1GE TOE iSCSI ports instead of 10GE TOE iSCSI ports
To use a TOE iSCSI port for server data VLAN traffic??

Yes doable. Also you can mark iSCSI with cos 2 and 9000 MTU with certain badwidth gaurantee for your iSCSI traffic and rest stays in default queue.
class-map type qos iSCSI-qos-class
     match cos 2
policy-map type qos iSCSI-qos-policy
     class iSCSI-qos-class
          set qos-group 2
     class class-default
          set qos-group 0
class-map type queuing iSCSI-queuing-class
     match qos-group 2
policy-map type queueing iSCSI-queuing-policy
     class type queuing iSCSI-queuing-class
          bandwidth percent 30
     class type queuing class-default
          bandwidth percent 70
class-map type network-qos iSCSI-network-class
     match qos-group 2
policy-map type network-qos iSCSI-network-policy
     class type network-qos iSCSI-network-class
          mtu 9216
     class type network-qos iSCSI-network-class
          mtu 1500
system qos
     service-policy type qos input iSCSI-qos-policy
     service-policy type queueing output iSCSI-queuing-policy
     service-policy type network-qos iSCSI-network-policy

Rspan vlan missing traffic

Hi,
I want to capture all traffic in a certain vlan (74) from two switches. I use a remote vlan to accomplish this.
The problem is that I see on the wireshark trace traffic which is traveling from one switch to the other but I don’t see traffic which remains within one switch.
So:
switch 1: server 1&2
switch 2: server 3&4
all interfaces in the same vlan (74)
remote vlan = vlan 745
connection switch 1 -> switch 2 = trunk (vlan 74 & 745)
action - on wireshark trace
ping server1 <-> sever 2 - no
ping server1<-> server 3 - yes
ping server 3 <-> server4 - no
I found some examples for the configuration and these are more or less the same as mine; so why is this not working as expected?
My config:
Switch 1 (3560)
monitor session 1 source vlan 74 rx
monitor session 1 destination remote vlan 745
switch 2 (4948)
monitor session 1 source vlan 74 rx
monitor session 1 destination remote vlan 745
monitor session 2 destination interface Gi1/17
monitor session 2 source remote vlan 745
Wireshark pc on port 17
Thanks for any help
Hans

Hi Hans
May I suggest this config for you to try:
switch 1
monitor session 1 source vlan 74 rx
monitor session destination remote vlan 745
switch 2
monitor session 1 source remote vlan 745
monitor session 1 destination interface Gi1/17
monitor session 2 source vlan 74 rx
monitor session 2 destination interface Gi1/17
Cheers
Stephen.

Vlan passing traffic between switches

I have a client that has two WAP321s, two Catalyst 2960s, one SG500X-48, and a Watchguard Router/Firewall (Model is not important).
I am trying to get the guest wireless network setup to pass traffic on VLAN2 to the router across the network. All regular traffic is on VLAN1. (yes I know it really should be on a different VLAN)
Background: I had originally had everything working till one of the unmanaged switches died. I move one of the Catalyst 2960s to replace the dead switch and then replaced the Catalyst 2960 with a SG500X-48.
Network layout: One WAP321 is connected to one of the Catalyst 2960s, which is connected to the Firewall/Router. (All traffic is passed as expected on both VLANS)
The second WAP321 is connected to the second Catalyst 2960, which connects to the SG500X-48, which connects to the first Catalyst 2960, and then to the Firewall/Router. The Default VLAN 1 works fine. VLAN2 does not.
What I have tried to do is set the ports on the second Catalyst 2960 which is connected to the WAP321 and the SG500X-48 to Trunk. I also set the port on the first Cataylst 2960 that connects to the SG500X-48 to trunk. (Although it was not set and passing traffic before moving switches around.) When I do this all traffic between the first Catalyst 2960 and the SG500X-48 stops. The Catalyst 2960 reports a port error and then shuts down the port. Only way to recover is to clear the port setting and then reboot the switch.
Does anyone have any ideas as to what is happening and what I am doing wrong?

Aniketalashe
I was able to get the port on the Catalyst 2960 set to trunk finally, not sure what did the trick, although that does not seem to be my problem.
Back to your question of the error report. I am unable to figure out how to get the log out of the 2960. I saw the error in the webGUI, when I moused over the port in question when the problem was happening.
I am starting to think that maybe the switch is starting to go.

Incoming RTP traffic blocked by SPA112 ATA: UDP port unreachable

Hi folks,
I'm using a Cisco SPA112 ATA behind a NAT, where port 5060,5061 and 16384-16482 are forwarded. Registration to the SIP proxy also works fine. However, I'm struggling with audio issues, meaning that the RTP session is not setup properly.
When investigating this issue at the packet-level, I found that the ATA itself is blocking traffic:
21:00:21.857655 IP 192.168.x.y > 82.197.a.b: ICMP 192.168.x.y udp port 16452 unreachable, length 208
The blocked port number depends per session, but is always between 16384 and 16482.
Actually, the issue sounds very much like in [1]. However, the proposed solution (disabling CDP) is not of any help to me, since it's disabled on my ATA by default. Any clue what could be the reason for this behaviour? Your help is greatly appreciated.
[1] https://supportforums.cisco.com/discussion/11470321/spa-962-intermittently-no-audio-rtp-port-closedunreachable

Hi,
You can try this packet Tracer:-
packet input outside udp <External Source Ip on the internet> 45657 <Outside interface IP> 43139 det
For the captures , you just need to verify that the ASA device is passing the traffic through as this is UDP traffic , we would not be able to find much.
For more information on captures:-
https://supportforums.cisco.com/document/69281/asa-using-packet-capture-troubleshoot-asa-firewall-configuration-and-scenarios
Let me know if you have any further queries.
Thanks and Regards,
Vibhor Amrodia

Traffic block on IPSEC tunnal

I'v allowd one private IP address to sepcific machine on tunnal ACL. My problem is when ever there is no acitivity from client side -- pix will block the traffic.
To enable the traffic I need ping client IP from specefic machine.
Any idea what's wrong

Your question is vague. If I understand. the symptom is that if you are not doing anything, when your allowed machine tries to communicate, it cannot at first but if you ping, it will work after...
If that is the case, then you are observing normal behavior in that the tunnel will go down after a period of time. To bring it back up, you simply have to send it interesting traffic..
The ping works but any traffic destined for that remote side (that's allowed of course) should bring it up.
Chris

Does cisco router support "tcp reset" mesg when the traffic blocked by access lit ?

hi ,
im trying to know if i blocked a destination with an access list on cisco.
can i make "tcp-rest " to that connection instead on dropping it ??
i belive it supported on ASA appliance , but not sure if supported on cisco routers.
im trying to migrate from linux router to cisco router and apply the same config , one of the challenging task is , i have
"reject-with=tcp-reset"
im wondering if i can do it on cisco router
waiting ur responce
regards

One of the things that keeps me engaged with these forums is that they challenge me and give me opportunities to learn new things. My initial reaction to your question about IPS on IOS router was to say that this is not supported. But I did some research and find that apparently IPS functionality is now supported on some (but not all) of Cisco IOS routers. See this link for additional detail:
http://www.cisco.com/c/en/us/products/collateral/security/ios-intrusion-prevention-system-ips/product_data_sheet0900aecd803137cf.html
HTH
Rick

Inbound Traffic Blocked

I am running VPN Client Version 5.0.00.0340. I have internal and external nics on the server. Once I have the tunnel established (inside internal nic) I seem to be dropping the inbound packets between the external and internal nics. Any suggestions?

Well no - not really. The VPN client will establish the connection to the remote end using the local routing table it has. From that point onwards - that is the terminating IP address of the vpn session. From the machine itself mit should be assigned an IP address from the remote VPN server - this IP address will be used the recevie and send encrypted traffic from the central end.
If you have an internal NIC in the server you also have the VPN client on....do you want to send traffic from your LAN thu the VPN client to the remote end? If so - the external & internal NIC's must be on the same IP subnet. As the remote VPN client cannot be used as a pass thru devices from 2 different subnets....unless you perform NAT on the device with the VPN client.....if you are doing that - you may as well just by a firewall or router!
HTH.

Vlan x traffic block on trunk

Similar Messages

Maybe you are looking for