Cisco Cram or: How I Learned to Stop Lolling and Love the Book: VLANs and Trunking

VLAN Overview

The concept of VLANs is the logical separation, or grouping, of hosts beyond physical boundaries. End stations in the same VLAN do not have to exist on the same LAN segment but they can span multiple switches. VLANs are usually associated IP networks, and hosts in the same VLAN share the same broadcast domain. This implies that traffic inside the same VLAN is Layer 2 switched but traffic between different VLANs must be Layer 3 routed.

VLAN Ranges

VLAN membership is defined by a number, which is a 12-bit field (0-4095) in the frame header, as defined by the IEEE 802.1Q standard. The VLAN Identifiers are divided into two sections: normal VLANs (1-1005) and extended VLANs (1006-4094), and some of them are reserved for special purposes.

Refer to the table below for more detail.

The last row regarding VTP is not entirely true because VTP version 3 (available on newer platforms) supports the advertisement of the extended range VLANs. Further, the router must be in VTP Transparent mode to configure an extended range VLAN. More on these coming up in the unspecified future.

VLAN Trunks

Trunk links are used to transport traffic for multiple VLANs between devices and extend VLANs across an entire network. To correctly deliver traffic for several VLANs over the same link, the switch needs a method to uniquely identify each VLAN. This is accomplished by using a special encapsulation method that inserts a tag into the frame header. The tag contains the 12-bit field that defines the VLAN membership, as briefly described previously.

There are actually two encapsulation options: ISL and 802.1Q. Both methods accomplish the same goal using different frame formats. ISL is a Cisco proprietary and is considered as a legacy protocol nowadays. In ISL, the original frame is encapsulated and an additional header is added before the frame is carried over a trunk link. At the receiving end, the header is removed and the frame is forwarded to the assigned VLAN. On the contrary, 802.1Q is almost universally supported and widely accepted as the current VLAN encoding method. In 802.1Q, the switch inserts a 4-byte tag into the original frame and recomputes the frame check sequence (FCS) before the device sends the frame over the trunk link. At the receiving end, the tag is removed and the frame is forwarded to the assigned VLAN. By tagging frames in this way, traffic separation between the VLANs is maintained when traversing over the same link.

In addition to 802.1Q tagged packets, a trunk port can carry untagged packets for one VLAN (the default VLAN). All untagged traffic is assumed to belong to this VLAN, and is referred to as the native VLAN.

The following graph represents the 802.1Q frame format.

The Tag field contains the 12-bit VLAN Identifier (VID).

Switchport Modes

There are essentially three different switchport modes: access, trunk, and dynamic. The latter is further divided into two subsections: desirable and auto, which run Dynamic Trunking Protocol (DTP). If an interface is explicitly configured in access or trunk mode (switchport mode access or switchport mode trunk), it will permanently remain in that mode, regardless of what is configured on the other end. On the contrary, DTP allows the switches to dynamically decide whether to run in access or trunk mode. The interfaces will generate DTP frames, negotiating with each other whether to convert the interconnecting link into trunking mode. The dynamic desirable mode (switchport mode dynamic desirable) makes the interface actively attempt to convert the link to a trunk link, whereas the dynamic auto mode (switchport mode dynamic auto) sets the interface to passively willing to form a trunk link if the other end suggests it.

DTP can be disabled on an interface basis, the switchport nonegotiate command will prevent the interface from generating DTP frames. In this case, the neighboring interface must be manually configured in trunking mode to establish a trunk link.

Different switch platforms have different default configurations regarding DTP. The most common is perhaps dynamic desirable.

The table below describes the resulting switchport mode with different combinations on neighboring ends.

Configuring an interface in access mode and the neighboring in trunking mode is not recommended because, as a result, the traffic from only one VLAN, the native VLAN, will traverse correctly. More on that in another post.

Configuring and Verifying Switchport Modes

In addition to displaying the VLAN assignments and DTP status, the show interface <int-num> switchport provides extensive about the administrative and operational modes of the interface.

Switch#show interface fa0/1 switchport
Name: Fa0/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)

Switch#show interface fa0/2 switchport
Name: Fa0/2
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 2 (VLAN0002)
Trunking Native Mode VLAN: 1 (default)

Switch#show interface fa0/4 switchport
Name: Fa0/4
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)

The Administrative Mode displays which mode the interface is configured in. Conversely, the Operational Mode verifies which mode the interface is actually operating in. Negotiation of Trunking shows whether DTP is turned on.