- Read today’s lesson notes (below)
- Review yesterday’s lesson notes
- Complete today’s lab
- Read the ICND1 cram guide
You will only encounter networks using one switch in the smallest of offices, whereas you will usually find multiple switches forming part of the network infrastructure. This brings its own set of configuration challenges, which will require a good understading of trunking and associated issues. Cisco consider the ability to install and troubleshoot multiple switch connections a fundamental CCNA-level topic.
Today you will learn about the following:
- Trunking
- Dynamic Trunking Protocol (DTP)
- Inter-VLAN Routing
This module maps to the following ICND1 syllabus requirements:
ü Configure and verify trunking on Cisco switches
ü DTP
ü Auto-negotiation
ü Configure and verify inter-VLAN routing (router-on-a-stick)
- Subinterfaces
- Upstream routing
- Encapsulation
ü Configure SVI interfaces
Configuring and Verifying Trunk Links
A trunk is a switch port that can carry multiple traffic types, each tagged with a unique VLAN ID. As data is switched across the trunk port or trunk link, it is tagged (or coloured) by the egress switch trunk port, which allows the receiving switch to identify that it belongs to a particular VLAN. On the receiving switch ingress port, the tag is removed and the data is forwarded to the intended destination.
The first configuration task when implementing VLAN trunking in Cisco IOS Catalyst switches is to configure the desired interface as a Layer 2 switch port. This is performed by issuing the switchport interface configuration command.
NOTE: This command is required only on Layer 3-capable or Multilayer switches. It is not applicable to Layer 2-only switches, such as the Catalyst 2960 series. A switch would need to support the command ip routing in order to be considered Layer 3 capable.
The second configuration task is to specify the encapsulation protocol that the trunk link should use. This is performed by issuing the switchport trunk encapsulation [option] command. The options available with this command are as follows:
|
Switch(config)#interface FastEthernet1/1 Switch (config-if)#switchport trunk encapsulation ? dot1q – Interface uses only 802.1q trunking encapsulation when trunking isl – Interface uses only ISL trunking encapsulation when trunking negotiate – Device will negotiate trunking encapsulation with peer on interface |
The [dot1q] keyword forces the switch port to use IEEE 802.1Q encapsulation. The [isl] keyword forces the switch port to use Cisco ISL encapsulation. The [negotiate] keyword is used to specify that if the Dynamic Inter-Switch Link Protocol (DISL) and the Dynamic Trunking Protocol (DTP) negotiation fails to successfully agree on the encapsulation format, then ISL is the selected format. DISL simplifies the creation of an ISL trunk from two interconnected FastEthernet devices. DISL minimises VLAN trunk configuration procedures because only one end of a link needs to be configured as a trunk.
DTP is a Cisco proprietary point-to-protocol that negotiates a common trunking mode between two switches. DTP will be described in detail later. The following output illustrates how to configure a switch port to use IEEE 802.1Q encapsulation when establishing a trunk:
| Switch (config)#interface FastEthernet1/1
Switch (config-if)#switchport Switch (config-if)#switchport trunk encapsulation dot1q |
This configuration can be validated via the show interfaces [name] switchport command, as illustrated in the following output:
| Switch#show interfaces FastEthernet1/1 switchport
Name: Fa0/2 Switchport: Enabled Administrative Mode: dynamic desirable Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: On Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default)
… [Truncated Output] |
The third trunk port configuration step is to implement configuration to ensure that the port is designated as a trunk port. This can be done in one of two ways:
- Manual (static) trunk configuration
- Dynamic Trunking Protocol (DTP)
Manual (Static) Trunk Configuration
The manual configuration of a trunk is performed by issuing the switchport mode trunk interface configuration command on the desired switch port. This command forces the port into a permanent (static) trunking mode. The following configuration output shows how to configure a port statically as a trunk port:
| VTP-Server(config)#interface FastEthernet0/1
VTP-Server(config-if)#switchport VTP-Server(config-if)#switchport trunk encapsulation dot1q VTP-Server(config-if)#switchport mode trunk VTP-Server(config-if)#exit VTP-Server(config)# |
Feel free to ignore the switchport command if you are using a lower-end switch (the above output was from a Cat6K switch). This configuration can be validated via the show interfaces [name] switchport command, as illustrated in the following output:
| VTP-Server#show interfaces FastEthernet0/1 switchport
Name: Fa0/1 Switchport: Enabled Administrative Mode: trunk Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: On Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default)
… [Truncated Output] |
Although manual (static) configuration of a trunk link forces the switch to establish a trunk, Dynamic ISL and Dynamic Trunking Protocol (DTP) packets will still be sent out of the interface. This is performed so that a statically configured trunk link can establish a trunk with a neighbouring switch that is using DTP, as will be described in the following section. This can be validated in the output of the show interfaces [name] switchport command illustrated below:
| VTP-Server#show interfaces FastEthernet0/1 switchport
Name: Fa0/1 Switchport: Enabled Administrative Mode: trunk Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: On Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default)
… [Truncated Output] |
In the output above, the text in bold indicates that despite the static configuration of the trunk link, the port is still sending out DTP and DISL packets. In some cases, this is considered undesirable. Therefore, it is considered good practice to disable the sending of DISL and DTP packets on a port statically configured as a trunk link by issuing the switchport nonegotiate interface configuration command, as illustrated in the following output:
| VTP-Server(config)#interface FastEthernet0/1
VTP-Server(config-if)#switchport VTP-Server(config-if)#switchport trunk encapsulation dot1q VTP-Server(config-if)#switchport mode trunk VTP-Server(config-if)#switchport nonegotiate VTP-Server(config-if)#exit VTP-Server(config)# |
Again, the show interfaces [name] switchport command can be used to validate the configuration, as follows:
| VTP-Server#show interfaces FastEthernet0/1 switchport
Name: Fa0/1 Switchport: Enabled Administrative Mode: trunk Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: Off Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default)
… [Truncated Output] |
Dynamic Trunking Protocol (DTP)
DTP is a Cisco proprietary point-to-protocol that negotiates a common trunking mode between two switches. This dynamic negotiation can also include trunking encapsulation. The two DTP modes that a switch port can use, depending upon the platform, are as follows:
- Dynamic desirable
- Dynamic auto
When using DTP on two neighbouring switches, if the switch port defaults to a dynamic desirable state, the port will actively attempt to become a trunk. If the switch port defaults to a dynamic auto state, the port will revert to being a trunk only if the neighbouring switch is set to dynamic desirable mode.
Figure 3.1 below illustrates the DTP mode combinations that will result in a trunk either being established or not being established (in this case they are all established; see note after Figure 3.2) between two Cisco Catalyst switches:
Figure 3.1 – DTP Mode Combinations
Figure 3.2 below illustrates the valid combinations that will result in the successful establishment of a trunk link between two neighbouring switches – one using DTP and the other statically configured as a trunk port:
Figure 3.2 – DTP Mode Combinations, Part 2
NOTE: It is important to know that if the switches are both set to dynamic auto, they will not be able to establish a trunk between them. This is because, unlike dynamic desirable mode, dynamic auto mode is a passive mode that waits for the other side to initiate trunk establishment. Therefore, if two passive ports are connected, neither will ever initiate trunk establishment and the trunk will never be formed. Similarly, if a statically configured switch port is also configured with the switchport nonegotiate command, it will never form a trunk with a neighbouring switch using DTP because this prevents the sending of DISL and DTP packets out of that port.
When using DTP in a switched LAN, the show dtp [interface <name>] command can be used to display DTP information globally for the switch or for the specified interface. The following output shows the information printed by the show dtp command:
| VTP-Server#show dtp
Global DTP information Sending DTP Hello packets every 30 seconds Dynamic Trunk timeout is 300 seconds 4 interfaces using DTP |
Based on the output above, the switch is sending DTP packets every 30 seconds. The timeout value for DTP is set to 300 seconds (5 minutes), and 4 interfaces are currently using DTP. The show dtp interface [name] command prints DTP information about the specified interface, which includes the type of interface (trunk or access), the current port DTP configuration, the trunk encapsulation, and DTP packet statistics, as illustrated in the following output:
| VTP-Server#show dtp interface FastEthernet0/1
DTP information for FastEthernet0/1: TOS/TAS/TNS: TRUNK/ON/TRUNK TOT/TAT/TNT: 802.1Q/802.1Q/802.1Q Neighbor address 1: 000000000000 Neighbor address 2: 000000000000 Hello timer expiration (sec/state): 7/RUNNING Access timer expiration (sec/state): never/STOPPED Negotiation timer expiration (sec/state): never/STOPPED Multidrop timer expiration (sec/state): never/STOPPED FSM state: S6:TRUNK # times multi & trunk 0 Enabled: yes In STP: no
Statistics ———- 0 packets received (0 good) 0 packets dropped 0 nonegotiate, 0 bad version, 0 domain mismatches, 0 bad TLVs, 0 other 764 packets output (764 good) 764 native, 0 software encap isl, 0 isl hardware native 0 output errors 0 trunk timeouts 2 link ups, last link up on Mon Mar 01 1993, 00:00:22 1 link downs, last link down on Mon Mar 01 1993, 00:00:20 |
IEEE 802.1Q Native VLAN
In the previous module, you learned that 802.1Q, or VLAN tagging, inserts a tag into all frames, except those in the native VLAN. The IEEE defined the native VLAN to provide for connectivity to old 802.3 ports that did not understand VLAN tags.
By default, an 802.1Q trunk uses VLAN 1 as the native VLAN. The default native VLAN on an 802.1Q trunk link can be verified by issuing the show interfaces [name] switchport or the show interfaces trunk command, as illustrated in the following output:
| VTP-Server#show interfaces FastEthernet0/1 switchport
Name: Fa0/1 Switchport: Enabled Administrative Mode: trunk Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: On Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default) Voice VLAN: none
… [Truncated Output] |
VLAN 1 is used by the switch to carry specific protocol traffic, like Cisco Discovery Protocol (CDP), VLAN Trunking Protocol (VTP), Port Aggregation Protocol (PAgP), and Dynamic Trunking Protocol (DTP) information. CDP and PAgP will be described in detail later in this guide. Although the default native VLAN is always VLAN 1, the native VLAN can be manually changed to any valid VLAN number that is not in the reserved range of VLANs.
However, it is important to remember that the native VLAN must be the same on both sides of the trunk link. If there is a native VLAN mismatch, Spanning Tree Protocol (STP) places the port in a port VLAN ID (PVID) inconsistent state and will not forward the link. Additionally, CDPv2 passes native VLAN information between switches and will print error messages on the switch console if there is a native VLAN mismatch. The default native VLAN can be changed by issuing the switchport trunk native vlan [number] interface configuration command on the desired 802.1Q trunk link, as illustrated in the following output:
| VTP-Server(config)#interface FastEthernet0/1
VTP-Server(config-if)#switchport trunk native vlan ? <1-4094> VLAN ID of the native VLAN when this port is in trunking mode |
Inter-VLAN Routing
By default, although VLANs can span the entire Layer 2 switched network, hosts in one VLAN cannot communicate directly with hosts in another VLAN. In order to do so, traffic must be routed between the different VLANs. This is referred to as inter-VLAN routing. The three methods of implementing inter-VLAN routing in switched LANs below, including their advantages and disadvantages, will be described in the following sections:
- Inter-VLAN routing using physical router interfaces
- Inter-VLAN routing using router subinterfaces
- Inter-VLAN routing using switched virtual interfaces
Inter-VLAN Routing Using Physical Router Interfaces
The first method of implementing inter-VLAN routing for communication entails using a router with multiple physical interfaces as the default gateway for each individually configured VLAN. The router can then route packets received from one VLAN to another using these physical LAN interfaces. This method is illustrated below in Figure 3.3:
Figure 3.3 – Inter-VLAN Routing Using Multiple Physical Router Interfaces
Figure 3.3 illustrates a single LAN using two different VLANs, each with an assigned IP subnet. Although the network hosts depicted in the figure are connected to the same physical switch, because they reside in different VLANs, packets between hosts in VLAN 10 and those in VLAN 20 must be routed, while packets within the same VLAN are simply switched.
The primary advantage of using this solution is that it is simple and easy to implement. The primary disadvantage, however, is that it is not scalable. For example, if 5, 10, or even 20 additional VLANs were configured on the switch, the same number of physical interfaces as VLANs would also be needed on the router. In most cases, this is technically not feasible.
When using multiple physical router interfaces, each switch link connected to the router is configured as an access link in the desired VLAN. The physical interfaces on the router are then configured with the appropriate IP addresses, and the network hosts are either statically configured with IP addresses in the appropriate VLAN, using the physical router interface as the default gateway, or dynamically configured using DHCP. The configuration of the switch illustrated in Figure 3.3 is illustrated in the following output:
| VTP-Server-1(config)#vlan 10
VTP-Server-1(config-vlan)#name Example-VLAN-10 VTP-Server-1(config-vlan)#exit VTP-Server-1(config)#vlan 20 VTP-Server-1(config-vlan)#name Example-VLAN-20 VTP-Server-1(config-vlan)#exit VTP-Server-1(config)#interface range FastEthernet0/1 – 2, 23 VTP-Server-1(config-if-range)#switchport VTP-Server-1(config-if-range)#switchport access vlan 10 VTP-Server-1(config-if-range)#switchport mode access VTP-Server-1(config-if-range)#exit VTP-Server-1(config)#interface range FastEthernet0/3 – 4, 24 VTP-Server-1(config-if-range)#switchport VTP-Server-1(config-if-range)#switchport access vlan 20 VTP-Server-1(config-if-range)#switchport mode access VTP-Server-1(config-if-range)#exit |
The switchport command isn’t required on the 2960 switch because the interface is already running in Layer 2 mode.
The router illustrated in Figure 3.3 is configured as shown in the following output:
| R1(config)#interface FastEthernet0/0
R1(config-if)#ip add 10.10.10.1 255.255.255.0 R1(config-if)#exit R1(config)#interface FastEthernet0/1 R1(config-if)#ip add 10.20.20.1 255.255.255.0 R1(config-if)#exit |
Inter-VLAN Routing Using Router Subinterfaces
Implementing inter-VLAN routing using subinterfaces addresses the scalability issues that are possible when using multiple physical router interfaces. With subinterfaces, only a single physical interface is required on the router and subsequent subinterfaces are configured off that physical interface. This is illustrated below in Figure 3.4:
Figure 3.4 – Inter-VLAN Routing Using Router Subinterfaces
Figure 3.4 depicts the same LAN illustrated in Figure 3.3. In Figure 3.4, however, only a single physical router interface is being used. In order to implement an inter-VLAN routing solution, subinterfaces are configured off the main physical router interface using the interface [name].[subinterface number] global configuration command. Each subinterface is associated with a particular VLAN using the encapsulation [isl|dot1Q] [vlan] subinterface configuration command. The final step is to configure the desired IP address on the interface.
On the switch, the single link connected to the router must be configured as a trunk link because routers don’t support DTP. If the trunk is configured as an 802.1Q trunk, a native VLAN must be defined if a VLAN other than the default will be used as the native VLAN. This native VLAN must also be configured on the respective router subinterface using the encapsulation dot1Q [vlan] native subinterface configuration command. The following output illustrates the configuration of inter-VLAN routing using a single physical interface (also referred to as “router-on-a-stick”). The two VLANs depicted in Figure 3.4 are shown in the following output, as is an additional VLAN used for Management; this VLAN will be configured as the native VLAN:
| VTP-Server-1(config)#vlan 10
VTP-Server-1(config-vlan)#name Example-VLAN-10 VTP-Server-1(config-vlan)#exit VTP-Server-1(config)#vlan 20 VTP-Server-1(config-vlan)#name Example-VLAN-20 VTP-Server-1(config-vlan)#exit VTP-Server-1(config)#vlan 30 VTP-Server-1(config-vlan)#name Management-VLAN VTP-Server-1(config-vlan)#exit VTP-Server-1(config)#interface range FastEthernet0/1 – 2 VTP-Server-1(config-if-range)#switchport VTP-Server-1(config-if-range)#switchport access vlan 10 VTP-Server-1(config-if-range)#switchport mode access VTP-Server-1(config-if-range)#exit VTP-Server-1(config)#interface range FastEthernet0/3 – 4 VTP-Server-1(config-if-range)#switchport VTP-Server-1(config-if-range)#switchport access vlan 20 VTP-Server-1(config-if-range)#switchport mode access VTP-Server-1(config-if-range)#exit VTP-Server-1(config)#interface FastEthernet0/24 VTP-Server-1(config-if)#switchport VTP-Server-1(config-if)#switchport trunk encapsulation dot1q VTP-Server-1(config-if)#switchport mode trunk VTP-Server-1(config-if)#switchport trunk native vlan 30 VTP-Server-1(config-if)#exit VTP-Server-1(config)#interface vlan 30 VTP-Server-1(config-if)#description ‘This is the Management Subnet’ VTP-Server-1(config-if)#ip address 10.30.30.2 255.255.255.0 VTP-Server-1(config-if)#no shutdown VTP-Server-1(config-if)#exit VTP-Server-1(config)#ip default-gateway 10.30.30.1 |
The router illustrated in Figure 3.4 is configured as shown in the following output:
| R1(config)#interface FastEthernet0/0
R1(config-if)#no ip address R1(config-if)#exit R1(config)#interface FastEthernet0/0.10 R1(config-subitf)#description ‘Subinterface For VLAN 10’ R1(config-subif)#encapsulation dot1Q 10 R1(config-subif)#ip add 10.10.10.1 255.255.255.0 R1(config-subif)#exit R1(config)#interface FastEthernet0/0.20 R1(config-subitf)#description ‘Subinterface For VLAN 20’ R1(config-subif)#encapsulation dot1Q 20 R1(config-subif)#ip add 10.20.20.1 255.255.255.0 R1(config-subif)#exit R1(config)#interface FastEthernet0/0.30 R1(config-subitf)#description ‘Subinterface For Management’ R1(config-subif)#encapsulation dot1Q 30 native R1(config-subif)#ip add 10.30.30.1 255.255.255.0 R1(config-subif)#exit |
The primary advantage of this solution is that only a single physical interface is required on the router. The primary disadvantage is that the bandwidth of the physical interface is shared between the various configured subinterfaces. Therefore, if there is a lot of inter-VLAN traffic, the router can quickly become a bottleneck in the network.
Inter-VLAN Routing Using Switched Virtual Interfaces
Multilayer switches support the configuration of IP addressing on physical interfaces. These interfaces, however, must be configured with the no switchport interface configuration command to allow administrators to configure IP addressing on them. In addition to using physical interfaces, Multilayer switches also support Switched Virtual Interfaces (SVIs).
SVIs are logical interfaces that represent a VLAN. Although the SVI represents a VLAN, it is not automatically configured when a Layer 2 VLAN is configured on the switch; it must be manually configured by the administrator using the interface vlan [number] global configuration command. The Layer 3 configuration parameters, such as IP addressing, are then configured on the SVI in the same manner as they would be on a physical interface.
The following output illustrates the configuration of SVIs to allow inter-VLAN routing on a single switch. This output references the VLANs used in the previous configuration outputs in this section:
| VTP-Server-1(config)#vlan 10
VTP-Server-1(config-vlan)#name Example-VLAN-10 VTP-Server-1(config-vlan)#exit VTP-Server-1(config)#vlan 20 VTP-Server-1(config-vlan)#name Example-VLAN-20 VTP-Server-1(config-vlan)#exit VTP-Server-1(config)#interface range FastEthernet0/1 – 2 VTP-Server-1(config-if-range)#switchport VTP-Server-1(config-if-range)#switchport mode access VTP-Server-1(config-if-range)#switchport access vlan 10 VTP-Server-1(config-if-range)#exit VTP-Server-1(config)#interface range FastEthernet0/3 – 4 VTP-Server-1(config-if-range)#switchport VTP-Server-1(config-if-range)#switchport mode access VTP-Server-1(config-if-range)#switchport access vlan 20 VTP-Server-1(config-if-range)#exit VTP-Server-1(config)#interface vlan 10 VTP-Server-1(config-if)#description “SVI for VLAN 10” VTP-Server-1(config-if)#ip address 10.10.10.1 255.255.255.0 VTP-Server-1(config-if)#no shutdown VTP-Server-1(config-if)#exit VTP-Server-1(config)#interface vlan 20 VTP-Server-1(config-if)#description ‘SVI for VLAN 10’ VTP-Server-1(config-if)#ip address 10.20.20.1 255.255.255.0 VTP-Server-1(config-if)#no shutdown VTP-Server-1(config-if)#exit |
When using Multilayer switches, SVIs are the recommended method for configuring and implementing an inter-VLAN routing solution.
You can verify that the SVI is properly configured (IP addressing, etc.) by using the how interface vlan x command. The output is identical to a show interface x command:
Switch#show interfaces vlan 100
Vlan100 is up, line protocol is down
Hardware is EtherSVI, address is c200.06c8.0000 (bia c200.06c8.0000)
Internet address is 10.10.10.1/24
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
ARP type: ARPA, ARP Timeout 04:00:00
If you wish to use a 2960 switch to route IP packets, it will require a configuration change and reload. The reason for this is the 2960 and newer model switches are tuned to allocate resources in a certain way. The resource management is called the Switch Database Management (SDM) template. Your choices include the following:
- Default – balances all functions
- Dual IPv4/IPv6 – for use in dual-stack environments
- Lanbase-routing – supports Unicast routes
- QoS – gives support for QoS features
Here are the options on my 3750 switch. They don’t match the 2960 options exactly, but you get the idea. Also, bear in mind that your switch model and IOS will affect the configuration options, so check the configuration guide for your model:
Switch(config)#sdm prefer ?
access Access bias
default Default bias
dual-ipv4-and-ipv6 Support both IPv4 and IPv6
ipe IPe bias
lanbase-routing Unicast bias
vlan VLAN bias
Lanbase-routing will need to be enabled if you wish to configure inter-VLAN routing on your 2960 switch. You will also need to reload the switch before the change will take effect. Here is the output of the show sdm prefer command, which tells you the current SDM configuration and resource allocation:
Switch#show sdm prefer
The current template is “desktop default“ template.
The selected template optimizes the resources in
the switch to support this level of features for
8 routed interfaces and 1024 VLANs.
number of unicast mac addresses: 6K
number of IPv4 IGMP groups + multicast routes: 1K
number of IPv4 unicast routes: 8K
number of directly-connected IPv4 hosts: 6K
number of indirect IPv4 routes: 2K
number of IPv4 policy based routing aces: 0
number of IPv4/MAC qos aces: 0.5K
number of IPv4/MAC security aces: 1K
Switch#