3

From what I understand, there are protocols like VTP and CDP that no matter what will use VLAN 1.

CDP and VTP are layer 2 meanwhile interface VLAN is layer 3. So, I wonder why I cannot delete interface VLAN 1?

I want to use different VLAN from VLAN 1 for managing my switch but it is impossible because only interface VLAN 1 can turn up in layer-2 switch.

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 6 '17 at 23:37
1

Remember, by default, VLAN 1 is associated with all the physical interfaces, Default VLAN (for access ports) and Native VLAN (for IEEE 802.1Q trunks) on the switch. The thing that people does is to unassociated with the required interface(in this case, VLAN 1 ):

 switchport trunk allowed vlan remove "VLAN_TO_REMOVE"(to remove a vlan from a trunk port)
 no switchport access vlan 1(to remove a vlan from access port)

The only way that one Vlan interfaces came UP is to associated with some interface of that switch, this is the only way.

I guess, this is the problem that you have. Here you can find the datasheet for your 2690 switch:

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_25_fx/configuration/guide/2960scg.pdf

Are supported up to 4096 Vlan ID on that switch, on the way that you can do what you are asking, i guess, first you need to clear the capabilities of your equipment, and next, configure what you want.

7
  • Then why my another VLAN interface did not come up when the VLAN is associated with trunk port? – Ron Vince Oct 20 '15 at 11:59
  • The only way that a VLAN IF will come UP, is if are associated with and ACCESS PORT. A VLAN can be permitted on a TRUNK port and not come UP. – Orlando Gaetano Oct 20 '15 at 12:22
  • Then, I guess it is impossible in my case because my switch is layer 2. I do not think it is a good idea to have management VLAN interface in the same user's VLAN. So, VLAN 1 is better choice than user's VLAN. – Ron Vince Oct 20 '15 at 12:36
  • I dont understand the problem that your switch is Layer 2 or 3 for the thing that you want. YOU CAN CHANGE THE NATIVE VLAN, this is the vlan that carrie out the UNTAGGED traffic – Orlando Gaetano Oct 20 '15 at 12:53
  • Let's say there is no access port associated with VLAN 1 in my switch. My user's VLAN is VLAN 5 and my targeted management VLAN is 9. Now, interface VLAN 1 still cannot be deleted but its status is down (because no access port associated with VLAN 1 as you said). No access port is also associated with VLAN 9 because I just want to access it remotely (traffic through trunk port). The only VLAN that associated with access ports is VLAN 5. Will interface VLAN 9 come up in this case? – Ron Vince Oct 20 '15 at 13:23
1

Link-local protocols, such as CDP, don't actually use a VLAN, which is really an end-to-end layer-2 construct. The frames that CDP uses are untagged so some people consider them in the native VLAN, but they can never go beyond the next hop because they are confined to the link.

If a frame is untagged, and can't be propagated beyond the next hop, it is really in a VLAN? No, because if it was in the native VLAN it could be propagated to the other ports in that same VLAN, and that is not the case for the link-local protocols. The fact is that you could have no native VLAN set for a trunk and remove VLAN 1 from the list of allowed VLANs on the trunk, and CDP,etc. will still cross to the next hop.

We do what you want to do all the time. You can't actually remove the layer-2 VLAN 1, but not allowing VLAN 1 across the trunk essentially disables it. You can restrict the trunk from using VLAN 1, and don't define a native VLAN for the trunk. You can remove the layer-3 SVI for VLAN 1, and add an SVI for whichever VLAN you wish to use to manage the switch. The SVI can have the IP address of the switch that can be used for switch management.

VLAN 1, as the default VLAN, is now considered a security risk, as are any native VLANS. After removing VLAN 1, and any native VLAN, from the trunk, you have crippled the ability of an attacker from using a default that is present in most networks. Untagged traffic will not be propagated beyond the link.

2
  • May I know how native VLAN imposed a network to security risk? – Ron Vince Oct 20 '15 at 15:01
  • Because native VLANs, usually VLAN 1, typically extend to all the switches at a site, and there are some attacks where a hacker can switch VLAN numbers. The prime target for the spoofed VLAN is the native VLAN. LAN security is a large subject, and there is a Cisco Press book all about it. – Ron Maupin Oct 20 '15 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.