My office is running a dual nexus 5k core, with catalyst 4506 closet switches at the user level. Today, I applied the following commands on one of the 4506s:

no switchport trunk native vlan 64

no switchport trunk allowed vlan 64,68

no switchport block unicast

no ip access-group ACL-ALLOW in

no authentication event fail action next-method

no authentication event server dead action authorize vlan 64

no authentication event server alive action reinitialize

no authentication host-mode multi-auth

no authentication order dot1x mab

no authentication priority dot1x mab

no authentication port-control auto

no authentication periodic

no authentication timer reauthenticate server

no authentication violation restrict

no mab

no snmp trap mac-notification change added

no snmp trap mac-notification change removed

no dot1x pae authenticator

no dot1x timeout quiet-period 300

no dot1x timeout tx-period 8

This resulted in the core losing all connection to several, "core" vlans that are not associated within the catalyst switches. After consoling into the core (due to the radius being no longer reachable), it appeared to take on only the vlans that were within the switch I applied the commands to. Given that the commands were only to user switchports, and they were only in reference to ise configuration, i believed them to be inoculate. Has anybody seen or experienced this before? If so, what was the problem?

  • just to specify, these commands were done at the switchport level, not globally
    – deaseec
    Feb 22 '16 at 17:12
  • Did you do this to the uplink ports? It's hard to tell what's going on without a diagram showing how the access and cores are connected. Try show spanning-tree vlan xx to see what ports are forwarding.
    – Ron Trunk
    Feb 22 '16 at 17:51
  • Also, are you running VTP?
    – Ron Trunk
    Feb 22 '16 at 17:52
  • our uplinks are on the ten gig fiber connections running back to the core. The above-referenced commands were only given to the gig ports 1-48 on the blades. The fix was to go back into the core via console, and add the server vlans. This brought everything up. I was half expecting for them to be knocked out again because i made no change to the catalyst. But it has yet to fail. In answer to your question, we are not running vtp
    – deaseec
    Feb 22 '16 at 18:00
  • I confess, I have no idea why vlans on the Nexus would have disappeared. But if you have it working now, please answer your own question (and accept the answer) so that others can learn from it.
    – Ron Trunk
    Feb 22 '16 at 18:08

This command:

no switchport trunk allowed vlan 64,68

probably didn't do what you think it does. The switch probably read that as

no switchport trunk allowed vlan

which would remove all vlans on the trunk

You probably meant to use:

switchport trunk allowed vlan remove 64, 68

Not sure why this worked, but the vlans were re-added to the nexus cores and everything came back up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.