4

Let's say I know my switches configurations, for each, I know what port are configured in access, what port are in trunk, and what vlan is on a port. For each device. I want to group vlan that can commuicate together. But i can't manage to find a necessary and sufficient condition.

If a two switch (SW1 and SW2) are connected through access ports, I can say that the 2 vlan configured on those ports can communicate toghether right ? But now that SW2 has reveived the untagged tram from SW1, what does it do with it?

If my port on SW1 was access vlan2 and my port or SW2 was access vlan3. Does that mean my sw1.vlan2 and my sw2.vlan3 are on the same layer2 network ?

The trunk case is easier because their is a tag. The only way I found for VLANs to be mixed on a trunk port is if native vlan on both ends are different (Native vlan mismatch on cisco)

My question : Is there a necessary and sufficient condition that I could check to know if two vlan belongs to the same network

Edit sum up of what I understand after the answers:

If sw1--access--access--sw2 , both VLAN configured belongs to the same l2

if sw1--trunk--trunk--sw2 VLAN configured with the same id are in the same l2 AND both native VLAN are in the same l2

if sw1--access--trunk--sw2 (If the link is up, depends on the constructor) the VLAN configured on the sw1-access and the native vlan on sw2-trunk are in the same l2.

Improve this question
3
  • I'm not sure what you want to accomplish, but leaking VLANs (what you propose) can cause problems. That is why Cisco devices will tell you about a native VLAN mismatch, although the Cisco devices will actually allow you to do that on trunks, even though you say it is not possible. You can do that , but you will constantly get a native VLAN mismatch warning, which you can suppress.
    – Ron Maupin ♦
    May 19, 2017 at 14:33
  • My goal is not to leak vlan, it's to detect stuff like this without any other information that configuration (no cdp/lldp/snmp etc...)
    – pwnsauce
    May 22, 2017 at 7:50
  • 1
    On Cisco switches, you can globally enable portfast and bpdugruard. That will automatically configure all the access interfaces, not the trunk interfaces, to go into errdisable if it detects BPDUs from another switch on the access interface.
    – Ron Maupin ♦
    May 22, 2017 at 8:02

2 Answers 2

Reset to default
4

If my port on SW1 was access vlan2 and my port on SW2 was access vlan3. Does that mean my sw1.vlan2 and my sw2.vlan3 are on the same layer2 network ?

Yes. If you connect two vlans together, you have essentially created one VLAN. They are in the same broadcast domain and all hosts can address each other directly. That makes it one layer 2 network.

The vlan names "VLAN 2", "VLAN 3," are local to the switch - they haven no meaning outside the switch. Although most switches don't operate this way, you could have the same VLAN have different tags on different ports. For example, you could have a VLAN that was tagged with VID 2 on one trunk port, but VID 3 on another. It's still the same layer 2 network.

Improve this answer
5
  • good. But how do you know what tag a VLAN will have when going out of a trunk then ? I though the vlan4 would be tagged VID4 when going out of a trunk. Because if two vlan have the same VID on a trunk link, that means they belong in the same l2 right ?
    – pwnsauce
    May 18, 2017 at 12:08
  • @pwnsauce There is an earlier post on Network Engineering explaining VLAN tagging: link
    – user36472
    May 18, 2017 at 12:24
  • 1
    @pwnsauce Yes, that's right. The receiving switch would put all the packets into the same VLAN. I should point out that nearly all switches tag VLANs according to the vlan identifier in the switch, as you describe.. I was making the point that the tag is only important to the local switch.
    – Ron Trunk
    May 18, 2017 at 17:22
  • would you say my edit summing-up is okay ?
    – pwnsauce
    May 19, 2017 at 12:11
  • @pwnsauce Yes, except for the very last point. The tagged VLAN won't be leaked onto the native VLAN.
    – Ron Trunk
    May 23, 2017 at 20:51
1

I find it a bit hard to understand exactly what you are trying to find out. With that said, based on Cisco equipment or other similar products, if you connect two VLANs together directly on an access port, there will be a mismatch condition. If no security measures have been configured, the two VLAN ip subnets can see each other and communicate with each other.

Checking for this condition can be done via various options, where normally in a Cisco environment you would enable BPDU guard to shut down the port, when access ports are connected together.

Link to native vlan mismatch case on Network Engineering

Improve this answer
2
  • What do you mean by "mismatch condition" ?
    – pwnsauce
    May 18, 2017 at 9:27
  • 1
    Native vlan mismatch, see this other case from Network engineering: link
    – user36472
    May 18, 2017 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.