1

Theoretically would I be able to connect two switch ports together with a simple straight/cross cable on the same switch. If the two ports are in different VLANs (eg. 2 and 22) and ports are in access mode?

BPDU guard and STP are active. The addresses and subnet is the same on both ports 10.9.0.0/24. (I mean there I have assets in VLAN 22, but I have route from the client side to VLAN2, default gw., if asset is connected to access port member in VLAN2, and has the address 10.9.0.2 it can be reached).

I would like to accomplish: make my assets only reachable when switch ports are connected with a cable (and the asset is connected to an access port member of VLAN22), and cut the connection as soon as I pull the cable out? Theoretically. In practice ports are in err-disabled with Cisco Nexus 31xx. It is easy if the cable connects two switches, but what if only one device is present?

Thank you!

  • What is the goal here? What are you trying to accomplish? There may be easier ways than the one you've described. If you pull the cable, will the device still work on VLAN 2? – Ron Trunk Feb 27 '18 at 18:52
  • The goal is represent "two switches" on one device and connect them with a single cable. In case of pulling the cables the devices in VLAN 2 should work. (And they already working). If I reconnect the same asset to a port configured to VLAN 22 it should also work if the two "segments" are cabled throgh. The device shoudn't have connection to any if "interconnect" cable is not present. (supposing the IP address is valid, and not present twice) – Janos Feb 27 '18 at 21:30
  • 2
    You can turn of bpdu guard on those ports. I would not disable STP though. – Ron Trunk Feb 27 '18 at 21:40
  • I will give a try. Still both ports are in err-disabled. – Janos Feb 28 '18 at 16:25
  • You can look in the log to see why they are disabled. – Ron Trunk Feb 28 '18 at 16:34
1

If you directly connect two different VLANs, you will have created a single broadcast domain from two separate broadcast domains. That means that the separate VLANs are unnecessary, or you have made a mistake that can cause you problems.

If you are using the same network addressing on both of the VLANs, you need to make sure that all the addresses used by the hosts are unique, otherwise you will have some serious trouble. Also, you cannot route traffic between the VLANs because a router will not route traffic from one network to the same network, and you cannot even set up two router interfaces in the same network.

It actually makes no sense to have separate VLANs that are in the same network that are connected to create a single VLAN. Simply use the same VLAN for both.

The switch interfaces will not err-disable unless you are running bpduguard on the interfaces.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.