1

The main goal is to guarantee communication between CE switches without any PE reconfiguration.

Interface GE0/0/1, GE0/0/2, GE0/0/3, GE0/0/4 will be connected to Customer switches. Customer decide how to configure ports on CE switches in direction to PE (Trunk or Access and which VLAN's).

For example: Variant 1 - client configure switches as a TRUNK (ex. vlan 10, 20, 30) - traffic goes between CE switches without reconfiguration our switch.

Variant 2 - client configure all ports as Access Vlan 70 - traffic goes between CE switches without reconfiguration our Switch.

Situation scheme

Improve this question
5
  • What is the question?
    – user36472
    Aug 27, 2018 at 12:44
  • How to configure ports ge1/0/1 1/0/2 1/0/3 1/0/4 to works for any solution (trunk or access) configured once (so we configure it at beggining and next client decide what he would like to do next without our reconfiguration)
    – Grzegorz
    Aug 27, 2018 at 12:46
  • So you want all ports to work with any variant, no matter what the customer chooses to use?
    – user36472
    Aug 27, 2018 at 12:47
  • Yes, if it is possible.
    – Grzegorz
    Aug 27, 2018 at 12:56
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 25, 2018 at 9:18

3 Answers 3

Reset to default
3

Configure all your ports as trunks.

Make VLAN 70 native (untagged).

Improve this answer
2
  • It is not solution for me. The client can use vlan 70 as access or any other. The main problem is, that client can change access vlan at any time, so we would like to configure interface ge1/0/1-4 as a "stupid medium" which transmit ip packets between CE1, CE2, CE3, CE4 at every variant without reconfiguration (I meen, client decide tommorow to change Access Vlan to 123 and it should work without reconfiguration of PE switch).
    – Grzegorz
    Aug 27, 2018 at 13:08
  • 2
    Create a new VLAN for the untagged VLAN -- Since it's untagged it doesn't matter what vlan they think it is.
    – Ron Trunk
    Aug 27, 2018 at 13:59
2

I might be mistaken, but from what I understand from the problem description, this might be a case for QinQ.

  • one service provider VLAN per customer.
  • edge ports of the service provider VLAN are (in Cisco speak) switchport access <serviceproviderVLAN> and switchport mode tunnel
  • customers may do (almost) anything with their switch interfaces.
  • some close attention must be kept on the untagged VLAN on the SP's infrastructure

Wrote about it here, but for a completely different use case:

What is the best to simulate an RJ45 cable failure without changing switch configuration or removing the cable?

Improve this answer
1

This only works if each customer switch may have access to any VLAN.

Simply create trunk ports and tag all VLANs or leave one as untagged.

If you don't know which VLANs a customer might get and you want your core switch to handle any future situation: this isn't possible unless you drop all security precautions - with MVRP and automatic VLAN learning you'd need to trust all connected switches 100% which you can't. If one customer creates a new VLAN between two of its edge switches any other customer would be able to join the VLAN as well.

If you need to protect customer VLANs from each other there's no alternative to configuring each VLAN on the switch. As far as I know there's no 802.1X variant for L2/VLANs - or is there?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.