I am a little embarrassed I do not know the answer to this already, well I think I know the answer but I am not 100% sure and this I need to be 100% sure on.

We have several core .1q trunks that we initially setup with several VLANs. There is the core set of "switchport trunk allowed vlan 1,2,3,4,5,etc" and then there are a ton of "switchport trunk allowed vlan add" lines under it.

We want to open these trunks as the management of this has become a slight nightmare. Several trunks servicing virtual environments using vMotion all over the place and there is disparity between the links on what VLANs are allowed so we decided to just remove them as they are not providing much benefit.

Anyway, I think a simple "no switchport allowed vlan" command will do the trick but then I started thinking about the "add" lines and wondered if that would also remove those? I do not have much of a lab or test environment and just wanted some reassurance from fellow professionals. I am currently working on a Cisco Nexus 7K.

Thanks in advance for any input.

  • It's not clear what you want to do. What vlans do you want allowed on the trunk when your configuration change is complete? Jan 24 '20 at 21:30
  • Properly done, an access switch only connects to a pair of distribution switches, no other access switches, and the VLANs on that access switch are not trunked to any other access switch. You then restrict the VLANs on that trunk to only those used on that access switch. We live in a layer-3 world, and you should not need to have a VLAN extend across multiple access switches. All VLANs could be trunked between the two distribution switches.
    – Ron Maupin
    Jan 24 '20 at 21:33
  • An even more modern way of doing it is to isolate each access switch by running layer-3 connections for the uplinks to the distribution switches that would be layer-3 only (no VLANs) on the distribution switches.
    – Ron Maupin
    Jan 24 '20 at 21:36
  • no switchport allowed vlan is the way to remove them. It switches to multiple statements (i.e. the "add"s) when the command line gets too long. BTW, I've not seen a config line that long in many years.
    – Ricky
    Jan 25 '20 at 4:32

switchport trunk allowed vlan all might be the way forward to get from a restricted 802.1q trunk to an unrestricted one ("unrestriced" as in: all VLANs allowed), without having to worry about some vlans being removed temporarily.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/interfaces/command/cisco_nexus7000_interfaces_command_ref/s_commands.html#wp2448189237

Be sure to compare/check/sync the list of configured VLANs on either side of the link, and be sure that the STP priorities are set properly, to make sure that you don't set off possibly hundreds of per-VLAN-STP (re)calculations.

Also: If that N7K is running as part of a VPC pair, be very careful if there are VPC and non-VPC VLANs (such as VLANs used to L3-forward traffic with SVIs). Things might go awfully wrong when you inadvertently enable non-VPC-VLANs on a trunk where they're not meant to be .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.