1

Refreshing VLAN knowledge with PT7.3, I came across some unexpected behavior.

Why does a chain of switches having proper trunk configuration between them DROP packets? Trying to ping hosts from the same VLAN across the switch chain, packets get dropped at the second node (Z3 on thetopology).

I have attached the topology and what PT is trying to say, as well as relevant configurations on switches.

topology

///--Z1--///
interface FastEthernet0/1
 switchport trunk allowed vlan 10,20
 switchport mode trunk
!
interface FastEthernet0/2
 switchport access vlan 10
 switchport mode access
!
interface FastEthernet0/3
 switchport access vlan 20
 switchport mode access
!

!///--Z3--///
interface FastEthernet0/1 - Fa0/3 basically
 switchport trunk allowed vlan 10,20
 switchport mode trunk
!

!///--Z2--///
!
interface FastEthernet0/1
 switchport trunk allowed vlan 10,20
 switchport mode trunk
!
interface FastEthernet0/2
 switchport access vlan 10
 switchport mode access
!
interface FastEthernet0/3
 switchport access vlan 20
 switchport mode access
!

Would it be some issue related to the native vlan? Not even ARP requests get forwarded.

Improve this question
5
  • On each switch type "show spanning-tree vlan 10" and "show spanning-tree vlan 20" Make sure all switches agree on the MAC address of the root bridge.
    – Ron Trunk
    May 15, 2020 at 16:34
  • "No spanning tree instance exists" from Z3... PT bug or IOS quirk?
    – Daniel B
    May 15, 2020 at 16:48
  • Did you actually create the VLANs, not the SVI interface vlan, but the global vlan command? Not creating the VLANs can cause strange, hard to track problems.
    – Ron Maupin ♦
    May 15, 2020 at 17:22
  • 2
    You didn't create the vlan on Z3 as @ronmaupin explained. Then things will work.
    – Ron Trunk
    May 15, 2020 at 17:39
  • @RonMaupin , can you post this comment as an answer? It was indeed the solution. Cisco IOS creates VLANs when declaring access switchports, but it doesn't when declaring trunks. Truly inconsistent thinking, but probably there's a security rationale behind it.
    – Daniel B
    May 17, 2020 at 11:23

2 Answers 2

Reset to default
1

Whenever you want to use VLANs, make sure that the VLANs were created on the switches that use those VLANs. You can look at the VLAN database (vlan.dat file) to make sure.

If you use VTP, it may spread the created VLANs to all the switches, but VTP is sometimes problematic, and it can be a security risk, so a best practice is to set the VTP to Transparent Mode. You then need to make sure to create the VLANs that the switch uses on each switch.

Many people get confused that creating the SVI (interface Vlan<VLAN number>) is what creates the VLAN on a switch, but that is something completely different. A good practice is to create the VLAN (global vlan <VLAN number> command) and name it (name <VLAN name>). There are some other optional commands for the VLAN, then exit the VLAN mode (exit).

Not actually creating the VLANs on a switch can cause various strange problems, and it is often difficult to relate the problems to not having created the VLANs on the switch. It may seem like you have the VLANs on the switch with various show commands, but you really have not created the VLANs.

Improve this answer
2

Why does a chain of switches having proper trunk configuration between them DROP packets?

It doesn't unless there's congestion, or the trunk configuration is not proper.

In your case the key is "the active VLAN interface is not up".

Depending on the exact behavior of the switch, either all interfaces associated with the VLAN are down or the VLAN itself is shutdown or hasn't even been created. Try a no (interface) vlan 10 shut and make sure it's really there. (I'm not familiar with PT.)

Since you're not posting the full config, it's also possible that you missed assigning the desired VLAN to the client ports for access (=untagged). Check the switch's MAC table to see if the client MAC is visible in the VLAN.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.