I have a switch configuration for a Cisco 2960cx that allows a specific VLAN on a trunk but no interface on the switch explicitly accesses that VLAN. So when the configuration is ran for the first time, all explicitly accessed VLANs are added to the vlan.dat but not the one that is allowed. I get the reasoning for doing this, but is there a way to have the switch add an allowed VLAN to vlan.dat automatically? (Without the user having to conf t-> vlan X)


interface GigabitEthernet0/4
switchport access vlan 300
switchport mode access

interface GigabitEthernet0/5
switchport trunk allowed vlan 10, 300

interface Vlan10
ip address 192.168...

VLAN 300 would be added to vlan.dat but not 10.

  • If no interfaces are in the VLAN, why would you want traffic for that VLAN?
    – Ron Maupin
    Oct 5, 2020 at 21:23
  • The VLAN is given an ip address and is used only as a way to ping the switch.
    – Bryan
    Oct 5, 2020 at 21:42

2 Answers 2


Some versions of IOS are better about automatic tracking of VLANs, but in general, VLAN configuration requires configuring VLANs. You need to actually set the vlan CLI command appropriately. You're setting VLANs on various interfaces, so it's not that hard to enter the vlan CLI command(s) as well.

(Older switches required manually editing the vlan database, totally outside the configuration. Be glad that's not how it's done anymore.)


Allowed VLANS aren't automatically added to vlan.dat, this allows for one-way traffic situations. (Useful? but not what I want..)

Best possible solution for this scenario seems to be manually adding the vlan. (conf t-> vlan x)

Then exporting the vlan.dat to be imported on new implementations. (This seems like a terrible solution to me, but with this implementation it looks to be quickest)

  • 1
    Again, you have to configure the interfaces, so it's no more work to configure vlan x at the same time. If this is being done pragmatically, then it's a one line addition. If it's a cut-n-paste, it's one more line per interface. It's much less hassle than keeping up with and copying a proprietary vlan.dat. (and what happens when you go to software/platforms that don't keep a vlan.dat?)
    – Ricky
    Oct 6, 2020 at 18:24
  • I agree, either way the user will be entering ~roughly one command. The current way things are being completed is by transferring the vlan.dat. I was looking for a possible solution to remove excess interaction from the end user. In this situation I don't want to merely remove one command just to add another, I'll just leave it as-is. I believe that for most situations your solution is best and I will select yours as the accepted answer, I just wanted to leave this answer in case someone has a similar requirement.
    – Bryan
    Oct 6, 2020 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.