9 votes
Accepted

Portfast on Trunk port

Having portfast on a inter-switch link is not the best of ideas, indeed. Switches and Bridges should take the time needed (going through listening/learning phases) to converge to a loop free L2 ...
Marc 'netztier' Luethi's user avatar
8 votes
Accepted

The best way to understand Vlans?

A broadcast domain / L2 segment / VLAN has several weaknesses and is prone to a number of attack vectors, most importantly: any host can directly talk to any other host broadcasts from any host reach ...
Zac67's user avatar
  • 84.4k
8 votes
Accepted

What is VLAN Hopping

VLAN hopping is when a client (unauthorized node) can add VLAN tags to its frames to enter VLANs that it's not supposed to be in or when it can generate MVRP/GVRP frames to make its port a member of ...
Zac67's user avatar
  • 84.4k
8 votes
Accepted

spanning-tree port type edge trunk on port-channel vs physical interface

Strongly suggested: Configure both port-channel and its members identically (except of course for description and the channel-group and vpc bits). As long as an interface is not configured to be ...
Marc 'netztier' Luethi's user avatar
7 votes

Aren't Switch Access ports tagged?

I think you're confusing what goes on internally on the switch. How it keeps track of which ports are in which VLAN is up to the manufacturer. It's important to remember that 802.1q frames are a ...
Ron Trunk's user avatar
  • 67.5k
7 votes
Accepted

What is difference between standard VLAN extended VLAN?

VLAN are introduced by the IEEE 802.1Q standard, which doesn't have this notion of standard or extended VLAN, nor made any difference between VLAN under or above 1005. This is Cisco implementation ...
JFL's user avatar
  • 19.6k
7 votes

Do VLANs within a subnet need to have their own subnet for router on a stick?

I'm not understanding your exact problem because you don't provide enough detail but maybe this helps: With rare exceptions, an IP subnet is mapped to a VLAN = broadcast domain = layer-2 network on a ...
Zac67's user avatar
  • 84.4k
7 votes

Can a single subnet work across several switches?

Without VLANs, connected switches form a single broadcast domain - that is exactly what you need for a single IP subnet. Just connect away. VLANs require managed switches and allow you to split (...
Zac67's user avatar
  • 84.4k
7 votes
Accepted

Can a single subnet work across several switches?

Yes. You don’t even need a trunk. If all ports on both switches are access ports on Vlan 3, then the port connecting the two switches are on Vlan 3 and both switches form one broadcast domain on that ...
Darrell Root's user avatar
  • 2,193
7 votes
Accepted

difference between switchport trunk encapsulation dot1q and switchport mode trunk

The switchport trunk encapsulation dot1q command tells the switch that the interface should use IEEE 802.1Q encapsulation on the frames when the interface is configured as a trunk. Basically 802.1Q ...
Ron Maupin's user avatar
  • 99.6k
6 votes
Accepted

Building too large for ethernet runs

Fiber is not so expensive unless you are getting fleeced. Indeed, it can be cheaper than copper cabling. It's also the right solution to long runs. Given the installation costs, it's likewise foolish ...
Ecnerwal's user avatar
  • 2,746
6 votes
Accepted

Port channel to two different switches

I understand that this is an incorrect configuration, but what was blocking traffic to the new switch? Is this part of the port channel or spanning tree or something else? Nothing was actually "...
YLearn's user avatar
  • 27.3k
6 votes

Assigning a single switchport to different VLANs

First of all an access port is by definition can only carry one Vlan. Voice vlan is used, when if its actually a voice vlan traffic needed to be carried. so lets say both vlans 232 and 233 are Data ...
HAZIF ISMAIL's user avatar
6 votes

Do VLANs within a subnet need to have their own subnet for router on a stick?

Just to amplify on Zac’s answer: you have one subnet per vlan and vice versa. At the CCNA level, you can ignore the rare exceptions. The router on a stick has an (sub)interface in each subnet. ...
Ron Trunk's user avatar
  • 67.5k
6 votes
Accepted

cisco switchport trunk native vlan

The problem is not the traffic from the server to the switch, but the return traffic, from the switch to the server. Since the VLAN is native, the switch will sent the traffic for this VLAN untagged, ...
JFL's user avatar
  • 19.6k
6 votes
Accepted

Can't add VLAN in the "allowed VLAN"

You have to already have a VLAN in the allowed list (not "all") before you can use the add command to append to the existing list. So, first, use: switchport trunk allowed vlan 52 Then you ...
Jesse P.'s user avatar
  • 4,690
5 votes
Accepted

How to encapsulate all VLAN traffic inside VXLAN

I think you are confusing a couple of concepts. Looking at the last configuration section of the document you have linked: 7.2) VXLAN without CVX Configuration on VTEPs: ! vlan 100 vlan 200 ! ...
Ron Maupin's user avatar
  • 99.6k
5 votes

Best practice for connecting router to switch? (re: VLANs and multiple ports)

At the risk of expressing an opinion here, there is no such thing as "best practice." There are good practices, there are bad practices, and there are a lot in between. There is no best practice ...
Ron Trunk's user avatar
  • 67.5k
5 votes

VLAN Tags Being Different for a VoIP Phone vs. the Host Daisy-Chained to it?

Certainly this is the usual situation for the Cisco and Avaya phones I'm familiar with, as it's usual to keep voice and data traffic separate. This is from a Cisco SPA504G phone web configuration; ...
jonathanjo's user avatar
  • 16.2k
5 votes

VLAN Tags Being Different for a VoIP Phone vs. the Host Daisy-Chained to it?

A VoIP phone that chains to another device is a switch, and it negotiates a trunk between the phone and the switch. This happens with CDP or LLDP. For example, a Cisco switch interface configured as ...
Ron Maupin's user avatar
  • 99.6k
5 votes

Native VLAN question

The native vlan just means the vlan is untagged on the trunk port. The vlan can be untagged on one trunk but tagged on another. In other words, “native” is in reference to a particular trunk port. ...
Ron Trunk's user avatar
  • 67.5k
5 votes

The best way to understand Vlans?

Before VLANs, we used to do it like this: Use separate sets of switches for each area (servers, desktops, whatever) Keep those LANs completely distinct (different IP address ranges and no wires in ...
jonathanjo's user avatar
  • 16.2k
5 votes

increasing bandwidth between two Cisco switches?

The bandwidth on an interface is the bandwidth on the interface. It is possible to use multiple interfaces (up to eight) in a port channel between the switches to give you a greater aggregate ...
Ron Maupin's user avatar
  • 99.6k
5 votes
Accepted

How can I set the switchport's trunk protocol?

Only Cisco switch platforms that still support isl trunking need to have the trunking protocol configured. Newer platforms have no support for isl trunking anymore, so the interface command ...
Marc 'netztier' Luethi's user avatar
5 votes
Accepted

Use of VLAN allowed feature and security risk associated with not configuring it

Generally, you'll want to secure VLAN membership for all ports that you don't control on both link ends. If a trunk port - or rather the link partner - can simply join any VLAN they want then an ...
Zac67's user avatar
  • 84.4k
5 votes

Partitioning between VLAN in a Trunk switch architecture

Most of the time, a computer is connected to an access port--not because of security, but because most computers don't need to switch VLANs. And since they don't switch, most NIC cards can't create ...
Ron Trunk's user avatar
  • 67.5k
5 votes

Why STP has to be disable on Trunk Ports?

You should not disable spanning tree on trunk interfaces. In fact, STP needs to be on links between the switches, which should be the trunk interfaces. You can also leave STP enabled on the access ...
Ron Maupin's user avatar
  • 99.6k
5 votes
Accepted

Access and Trunk Port

What you have is correct. Changing the modes does not remove all of the configuration that the port previously had, in case you need to switch back for any reason. So, whatever it says in the ...
Jesse P.'s user avatar
  • 4,690
4 votes
Accepted

Are there any security advantages to activating VLAN tagging?

The security part comes from using VLANs. Users and devices on one VLAN cannot communicate with users and devices on another VLAN, except through a router. This gives you the opportunity to place ...
Ron Maupin's user avatar
  • 99.6k
4 votes

VTP and VTP domain

If you have not previously configured a switch to be in a VTP domain, it will become part of the VTP domain from the first VTP advertisement it sees. See the sections which I emphasized below: ...
Ron Maupin's user avatar
  • 99.6k

Only top scored, non community-wiki answers of a minimum length are eligible