Chapter 1. Using the Command-Line Interface

Information About Using the Command-Line Interface

Command Modes

Using the Help System

Understanding Abbreviated Commands

No and Default Forms of Commands

CLI Error Messages

Configuration Logging

Configuring the Command History

Changing the Command History Buffer Size

Recalling Commands

Disabling the Command History Feature

Enabling and Disabling Editing Features

Editing Commands Through Keystrokes

Editing Command Lines That Wrap

Searching and Filtering Output of show and more Commands

Accessing the CLI Through a Console Connection or Through Telnet

Chapter 2. Using the Web Graphical User Interface

Prerequisites for Using the Web GUI

Information About Using The Web GUI

Web GUI Features

Connecting the Console Port of the ControllerDevice

Logging On to the Web GUI

Enabling Web and Secure Web Modes

Configuring the ControllerDevice Web GUI

Chapter 3. Configuring VTP

Finding Feature Information

Prerequisites for VTP

Restrictions for VTP

VTP

VTP Domain

VTP Modes

VTP Advertisements

VTP Version 2

VTP Version 3

VTP Pruning

VTP Configuration Requirements

VTP Settings

Domain Names for Configuring VTP

Passwords for the VTP Domain

VTP Version

Configuring VTP Mode

Configuring a VTP Version 3 Password

Configuring a VTP Version 3 Primary Server

Enabling the VTP Version

Enabling VTP Pruning

Configuring VTP on a Per-Port Basis

Adding a VTP Client Switch to a VTP Domain

Monitoring VTP

Example: Configuring a Switch as the Primary Server

Where to Go Next

Additional References

Feature History and Information for VTP

Chapter 4. Configuring VLANs

Finding Feature Information

Prerequisites for VLANs

Restrictions for VLANs

Logical Networks

Supported VLANs

VLAN Port Membership Modes

VLAN Configuration Files

Normal-Range VLAN Configuration Guidelines

Extended-Range VLAN Configuration Guidelines

Information About VLAN Groups

How to Configure Normal-Range VLANs

Creating or Modifying an Ethernet VLAN

Deleting a VLAN

Creating VLAN Groups (CLI)

Adding a VLAN Group to WLAN (CLI)

Assigning Static-Access Ports to a VLAN

How to Configure Extended-Range VLANs

Creating an Extended-Range VLAN

Monitoring VLANs

Where to Go Next

Additional References

Feature History and Information for VLANs

Chapter 5. Configuring VLAN Group

Finding Feature Information

Prerequisites for VLAN Groups

Restrictions for VLAN Groups

Information About VLAN Groups

Creating VLAN Groups (CLI)

Removing VLAN Group (CLI)

Creating VLAN Groups (GUI)

Adding a VLAN Group to WLAN (CLI)

Adding a VLAN Group to WLAN (GUI)

Removing VLAN Groups (GUI)

Viewing VLANs in VLAN Groups (CLI)

Viewing VLAN Groups (GUI)

Where to Go Next

Additional References

Feature History and Information for VLAN Groups

Chapter 6. Configuring VLAN Trunks

Finding Feature Information

Prerequisites for VLAN Trunks

Restrictions for VLAN Trunks

Trunking Overview

Trunking Modes

Layer 2 Interface Modes

Allowed VLANs on a Trunk

Load Sharing on Trunk Ports

Network Load Sharing Using STP Priorities

Network Load Sharing Using STP Path Cost

Feature Interactions

How to Configure VLAN Trunks

Configuring a Trunk Port

Defining the Allowed VLANs on a Trunk

Changing the Pruning-Eligible List

Configuring the Native VLAN for Untagged Traffic

Configuring Load Sharing Using STP Port Priorities

Configuring Load Sharing Using STP Path Cost

Where to Go Next

Additional References

Feature History and Information for VLAN Trunks

Preface

Document Conventions

Related Documentation

Obtaining Documentation and Submitting a Service Request

Chapter 1. Using the Command-Line Interface

- Information About Using the Command-Line Interface

Information About Using the Command-Line Interface

- Command Modes

- Using the Help System

- Understanding Abbreviated Commands

- No and Default Forms of Commands

- CLI Error Messages

- Configuration Logging

Command Modes

The Cisco IOS user interface is divided into many different modes. The commands available to you depend on which mode you are currently in. Enter a question mark (?) at the system prompt to obtain a list of commands available for each command mode.

You can start a CLI session through a console connection, through Telnet, a SSH, or by using the browser.

When you start a session, you begin in user mode, often called user EXEC mode. Only a limited subset of the commands are available in user EXEC mode. For example, most of the user EXEC commands are one-time commands, such as show commands, which show the current configuration status, and clear commands, which clear counters or interfaces. The user EXEC commands are not saved when the controllerdevice reboots.

To have access to all commands, you must enter privileged EXEC mode. Normally, you must enter a password to enter privileged EXEC mode. From this mode, you can enter any privileged EXEC command or enter global configuration mode.

Using the configuration modes (global, interface, and line), you can make changes to the running configuration. If you save the configuration, these commands are stored and used when the controllerdevice reboots. To access the various configuration modes, you must start at global configuration mode. From global configuration mode, you can enter interface configuration mode and line configuration mode.

This table describes the main command modes, how to access each one, the prompt you see in that mode, and how to exit the mode.

Command Mode Summary

Mode

Access Method

Prompt

Exit Method

About This Mode

User EXEC

Begin a session using Telnet, SSH, or console.

>

Enter logout or quit.

Use this mode to

- Change terminal settings.

- Perform basic tests.

- Display system information.

Privileged EXEC

While in user EXEC mode, enter the enable command.

#

Enter disable to exit.

Use this mode to verify commands that you have entered. Use a password to protect access to this mode.

Use this mode to execute privilege EXEC commands for access points. These commands are not part of the running config of the controller, they are sent to the IOS config of the access point.

Global configuration

While in privileged EXEC mode, enter the configure command.

(config)#

To exit to privileged EXEC mode, enter exit or end, or press Ctrl-Z.

Use this mode to configure parameters that apply to the entire controllerdevice.

Use this mode to configure access point commands that are part of the running config of the controller.

VLAN configuration

While in global configuration mode, enter the vlan vlan-id command.

(config-vlan)#

To exit to global configuration mode, enter the exit command.

To return to privileged EXEC mode, press Ctrl-Z or enter end.

Use this mode to configure VLAN parameters. When VTP mode is transparent, you can create extended-range VLANs (VLAN IDs greater than 1005) and save configurations in the controllerdevice startup configuration file.

Interface configuration

While in global configuration mode, enter the interface command (with a specific interface).

(config-if)#

To exit to global configuration mode, enter exit.

To return to privileged EXEC mode, press Ctrl-Z or enter end.

Use this mode to configure parameters for the Ethernet ports.

Line configuration

While in global configuration mode, specify a line with the line vty or line console command.

(config-line)#

To exit to global configuration mode, enter exit.

To return to privileged EXEC mode, press Ctrl-Z or enter end.

Use this mode to configure parameters for the terminal line.

Using the Help System

You can enter a question mark (?) at the system prompt to display a list of commands available for each command mode. You can also obtain a list of associated keywords and arguments for any command.

SUMMARY STEPS

1.    help

2.    abbreviated-command-entry ?

3.    abbreviated-command-entry <Tab>

4.    ?

5.    command ?

6.    command keyword ?

DETAILED STEPS

Command or Action

Purpose

Step 1

help

Example:

# help

Obtains a brief description of the help system in any command mode.

Step 2

abbreviated-command-entry ?

Example:

# di?
dir disable disconnect

Obtains a list of commands that begin with a particular character string.

Step 3

abbreviated-command-entry <Tab>

Example:

# sh conf<tab>
# show configuration

Completes a partial command name.

Step 4

?

Example:

> ?

Lists all commands available for a particular command mode.

Step 5

command ?

Example:

> show ?

Lists the associated keywords for a command.

Step 6

command keyword ?

Example:

(config)# cdp holdtime ?
<10-255> Length of time (in sec) that receiver must keep this packet

Lists the associated arguments for a keyword.

Understanding Abbreviated Commands

You need to enter only enough characters for the controllerdevice to recognize the command as unique.

This example shows how to enter the show configuration privileged EXEC command in an abbreviated form:

# show conf

No and Default Forms of Commands

Almost every configuration command also has a no form. In general, use the no form to disable a feature or function or reverse the action of a command. For example, the no shutdown interface configuration command reverses the shutdown of an interface. Use the command without the keyword no to reenable a disabled feature or to enable a feature that is disabled by default.

Configuration commands can also have a default form. The default form of a command returns the command setting to its default. Most commands are disabled by default, so the default form is the same as the no form. However, some commands are enabled by default and have variables set to certain default values. In these cases, the default command enables the command and sets variables to their default values.

CLI Error Messages

This table lists some error messages that you might encounter while using the CLI to configure your controllerdevice.

Common CLI Error Messages

Error Message

Meaning

How to Get Help

% Ambiguous command: "show con"

You did not enter enough characters for your controllerdevice to recognize the command.

Reenter the command followed by a question mark (?) without any space between the command and the question mark.

The possible keywords that you can enter with the command appear.

% Incomplete command.

You did not enter all of the keywords or values required by this command.

Reenter the command followed by a question mark (?) with a space between the command and the question mark.

The possible keywords that you can enter with the command appear.

% Invalid input detected at ‘^’ marker.

You entered the command incorrectly. The caret (^) marks the point of the error.

Enter a question mark (?) to display all of the commands that are available in this command mode.

The possible keywords that you can enter with the command appear.

Configuration Logging

You can log and view changes to the controllerdevice configuration. You can use the Configuration Change Logging and Notification feature to track changes on a per-session and per-user basis. The logger tracks each configuration command that is applied, the user who entered the command, the time that the command was entered, and the parser return code for the command. This feature includes a mechanism for asynchronous notification to registered applications whenever the configuration changes. You can choose to have the notifications sent to the syslog.

Note

Only CLI or HTTP changes are logged.

Configuring the Command History

The software provides a history or record of commands that you have entered. The command history feature is particularly useful for recalling long or complex commands or entries, including access lists. You can customize this feature to suit your needs.

- Changing the Command History Buffer Size

- Recalling Commands

- Disabling the Command History Feature

Changing the Command History Buffer Size

By default, the controllerdevice records ten command lines in its history buffer. You can alter this number for a current terminal session or for all sessions on a particular line. This procedure is optional.

SUMMARY STEPS

1.    terminal history [size number-of-lines]

DETAILED STEPS

Command or Action

Purpose

Step 1

terminal history [size number-of-lines]

Example:

# terminal history size 200

Changes the number of command lines that the controllerdevice records during the current terminal session in privileged EXEC mode. You can configure the size from 0 to 256.

Recalling Commands

To recall commands from the history buffer, perform one of the actions listed in this table. These actions are optional.

Note

The arrow keys function only on ANSI-compatible terminals such as VT100s.

SUMMARY STEPS

1.    Ctrl-P or use the up arrow key

2.    Ctrl-N or use the down arrow key

3.    show history

DETAILED STEPS

Command or Action

Purpose

Step 1

Ctrl-P or use the up arrow key

Recalls commands in the history buffer, beginning with the most recent command. Repeat the key sequence to recall successively older commands.

Step 2

Ctrl-N or use the down arrow key

Returns to more recent commands in the history buffer after recalling commands with Ctrl-P or the up arrow key. Repeat the key sequence to recall successively more recent commands.

Step 3

show history

Example:

# show history

Lists the last several commands that you just entered in privileged EXEC mode. The number of commands that appear is controlled by the setting of the terminal history global configuration command and the history line configuration command.

Disabling the Command History Feature

The command history feature is automatically enabled. You can disable it for the current terminal session or for the command line. This procedure is optional.

SUMMARY STEPS

1.    terminal no history

DETAILED STEPS

Command or Action

Purpose

Step 1

terminal no history

Example:

# terminal no history

Disables the feature during the current terminal session in privileged EXEC mode.

Enabling and Disabling Editing Features

Although enhanced editing mode is automatically enabled, you can disable it and reenable it.

SUMMARY STEPS

1.    terminal editing

2.    terminal no editing

DETAILED STEPS

Command or Action

Purpose

Step 1

terminal editing

Example:

# terminal editing

Reenables the enhanced editing mode for the current terminal session in privileged EXEC mode.

Step 2

terminal no editing

Example:

# terminal no editing

Disables the enhanced editing mode for the current terminal session in privileged EXEC mode.

- Editing Commands Through Keystrokes

- Editing Command Lines That Wrap

Editing Commands Through Keystrokes

The keystrokes help you to edit the command lines. These keystrokes are optional.

Note

The arrow keys function only on ANSI-compatible terminals such as VT100s.

Editing Commands

Editing Commands

Description

Ctrl-B or use the left arrow key

Moves the cursor back one character.

Ctrl-F or use the right arrow key

Moves the cursor forward one character.

Ctrl-A

Moves the cursor to the beginning of the command line.

Ctrl-E

Moves the cursor to the end of the command line.

Esc B

Moves the cursor back one word.

Esc F

Moves the cursor forward one word.

Ctrl-T

Transposes the character to the left of the cursor with the character located at the cursor.

Delete or Backspace key

Erases the character to the left of the cursor.

Ctrl-D

Deletes the character at the cursor.

Ctrl-K

Deletes all characters from the cursor to the end of the command line.

Ctrl-U or Ctrl-X

Deletes all characters from the cursor to the beginning of the command line.

Ctrl-W

Deletes the word to the left of the cursor.

Esc D

Deletes from the cursor to the end of the word.

Esc C

Capitalizes at the cursor.

Esc L

Changes the word at the cursor to lowercase.

Esc U

Capitalizes letters from the cursor to the end of the word.

Ctrl-V or Esc Q

Designates a particular keystroke as an executable command, perhaps as a shortcut.

Return key

Scrolls down a line or screen on displays that are longer than the terminal screen can display.

Note:
The More prompt is used for any output that has more lines than can be displayed on the terminal screen, including show command output. You can use the Return and Space bar keystrokes whenever you see the More prompt.

Space bar

Scrolls down one screen.

Ctrl-L or Ctrl-R

Redisplays the current command line if the controllerdevice suddenly sends a message to your screen.

Editing Command Lines That Wrap

You can use a wraparound feature for commands that extend beyond a single line on the screen. When the cursor reaches the right margin, the command line shifts ten spaces to the left. You cannot see the first ten characters of the line, but you can scroll back and check the syntax at the beginning of the command. The keystroke actions are optional.

To scroll back to the beginning of the command entry, press Ctrl-B or the left arrow key repeatedly. You can also press Ctrl-A to immediately move to the beginning of the line.

Note

The arrow keys function only on ANSI-compatible terminals such as VT100s.

The following example shows how to wrap a command line that extends beyond a single line on the screen.

SUMMARY STEPS

1.    access-list

2.    Ctrl-A

3.    Return key

DETAILED STEPS

Command or Action

Purpose

Step 1

access-list

Example:

(config)# access-list 101 permit tcp 10.15.22.25 255.255.255.0 10.15.22.35
(config)# $ 101 permit tcp 10.15.22.25 255.255.255.0 10.15.22.35 255.25
(config)# $t tcp 10.15.22.25 255.255.255.0 131.108.1.20 255.255.255.0 eq
(config)# $15.22.25 255.255.255.0 10.15.22.35 255.255.255.0 eq 45

Displays the global configuration command entry that extends beyond one line.

When the cursor first reaches the end of the line, the line is shifted ten spaces to the left and redisplayed. The dollar sign ($) shows that the line has been scrolled to the left. Each time the cursor reaches the end of the line, the line is again shifted ten spaces to the left.

Step 2

Ctrl-A

Example:

(config)# access-list 101 permit tcp 10.15.22.25 255.255.255.0 10.15.2$

Checks the complete syntax.

The dollar sign ($) appears at the end of the line to show that the line has been scrolled to the right.

Step 3

Return key

Execute the commands.

The software assumes that you have a terminal screen that is 80 columns wide. If you have a different width, use the terminal width privileged EXEC command to set the width of your terminal.

Use line wrapping with the command history feature to recall and modify previous complex command entries.

Searching and Filtering Output of show and more Commands

You can search and filter the output for show and more commands. This is useful when you need to sort through large amounts of output or if you want to exclude output that you do not need to see. Using these commands is optional.

SUMMARY STEPS

1.    {show | more} command | {begin | include | exclude} regular-expression

DETAILED STEPS

Command or Action

Purpose

Step 1

{show | more} command | {begin | include | exclude} regular-expression

Example:

# show interfaces | include protocol
Vlan1 is up, line protocol is up
Vlan10 is up, line protocol is down
GigabitEthernet1/0/1 is up, line protocol is down
GigabitEthernet1/0/2 is up, line protocol is up

Searches and filters the output.

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain output appear.

Accessing the CLI Through a Console Connection or Through Telnet

Before you can access the CLI, you must connect a terminal or a PC to the controllerdevice console or connect a PC to the Ethernet management port and then power on the controllerdevice, as described in the hardware installation guide that shipped with your controllerdevice.

If your controllerdevice is already configured, you can access the CLI through a local console connection or through a remote Telnet session, but your controllerdevice must first be configured for this type of access.

You can use one of these methods to establish a connection with the controllerdevice:

- Connect the controllerdevice console port to a management station or dial-up modem, or connect the Ethernet management port to a PC. For information about connecting to the console or Ethernet management port, see the controllerdevice hardware installation guide.

- Use any Telnet TCP/IP or encrypted Secure Shell (SSH) package from a remote management station. The controllerdevice must have network connectivity with the Telnet or SSH client, and the controllerdevice must have an enable secret password configured.

- The controllerdevice supports up to 16 simultaneous Telnet sessions. Changes made by one Telnet user are reflected in all other Telnet sessions.

- The controllerdevice supports up to five simultaneous secure SSH sessions.

After you connect through the console port, through the Ethernet management port, through a Telnet session or through an SSH session, the user EXEC prompt appears on the management station.

Chapter 2. Using the Web Graphical User Interface

- Prerequisites for Using the Web GUI

- Information About Using The Web GUI

- Connecting the Console Port of the ControllerDevice

- Logging On to the Web GUI

- Enabling Web and Secure Web Modes

- Configuring the ControllerDevice Web GUI

Prerequisites for Using the Web GUI

- The GUI must be used on a PC running Windows 7, Windows XP SP1 (or later releases), or Windows 2000 SP4 (or later releases).

- The controllerdevice GUI is compatible with Microsoft Internet Explorer version 10.x, Mozilla Firefox 20.x, or Google Chrome 26.x.

Information About Using The Web GUI

A web browser, or graphical user interface (GUI), is built into each controllerdevice.

You can use either the service port interface or the management interface to access the GUI. We recommend that you use the service-port interface. Click Help at the top of any page in the GUI to display online help. You might need to disable your browser’s pop-up blocker to view the online help.

- Web GUI Features

Web GUI Features

The controllerdevice web GUI supports the following:

The Configuration Wizard—After initial configuration of the IP address and the local username/password or auth via the authentication server (privilege 15 needed), the wizard provides a method to complete the initial wireless configuration. Start the wizard through Configuration -> Wizard and follow the nine-step process to configure the following:

- Admin Users

- SNMP System Summary

- Management Port

- Wireless Management

- RF Mobility and Country code

- Mobility configuration

- WLANs

- 802.11 Configuration

- Set Time

The Monitor tab:

- Displays summary details of controllerdevice, clients, and access points.

- Displays all radio and AP join statistics.

- Displays air quality on access points.

- Displays list of all Cisco Discovery Protocol (CDP) neighbors on all interfaces and the CDP traffic information.

- Displays all rogue access points based on their classification-friendly, malicious, ad hoc, classified, and unclassified.

The Configuration tab:

- Enables you to configure the controllerdevice for all initial operation using the web Configuration Wizard. The wizard allows you to configure user details, management interface, and so on.

- Enables you to configure the system, internal DHCP server, management, and mobility management parameters.

- Enables you to configure the controllerdevice, WLAN, and radios.

- Enables you to configure and set security policies on your controllerdevice.

- Enables you to access the controllerdevice operating system software management commands.

The Administration tab enables you to configure system logs.

Connecting the Console Port of the ControllerDevice

Before You Begin
Before you can configure the controllerdevice for basic operations, you need to connect it to a PC that uses a VT-100 terminal emulation program (such as HyperTerminal, ProComm, Minicom, or Tip).

Step 1

Connect one end of a null-modem serial cable to the controllerdevice's RJ-45 console port and the other end to your PC's serial port.

Step 2

Plug the AC power cord into the controllerdevice and a grounded 100 to 240 VAC, 50/60-Hz electrical outlet. Turn on the power supply. The bootup script displays operating system software initialization (code download and power-on self-test verification) and basic configuration. If the controllerdevice passes the power-on self-test, the bootup script runs the configuration wizard, which prompts you for basic configuration input.

Step 3

Enter yes. Proceed with basic initial setup configuration parameters in the CLI setup wizard. Specify the IP address for the service port which is the gigabitethernet 0/0 interface.
After entering the configuration parameters in the configuration wizard, you can access the Web GUI. Now, the controllerdevice is configured with the IP address for service port.

Logging On to the Web GUI

Step 1

Enter the controllerdevice IP address in your browser’s address bar. For a secure connection, enter https://ip-address. For a less secure connection, enter http://ip-address.

Step 2

When prompted, enter a valid username and password and click OK.
Note:
The administrative username and password that you created in the configuration wizard are case sensitive. The default username is admin, and the default password is cisco.

The Accessing page appears.

Enabling Web and Secure Web Modes

Step 1

Choose Configuration > Controller > Management > Protocol Management > HTTP-HTTPS.

The HTTP-HTTPS Configuration page appears.

Step 2

To enable web mode, which allows users to access the controllerdevice GUI using “http://ip-address,” choose Enabled from the HTTP Access drop-down list. Otherwise, choose Disabled. Web mode (HTTP) is not a secure connection.

Step 3

To enable secure web mode, which allows users to access the controllerdevice GUI using “https://ip-address,” choose Enabled from the HTTPS Access drop-down list. Otherwise, choose Disabled. Secure web mode (HTTPS) is a secure connection.

Step 4

Choose to track the device in the IP Device Tracking check box.

Step 5

Choose to enable the trust point in the Enable check box.

Step 6

Choose the trustpoints from the Trustpoints drop-down list.

Step 7

Enter the amount of time, in seconds, before the web session times out due to inactivity in the HTTP Timeout-policy (1 to 600 sec) text box.
The valid range is from 1 to 600 seconds.

Step 8

Enter the server life time in the Server Life Time (1 to 86400 sec) text box.
The valid range is from1 to 86400 seconds.

Step 9

Enter the maximum number of connection requests that the server can accept in the Maximum number of Requests (1 to 86400) text box.
The valid range is from 1 to 86400 connections.

Step 10

Click Apply.

Step 11

Click Save Configuration.

Configuring the ControllerDevice Web GUI

The configuration wizard enables you to configure basic settings on the controllerdevice. You can run the wizard after you receive the controllerdevice from the factory or after the controllerdevice has been reset to factory defaults. The configuration wizard is available in both GUI and CLI formats.

Step 1

Connect your PC to the service port and configure an IPv4 address to use the same subnet as the controllerdevice. The controllerdevice is loaded with IOS XE image and the service port interface is configured as gigabitethernet 0/0.

Step 2

Start Internet Explorer 10 (or later), Firefox 2.0.0.11 (or later), or Google Chrome on your PC and enter the management interface IP address on the browser window. The management interface IP address is same as the gigabitethernet 0/0 (also known as service port interface). When you log in for the first time, you need to enter HTTP username and password. By default, the username is admin and the password is cisco.
You can use both HTTP and HTTPS when using the service port interface. HTTPS is enabled by default and HTTP can also be enabled.

When you log in for the first time, the Accessing Cisco Controller <Model Number> <Hostname> page appears.

Step 3

On the Accessing Cisco Controller page, click the Wireless Web GUI link to access controllerdevice web GUI Home page.

Step 4

Choose Configuration > Wizard to perform all steps that you need to configure the controllerdevice initially.
The Admin Users page appears.

Step 5

On the Admin Users page, enter the administrative username to be assigned to this controllerdevice in the User Name text box and the administrative password to be assigned to this controllerdevice in the Password and Confirm Password text boxes. Click Next.
The default username is admin and the default password is cisco. You can also create a new administrator user for the controllerdevice. You can enter up to 24 ASCII characters for username and password.

The SNMP System Summary page appears.

Step 6

On the SNMP System Summary page, enter the following SNMP system parameters for the controllerdevice, and click Next:

- Customer-definable controllerdevice location in the Location text box.

- Customer-definable contact details such as phone number with names in the Contact text box.

- Choose enabled to send SNMP notifications for various SNMP traps or disabled not to send SNMP notifications for various SNMP traps from the SNMP Global Trap drop-down list.

- Choose enabled to send system log messages or disabled not to send system log messages from the SNMP Logging drop-down list.

Note:
The SNMP trap server, must be reachable through the distribution ports (and not through the gigabitethernet0/0 service or management interface).

The Management Port page appears.

Step 7

In the Management Port page, enter the following parameters for the management port interface (gigabitethernet 0/0) and click Next.

- Interface IP address that you assigned for the service port in the IP Address text box.

- Network mask address of the management port interface in the Netmask text box.

- The IPv4 Dynamic Host Configuration Protocol (DHCP) address for the selected port in the IPv4 DHCP Server text box.

The Wireless Management page appears.

Step 8

In the Wireless Management page, enter the following wireless interface management details, and click Next.

- Choose the interface—VLAN, or Ten Gigabit Ethernet from the Select Interface drop-down list.

- VLAN tag identifier, or 0 for no VLAN tag in the VLAN id text box.

- IP address of wireless management interface where access points are connected in the IP Address text box.

- Network mask address of the wireless management interface in the Netmask text box.

- DHCP IPv4 IP address in the IPv4 DHCP Server text box.

When selecting VLAN as interface, you can specify the ports as –Trunk or Access ports from the selected list displayed in the Switch Port Configuration text box.

The RF Mobility and Country Code page appears.

Step 9

In the RF Mobility and Country Code page, enter the RF mobility domain name in the RF Mobility text box, choose current country code from the Country Code drop-down list, and click Next. From the GUI, you can select only one country code.

Note:   Before configuring RF grouping parameters and mobility configuration, ensure that you refer to the relevant conceptual content and then proceed with the configuration.

The Mobility Configuration page with mobility global configuration settings appears.

Step 10

In the Mobility Configuration page, view and enter the following mobility global configuration settings, and click Next.

- Displays Mobility Controller in the Mobility Role text box.

- Displays mobility protocol port number in the Mobility Protocol Port text box.

- Displays the mobility group name in the Mobility Group Name text box.

- Displays whether DTLS is enabled in the DTLS Mode text box. DTLS is a standards-track Internet Engineering Task Force (IETF) protocol based on TLS.

- Displays mobility domain identifier for 802.11 radios in the Mobility Domain ID for 802.11 radios text box.

- Displays the number of members configured on the controllerdevice in the Mobility Domain Member Count text box.

- To enable the controller as a Mobility Oracle, select the Mobility Oracle Enabled check box.
Note:
Only the controller can be configured as Mobility Oracle. You cannot configure the switch as Mobility Oracle.

The Mobility Oracle is optional, it maintains the client database under one complete mobility domain.

- The amount of time (in seconds) between each ping request sent to an peer controllerdevice in the Mobility Keepalive Interval (1-30)sec text box. Valid range is from 1 to 30 seconds, and the default value is 10 seconds.

- Number of times a ping request is sent to an peer controllerdevice before the peer is considered to be unreachable in the Mobility Keepalive Count (3-20) text box. The valid range is from 3 to 20, and the default value is 3.

- The DSCP value that you can set for the mobility controllerdevice in the Mobility Control Message DSCP Value (0-63) text box. The valid range is 0 to 63, and the default value is 0.

The WLANs page appears.

Step 11

In the WLANs page, enter the following WLAN configuration parameters, and click Next.

- WLAN identifier in the WLAN ID text box.

- SSID of the WLAN that the client is associated with in the SSID text box.

- Name of the WLAN used by the client in the Profile Name text box.

The 802.11 Configuration page appears.

Step 12

In the 802.11 Configuration page, check either one or both 802.11a/n/ac and 802.11b/g/n check boxes to enable the 802.11 radios, and click Next.
The Set Time page appears.

Step 13

In the Set Time page, you can configure the time and date on the controllerdevice based on the following parameters, and click Next.

- Displays current timestamp on the controllerdevice in the Current Time text box.

- Choose either Manual or NTP from the Mode drop-down list. On using the NTP server, all access points connected to the controllerdevice, synchronizes its time based on the NTP server settings available.

- Choose date on the controllerdevice from the Year, Month, and Day drop-down list.

- Choose time from the Hours, Minutes, and Seconds drop-down list.

- Enter the time zone in the Zone text box and select the off setting required when compared to the current time configured on the controllerdevice from the Offset drop-down list.

The Save Wizard page appears.

Step 14

In the Save Wizard page, you can review the configuration settings performed on the controllerdevice using these steps, and if you wish to change any configuration value, click Previous and navigate to that page.
You can save the controllerdevice configuration created using the wizard only if a success message is displayed for all the wizards. If the Save Wizard page displays errors, you must recreate the wizard for initial configuration of the controllerdevice.

Chapter 3. Configuring VTP

- Finding Feature Information

- Prerequisites for VTP

- Restrictions for VTP

- Monitoring VTP

- Where to Go Next

- Additional References

- Feature History and Information for VTP

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for VTP

Before you create VLANs, you must decide whether to use the VLAN Trunking Protocol (VTP) in your network. Using VTP, you can make configuration changes centrally on one or more controllersdevices and have those changes automatically communicated to all the other controllersdevices in the network. Without VTP, you cannot send information about VLANs to other controllersdevices.

VTP is designed to work in an environment where updates are made on a single controllerdevice and are sent through VTP to other controllersdevices in the domain. It does not work well in a situation where multiple updates to the VLAN database occur simultaneously on controllersdevices in the same domain, which would result in an inconsistency in the VLAN database.

The controllerdevice supports a total of 4094 VLANs. However, the number of configured features affects the usage of the controllerdevice hardware. If the controllerdevice is notified by VTP of a new VLAN and the controllerdevice is already using the maximum available hardware resources, it sends a message that there are not enough hardware resources available and shuts down the VLAN. The output of the show vlan user EXEC command shows the VLAN in a suspended state.

Because trunk ports send and receive VTP advertisements, you must ensure that at least one trunk port is configured on the controllerdevice and that this trunk port is connected to the trunk port of another controllerdevice. Otherwise, the controllerdevice cannot receive any VTP advertisements.

Restrictions for VTP

Caution

Before adding a VTP client controllerdevice to a VTP domain, always verify that its VTP configuration revision number is lower than the configuration revision number of the other controllersdevices in the VTP domain. ControllersDevices in a VTP domain always use the VLAN configuration of the controllerdevice with the highest VTP configuration revision number. If you add a controllerdevice that has a revision number higher than the revision number in the VTP domain, it can erase all VLAN information from the VTP server and VTP domain.

VTP

VTP is a Layer 2 messaging protocol that maintains VLAN configuration consistency by managing the addition, deletion, and renaming of VLANs on a network-wide basis. VTP minimizes misconfigurations and configuration inconsistencies that can cause several problems, such as duplicate VLAN names, incorrect VLAN-type specifications, and security violations.

VTP Domain

A VTP domain (also called a VLAN management domain) consists of one controllerdevice or several interconnected controllersdevices or controllerdevice stacks under the same administrative responsibility sharing the same VTP domain name. A controllerdevice can be in only one VTP domain. You make global VLAN configuration changes for the domain.

By default, the controllerdevice is in the VTP no-management-domain state until it receives an advertisement for a domain over a trunk link (a link that carries the traffic of multiple VLANs) or until you configure a domain name. Until the management domain name is specified or learned, you cannot create or modify VLANs on a VTP server, and VLAN information is not propagated over the network.

If the controllerdevice receives a VTP advertisement over a trunk link, it inherits the management domain name and the VTP configuration revision number. The controllerdevice then ignores advertisements with a different domain name or an earlier configuration revision number.

When you make a change to the VLAN configuration on a VTP server, the change is propagated to all controllersdevices in the VTP domain. VTP advertisements are sent over all IEEE trunk connections, including IEEE 802.1Q. VTP dynamically maps VLANs with unique names and internal index associates across multiple LAN types. Mapping eliminates excessive device administration required from network administrators.

If you configure a controllerdevice for VTP transparent mode, you can create and modify VLANs, but the changes are not sent to other controllersdevices in the domain, and they affect only the individual controllerdevice. However, configuration changes made when the controllerdevice is in this mode are saved in the controllerdevice running configuration and can be saved to the controllerdevice startup configuration file.

VTP Modes

VTP Modes

VTP Mode

Description

VTP server

In VTP server mode, you can create, modify, and delete VLANs, and specify other configuration parameters (such as the VTP version) for the entire VTP domain. VTP servers advertise their VLAN configurations to other controllersdevices in the same VTP domain and synchronize their VLAN configurations with other controllersdevices based on advertisements received over trunk links.

VTP server is the default mode.

In VTP server mode, VLAN configurations are saved in NVRAM. If the controllerdevice detects a failure while writing a configuration to NVRAM, VTP mode automatically changes from server mode to client mode. If this happens, the controllerdevice cannot be returned to VTP server mode until the NVRAM is functioning.

VTP client

A VTP client functions like a VTP server and transmits and receives VTP updates on its trunks, but you cannot create, change, or delete VLANs on a VTP client. VLANs are configured on another controllerdevice in the domain that is in server mode.

In VTP versions 1 and 2 in VTP client mode, VLAN configurations are not saved in NVRAM. In VTP version 3, VLAN configurations are saved in NVRAM in client mode.

VTP transparent

VTP transparent controllersdevices do not participate in VTP. A VTP transparent controllerdevice does not advertise its VLAN configuration and does not synchronize its VLAN configuration based on received advertisements. However, in VTP version 2 or version 3, transparent controllersdevices do forward VTP advertisements that they receive from other controllersdevices through their trunk interfaces. You can create, modify, and delete VLANs on a controllerdevice in VTP transparent mode.

When the controllerdevice is in VTP transparent mode, the VTP and VLAN configurations are saved in NVRAM, but they are not advertised to other controllersdevices. In this mode, VTP mode and domain name are saved in the controllerdevice running configuration, and you can save this information in the controllerdevice startup configuration file by using the copy running-config startup-config privileged EXEC command.

VTP off

A controllerdevice in VTP off mode functions in the same manner as a VTP transparent controllerdevice, except that it does not forward VTP advertisements on trunks.

VTP Advertisements

Each controllerdevice in the VTP domain sends periodic global configuration advertisements from each trunk port to a reserved multicast address. Neighboring controllersdevices receive these advertisements and update their VTP and VLAN configurations as necessary.

VTP advertisements distribute this global domain information:

- VTP domain name

- VTP configuration revision number

- Update identity and update timestamp

- MD5 digest VLAN configuration, including maximum transmission unit (MTU) size for each VLAN

- Frame format

VTP advertisements distribute this VLAN information for each configured VLAN:

- VLAN IDs (including IEEE 802.1Q)

- VLAN name

- VLAN type

- VLAN state

- Additional VLAN configuration information specific to the VLAN type

In VTP version 3, VTP advertisements also include the primary server ID, an instance number, and a start index.

VTP Version 2

If you use VTP in your network, you must decide which version of VTP to use. By default, VTP operates in version 1.

VTP version 2 supports these features that are not supported in version 1:

- Token Ring support—VTP version 2 supports Token Ring Bridge Relay Function (TrBRF) and Token Ring Concentrator Relay Function (TrCRF) VLANs.

- Unrecognized Type-Length-Value (TLV) support—A VTP server or client propagates configuration changes to its other trunks, even for TLVs it is not able to parse. The unrecognized TLV is saved in NVRAM when the controllerdevice is operating in VTP server mode.

- Version-Dependent Transparent Mode—In VTP version 1, a VTP transparent controllerdevice inspects VTP messages for the domain name and version and forwards a message only if the version and domain name match. Although VTP version 2 supports only one domain, a VTP version 2 transparent controllerdevice forwards a message only when the domain name matches.

- Consistency Checks—In VTP version 2, VLAN consistency checks (such as VLAN names and values) are performed only when you enter new information through the CLI or SNMP. Consistency checks are not performed when new information is obtained from a VTP message or when information is read from NVRAM. If the MD5 digest on a received VTP message is correct, its information is accepted.

VTP Version 3

VTP version 3 supports these features that are not supported in version 1 or version 2:

- Enhanced authentication—You can configure the authentication as hidden or secret. When hidden, the secret key from the password string is saved in the VLAN database file, but it does not appear in plain text in the configuration. Instead, the key associated with the password is saved in hexadecimal format in the running configuration. You must reenter the password if you enter a takeover command in the domain. When you enter the secret keyword, you can directly configure the password secret key.

- Support for extended range VLAN (VLANs 1006 to 4094) database propagation—VTP versions 1 and 2 propagate only VLANs 1 to 1005.

Note

VTP pruning still applies only to VLANs 1 to 1005, and VLANs 1002 to 1005 are still reserved and cannot be modified.

- Support for any database in a domain—In addition to propagating VTP information, version 3 can propagate Multiple Spanning Tree (MST) protocol database information. A separate instance of the VTP protocol runs for each application that uses VTP.

- VTP primary server and VTP secondary servers—A VTP primary server updates the database information and sends updates that are honored by all devices in the system. A VTP secondary server can only back up the updated VTP configurations received from the primary server to its NVRAM. By default, all devices come up as secondary servers. You can enter the vtp primary privileged EXEC command to specify a primary server. Primary server status is only needed for database updates when the administrator issues a takeover message in the domain. You can have a working VTP domain without any primary servers. Primary server status is lost if the device reloads or domain parameters change, even when a password is configured on the controllerdevice.

- The option to turn VTP on or off on a per-trunk (per-port) basis—You can enable or disable VTP per port by entering the [no] vtp interface configuration command. When you disable VTP on trunking ports, all VTP instances for that port are disabled. You cannot set VTP to off for the MST database and on for the VLAN database on the same port. When you globally set VTP mode to off, it applies to all the trunking ports in the system. However, you can specify on or off on a per-VTP instance basis. For example, you can configure the controllerdevice as a VTP server for the VLAN database but with VTP off for the MST database.

VTP Pruning

VTP pruning increases network available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to reach the destination devices. Without VTP pruning, a controllerdevice floods broadcast, multicast, and unknown unicast traffic across all trunk links within a VTP domain even though receiving controllersdevices might discard them. VTP pruning is disabled by default.

VTP pruning blocks unneeded flooded traffic to VLANs on trunk ports that are included in the pruning-eligible list. Only VLANs included in the pruning-eligible list can be pruned. By default, VLANs 2 through 1001 are pruning eligible controllerdevice trunk ports. If the VLANs are configured as pruning-ineligible, the flooding continues. VTP pruning is supported in all VTP versions.

Enabling VTP pruning on a VTP server enables pruning for the entire management domain. Making VLANs pruning-eligible or pruning-ineligible affects pruning eligibility for those VLANs on that trunk only (not on all controllersdevices in the VTP domain).

VTP pruning takes effect several seconds after you enable it. VTP pruning does not prune traffic from VLANs that are pruning-ineligible. VLAN 1 and VLANs 1002 to 1005 are always pruning-ineligible; traffic from these VLANs cannot be pruned. Extended-range VLANs (VLAN IDs higher than 1005) are also pruning-ineligible.

VTP Configuration Requirements

When you configure VTP, you must configure a trunk port so that the controllerdevice can send and receive VTP advertisements to and from other controllersdevices in the domain.

VTP Settings

The VTP information is saved in the VTP VLAN database. When VTP mode is transparent, the VTP domain name and mode are also saved in the controllerdevice running configuration file, and you can save it in the controllerdevice startup configuration file by entering the copy running-config startup-config privileged EXEC command. You must use this command if you want to save VTP mode as transparent, even if the controllerdevice resets.

When you save VTP information in the controllerdevice startup configuration file and reboot the controllerdevice, the controllerdevice configuration is selected as follows:

- If the VTP mode is transparent in the startup configuration and the VLAN database and the VTP domain name from the VLAN database matches that in the startup configuration file, the VLAN database is ignored (cleared), and the VTP and VLAN configurations in the startup configuration file are used. The VLAN database revision number remains unchanged in the VLAN database.

- If the VTP mode or domain name in the startup configuration do not match the VLAN database, the domain name and VTP mode and configuration for VLAN IDs 1 to 1005 use the VLAN database information.

Domain Names for Configuring VTP

When configuring VTP for the first time, you must always assign a domain name. You must configure all controllersdevices in the VTP domain with the same domain name. ControllersDevices in VTP transparent mode do not exchange VTP messages with other controllersdevices, and you do not need to configure a VTP domain name for  them.

Note

If the NVRAM and DRAM storage is sufficient, all controllersdevices in a VTP domain should be in VTP server mode.

Caution

Do not configure a VTP domain if all controllersdevices are operating in VTP client mode. If you configure the domain, it is impossible to make changes to the VLAN configuration of that domain. Make sure that you configure at least one controllerdevice in the VTP domain for VTP server mode.

Passwords for the VTP Domain

You can configure a password for the VTP domain, but it is not required. If you do configure a domain password, all domain controllersdevices must share the same password and you must configure the password on each controllerdevice in the management domain. ControllersDevices without a password or with the wrong password reject VTP advertisements.

If you configure a VTP password for a domain, a controllerdevice that is booted without a VTP configuration does not accept VTP advertisements until you configure it with the correct password. After the configuration, the controllerdevice accepts the next VTP advertisement that uses the same password and domain name in the advertisement.

If you are adding a new controllerdevice to an existing network with VTP capability, the new controllerdevice learns the domain name only after the applicable password has been configured on it.

Caution

When you configure a VTP domain password, the management domain does not function properly if you do not assign a management domain password to each controllerdevice in the domain.

VTP Version

Follow these guidelines when deciding which VTP version to implement:

- All controllersdevices in a VTP domain must have the same domain name, but they do not need to run the same VTP version.

- A VTP version 2-capable controllerdevice can operate in the same VTP domain as a controllerdevice running VTP version 1 if version 2 is disabled on the version 2-capable controllerdevice (version 2 is disabled by default).

- If a controllerdevice running VTP version 1, but capable of running VTP version 2, receives VTP version 3 advertisements, it automatically moves to VTP version 2.

- If a controllerdevice running VTP version 3 is connected to a controllerdevice running VTP version 1, the VTP version 1 controllerdevice moves to VTP version 2, and the VTP version 3 controllerdevice sends scaled-down versions of the VTP packets so that the VTP version 2 controllerdevice can update its database.

- A controllerdevice running VTP version 3 cannot move to version 1 or 2 if it has extended VLANs.

- Do not enable VTP version 2 on a controllerdevice unless all of the controllersdevices in the same VTP domain are version-2-capable. When you enable version 2 on a controllerdevice, all of the version-2-capable controllersdevices in the domain enable version 2. If there is a version 1-only controllerdevice, it does not exchange VTP information with controllersdevices that have version 2 enabled.

- Cisco recommends placing VTP version 1 and 2 controllersdevices at the edge of the network because they do not forward VTP version 3 advertisements.

- If there are TrBRF and TrCRF Token Ring networks in your environment, you must enable VTP version 2 or version 3 for Token Ring VLAN switching to function properly. To run Token Ring and Token Ring-Net, disable VTP version 2.

- VTP version 1 and version 2 do not propagate configuration information for extended range VLANs (VLANs 1006 to 4094). You must configure these VLANs manually on each device. VTP version 3 supports extended-range VLANs and support for extended range VLAN database propagation.

- When a VTP version 3 device trunk port receives messages from a VTP version 2 device, it sends a scaled-down version of the VLAN database on that particular trunk in VTP version 2 format. A VTP version 3 device does not send VTP version 2-formatted packets on a trunk unless it first receives VTP version 2 packets on that trunk port.

- When a VTP version 3 device detects a VTP version 2 device on a trunk port, it continues to send VTP version 3 packets, in addition to VTP version 2 packets, to allow both kinds of neighbors to coexist on the same trunk.

- A VTP version 3 device does not accept configuration information from a VTP version 2 or version 1 device.

- Two VTP version 3 regions can only communicate in transparent mode over a VTP version 1 or version 2 region.

- Devices that are only VTP version 1 capable cannot interoperate with VTP version 3 devices.

- VTP version 1 and version 2 do not propagate configuration information for extended range VLANs (VLANs 1006 to 4094). You must manually configure these VLANs on each device.

Configuring VTP Mode

You can configure VTP mode as one of these:

- VTP server mode—In VTP server mode, you can change the VLAN configuration and have it propagated throughout the network.

- VTP client mode—In VTP client mode, you cannot change its VLAN configuration. The client controllerdevice receives VTP updates from a VTP server in the VTP domain and then modifies its configuration accordingly.

- VTP transparent mode—In VTP transparent mode, VTP is disabled on the controllerdevice. The controllerdevice does not send VTP updates and does not act on VTP updates received from other controllerdevice. However, a VTP transparent controllerdevice running VTP version 2 does forward received VTP advertisements on its trunk links.

- VTP off mode—VTP off mode is the same as VTP transparent mode except that VTP advertisements are not forwarded.

When you configure a domain name, it cannot be removed; you can only reassign a controllerdevice to a different domain.

SUMMARY STEPS

1.    configure terminal

2.    vtp domain domain-name

3.    vtp mode {client | server | transparent | off} {vlan | mst | unknown}

4.    vtp password password

5.    end

6.    show vtp status

7.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vtp domain domain-name

Example:

(config)# vtp domain eng_group

Configures the VTP administrative-domain name. The name can be 1 to 32 characters. All controllersdevices operating in VTP server or client mode under the same administrative responsibility must be configured with the same domain name.

This command is optional for modes other than server mode. VTP server mode requires a domain name. If the controllerdevice has a trunk connection to a VTP domain, the controllerdevice learns the domain name from the VTP server in the domain.

You should configure the VTP domain before configuring other VTP parameters.

Note:

Step 3

vtp mode {client | server | transparent | off} {vlan | mst | unknown}

Example:

(config)# vtp mode server

Configures the controllerdevice for VTP mode (client, server, transparent, or off).

- vlan—The VLAN database is the default if none are configured.

- mst—The multiple spanning tree (MST) database.

- unknown—An unknown database type.

Step 4

vtp password password

Example:

(config)# vtp password mypassword

(Optional) Sets the password for the VTP domain. The password can be 8 to 64 characters. If you configure a VTP password, the VTP domain does not function properly if you do not assign the same password to each controllerdevice in the domain.

Step 5

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 6

show vtp status

Example:

# show vtp status

Verifies your entries in the VTP Operating Mode and the VTP Domain Name fields of the display.

Step 7

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves the configuration in the startup configuration file.

Only VTP mode and domain name are saved in the controllerdevice running configuration and can be copied to the startup configuration file.

Configuring a VTP Version 3 Password

You can configure a VTP version 3 password on the controllerdevice.

SUMMARY STEPS

1.    configure terminal

2.    vtp password password [hidden | secret]

3.    end

4.    show vtp password

5.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vtp password password [hidden | secret]

Example:

(config)# vtp password mypassword hidden

(Optional) Sets the password for the VTP domain. The password can be 8 to 64 characters.

- (Optional) hidden—Saves the secret key generated from the password string in the nvram:vlan.dat file. If you configure a takeover by configuring a VTP primary server, you are prompted to reenter the password.

- (Optional) secret—Directly configures the password. The secret password must contain 32 hexadecimal characters.

Step 3

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 4

show vtp password

Example:

# show vtp password

Verifies your entries. The output appears like this:

VTP password: 89914640C8D90868B6A0D8103847A733

Step 5

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves the configuration in the startup configuration file.

Configuring a VTP Version 3 Primary Server

When you configure a VTP server as a VTP primary server, the takeover operation starts.

SUMMARY STEPS

1.    vtp primary [vlan | mst] [force]

DETAILED STEPS

Command or Action

Purpose

Step 1

vtp primary [vlan | mst] [force]

Example:

# vtp primary vlan force

Changes the operational state of a controllerdevice from a secondary server (the default) to a primary server and advertises the configuration to the domain. If the controllerdevice password is configured as hidden, you are prompted to reenter the password.

- (Optional) vlan—Selects the VLAN database as the takeover feature. This is the default.

- (Optional) mst—Selects the multiple spanning tree (MST) database as the takeover feature.

- (Optional) force—Overwrites the configuration of any conflicting servers. If you do not enter force, you are prompted for confirmation before the takeover.

Enabling the VTP Version

VTP version 2 and version 3 are disabled by default.

- When you enable VTP version 2 on a controllerdevice , every VTP version 2-capable controllerdevice in the VTP domain enables version 2. To enable VTP version 3, you must manually configure it on each controllerdevice .

- With VTP versions 1 and 2, you can configure the version only on controllersdevices in VTP server or transparent mode. If a controllerdevice is running VTP version 3, you can change to version 2 when the controllerdevice is in client mode if no extended VLANs exist, and no hidden password was configured.

Caution

VTP version 1 and VTP version 2 are not interoperable on controllersdevices in the same VTP domain. Do not enable VTP version 2 unless every controllerdevice in the VTP domain supports version 2.

- In TrCRF and TrBRF Token Ring environments, you must enable VTP version 2 or VTP version 3 for Token Ring VLAN switching to function properly. For Token Ring and Token Ring-Net media, disable VTP version 2.

- Caution

In VTP version 3, both the primary and secondary servers can exist on an instance in the domain.

SUMMARY STEPS

1.    configure terminal

2.    vtp version {1 | 2 | 3}

3.    end

4.    show vtp status

5.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vtp version {1 | 2 | 3}

Example:

(config)# vtp version 2

Enables the VTP version on the controllerdevice. The default is VTP version 1.

Step 3

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 4

show vtp status

Example:

# show vtp status

Verifies that the configured VTP version is enabled.

Step 5

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves the configuration in the startup configuration file.

Enabling VTP Pruning

Pruning increases available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to access the destination devices. You can only enable VTP pruning on a controllerdevice in VTP server mode.

With VTP versions 1 and 2, when you enable pruning on the VTP server, it is enabled for the entire VTP domain. In VTP version 3, you must manually enable pruning on each controllerdevice in the domain.

Only VLANs included in the pruning-eligible list can be pruned. By default, VLANs 2 through 1001 are pruning-eligible on trunk ports. Reserved VLANs and extended-range VLANs cannot be pruned.

Before You Begin
VTP pruning is not designed to function in VTP transparent mode. If one or more controllersdevices in the network are in VTP transparent mode, you should do one of these actions:

- Turn off VTP pruning in the entire network.

- Turn off VTP pruning by making all VLANs on the trunk of the controllerdevice upstream to the VTP transparent controllerdevice pruning ineligible.

To configure VTP pruning on an interface, use the switchport trunk pruning vlan interface configuration command. VTP pruning operates when an interface is trunking. You can set VLAN pruning-eligibility, whether or not VTP pruning is enabled for the VTP domain, whether or not any given VLAN exists, and whether or not the interface is currently trunking.

SUMMARY STEPS

1.    configure terminal

2.    vtp pruning

3.    end

4.    show vtp status

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vtp pruning

Example:

(config)# vtp pruning

Enables pruning in the VTP administrative domain.

By default, pruning is disabled. You need to enable pruning on only one controllerdevice in VTP server mode.

Step 3

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 4

show vtp status

Example:

# show vtp status

Verifies your entries in the VTP Pruning Mode field of the display.

Configuring VTP on a Per-Port Basis

With VTP version 3, you can enable or disable VTP on a per-port basis. You can enable VTP only on ports that are in trunk mode. Incoming and outgoing VTP traffic are blocked, not forwarded.

SUMMARY STEPS

1.    configure terminal

2.    interface interface-id

3.    vtp

4.    end

5.    show running-config interface interface-id

6.    show vtp status

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

interface interface-id

Example:

(config)# interface gigabitethernet1/0/1

Identifies an interface, and enters interface configuration mode.

Step 3

vtp

Example:

(config)# vtp

Enables VTP on the specified port.

Step 4

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 5

show running-config interface interface-id

Example:

# show running-config interface gigabitethernet1/0/1

Verifies the change to the port.

Step 6

show vtp status

Example:

# show vtp status

Verifies the configuration.

Adding a VTP Client Switch to a VTP Domain

Follow these steps to verify and reset the VTP configuration revision number on a controllerdevice before adding it to a VTP domain.

Before You Begin
Before adding a VTP client to a VTP domain, always verify that its VTP configuration revision number is lower than the configuration revision number of the other controllersdevices in the VTP domain. ControllersDevices in a VTP domain always use the VLAN configuration of the controllerdevice with the highest VTP configuration revision number. With VTP versions 1 and 2, adding a controllerdevice that has a revision number higher than the revision number in the VTP domain can erase all VLAN information from the VTP server and VTP domain. With VTP version 3, the VLAN information is not erased.

You can use the vtp mode transparent global configuration command to disable VTP on the controllerdevice and then to change its VLAN information without affecting the other controllersdevices in the VTP domain.

SUMMARY STEPS

1.    show vtp status

2.    configure terminal

3.    vtp domain domain-name

4.    end

5.    show vtp status

6.    configure terminal

7.    vtp domain domain-name

8.    end

9.    show vtp status

DETAILED STEPS

Command or Action

Purpose

Step 1

show vtp status

Example:

# show vtp status

Checks the VTP configuration revision number.

If the number is 0, add the controllerdevice to the VTP domain.

If the number is greater than 0, follow these substeps:

- Write down the domain name.

- Write down the configuration revision number.

- Continue with the next steps to reset the controllerdevice configuration revision number.

Step 2

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 3

vtp domain domain-name

Example:

(config)# vtp domain domain123

Changes the domain name from the original one displayed in Step 1 to a new name.

Step 4

end

Example:

(config)# end

Returns to privileged EXEC mode. The VLAN information on the controllerdevice is updated and the configuration revision number is reset to 0.

Step 5

show vtp status

Example:

# show vtp status

Verifies that the configuration revision number has been reset to 0.

Step 6

configure terminal

Example:

# configure terminal

Enters global configuration mode.

Step 7

vtp domain domain-name

Example:

(config)# vtp domain domain012

Enters the original domain name on the controllerdevice

Step 8

end

Example:

(config)# end

Returns to privileged EXEC mode. The VLAN information on the controllerdevice is updated.

Step 9

show vtp status

Example:

# show vtp status

(Optional) Verifies that the domain name is the same as in Step 1 and that the configuration revision number is 0.

Monitoring VTP

This section describes commands used to display and monitor the VTP configuration.

You monitor VTP by displaying VTP configuration information: the domain name, the current VTP revision, and the number of VLANs. You can also display statistics about the advertisements sent and received by the controllerdevice.

VTP Monitoring Commands

Command

Purpose

show vtp counters

Displays counters about VTP messages that have been sent and received.

show vtp devices [conflict]

Displays information about all VTP version 3 devices in the domain. Conflicts are VTP version 3 devices with conflicting primary servers. The show vtp devices command does not display information when the controllerdevice is in transparent or off mode.

show vtp interface [interface-id]

Displays VTP status and configuration for all interfaces or the specified interface.

show vtp password

Displays the VTP password. The form of the password displayed depends on whether or not the hidden keyword was entered and if encryption is enabled on the controllerdevice.

show vtp status

Displays the VTP controllerdevice configuration information.

Example: Configuring a Switch as the Primary Server

This example shows how to configure a controllerdevice as the primary server for the VLAN database (the default) when a hidden or secret password was configured:

# vtp primary vlan
Enter VTP password: mypassword
This switch is becoming Primary server for vlan feature in the VTP  domain

VTP Database Conf Switch ID      Primary Server Revision System Name
------------ ---- -------------- -------------- -------- --------------------
VLANDB       Yes  00d0.00b8.1400=00d0.00b8.1400 1        stp7

Do you want to continue (y/n) [n]? y

Where to Go Next

After configuring VTP, you can configure the following:

- VLANs

- VLAN trunking

Additional References

Standards and RFCs

Standard/RFC

Title

RFC 1573

Evolution of the Interfaces Group of MIB-II

RFC 1757

Remote Network Monitoring Management

RFC 2021

SNMPv2 Management Information Base for the Transmission Control Protocol using SMIv2

MIBs

MIB

MIBs Link

All supported MIBs for this release.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

Click Here

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

Click Here

Feature History and Information for VTP

Release

Modification

Cisco IOS XE 3.2SE

This feature was introduced.

Chapter 4. Configuring VLANs

- Finding Feature Information

- Prerequisites for VLANs

- Restrictions for VLANs

- Monitoring VLANs

- Where to Go Next

- Additional References

- Feature History and Information for VLANs

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for VLANs

The following are prerequisites and considerations for configuring VLANs:

- Before you create VLANs, you must decide whether to use VLAN Trunking Protocol (VTP) to maintain global VLAN configuration for your network.

- If you plan to configure many VLANs on the controllerdevice and to not enable routing, you can set the Switch Database Management (SDM) feature to the VLAN template, which configures system resources to support the maximum number of unicast MAC addresses.

- ControllersDevices running the LAN Base feature set support only static routing on SVIs.

- A VLAN should be present in the controllerdevice to be able to add it to the VLAN group.

Restrictions for VLANs

The following are restrictions for VLANs:

- The controllerdevice supports per-VLAN spanning-tree plus (PVST+) or rapid PVST+ with a maximum of 128 spanning-tree instances. One spanning-tree instance is allowed per VLAN.

- The controllerdevice supports IEEE 802.1Q trunking methods for sending VLAN traffic over Ethernet ports.

- Configuring an interface VLAN router's MAC address is not supported. The interface VLAN already has an MAC address assigned by default.

- Private VLANs are not supported on the controllerdevice.

Logical Networks

A VLAN is a switched network that is logically segmented by function, project team, or application, without regard to the physical locations of the users. VLANs have the same attributes as physical LANs, but you can group end stations even if they are not physically located on the same LAN segment. Any controllerdevice port can belong to a VLAN, and unicast, broadcast, and multicast packets are forwarded and flooded only to end stations in the VLAN. Each VLAN is considered a logical network, and packets destined for stations that do not belong to the VLAN must be forwarded through a router or a controllerdevice supporting fallback bridging. Because a VLAN is considered a separate logical network, it contains its own bridge Management Information Base (MIB) information and can support its own implementation of spanning tree.

VLANs are often associated with IP subnetworks. For example, all the end stations in a particular IP subnet belong to the same VLAN. Interface VLAN membership on the controllerdevice is assigned manually on an interface-by-interface basis. When you assign controllerdevice interfaces to VLANs by using this method, it is known as interface-based, or static, VLAN membership.

Traffic between VLANs must be routed.

The controllerdevice can route traffic between VLANs by using controllerdevice virtual interfaces (SVIs). An SVI must be explicitly configured and assigned an IP address to route traffic between VLANs.

Supported VLANs

The controllerdevice supports VLANs in VTP client, server, and transparent modes. VLANs are identified by a number from 1 to 4094. VLAN 1 is the default VLAN and is created during system initialization. VLAN IDs 1002 through 1005 are reserved for Token Ring and FDDI VLANs. All of the VLANs except 1002 to 1005 are available for user configuration.

There are 3 VTP versions: VTP version 1, version 2, and version 3. All VTP versions support both normal and extended range VLANs, but only with VTP version 3, does the controllerdevice propagate extended range VLAN configuration information. When extended range VLANs are created in VTP versions 1 and 2, their configuration information is not propagated. Even the local VTP database entries on the controllerdevice are not updated, but the extended range VLANs configuration information is created and stored in the running configuration file.

You can configure up to 4094 VLANs on the controllerdevice.

VLAN Port Membership Modes

You configure a port to belong to a VLAN by assigning a membership mode that specifies the kind of traffic the port carries and the number of VLANs to which it can belong.

When a port belongs to a VLAN, the controllerdevice learns and manages the addresses associated with the port on a per-VLAN basis.

Port Membership Modes and Characteristics

Membership Mode

VLAN Membership Characteristics

VTP Characteristics

Static-access

A static-access port can belong to one VLAN and is manually assigned to that VLAN.

VTP is not required. If you do not want VTP to globally propagate information, set the VTP mode to transparent. To participate in VTP, there must be at least one trunk port on the controllerdevice connected to a trunk port of a second controllerdevice.

Trunk (IEEE 802.1Q) :

- IEEE 802.1Q— Industry-standard trunking encapsulation.

A trunk port is a member of all VLANs by default, including extended-range VLANs, but membership can be limited by configuring the allowed-VLAN list. You can also modify the pruning-eligible list to block flooded traffic to VLANs on trunk ports that are included in the list.

VTP is recommended but not required. VTP maintains VLAN configuration consistency by managing the addition, deletion, and renaming of VLANs on a network-wide basis. VTP exchanges VLAN configuration messages with other controllersdevices over trunk links.

Dynamic access

A dynamic-access port can belong to one VLAN (VLAN ID 1 to 4094) and is dynamically assigned by a VLAN Member Policy Server (VMPS).

You can have dynamic-access ports and trunk ports on the same controllerdevice, but you must connect the dynamic-access port to an end station or hub and not to another controllerdevice.

VTP is required.

Configure the VMPS and the client with the same VTP domain name.

To participate in VTP, at least one trunk port on the controllerdevice must be connected to a trunk port of a second controllerdevice .

Voice VLAN

A voice VLAN port is an access port attached to a Cisco IP Phone, configured to use one VLAN for voice traffic and another VLAN for data traffic from a device attached to the phone.

VTP is not required; it has no effect on a voice VLAN.

VLAN Configuration Files

Configurations for VLAN IDs 1 to 1005 are written to the vlan.dat file (VLAN database), and you can display them by entering the show vlan privileged EXEC command. The vlan.dat file is stored in flash memory. If the VTP mode is transparent, they are also saved in the controllerdevice running configuration file.

You use the interface configuration mode to define the port membership mode and to add and remove ports from VLANs. The results of these commands are written to the running-configuration file, and you can display the file by entering the show running-config privileged EXEC command.

When you save VLAN and VTP information (including extended-range VLAN configuration information) in the startup configuration file and reboot the controllerdevice, the controllerdevice configuration is selected as follows:

- If the VTP mode is transparent in the startup configuration, and the VLAN database and the VTP domain name from the VLAN database matches that in the startup configuration file, the VLAN database is ignored (cleared), and the VTP and VLAN configurations in the startup configuration file are used. The VLAN database revision number remains unchanged in the VLAN database.

- If the VTP mode or domain name in the startup configuration does not match the VLAN database, the domain name and VTP mode and configuration for the VLAN IDs 1 to 1005 use the VLAN database information.

- In VTP versions 1 and 2, if VTP mode is server, the domain name and VLAN configuration for VLAN IDs 1 to 1005 use the VLAN database information. VTP version 3 also supports VLANs 1006 to 4094.

Normal-Range VLAN Configuration Guidelines

Normal-range VLANs are VLANs with IDs from 1 to 1005.

Follow these guidelines when creating and modifying normal-range VLANs in your network:

- Normal-range VLANs are identified with a number between 1 and 1001. VLAN numbers 1002 through 1005 are reserved for Token Ring and FDDI VLANs.

- VLAN configurations for VLANs 1 to 1005 are always saved in the VLAN database. If the VTP mode is transparent, VTP and VLAN configurations are also saved in the controllerdevice running configuration file.

- If the controllerdevice is in VTP server or VTP  transparent mode, you can add, modify or remove configurations for VLANs 2 to 1001 in the VLAN database. (VLAN IDs 1 and 1002 to 1005 are automatically created and cannot be removed.)

- Extended-range VLANs created in VTP transparent mode are not saved in the VLAN database and are not propagated. VTP version 3 supports extended range VLAN (VLANs 1006 to 4094) database propagation in VTP server mode.

- Before you can create a VLAN, the controllerdevice must be in VTP server mode or VTP transparent mode. If the controllerdevice is a VTP server, you must define a VTP domain or VTP will not function.

- The controllerdevice does not support Token Ring or FDDI media. The controllerdevice does not forward FDDI, FDDI-Net, TrCRF, or TrBRF traffic, but it does propagate the VLAN configuration through  VTP.

- The controllerdevice supports 128 spanning tree instances. If a controllerdevice has more active VLANs than supported spanning-tree instances, spanning tree can be enabled on 128 VLANs and is disabled on the remaining VLANs. If you have already used all available spanning-tree instances on a controllerdevice, adding another VLAN anywhere in the VTP domain creates a VLAN on that controllerdevice that is not running spanning-tree. If you have the default allowed list on the trunk ports of that controllerdevice (which is to allow all VLANs), the new VLAN is carried on all trunk ports. Depending on the topology of the network, this could create a loop in the new VLAN that would not be broken, particularly if there are several adjacent controllersdevices that all have run out of spanning-tree instances. You can prevent this possibility by setting allowed lists on the trunk ports of controllersdevices that have used up their allocation of spanning-tree instances. If the number of VLANs on the controllerdevice exceeds the number of supported spanning-tree instances, we recommend that you configure the IEEE 802.1s Multiple STP (MSTP) on your controllerdevice to map multiple VLANs to a single spanning-tree instance.

Extended-Range VLAN Configuration Guidelines

Extended-range VLANs are VLANs with IDs from 1006 to 4094.

Follow these guidelines when creating extended-range VLANs:

- VLAN IDs in the extended range are not saved in the VLAN database and are not recognized by VTP unless the controllerdevice is running VTP version 3.

- You cannot include extended-range VLANs in the pruning eligible range.

- For VTP version 1 or 2, you can set the VTP mode to transparent in global configuration mode. You should save this configuration to the startup configuration so that the controllerdevice boots up in VTP transparent mode. Otherwise, you lose the extended-range VLAN configuration if the controllerdevice resets. If you create extended-range VLANs in VTP version 3, you cannot convert to VTP version 1 or 2.

Information About VLAN Groups

Whenever a wireless client connects to a wireless network (WLAN), the client is placed in a VLAN that is associated with the WLAN. In a large venue such as an auditorium, a stadium, or a conference room where there are numerous wireless clients, having only a single WLAN to accommodate many clients might be a challenge.

The VLAN group feature uses a single WLAN that can support multiple VLANs. The clients can get assigned to one of the configured VLANs. This feature maps a WLAN to a single VLAN or multiple VLANs using the VLAN groups. When a wireless client associates to the WLAN, the VLAN is derived by an algorithm based on the MAC address of the wireless client. A VLAN is assigned to the client and the client gets the IP address from the assigned VLAN. This feature also extends the current AP group architecture and AAA override architecture, where the AP groups and AAA override can override a VLAN or a VLAN group to which the WLAN is mapped.

How to Configure Normal-Range VLANs

You can set these parameters when you create a new normal-range VLAN or modify an existing VLAN in the VLAN database:

- VLAN ID

- VLAN name

- VLAN type

- Ethernet

- Fiber Distributed Data Interface [FDDI]

- FDDI network entity title [NET]

- TrBRF or TrCRF

- Token Ring

- Token Ring-Net

- VLAN state (active or suspended)

- Maximum transmission unit (MTU) for the VLAN

- Security Association Identifier (SAID)

- Bridge identification number for TrBRF VLANs

- Ring number for FDDI and TrCRF VLANs

- Parent VLAN number for TrCRF VLANs

- Spanning Tree Protocol (STP) type for TrCRF VLANs

- VLAN number to use when translating from one VLAN type to another

You can cause inconsistency in the VLAN database if you attempt to manually delete the vlan.dat file. If you want to modify the VLAN configuration, follow the procedures in this section.

- Creating or Modifying an Ethernet VLAN

- Deleting a VLAN

- Creating VLAN Groups (CLI)

- Adding a VLAN Group to WLAN (CLI)

- Assigning Static-Access Ports to a VLAN

Creating or Modifying an Ethernet VLAN

Before You Begin
With VTP version 1 and 2, if the controllerdevice is in VTP transparent mode, you can assign VLAN IDs greater than 1006, but they are not added to the VLAN database.

The controllerdevice supports only Ethernet interfaces. Because FDDI and Token Ring VLANs are not locally supported, you only configure FDDI and Token Ring media-specific characteristics for VTP global advertisements to other controllersdevices.

Although the controllerdevice does not support Token Ring connections, a remote device with Token Ring connections could be managed from one of the supported controllersdevices. ControllersDevices running VTP Version 2 advertise information about these Token Ring VLANs:

- Token Ring TrBRF VLANs

- Token Ring TrCRF VLANs

SUMMARY STEPS

1.    configure terminal

2.    vlan vlan-id

3.    name vlan-name

4.    media { ethernet | fd-net | fddi | tokenring | trn-net }

5.    remote-span

6.    end

7.    show vlan {name vlan-name | id vlan-id}

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vlan vlan-id

Example:

(config)# vlan 20

Enters a VLAN ID, and enters VLAN configuration mode. Enter a new VLAN ID to create a VLAN, or enter an existing VLAN ID to modify that VLAN.

Note:
The available VLAN ID range for this command is 1 to 4094.

Step 3

name vlan-name

Example:

(config-vlan)# name test20

(Optional) Enters a name for the VLAN. If no name is entered for the VLAN, the default is to append the vlan-id value with leading zeros to the word VLAN. For example, VLAN0004 is a default VLAN name for VLAN 4.

Step 4

media { ethernet | fd-net | fddi | tokenring | trn-net }

Example:

(config-vlan)# media ethernet

Configures the VLAN media type. Command options include:

- ethernet—Sets the VLAN media type as Ethernet.

- fd-net—Sets the VLAN media type as FDDI net.

- fddi—Sets the VLAN media type as FDDI.

- tokenring—Sets the VLAN media type as Token Ring.

- trn-net—Sets the VLAN media type as Token Ring net.

Step 5

remote-span

Example:

(config-vlan)# remote-span

(Optional) Configures the VLAN as the RSPAN VLAN for a remote SPAN session. For more information on remote SPAN, see the Catalyst 3850 Network Management Configuration Guide.

Step 6

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 7

show vlan {name vlan-name | id vlan-id}

Example:

# show vlan name test20 id 20

Verifies your entries.

Deleting a VLAN

When you delete a VLAN from a controllerdevice that is in VTP server mode, the VLAN is removed from the VLAN database for all controllersdevices in the VTP domain. When you delete a VLAN from a controllerdevice that is in VTP transparent mode, the VLAN is deleted only on that specific controllerdevice .

You cannot delete the default VLANs for the different media types: Ethernet VLAN 1 and FDDI or Token Ring VLANs 1002 to 1005.

Caution

When you delete a VLAN, any ports assigned to that VLAN become inactive. They remain associated with the VLAN (and thus inactive) until you assign them to a new VLAN.

SUMMARY STEPS

1.    configure terminal

2.    no vlan vlan-id

3.    end

4.    show vlan brief

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

no vlan vlan-id

Example:

(config)# no vlan 4

Removes the VLAN by entering the VLAN ID.

Step 3

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 4

show vlan brief

Example:

# show vlan brief

Verifies the VLAN removal.

Creating VLAN Groups (CLI)

SUMMARY STEPS

1.    configure terminal

2.    vlan group WORD vlan-list vlan-ID

3.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global command mode.

Step 2

vlan group WORD vlan-list vlan-ID

Example:

(config)#vlan group vlangrp1 vlan-list 91-95

Creates a VLAN group with the given group name (vlangrp1) and adds all the VLANs listed in the command. The VLAN list ranges from 1 to 4096 and the recommended number of VLANs in a group is 32.

Step 3

end

Example:

(config)#end

Exits the global configuration mode and returns to privileged EXEC mode. Alternatively, press CTRL-Z to exit the global configuration mode.

Adding a VLAN Group to WLAN (CLI)

SUMMARY STEPS

1.    configure terminal

2.    wlan WORD number

3.    client vlan WORD

4.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global command mode.

Step 2

wlan WORD number

Example:

(config)#wlan wlanname 512

Enables the WLAN to map a VLAN group using an identifier. The WLAN identifier values range from 1 to 512.

Step 3

client vlan WORD

Example:

(config-wlan)#client vlan vlangrp1

Maps the VLAN group to the WLAN by entering the VLAN identifier, VLAN group, or the VLAN name.

Step 4

end

Example:

(config-wlan)#end

Exits the global configuration mode and returns to privileged EXEC mode . Alternatively, press CTRL-Z to exit the global configuration mode.

Assigning Static-Access Ports to a VLAN

You can assign a static-access port to a VLAN without having VTP globally propagate VLAN configuration information by disabling VTP (VTP transparent mode).

If you assign an interface to a VLAN that does not exist, the new VLAN is created.

SUMMARY STEPS

1.    configure terminal

2.    interface interface-id

3.    switchport mode access

4.    switchport access vlan vlan-id

5.    end

6.    show running-config interface interface-id

7.    show interfaces interface-id switchport

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global configuration mode

Step 2

interface interface-id

Example:

(config)# interface gigabitethernet2/0/1

Enters the interface to be added to the VLAN.

Step 3

switchport mode access

Example:

(config-if)# switchport mode access

Defines the VLAN membership mode for the port (Layer 2 access port).

Step 4

switchport access vlan vlan-id

Example:

(config-if)# switchport access vlan 2

Assigns the port to a VLAN. Valid VLAN IDs are 1 to 4094.

Step 5

end

Example:

(config-if)# end

Returns to privileged EXEC mode.

Step 6

show running-config interface interface-id

Example:

# show running-config interface gigabitethernet2/0/1

Verifies the VLAN membership mode of the interface.

Step 7

show interfaces interface-id switchport

Example:

# show interfaces gigabitethernet2/0/1 switchport

Verifies your entries in the Administrative Mode and the Access Mode VLAN fields of the display.

How to Configure Extended-Range VLANs

Extended-range VLANs enable service providers to extend their infrastructure to a greater number of customers. The extended-range VLAN IDs are allowed for any switchport commands that allow VLAN IDs.

With VTP version 1 or 2, extended-range VLAN configurations are not stored in the VLAN database, but because VTP mode is transparent, they are stored in the controllerdevice running configuration file, and you can save the configuration in the startup configuration file. Extended-range VLANs created in VTP version 3 are stored in the VLAN database.

You can change only the MTU size and the remote SPAN configuration state on extended-range VLANs; all other characteristics must remain at the default state.

- Creating an Extended-Range VLAN

Creating an Extended-Range VLAN

SUMMARY STEPS

1.    configure terminal

2.    vlan vlan-id

3.    remote-span

4.    exit

5.    end

6.    show vlan id vlan-id

7.    copy running-config startup config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vlan vlan-id

Example:

(config)# vlan 2000
(config-vlan)#

Enters an extended-range VLAN ID and enters VLAN configuration mode. The range is 1006 to 4094.

Step 3

remote-span

Example:

(config-vlan)# remote-span

(Optional) Configures the VLAN as the RSPAN VLAN.

Step 4

exit

Example:

(config-vlan)# exit
(config)#

Returns to configuration mode.

Step 5

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 6

show vlan id vlan-id

Example:

# show vlan id 2000

Verifies that the VLAN has been created.

Step 7

copy running-config startup config

Example:

# copy running-config startup-config

Saves your entries in the controllerdevice startup configuration file. To save an extended-range VLAN configuration, you need to save the VTP transparent mode configuration and the extended-range VLAN configuration in the controllerdevice startup configuration file. Otherwise, if the controllerdevice resets, it will default to VTP server mode, and the extended-range VLAN IDs will not be saved.

Note:
This step is not required for VTP version 3 because VLANs are saved in the VLAN database.

Monitoring VLANs

Privileged EXEC show Commands

Command

Purpose

show interfaces [vlan vlan-id]

Displays characteristics for all interfaces or for the specified VLAN configured on the controllerdevice .

show vlan [ access-map name | brief | dot1q { tag native } | filter [ access-map | vlan ] | group [ group-name name ] | id vlan-id | ifindex | mtu | name name | remote-span | summary ]

Displays parameters for all VLANs or the specified VLAN on the controllerdevice. The following command options are available:

- access-map—Displays the VLAN access-maps.

- brief—Displays VTP VLAN status in brief.

- dot1q—Displays the dot1q parameters.

- filter—Displays VLAN filter information.

- group—Displays the VLAN group with its name and the connected VLANs that are available.

- id—Displays VTP VLAN status by identification number.

- ifindex—Displays SNMP ifIndex.

- mtu—Displays VLAN MTU information.

- name—Displays the VTP VLAN information by specified name.

- remote-span–Displays the remote SPAN VLANs.

- summary—Displays a summary of VLAN information.

Where to Go Next

After configuring VLANs, you can configure the following:

- VLAN Trunking Protocol (VTP)

- VLAN trunks

Additional References

Standards and RFCs

Standard/RFC

Title

RFC 1573

Evolution of the Interfaces Group of MIB-II

RFC 1757

Remote Network Monitoring Management

RFC 2021

SNMPv2 Management Information Base for the Transmission Control Protocol using SMIv2

MIBs

MIB

MIBs Link

All supported MIBs for this release.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

Click Here

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

Click Here

Feature History and Information for VLANs

Release

Modification

Cisco IOS XE 3.2SE

This feature was introduced.

Chapter 5. Configuring VLAN Group

- Finding Feature Information

- Prerequisites for VLAN Groups

- Restrictions for VLAN Groups

- Information About VLAN Groups

- Where to Go Next

- Additional References

- Feature History and Information for VLAN Groups

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for VLAN Groups

A VLAN should be present in the controllerdevice to be able to add it to the VLAN group.

Restrictions for VLAN Groups

The number of VLANs mapped to a VLAN group is not limited by Cisco IOS Software Release. But if the number of VLANs in a VLAN group exceed the recommended value of 32, the mobility behavior is unexpected and in the VLAN group, L2 multicast breaks for some VLANs. So it is the responsibility of the administrator to configure feasible number of VLANs in a VLAN group. When a VLAN is added to a VLAN group mapped to a WLAN which already has 32 VLANs, a warning is generated. But when a new VLAN group is mapped to a WLAN with more than 32 VLANs, an error is generated.

For expected behavior of the VLAN group, the VLANs mapped in the group must be present in the controllerdevice. The static IP client behavior is not supported.

Information About VLAN Groups

Whenever a wireless client connects to a wireless network (WLAN), the client is placed in a VLAN that is associated with the WLAN. In a large venue such as an auditorium, a stadium, or a conference room where there are numerous wireless clients, having only a single WLAN to accommodate many clients might be a challenge.

The VLAN group feature uses a single WLAN that can support multiple VLANs. The clients can get assigned to one of the configured VLANs. This feature maps a WLAN to a single VLAN or multiple VLANs using the VLAN groups. When a wireless client associates to the WLAN, the VLAN is derived by an algorithm based on the MAC address of the wireless client. A VLAN is assigned to the client and the client gets the IP address from the assigned VLAN. This feature also extends the current AP group architecture and AAA override architecture, where the AP groups and AAA override can override a VLAN or a VLAN group to which the WLAN is mapped.

Creating VLAN Groups (CLI)

SUMMARY STEPS

1.    configure terminal

2.    vlan group WORD vlan-list vlan-ID

3.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global command mode.

Step 2

vlan group WORD vlan-list vlan-ID

Example:

(config)#vlan group vlangrp1 vlan-list 91-95

Creates a VLAN group with the given group name (vlangrp1) and adds all the VLANs listed in the command. The VLAN list ranges from 1 to 4096 and the recommended number of VLANs in a group is 32.

Step 3

end

Example:

(config)#end

Exits the global configuration mode and returns to privileged EXEC mode. Alternatively, press CTRL-Z to exit the global configuration mode.

Removing VLAN Group (CLI)

SUMMARY STEPS

1.    configure terminal

2.    vlan group WORD vlan-list vlan-ID

3.    no vlan group WORD vlan-list vlan-ID

4.    end

DETAILED STEPS

Step 1

configure terminal

Example:

# configure terminal

Enters global command mode.

Step 2

vlan group WORD vlan-list vlan-ID

Example:

(config)#vlan group vlangrp1 vlan-list 91-95

Creates a VLAN group with the given group name (vlangrp1) and adds all the VLANs listed in the command. The VLAN list ranges from 1 to 4096 and the recommended number of VLANs in a group is 32.

Step 3

no vlan group WORD vlan-list vlan-ID

Example:

(config)#no vlan group vlangrp1 vlan-list 91-95

Removes the VLAN group with the given group name (vlangrp1).

Step 4

end

Example:

(config)#end

Exits the global configuration mode and returns to privileged EXEC mode. Alternatively, press CTRL-Z to exit the global configuration mode.

Creating VLAN Groups (GUI)

To create a VLAN group using the controllerdevice web UI, you must:

Step 1

Choose Configuration > Controller > System > VLAN > VLAN Group.
The VLAN Group page appears. You must provide values for all parameters listed in the VLAN Group window.

Parameter

Description

VLAN Group Name

Group name for the VLANs.

VLAN List

The VLAN list to configure the mesh access point (MAP) access port.

Step 2

Click Apply.

Adding a VLAN Group to WLAN (CLI)

SUMMARY STEPS

1.    configure terminal

2.    wlan WORD number

3.    client vlan WORD

4.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global command mode.

Step 2

wlan WORD number

Example:

(config)#wlan wlanname 512

Enables the WLAN to map a VLAN group using an identifier. The WLAN identifier values range from 1 to 512.

Step 3

client vlan WORD

Example:

(config-wlan)#client vlan vlangrp1

Maps the VLAN group to the WLAN by entering the VLAN identifier, VLAN group, or the VLAN name.

Step 4

end

Example:

(config-wlan)#end

Exits the global configuration mode and returns to privileged EXEC mode . Alternatively, press CTRL-Z to exit the global configuration mode.

Adding a VLAN Group to WLAN (GUI)

To add a VLAN group to WLAN using the controllerdevice web UI, you must follow the steps defined in this procedure.

Step 1

To add a VLAN group to a WLAN, choose Configuration > Wireless > WLANs > WLAN Profile > General.
The general parameter page of the WLAN group appears.

Step 2

Select the VLAN group values listed in the Interface/Interface Group drop-down list to associate the selected WLAN profile to a VLAN group.

Step 3

Click Apply.

Removing VLAN Groups (GUI)

To remove a VLAN groups using the controllerdevice web UI, you must:

Step 1

Choose Configuration > Controller > System > VLAN > VLAN Group.
The VLAN Group page appears, listing the following details of the VLAN groups associated with the controllerdevice.

Parameter

Description

VLAN Group Name

Group name for the VLANs.

VLAN List

The VLAN list to configure the mesh access point (MAP) access port.

Step 2

Check the checkbox of the VLAN group you need to delete from the VLAN group names displayed in the VLAN group list .
You will receive a confirmation message confirming deletion of the selected VLAN group.

Step 3

Click Ok.

Viewing VLANs in VLAN Groups (CLI)

Commands

Description

show vlan group

Displays the list of VLAN groups with its name and the VLANs that are available.

show vlan group group-name <group_name>

Displays the specified VLAN group details.

show wireless vlan group <group_name>

Displays the specified wireless VLAN group details.

Viewing VLAN Groups (GUI)

To view a VLAN groups using the controllerdevice web UI, you must:

Step 1

Choose Configuration > Controller > System > VLAN > VLAN Group.
The VLAN Group page appears, listing the following details of the VLAN groups associated with the controllerdevice.

Parameter

Description

VLAN Group Name

Group name for the VLANs.

VLAN List

The VLAN list to configure the mesh access point (MAP) access port.

Step 2

Click Apply.

Where to Go Next

After configuring VLAN groups, you can configure the following:

- VLANs

- VLAN Trunking Protocol (VTP)

- VLAN trunks

Additional References

Related Documents

Related Topic

Document Title

For complete syntax and usage information for the commands used in this chapter.

VLAN Command Reference (Cisco WLC 5700 Series)

Layer 2 Command Reference (Cisco WLC 5700 Series)

VLAN access-maps

Security Configuration Guide (Cisco WLC 5700 Series)

Security Command Reference (Cisco WLC 5700 Series)

VLAN and Mobility Agents

Cisco Flexible NetFlow

IGMP Snooping

Cisco 5760 Multicast Command Reference (Cisco WLC 5700 Series)

Routing Configuration Guide (Cisco WLC 5700 Series)

IPv6

IPv6 Configuration Guide (Cisco WLC 5700 Series)

IPv6 Command Reference (Cisco WLC 5700 Series)

SPAN

Network Management Command Reference (Cisco WLC 5700 Series)

Network Management Configuration Guide (Cisco WLC 5700 Series)

Platform-independent configuration information

Identity Based Networking Services Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)

Error Message Decoder

Description

Link

To help you research and resolve system error messages in this release, use the Error Message Decoder tool.

Click Here

Standards and RFCs

Standard/RFC

Title

RFC 1573

Evolution of the Interfaces Group of MIB-II

RFC 1757

Remote Network Monitoring Management

RFC 2021

SNMPv2 Management Information Base for the Transmission Control Protocol using SMIv2

MIBs

MIB

MIBs Link

All supported MIBs for this release.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

Click Here

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

Click Here

Feature History and Information for VLAN Groups

Release

Modification

Cisco IOS XE 3.2SE

This feature was introduced.

Chapter 6. Configuring VLAN Trunks

- Finding Feature Information

- Prerequisites for VLAN Trunks

- Restrictions for VLAN Trunks

- How to Configure VLAN Trunks

- Where to Go Next

- Additional References

- Feature History and Information for VLAN Trunks

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to Click Here . An account on Cisco.com is not required.

Prerequisites for VLAN Trunks

The IEEE 802.1Q trunks impose these limitations on the trunking strategy for a network:

- In a network of Cisco controllersdevices connected through IEEE 802.1Q trunks, the controllersdevices maintain one spanning-tree instance for each VLAN allowed on the trunks. Non-Cisco devices might support one spanning-tree instance for all VLANs. When you connect a Cisco controllerdevice to a non-Cisco device through an IEEE 802.1Q trunk, the Cisco controllerdevice combines the spanning-tree instance of the VLAN of the trunk with the spanning-tree instance of the non-Cisco IEEE 802.1Q controllerdevice. However, spanning-tree information for each VLAN is maintained by Cisco controllersdevices separated by a cloud of non-Cisco IEEE 802.1Q controllersdevices. The non-Cisco IEEE 802.1Q cloud separating the Cisco controllersdevices is treated as a single trunk link between the controllersdevices.

- Make sure the native VLAN for an IEEE 802.1Q trunk is the same on both ends of the trunk link. If the native VLAN on one end of the trunk is different from the native VLAN on the other end, spanning-tree loops might result.

- Disabling spanning tree on the native VLAN of an IEEE 802.1Q trunk without disabling spanning tree on every VLAN in the network can potentially cause spanning-tree loops. We recommend that you leave spanning tree enabled on the native VLAN of an IEEE 802.1Q trunk or disable spanning tree on every VLAN in the network. Make sure your network is loop-free before disabling spanning tree.

Restrictions for VLAN Trunks

The following are restrictions for VLAN trunks:

- Dynamic Trunking Protocol (DTP) is not supported on tunnel ports.

- The controllerdevice does not support Layer 3 trunks; you cannot configure subinterfaces or use the encapsulation keyword on Layer 3 interfaces. The controllerdevice does support Layer 2 trunks and Layer 3 VLAN interfaces, which provide equivalent capabilities.

Trunking Overview

A trunk is a point-to-point link between one or more Ethernet controllerdevice interfaces and another networking device such as a router or a controllerdevice. Ethernet trunks carry the traffic of multiple VLANs over a single link, and you can extend the VLANs across an entire network.

The following trunking encapsulations are available on all Ethernet interfaces:

- IEEE 802.1Q— Industry-standard trunking encapsulation.

Trunking Modes

Ethernet trunk interfaces support different trunking modes. You can set an interface as trunking or nontrunking or to negotiate trunking with the neighboring interface. To autonegotiate trunking, the interfaces must be in the same VTP domain.

Trunk negotiation is managed by the Dynamic Trunking Protocol (DTP), which is a Point-to-Point Protocol (PPP). However, some internetworking devices might forward DTP frames improperly, which could cause misconfigurations.

Layer 2 Interface Modes

Layer 2 Interface Modes

Mode

Function

switchport mode access

Puts the interface (access port) into permanent nontrunking mode and negotiates to convert the link into a nontrunk link. The interface becomes a nontrunk interface regardless of whether or not the neighboring interface is a trunk interface.

switchport mode dynamic auto

Makes the interface able to convert the link to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk or desirable mode. The default switchport mode for all Ethernet interfaces is dynamic auto.

switchport mode dynamic desirable

Makes the interface actively attempt to convert the link to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode.

switchport mode trunk

Puts the interface into permanent trunking mode and negotiates to convert the neighboring link into a trunk link. The interface becomes a trunk interface even if the neighboring interface is not a trunk interface.

switchport nonegotiate

Prevents the interface from generating DTP frames. You can use this command only when the interface switchport mode is access or trunk. You must manually configure the neighboring interface as a trunk interface to establish a trunk link.

Allowed VLANs on a Trunk

By default, a trunk port sends traffic to and receives traffic from all VLANs. All VLAN IDs, 1 to 4094, are allowed on each trunk. However, you can remove VLANs from the allowed list, preventing traffic from those VLANs from passing over the trunk.

To reduce the risk of spanning-tree loops or storms, you can disable VLAN 1 on any individual VLAN trunk port by removing VLAN 1 from the allowed list. When you remove VLAN 1 from a trunk port, the interface continues to send and receive management traffic, for example, Cisco Discovery Protocol (CDP), Port Aggregation Protocol (PAgP), Link Aggregation Control Protocol (LACP), DTP, and VTP in VLAN 1.

If a trunk port with VLAN 1 disabled is converted to a nontrunk port, it is added to the access VLAN. If the access VLAN is set to 1, the port will be added to VLAN 1, regardless of the switchport trunk allowed setting. The same is true for any VLAN that has been disabled on the port.

A trunk port can become a member of a VLAN if the VLAN is enabled, if VTP knows of the VLAN, and if the VLAN is in the allowed list for the port. When VTP detects a newly enabled VLAN and the VLAN is in the allowed list for a trunk port, the trunk port automatically becomes a member of the enabled VLAN. When VTP detects a new VLAN and the VLAN is not in the allowed list for a trunk port, the trunk port does not become a member of the new VLAN.

Load Sharing on Trunk Ports

Load sharing divides the bandwidth supplied by parallel trunks connecting controllersdevices. To avoid loops, STP normally blocks all but one parallel link between controllersdevices. Using load sharing, you divide the traffic between the links according to which VLAN the traffic belongs.

You configure load sharing on trunk ports by using STP port priorities or STP path costs. For load sharing using STP port priorities, both load-sharing links must be connected to the same controllerdevice. For load sharing using STP path costs, each load-sharing link can be connected to the same controllerdevice or to two different controllersdevices.

- Network Load Sharing Using STP Priorities

- Network Load Sharing Using STP Path Cost

Network Load Sharing Using STP Priorities

When two ports on the same controllerdevice form a loop, the controllerdevice uses the STP port priority to decide which port is enabled and which port is in a blocking state. You can set the priorities on a parallel trunk port so that the port carries all the traffic for a given VLAN. The trunk port with the higher priority (lower values) for a VLAN is forwarding traffic for that VLAN. The trunk port with the lower priority (higher values) for the same VLAN remains in a blocking state for that VLAN. One trunk port sends or receives all traffic for the VLAN.

Network Load Sharing Using STP Path Cost

You can configure parallel trunks to share VLAN traffic by setting different path costs on a trunk and associating the path costs with different sets of VLANs, blocking different ports for different VLANs. The VLANs keep the traffic separate and maintain redundancy in the event of a lost link.

Feature Interactions

Trunking interacts with other features in these ways:

- A trunk port cannot be a secure port.

- Trunk ports can be grouped into EtherChannel port groups, but all trunks in the group must have the same configuration. When a group is first created, all ports follow the parameters set for the first port to be added to the group. If you change the configuration of one of these parameters, the controllerdevice propagates the setting that you entered to all ports in the group:

- Allowed-VLAN list.

- STP port priority for each VLAN.

- STP Port Fast setting.

- Trunk status: If one port in a port group ceases to be a trunk, all ports cease to be trunks.

- We recommend that you configure no more than 24 trunk ports in Per VLAN Spanning Tree (PVST) mode and no more than 40 trunk ports in Multiple Spanning Tree (MST) mode.

- If you try to enable IEEE 802.1x on a trunk port, an error message appears, and IEEE 802.1x is not enabled. If you try to change the mode of an IEEE 802.1x-enabled port to trunk, the port mode is not changed.

- A port in dynamic mode can negotiate with its neighbor to become a trunk port. If you try to enable IEEE 802.1x on a dynamic port, an error message appears, and IEEE 802.1x is not enabled. If you try to change the mode of an IEEE 802.1x-enabled port to dynamic, the port mode is not changed.

How to Configure VLAN Trunks

To avoid trunking misconfigurations, configure interfaces connected to devices that do not support DTP to not forward DTP frames, that is, to turn off DTP.

- If you do not intend to trunk across those links, use the switchport mode access interface configuration command to disable trunking.

- To enable trunking to a device that does not support DTP, use the switchport mode trunk and switchport nonegotiate interface configuration commands to cause the interface to become a trunk but to not generate DTP frames.

Configuring a Trunk Port

Because trunk ports send and receive VTP advertisements, to use VTP you must ensure that at least one trunk port is configured on the controllerdevice and that this trunk port is connected to the trunk port of a second controllerdevice. Otherwise, the controllerdevice cannot receive any VTP advertisements.

Before You Begin

SUMMARY STEPS

1.    configure terminal

2.    interface interface-id

3.    switchport mode {dynamic {auto | desirable} | trunk}

4.    switchport access vlan vlan-id

5.    switchport trunk native vlan vlan-id

6.    end

7.    show interfaces interface-id switchport

8.    show interfaces interface-id trunk

9.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

interface interface-id

Example:

(config)# interface gigabitethernet1/0/2

Specifies the port to be configured for trunking, and enters interface configuration mode.

Step 3

switchport mode {dynamic {auto | desirable} | trunk}

Example:

(config-if)# switchport mode dynamic desirable

Configures the interface as a Layer 2 trunk (required only if the interface is a Layer 2 access port or tunnel port or to specify the trunking mode).

- dynamic auto—Sets the interface to a trunk link if the neighboring interface is set to trunk or desirable mode. This is the default.

- dynamic desirable—Sets the interface to a trunk link if the neighboring interface is set to trunk, desirable, or auto mode.

- trunk—Sets the interface in permanent trunking mode and negotiate to convert the link to a trunk link even if the neighboring interface is not a trunk interface.

Step 4

switchport access vlan vlan-id

Example:

(config-if)# switchport access vlan 200

(Optional) Specifies the default VLAN, which is used if the interface stops trunking.

Step 5

switchport trunk native vlan vlan-id

Example:

(config-if)# switchport trunk native vlan 200

Specifies the native VLAN for IEEE 802.1Q trunks.

Step 6

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 7

show interfaces interface-id switchport

Example:

# show interfaces gigabitethernet1/0/2 switchport

Displays the switch port configuration of the interface in the Administrative Mode and the Administrative Trunking Encapsulation fields of the display.

Step 8

show interfaces interface-id trunk

Example:

# show interfaces gigabitethernet1/0/2 trunk

Displays the trunk configuration of the interface.

Step 9

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Defining the Allowed VLANs on a Trunk

VLAN 1 is the default VLAN on all trunk ports in all Cisco controllersdevices, and it has previously been a requirement that VLAN 1 always be enabled on every trunk link. You can use the VLAN 1 minimization feature to disable VLAN 1 on any individual VLAN trunk link so that no user traffic (including spanning-tree advertisements) is sent or received on VLAN 1.

SUMMARY STEPS

1.    configure terminal

2.    interface interface-id

3.    switchport mode trunk

4.    end

5.    show interfaces interface-id switchport

6.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

interface interface-id

Example:

(config)# interface gigabitethernet1/0/1

Specifies the port to be configured, and enters interface configuration mode.

Step 3

switchport mode trunk

Example:

(config-if)# switchport mode trunk

Configures the interface as a VLAN trunk port.

Step 4

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 5

show interfaces interface-id switchport

Example:

# show interfaces gigabitethernet1/0/1 switchport

Verifies your entries in the Trunking VLANs Enabled field of the display.

Step 6

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Changing the Pruning-Eligible List

The pruning-eligible list applies only to trunk ports. Each trunk port has its own eligibility list. VTP pruning must be enabled for this procedure to take effect.

SUMMARY STEPS

1.    configure terminal

2.    interface interface-id

3.    switchport trunk pruning vlan {add | except | none | remove} vlan-list [,vlan [,vlan [,,,]]

4.    end

5.    show interfaces interface-id switchport

6.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

interface interface-id

Example:

(config)# interface gigabitethernet2/0/1

Selects the trunk port for which VLANs should be pruned, and enters interface configuration mode.

Step 3

switchport trunk pruning vlan {add | except | none | remove} vlan-list [,vlan [,vlan [,,,]]

Configures the list of VLANs allowed to be pruned from the trunk.

For explanations about using the add, except, none, and remove keywords, see the command reference for this release.

Separate non-consecutive VLAN IDs with a comma and no spaces; use a hyphen to designate a range of IDs. Valid IDs are 2 to 1001. Extended-range VLANs (VLAN IDs 1006 to 4094) cannot be pruned.

VLANs that are pruning-ineligible receive flooded traffic.

The default list of VLANs allowed to be pruned contains VLANs 2 to 1001.

Step 4

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 5

show interfaces interface-id switchport

Example:

# show interfaces gigabitethernet2/0/1 switchport

Verifies your entries in the Pruning VLANs Enabled field of the display.

Step 6

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Configuring the Native VLAN for Untagged Traffic

A trunk port configured with IEEE 802.1Q tagging can receive both tagged and untagged traffic. By default, the controllerdevice forwards untagged traffic in the native VLAN configured for the port. The native VLAN is VLAN 1 by default.

The native VLAN can be assigned any VLAN ID.

If a packet has a VLAN ID that is the same as the outgoing port native VLAN ID, the packet is sent untagged; otherwise, the controllerdevice sends the packet with a tag.

SUMMARY STEPS

1.    configure terminal

2.    interface interface-id

3.    switchport trunk native vlan vlan-id

4.    end

5.    show interfaces interface-id switchport

6.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

interface interface-id

Example:

(config)# interface gigabitethernet1/0/2

Defines the interface that is configured as the IEEE 802.1Q trunk, and enters interface configuration mode.

Step 3

switchport trunk native vlan vlan-id

Example:

(config-if)# switchport trunk native vlan 12

Configures the VLAN that is sending and receiving untagged traffic on the trunk port.

For vlan-id, the range is 1 to 4094.

Step 4

end

Example:

(config-if)# end

Returns to privileged EXEC mode.

Step 5

show interfaces interface-id switchport

Example:

# show interfaces gigabitethernet1/0/2 switchport

Verifies your entries in the Trunking Native Mode VLAN field.

Step 6

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Configuring Load Sharing Using STP Port Priorities

These steps describe how to configure a network with load sharing using STP port priorities.

SUMMARY STEPS

1.    configure terminal

2.    vtp domain domain-name

3.    vtp mode server

4.    end

5.    show vtp status

6.    show vlan

7.    configure terminal

8.    interface interface-id

9.    switchport mode trunk

10.    end

11.    show interfaces interface-id switchport

12.    Repeat the above steps on ControllerDevice A for a second port in the controllerdevice.

13.    Repeat the above steps on ControllerDevice B to configure the trunk ports that connect to the trunk ports configured on ControllerDevice A.

14.    show vlan

15.    configure terminal

16.    interface interface-id

17.    spanning-tree vlan vlan-range port-priority priority-value

18.    exit

19.    interface interface-id

20.    spanning-tree vlan vlan-range port-priority priority-value

21.    end

22.    show running-config

23.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global configuration mode on ControllerDevice A.

Step 2

vtp domain domain-name

Example:

(config)# vtp domain workdomain

Configures a VTP administrative domain.

The domain name can be 1 to 32 characters.

Step 3

vtp mode server

Example:

(config)# vtp mode server

Configures ControllerDevice A as the VTP server.

Step 4

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 5

show vtp status

Example:

# show vtp status

Verifies the VTP configuration on both ControllerDevice A and ControllerDevice B.

In the display, check the VTP Operating Mode and the VTP Domain Name fields.

Step 6

show vlan

Example:

# show vlan

Verifies that the VLANs exist in the database on ControllerDevice A.

Step 7

configure terminal

Example:

# configure terminal

Enters global configuration mode.

Step 8

interface interface-id

Example:

(config)# interface gigabitethernet1/0/1

Defines the interface to be configured as a trunk, and enters interface configuration mode.

Step 9

switchport mode trunk

Example:

(config-if)# switchport mode trunk

Configures the port as a trunk port.

Step 10

end

Example:

(config-if)# end

Returns to privileged EXEC mode.

Step 11

show interfaces interface-id switchport

Example:

# show interfaces gigabitethernet1/0/1 switchport

Verifies the VLAN configuration.

Step 12

Repeat the above steps on ControllerDevice A for a second port in the controllerdevice.

Step 13

Repeat the above steps on ControllerDevice B to configure the trunk ports that connect to the trunk ports configured on ControllerDevice A.

Step 14

show vlan

Example:

# show vlan

When the trunk links come up, VTP passes the VTP and VLAN information to ControllerDevice B. This command verifies that ControllerDevice B has learned the VLAN configuration.

Step 15

configure terminal

Example:

# configure terminal

Enters global configuration mode on ControllerDevice A.

Step 16

interface interface-id

Example:

(config)# interface gigabitethernet1/0/1

Defines the interface to set the STP port priority, and enters interface configuration mode.

Step 17

spanning-tree vlan vlan-range port-priority priority-value

Example:

(config-if)# spanning-tree vlan 8-10 port-priority 16

Assigns the port priority for the VLAN range specified. Enter a port priority value from 0 to 240. Port priority values increment by 16.

Step 18

exit

Example:

(config-if)# exit

Returns to global configuration mode.

Step 19

interface interface-id

Example:

(config)# interface gigabitethernet1/0/2

Defines the interface to set the STP port priority, and enters interface configuration mode.

Step 20

spanning-tree vlan vlan-range port-priority priority-value

Example:

(config-if)# spanning-tree vlan 3-6 port-priority 16

Assigns the port priority for the VLAN range specified. Enter a port priority value from 0 to 240. Port priority values increment by 16.

Step 21

end

Example:

(config-if)# end

Returns to privileged EXEC mode.

Step 22

show running-config

Example:

# show running-config

Verifies your entries.

Step 23

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Configuring Load Sharing Using STP Path Cost

These steps describe how to configure a network with load sharing using STP path costs.

SUMMARY STEPS

1.    configure terminal

2.    interface interface-id

3.    switchport mode trunk

4.    exit

5.    Repeat Steps 2 through 4 on a second interface in ControllerDevice A .

6.    end

7.    show running-config

8.    show vlan

9.    configure terminal

10.    interface interface-id

11.    spanning-tree vlan vlan-range cost cost-value

12.    end

13.    Repeat Steps 9 through 13 on the other configured trunk interface on ControllerDevice A, and set the spanning-tree path cost to 30 for VLANs 8, 9, and 10.

14.    exit

15.    show running-config

16.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global configuration mode on ControllerDevice A.

Step 2

interface interface-id

Example:

(config)# interface gigabitethernet1/0/1

Defines the interface to be configured as a trunk, and enters interface configuration mode.

Step 3

switchport mode trunk

Example:

(config-if)# switchport mode trunk

Configures the port as a trunk port.

Step 4

exit

Example:

(config-if)# exit

Returns to global configuration mode.

Step 5

Repeat Steps 2 through 4 on a second interface in ControllerDevice A .

Step 6

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 7

show running-config

Example:

# show running-config

Verifies your entries. In the display, make sure that the interfaces are configured as trunk ports.

Step 8

show vlan

Example:

# show vlan

When the trunk links come up, ControllerDevice A receives the VTP information from the other controllersdevices. This command verifies that ControllerDevice A has learned the VLAN configuration.

Step 9

configure terminal

Example:

# configure terminal

Enters global configuration mode.

Step 10

interface interface-id

Example:

(config)# interface gigabitethernet1/0/1

Defines the interface on which to set the STP cost, and enters interface configuration mode.

Step 11

spanning-tree vlan vlan-range cost cost-value

Example:

(config-if)# spanning-tree vlan 2-4 cost 30

Sets the spanning-tree path cost to 30 for VLANs 2 through 4.

Step 12

end

Example:

(config-if)# end

Returns to global configuration mode.

Step 13

Repeat Steps 9 through 13 on the other configured trunk interface on ControllerDevice A, and set the spanning-tree path cost to 30 for VLANs 8, 9, and 10.

Step 14

exit

Example:

(config)# exit

Returns to privileged EXEC mode.

Step 15

show running-config

Example:

# show running-config

Verifies your entries. In the display, verify that the path costs are set correctly for both trunk interfaces.

Step 16

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Where to Go Next

After configuring VLAN trunks, you can configure the following:

- VLANs

Additional References

Related Documents

Related Topic

Document Title

CLI commands

VLAN Command Reference (Cisco WLC 5700 Series)

Standards and RFCs

Standard/RFC

Title

RFC 1573

Evolution of the Interfaces Group of MIB-II

RFC 1757

Remote Network Monitoring Management

RFC 2021

SNMPv2 Management Information Base for the Transmission Control Protocol using SMIv2

MIBs

MIB

MIBs Link

All supported MIBs for this release.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

Click Here

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

Click Here

Feature History and Information for VLAN Trunks

Release

Modification

Cisco IOS XE 3.2SE

This feature was introduced.

Preface

- Document Conventions

- Related Documentation

- Obtaining Documentation and Submitting a Service Request

Document Conventions

This document uses the following conventions:

Convention

Description

^ or Ctrl

Both the ^ symbol and Ctrl represent the Control (Ctrl) key on a keyboard. For example, the key combination ^D or Ctrl-D means that you hold down the Control key while you press the D key. (Keys are indicated in capital letters but are not case sensitive.)

bold font

Commands and keywords and user-entered text appear in bold font.

Italic font

Document titles, new or emphasized terms, and arguments for which you supply values are in italic font.

Courier font

Terminal sessions and information the system displays appear in courier font.

Bold Courier font

Bold Courier font indicates text that the user must enter.

[x]

Elements in square brackets are optional.

...

An ellipsis (three consecutive nonbolded periods without spaces) after a syntax element indicates that the element can be repeated.

|

A vertical line, called a pipe, indicates a choice within a set of keywords or arguments.

[x | y]

Optional alternative keywords are grouped in brackets and separated by vertical bars.

{x | y}

Required alternative keywords are grouped in braces and separated by vertical bars.

[x {y | z}]

Nested set of square brackets or braces indicate optional or required choices within optional or required elements. Braces and a vertical bar within square brackets indicate a required choice within an optional element.

string

A nonquoted set of characters. Do not use quotation marks around the string or the string will include the quotation marks.

< >

Nonprinting characters such as passwords are in angle brackets.

[ ]

Default responses to system prompts are in square brackets.

!, #

An exclamation point (!) or a pound sign (#) at the beginning of a line of code indicates a comment line.

Reader Alert Conventions

This document may use the following conventions for reader alerts:

Note

Means reader take note. Notes contain helpful suggestions or references to material not covered in the manual.

Tip

Means the following information will help you solve a problem.

Caution

Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data.

Timesaver

Means the described action saves time. You can save time by performing the action described in the paragraph.

Warning

IMPORTANT SAFETY INSTRUCTIONS

This warning symbol means danger. You are in a situation that could cause bodily injury. Before you work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar with standard practices for preventing accidents. Use the statement number provided at the end of each warning to locate its translation in the translated safety warnings that accompanied this device. Statement 1071

SAVE THESE INSTRUCTIONS

Related Documentation

Note

Before installing or upgrading the controllerdevice, refer to the controllerdevice release notes.

- Cisco Validated Designs documents, located at: Click Here

- Error Message Decoder, located at: Click Here

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:

Click Here

Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.

VTP Advertisements

Each controllerdevice in the VTP domain sends periodic global configuration advertisements from each trunk port to a reserved multicast address. Neighboring controllersdevices receive these advertisements and update their VTP and VLAN configurations as necessary.

VTP advertisements distribute this global domain information:

- VTP domain name

- VTP configuration revision number

- Update identity and update timestamp

- MD5 digest VLAN configuration, including maximum transmission unit (MTU) size for each VLAN

- Frame format

VTP advertisements distribute this VLAN information for each configured VLAN:

- VLAN IDs (including IEEE 802.1Q)

- VLAN name

- VLAN type

- VLAN state

- Additional VLAN configuration information specific to the VLAN type

In VTP version 3, VTP advertisements also include the primary server ID, an instance number, and a start index.

Related References

Prerequisites for VTP

Prerequisites for VTP

Before you create VLANs, you must decide whether to use the VLAN Trunking Protocol (VTP) in your network. Using VTP, you can make configuration changes centrally on one or more controllersdevices and have those changes automatically communicated to all the other controllersdevices in the network. Without VTP, you cannot send information about VLANs to other controllersdevices.

VTP is designed to work in an environment where updates are made on a single controllerdevice and are sent through VTP to other controllersdevices in the domain. It does not work well in a situation where multiple updates to the VLAN database occur simultaneously on controllersdevices in the same domain, which would result in an inconsistency in the VLAN database.

The controllerdevice supports a total of 4094 VLANs. However, the number of configured features affects the usage of the controllerdevice hardware. If the controllerdevice is notified by VTP of a new VLAN and the controllerdevice is already using the maximum available hardware resources, it sends a message that there are not enough hardware resources available and shuts down the VLAN. The output of the show vlan user EXEC command shows the VLAN in a suspended state.

Because trunk ports send and receive VTP advertisements, you must ensure that at least one trunk port is configured on the controllerdevice and that this trunk port is connected to the trunk port of another controllerdevice. Otherwise, the controllerdevice cannot receive any VTP advertisements.

Related Concepts

VTP Advertisements

Adding a VTP Client Switch to a VTP Domain

Follow these steps to verify and reset the VTP configuration revision number on a controllerdevice before adding it to a VTP domain.

Before You Begin
Before adding a VTP client to a VTP domain, always verify that its VTP configuration revision number is lower than the configuration revision number of the other controllersdevices in the VTP domain. ControllersDevices in a VTP domain always use the VLAN configuration of the controllerdevice with the highest VTP configuration revision number. With VTP versions 1 and 2, adding a controllerdevice that has a revision number higher than the revision number in the VTP domain can erase all VLAN information from the VTP server and VTP domain. With VTP version 3, the VLAN information is not erased.

You can use the vtp mode transparent global configuration command to disable VTP on the controllerdevice and then to change its VLAN information without affecting the other controllersdevices in the VTP domain.

SUMMARY STEPS

1.    show vtp status

2.    configure terminal

3.    vtp domain domain-name

4.    end

5.    show vtp status

6.    configure terminal

7.    vtp domain domain-name

8.    end

9.    show vtp status

DETAILED STEPS

Command or Action

Purpose

Step 1

show vtp status

Example:

# show vtp status

Checks the VTP configuration revision number.

If the number is 0, add the controllerdevice to the VTP domain.

If the number is greater than 0, follow these substeps:

- Write down the domain name.

- Write down the configuration revision number.

- Continue with the next steps to reset the controllerdevice configuration revision number.

Step 2

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 3

vtp domain domain-name

Example:

(config)# vtp domain domain123

Changes the domain name from the original one displayed in Step 1 to a new name.

Step 4

end

Example:

(config)# end

Returns to privileged EXEC mode. The VLAN information on the controllerdevice is updated and the configuration revision number is reset to 0.

Step 5

show vtp status

Example:

# show vtp status

Verifies that the configuration revision number has been reset to 0.

Step 6

configure terminal

Example:

# configure terminal

Enters global configuration mode.

Step 7

vtp domain domain-name

Example:

(config)# vtp domain domain012

Enters the original domain name on the controllerdevice

Step 8

end

Example:

(config)# end

Returns to privileged EXEC mode. The VLAN information on the controllerdevice is updated.

Step 9

show vtp status

Example:

# show vtp status

(Optional) Verifies that the domain name is the same as in Step 1 and that the configuration revision number is 0.

Related Concepts

VTP Domain

Related References

Prerequisites for VTP

VTP Domain

A VTP domain (also called a VLAN management domain) consists of one controllerdevice or several interconnected controllersdevices or controllerdevice stacks under the same administrative responsibility sharing the same VTP domain name. A controllerdevice can be in only one VTP domain. You make global VLAN configuration changes for the domain.

By default, the controllerdevice is in the VTP no-management-domain state until it receives an advertisement for a domain over a trunk link (a link that carries the traffic of multiple VLANs) or until you configure a domain name. Until the management domain name is specified or learned, you cannot create or modify VLANs on a VTP server, and VLAN information is not propagated over the network.

If the controllerdevice receives a VTP advertisement over a trunk link, it inherits the management domain name and the VTP configuration revision number. The controllerdevice then ignores advertisements with a different domain name or an earlier configuration revision number.

When you make a change to the VLAN configuration on a VTP server, the change is propagated to all controllersdevices in the VTP domain. VTP advertisements are sent over all IEEE trunk connections, including IEEE 802.1Q. VTP dynamically maps VLANs with unique names and internal index associates across multiple LAN types. Mapping eliminates excessive device administration required from network administrators.

If you configure a controllerdevice for VTP transparent mode, you can create and modify VLANs, but the changes are not sent to other controllersdevices in the domain, and they affect only the individual controllerdevice. However, configuration changes made when the controllerdevice is in this mode are saved in the controllerdevice running configuration and can be saved to the controllerdevice startup configuration file.

Related Tasks

Adding a VTP Client Switch to a VTP Domain

Related References

Prerequisites for VTP

Prerequisites for VTP

Before you create VLANs, you must decide whether to use the VLAN Trunking Protocol (VTP) in your network. Using VTP, you can make configuration changes centrally on one or more controllersdevices and have those changes automatically communicated to all the other controllersdevices in the network. Without VTP, you cannot send information about VLANs to other controllersdevices.

VTP is designed to work in an environment where updates are made on a single controllerdevice and are sent through VTP to other controllersdevices in the domain. It does not work well in a situation where multiple updates to the VLAN database occur simultaneously on controllersdevices in the same domain, which would result in an inconsistency in the VLAN database.

The controllerdevice supports a total of 4094 VLANs. However, the number of configured features affects the usage of the controllerdevice hardware. If the controllerdevice is notified by VTP of a new VLAN and the controllerdevice is already using the maximum available hardware resources, it sends a message that there are not enough hardware resources available and shuts down the VLAN. The output of the show vlan user EXEC command shows the VLAN in a suspended state.

Because trunk ports send and receive VTP advertisements, you must ensure that at least one trunk port is configured on the controllerdevice and that this trunk port is connected to the trunk port of another controllerdevice. Otherwise, the controllerdevice cannot receive any VTP advertisements.

Related Concepts

VTP Domain

Related Tasks

Adding a VTP Client Switch to a VTP Domain

VTP Modes

VTP Modes

VTP Mode

Description

VTP server

In VTP server mode, you can create, modify, and delete VLANs, and specify other configuration parameters (such as the VTP version) for the entire VTP domain. VTP servers advertise their VLAN configurations to other controllersdevices in the same VTP domain and synchronize their VLAN configurations with other controllersdevices based on advertisements received over trunk links.

VTP server is the default mode.

In VTP server mode, VLAN configurations are saved in NVRAM. If the controllerdevice detects a failure while writing a configuration to NVRAM, VTP mode automatically changes from server mode to client mode. If this happens, the controllerdevice cannot be returned to VTP server mode until the NVRAM is functioning.

VTP client

A VTP client functions like a VTP server and transmits and receives VTP updates on its trunks, but you cannot create, change, or delete VLANs on a VTP client. VLANs are configured on another controllerdevice in the domain that is in server mode.

In VTP versions 1 and 2 in VTP client mode, VLAN configurations are not saved in NVRAM. In VTP version 3, VLAN configurations are saved in NVRAM in client mode.

VTP transparent

VTP transparent controllersdevices do not participate in VTP. A VTP transparent controllerdevice does not advertise its VLAN configuration and does not synchronize its VLAN configuration based on received advertisements. However, in VTP version 2 or version 3, transparent controllersdevices do forward VTP advertisements that they receive from other controllersdevices through their trunk interfaces. You can create, modify, and delete VLANs on a controllerdevice in VTP transparent mode.

When the controllerdevice is in VTP transparent mode, the VTP and VLAN configurations are saved in NVRAM, but they are not advertised to other controllersdevices. In this mode, VTP mode and domain name are saved in the controllerdevice running configuration, and you can save this information in the controllerdevice startup configuration file by using the copy running-config startup-config privileged EXEC command.

VTP off

A controllerdevice in VTP off mode functions in the same manner as a VTP transparent controllerdevice, except that it does not forward VTP advertisements on trunks.

Related References

Prerequisites for VTP

Prerequisites for VTP

Before you create VLANs, you must decide whether to use the VLAN Trunking Protocol (VTP) in your network. Using VTP, you can make configuration changes centrally on one or more controllersdevices and have those changes automatically communicated to all the other controllersdevices in the network. Without VTP, you cannot send information about VLANs to other controllersdevices.

VTP is designed to work in an environment where updates are made on a single controllerdevice and are sent through VTP to other controllersdevices in the domain. It does not work well in a situation where multiple updates to the VLAN database occur simultaneously on controllersdevices in the same domain, which would result in an inconsistency in the VLAN database.

The controllerdevice supports a total of 4094 VLANs. However, the number of configured features affects the usage of the controllerdevice hardware. If the controllerdevice is notified by VTP of a new VLAN and the controllerdevice is already using the maximum available hardware resources, it sends a message that there are not enough hardware resources available and shuts down the VLAN. The output of the show vlan user EXEC command shows the VLAN in a suspended state.

Because trunk ports send and receive VTP advertisements, you must ensure that at least one trunk port is configured on the controllerdevice and that this trunk port is connected to the trunk port of another controllerdevice. Otherwise, the controllerdevice cannot receive any VTP advertisements.

Related Concepts

VTP Modes

Enabling VTP Pruning

Pruning increases available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to access the destination devices. You can only enable VTP pruning on a controllerdevice in VTP server mode.

With VTP versions 1 and 2, when you enable pruning on the VTP server, it is enabled for the entire VTP domain. In VTP version 3, you must manually enable pruning on each controllerdevice in the domain.

Only VLANs included in the pruning-eligible list can be pruned. By default, VLANs 2 through 1001 are pruning-eligible on trunk ports. Reserved VLANs and extended-range VLANs cannot be pruned.

Before You Begin
VTP pruning is not designed to function in VTP transparent mode. If one or more controllersdevices in the network are in VTP transparent mode, you should do one of these actions:

- Turn off VTP pruning in the entire network.

- Turn off VTP pruning by making all VLANs on the trunk of the controllerdevice upstream to the VTP transparent controllerdevice pruning ineligible.

To configure VTP pruning on an interface, use the switchport trunk pruning vlan interface configuration command. VTP pruning operates when an interface is trunking. You can set VLAN pruning-eligibility, whether or not VTP pruning is enabled for the VTP domain, whether or not any given VLAN exists, and whether or not the interface is currently trunking.

SUMMARY STEPS

1.    configure terminal

2.    vtp pruning

3.    end

4.    show vtp status

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vtp pruning

Example:

(config)# vtp pruning

Enables pruning in the VTP administrative domain.

By default, pruning is disabled. You need to enable pruning on only one controllerdevice in VTP server mode.

Step 3

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 4

show vtp status

Example:

# show vtp status

Verifies your entries in the VTP Pruning Mode field of the display.

Related Concepts

VTP Pruning

VTP Pruning

VTP pruning increases network available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to reach the destination devices. Without VTP pruning, a controllerdevice floods broadcast, multicast, and unknown unicast traffic across all trunk links within a VTP domain even though receiving controllersdevices might discard them. VTP pruning is disabled by default.

VTP pruning blocks unneeded flooded traffic to VLANs on trunk ports that are included in the pruning-eligible list. Only VLANs included in the pruning-eligible list can be pruned. By default, VLANs 2 through 1001 are pruning eligible controllerdevice trunk ports. If the VLANs are configured as pruning-ineligible, the flooding continues. VTP pruning is supported in all VTP versions.

Enabling VTP pruning on a VTP server enables pruning for the entire management domain. Making VLANs pruning-eligible or pruning-ineligible affects pruning eligibility for those VLANs on that trunk only (not on all controllersdevices in the VTP domain).

VTP pruning takes effect several seconds after you enable it. VTP pruning does not prune traffic from VLANs that are pruning-ineligible. VLAN 1 and VLANs 1002 to 1005 are always pruning-ineligible; traffic from these VLANs cannot be pruned. Extended-range VLANs (VLAN IDs higher than 1005) are also pruning-ineligible.

Related Tasks

Enabling VTP Pruning

Enabling the VTP Version

VTP version 2 and version 3 are disabled by default.

- When you enable VTP version 2 on a controllerdevice , every VTP version 2-capable controllerdevice in the VTP domain enables version 2. To enable VTP version 3, you must manually configure it on each controllerdevice .

- With VTP versions 1 and 2, you can configure the version only on controllersdevices in VTP server or transparent mode. If a controllerdevice is running VTP version 3, you can change to version 2 when the controllerdevice is in client mode if no extended VLANs exist, and no hidden password was configured.

Caution

VTP version 1 and VTP version 2 are not interoperable on controllersdevices in the same VTP domain. Do not enable VTP version 2 unless every controllerdevice in the VTP domain supports version 2.

- In TrCRF and TrBRF Token Ring environments, you must enable VTP version 2 or VTP version 3 for Token Ring VLAN switching to function properly. For Token Ring and Token Ring-Net media, disable VTP version 2.

- Caution

In VTP version 3, both the primary and secondary servers can exist on an instance in the domain.

SUMMARY STEPS

1.    configure terminal

2.    vtp version {1 | 2 | 3}

3.    end

4.    show vtp status

5.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vtp version {1 | 2 | 3}

Example:

(config)# vtp version 2

Enables the VTP version on the controllerdevice. The default is VTP version 1.

Step 3

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 4

show vtp status

Example:

# show vtp status

Verifies that the configured VTP version is enabled.

Step 5

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves the configuration in the startup configuration file.

Related Concepts

VTP Version

VTP Version

Follow these guidelines when deciding which VTP version to implement:

- All controllersdevices in a VTP domain must have the same domain name, but they do not need to run the same VTP version.

- A VTP version 2-capable controllerdevice can operate in the same VTP domain as a controllerdevice running VTP version 1 if version 2 is disabled on the version 2-capable controllerdevice (version 2 is disabled by default).

- If a controllerdevice running VTP version 1, but capable of running VTP version 2, receives VTP version 3 advertisements, it automatically moves to VTP version 2.

- If a controllerdevice running VTP version 3 is connected to a controllerdevice running VTP version 1, the VTP version 1 controllerdevice moves to VTP version 2, and the VTP version 3 controllerdevice sends scaled-down versions of the VTP packets so that the VTP version 2 controllerdevice can update its database.

- A controllerdevice running VTP version 3 cannot move to version 1 or 2 if it has extended VLANs.

- Do not enable VTP version 2 on a controllerdevice unless all of the controllersdevices in the same VTP domain are version-2-capable. When you enable version 2 on a controllerdevice, all of the version-2-capable controllersdevices in the domain enable version 2. If there is a version 1-only controllerdevice, it does not exchange VTP information with controllersdevices that have version 2 enabled.

- Cisco recommends placing VTP version 1 and 2 controllersdevices at the edge of the network because they do not forward VTP version 3 advertisements.

- If there are TrBRF and TrCRF Token Ring networks in your environment, you must enable VTP version 2 or version 3 for Token Ring VLAN switching to function properly. To run Token Ring and Token Ring-Net, disable VTP version 2.

- VTP version 1 and version 2 do not propagate configuration information for extended range VLANs (VLANs 1006 to 4094). You must configure these VLANs manually on each device. VTP version 3 supports extended-range VLANs and support for extended range VLAN database propagation.

- When a VTP version 3 device trunk port receives messages from a VTP version 2 device, it sends a scaled-down version of the VLAN database on that particular trunk in VTP version 2 format. A VTP version 3 device does not send VTP version 2-formatted packets on a trunk unless it first receives VTP version 2 packets on that trunk port.

- When a VTP version 3 device detects a VTP version 2 device on a trunk port, it continues to send VTP version 3 packets, in addition to VTP version 2 packets, to allow both kinds of neighbors to coexist on the same trunk.

- A VTP version 3 device does not accept configuration information from a VTP version 2 or version 1 device.

- Two VTP version 3 regions can only communicate in transparent mode over a VTP version 1 or version 2 region.

- Devices that are only VTP version 1 capable cannot interoperate with VTP version 3 devices.

- VTP version 1 and version 2 do not propagate configuration information for extended range VLANs (VLANs 1006 to 4094). You must manually configure these VLANs on each device.

Related Tasks

Enabling the VTP Version

Enabling the VTP Version

VTP version 2 and version 3 are disabled by default.

- When you enable VTP version 2 on a controllerdevice , every VTP version 2-capable controllerdevice in the VTP domain enables version 2. To enable VTP version 3, you must manually configure it on each controllerdevice .

- With VTP versions 1 and 2, you can configure the version only on controllersdevices in VTP server or transparent mode. If a controllerdevice is running VTP version 3, you can change to version 2 when the controllerdevice is in client mode if no extended VLANs exist, and no hidden password was configured.

Caution

VTP version 1 and VTP version 2 are not interoperable on controllersdevices in the same VTP domain. Do not enable VTP version 2 unless every controllerdevice in the VTP domain supports version 2.

- In TrCRF and TrBRF Token Ring environments, you must enable VTP version 2 or VTP version 3 for Token Ring VLAN switching to function properly. For Token Ring and Token Ring-Net media, disable VTP version 2.

- Caution

In VTP version 3, both the primary and secondary servers can exist on an instance in the domain.

SUMMARY STEPS

1.    configure terminal

2.    vtp version {1 | 2 | 3}

3.    end

4.    show vtp status

5.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vtp version {1 | 2 | 3}

Example:

(config)# vtp version 2

Enables the VTP version on the controllerdevice. The default is VTP version 1.

Step 3

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 4

show vtp status

Example:

# show vtp status

Verifies that the configured VTP version is enabled.

Step 5

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves the configuration in the startup configuration file.

Related Concepts

VTP Version 2

VTP Version 2

If you use VTP in your network, you must decide which version of VTP to use. By default, VTP operates in version 1.

VTP version 2 supports these features that are not supported in version 1:

- Token Ring support—VTP version 2 supports Token Ring Bridge Relay Function (TrBRF) and Token Ring Concentrator Relay Function (TrCRF) VLANs.

- Unrecognized Type-Length-Value (TLV) support—A VTP server or client propagates configuration changes to its other trunks, even for TLVs it is not able to parse. The unrecognized TLV is saved in NVRAM when the controllerdevice is operating in VTP server mode.

- Version-Dependent Transparent Mode—In VTP version 1, a VTP transparent controllerdevice inspects VTP messages for the domain name and version and forwards a message only if the version and domain name match. Although VTP version 2 supports only one domain, a VTP version 2 transparent controllerdevice forwards a message only when the domain name matches.

- Consistency Checks—In VTP version 2, VLAN consistency checks (such as VLAN names and values) are performed only when you enter new information through the CLI or SNMP. Consistency checks are not performed when new information is obtained from a VTP message or when information is read from NVRAM. If the MD5 digest on a received VTP message is correct, its information is accepted.

Related Tasks

Enabling the VTP Version

Enabling the VTP Version

VTP version 2 and version 3 are disabled by default.

- When you enable VTP version 2 on a controllerdevice , every VTP version 2-capable controllerdevice in the VTP domain enables version 2. To enable VTP version 3, you must manually configure it on each controllerdevice .

- With VTP versions 1 and 2, you can configure the version only on controllersdevices in VTP server or transparent mode. If a controllerdevice is running VTP version 3, you can change to version 2 when the controllerdevice is in client mode if no extended VLANs exist, and no hidden password was configured.

Caution

VTP version 1 and VTP version 2 are not interoperable on controllersdevices in the same VTP domain. Do not enable VTP version 2 unless every controllerdevice in the VTP domain supports version 2.

- In TrCRF and TrBRF Token Ring environments, you must enable VTP version 2 or VTP version 3 for Token Ring VLAN switching to function properly. For Token Ring and Token Ring-Net media, disable VTP version 2.

- Caution

In VTP version 3, both the primary and secondary servers can exist on an instance in the domain.

SUMMARY STEPS

1.    configure terminal

2.    vtp version {1 | 2 | 3}

3.    end

4.    show vtp status

5.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vtp version {1 | 2 | 3}

Example:

(config)# vtp version 2

Enables the VTP version on the controllerdevice. The default is VTP version 1.

Step 3

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 4

show vtp status

Example:

# show vtp status

Verifies that the configured VTP version is enabled.

Step 5

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves the configuration in the startup configuration file.

Related Concepts

VTP Version 3

VTP Version 3

VTP version 3 supports these features that are not supported in version 1 or version 2:

- Enhanced authentication—You can configure the authentication as hidden or secret. When hidden, the secret key from the password string is saved in the VLAN database file, but it does not appear in plain text in the configuration. Instead, the key associated with the password is saved in hexadecimal format in the running configuration. You must reenter the password if you enter a takeover command in the domain. When you enter the secret keyword, you can directly configure the password secret key.

- Support for extended range VLAN (VLANs 1006 to 4094) database propagation—VTP versions 1 and 2 propagate only VLANs 1 to 1005.

Note

VTP pruning still applies only to VLANs 1 to 1005, and VLANs 1002 to 1005 are still reserved and cannot be modified.

- Support for any database in a domain—In addition to propagating VTP information, version 3 can propagate Multiple Spanning Tree (MST) protocol database information. A separate instance of the VTP protocol runs for each application that uses VTP.

- VTP primary server and VTP secondary servers—A VTP primary server updates the database information and sends updates that are honored by all devices in the system. A VTP secondary server can only back up the updated VTP configurations received from the primary server to its NVRAM. By default, all devices come up as secondary servers. You can enter the vtp primary privileged EXEC command to specify a primary server. Primary server status is only needed for database updates when the administrator issues a takeover message in the domain. You can have a working VTP domain without any primary servers. Primary server status is lost if the device reloads or domain parameters change, even when a password is configured on the controllerdevice.

- The option to turn VTP on or off on a per-trunk (per-port) basis—You can enable or disable VTP per port by entering the [no] vtp interface configuration command. When you disable VTP on trunking ports, all VTP instances for that port are disabled. You cannot set VTP to off for the MST database and on for the VLAN database on the same port. When you globally set VTP mode to off, it applies to all the trunking ports in the system. However, you can specify on or off on a per-VTP instance basis. For example, you can configure the controllerdevice as a VTP server for the VLAN database but with VTP off for the MST database.

Related Tasks

Enabling the VTP Version

Adding a VTP Client Switch to a VTP Domain

Follow these steps to verify and reset the VTP configuration revision number on a controllerdevice before adding it to a VTP domain.

Before You Begin
Before adding a VTP client to a VTP domain, always verify that its VTP configuration revision number is lower than the configuration revision number of the other controllersdevices in the VTP domain. ControllersDevices in a VTP domain always use the VLAN configuration of the controllerdevice with the highest VTP configuration revision number. With VTP versions 1 and 2, adding a controllerdevice that has a revision number higher than the revision number in the VTP domain can erase all VLAN information from the VTP server and VTP domain. With VTP version 3, the VLAN information is not erased.

You can use the vtp mode transparent global configuration command to disable VTP on the controllerdevice and then to change its VLAN information without affecting the other controllersdevices in the VTP domain.

SUMMARY STEPS

1.    show vtp status

2.    configure terminal

3.    vtp domain domain-name

4.    end

5.    show vtp status

6.    configure terminal

7.    vtp domain domain-name

8.    end

9.    show vtp status

DETAILED STEPS

Command or Action

Purpose

Step 1

show vtp status

Example:

# show vtp status

Checks the VTP configuration revision number.

If the number is 0, add the controllerdevice to the VTP domain.

If the number is greater than 0, follow these substeps:

- Write down the domain name.

- Write down the configuration revision number.

- Continue with the next steps to reset the controllerdevice configuration revision number.

Step 2

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 3

vtp domain domain-name

Example:

(config)# vtp domain domain123

Changes the domain name from the original one displayed in Step 1 to a new name.

Step 4

end

Example:

(config)# end

Returns to privileged EXEC mode. The VLAN information on the controllerdevice is updated and the configuration revision number is reset to 0.

Step 5

show vtp status

Example:

# show vtp status

Verifies that the configuration revision number has been reset to 0.

Step 6

configure terminal

Example:

# configure terminal

Enters global configuration mode.

Step 7

vtp domain domain-name

Example:

(config)# vtp domain domain012

Enters the original domain name on the controllerdevice

Step 8

end

Example:

(config)# end

Returns to privileged EXEC mode. The VLAN information on the controllerdevice is updated.

Step 9

show vtp status

Example:

# show vtp status

(Optional) Verifies that the domain name is the same as in Step 1 and that the configuration revision number is 0.

Related Concepts

Domain Names for Configuring VTP

Domain Names for Configuring VTP

When configuring VTP for the first time, you must always assign a domain name. You must configure all controllersdevices in the VTP domain with the same domain name. ControllersDevices in VTP transparent mode do not exchange VTP messages with other controllersdevices, and you do not need to configure a VTP domain name for  them.

Note

If the NVRAM and DRAM storage is sufficient, all controllersdevices in a VTP domain should be in VTP server mode.

Caution

Do not configure a VTP domain if all controllersdevices are operating in VTP client mode. If you configure the domain, it is impossible to make changes to the VLAN configuration of that domain. Make sure that you configure at least one controllerdevice in the VTP domain for VTP server mode.

Related Tasks

Adding a VTP Client Switch to a VTP Domain

Configuring VTP on a Per-Port Basis

With VTP version 3, you can enable or disable VTP on a per-port basis. You can enable VTP only on ports that are in trunk mode. Incoming and outgoing VTP traffic are blocked, not forwarded.

SUMMARY STEPS

1.    configure terminal

2.    interface interface-id

3.    vtp

4.    end

5.    show running-config interface interface-id

6.    show vtp status

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

interface interface-id

Example:

(config)# interface gigabitethernet1/0/1

Identifies an interface, and enters interface configuration mode.

Step 3

vtp

Example:

(config)# vtp

Enables VTP on the specified port.

Step 4

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 5

show running-config interface interface-id

Example:

# show running-config interface gigabitethernet1/0/1

Verifies the change to the port.

Step 6

show vtp status

Example:

# show vtp status

Verifies the configuration.

Related Concepts

VTP Settings

VTP Settings

The VTP information is saved in the VTP VLAN database. When VTP mode is transparent, the VTP domain name and mode are also saved in the controllerdevice running configuration file, and you can save it in the controllerdevice startup configuration file by entering the copy running-config startup-config privileged EXEC command. You must use this command if you want to save VTP mode as transparent, even if the controllerdevice resets.

When you save VTP information in the controllerdevice startup configuration file and reboot the controllerdevice, the controllerdevice configuration is selected as follows:

- If the VTP mode is transparent in the startup configuration and the VLAN database and the VTP domain name from the VLAN database matches that in the startup configuration file, the VLAN database is ignored (cleared), and the VTP and VLAN configurations in the startup configuration file are used. The VLAN database revision number remains unchanged in the VLAN database.

- If the VTP mode or domain name in the startup configuration do not match the VLAN database, the domain name and VTP mode and configuration for VLAN IDs 1 to 1005 use the VLAN database information.

Related Tasks

Configuring VTP on a Per-Port Basis

Configuring a VTP Version 3 Primary Server

When you configure a VTP server as a VTP primary server, the takeover operation starts.

SUMMARY STEPS

1.    vtp primary [vlan | mst] [force]

DETAILED STEPS

Command or Action

Purpose

Step 1

vtp primary [vlan | mst] [force]

Example:

# vtp primary vlan force

Changes the operational state of a controllerdevice from a secondary server (the default) to a primary server and advertises the configuration to the domain. If the controllerdevice password is configured as hidden, you are prompted to reenter the password.

- (Optional) vlan—Selects the VLAN database as the takeover feature. This is the default.

- (Optional) mst—Selects the multiple spanning tree (MST) database as the takeover feature.

- (Optional) force—Overwrites the configuration of any conflicting servers. If you do not enter force, you are prompted for confirmation before the takeover.

Related Concepts

VTP Settings

VTP Settings

The VTP information is saved in the VTP VLAN database. When VTP mode is transparent, the VTP domain name and mode are also saved in the controllerdevice running configuration file, and you can save it in the controllerdevice startup configuration file by entering the copy running-config startup-config privileged EXEC command. You must use this command if you want to save VTP mode as transparent, even if the controllerdevice resets.

When you save VTP information in the controllerdevice startup configuration file and reboot the controllerdevice, the controllerdevice configuration is selected as follows:

- If the VTP mode is transparent in the startup configuration and the VLAN database and the VTP domain name from the VLAN database matches that in the startup configuration file, the VLAN database is ignored (cleared), and the VTP and VLAN configurations in the startup configuration file are used. The VLAN database revision number remains unchanged in the VLAN database.

- If the VTP mode or domain name in the startup configuration do not match the VLAN database, the domain name and VTP mode and configuration for VLAN IDs 1 to 1005 use the VLAN database information.

Related Tasks

Configuring a VTP Version 3 Primary Server

Configuring a VTP Version 3 Password

You can configure a VTP version 3 password on the controllerdevice.

SUMMARY STEPS

1.    configure terminal

2.    vtp password password [hidden | secret]

3.    end

4.    show vtp password

5.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vtp password password [hidden | secret]

Example:

(config)# vtp password mypassword hidden

(Optional) Sets the password for the VTP domain. The password can be 8 to 64 characters.

- (Optional) hidden—Saves the secret key generated from the password string in the nvram:vlan.dat file. If you configure a takeover by configuring a VTP primary server, you are prompted to reenter the password.

- (Optional) secret—Directly configures the password. The secret password must contain 32 hexadecimal characters.

Step 3

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 4

show vtp password

Example:

# show vtp password

Verifies your entries. The output appears like this:

VTP password: 89914640C8D90868B6A0D8103847A733

Step 5

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves the configuration in the startup configuration file.

Related Concepts

Passwords for the VTP Domain

Related References

Example: Configuring a Switch as the Primary Server

Passwords for the VTP Domain

You can configure a password for the VTP domain, but it is not required. If you do configure a domain password, all domain controllersdevices must share the same password and you must configure the password on each controllerdevice in the management domain. ControllersDevices without a password or with the wrong password reject VTP advertisements.

If you configure a VTP password for a domain, a controllerdevice that is booted without a VTP configuration does not accept VTP advertisements until you configure it with the correct password. After the configuration, the controllerdevice accepts the next VTP advertisement that uses the same password and domain name in the advertisement.

If you are adding a new controllerdevice to an existing network with VTP capability, the new controllerdevice learns the domain name only after the applicable password has been configured on it.

Caution

When you configure a VTP domain password, the management domain does not function properly if you do not assign a management domain password to each controllerdevice in the domain.

Related Tasks

Configuring a VTP Version 3 Password

Related References

Example: Configuring a Switch as the Primary Server

Example: Configuring a Switch as the Primary Server

This example shows how to configure a controllerdevice as the primary server for the VLAN database (the default) when a hidden or secret password was configured:

# vtp primary vlan
Enter VTP password: mypassword
This switch is becoming Primary server for vlan feature in the VTP  domain

VTP Database Conf Switch ID      Primary Server Revision System Name
------------ ---- -------------- -------------- -------- --------------------
VLANDB       Yes  00d0.00b8.1400=00d0.00b8.1400 1        stp7

Do you want to continue (y/n) [n]? y

Related Concepts

Passwords for the VTP Domain

Related Tasks

Configuring a VTP Version 3 Password

Configuring VTP Mode

You can configure VTP mode as one of these:

- VTP server mode—In VTP server mode, you can change the VLAN configuration and have it propagated throughout the network.

- VTP client mode—In VTP client mode, you cannot change its VLAN configuration. The client controllerdevice receives VTP updates from a VTP server in the VTP domain and then modifies its configuration accordingly.

- VTP transparent mode—In VTP transparent mode, VTP is disabled on the controllerdevice. The controllerdevice does not send VTP updates and does not act on VTP updates received from other controllerdevice. However, a VTP transparent controllerdevice running VTP version 2 does forward received VTP advertisements on its trunk links.

- VTP off mode—VTP off mode is the same as VTP transparent mode except that VTP advertisements are not forwarded.

When you configure a domain name, it cannot be removed; you can only reassign a controllerdevice to a different domain.

SUMMARY STEPS

1.    configure terminal

2.    vtp domain domain-name

3.    vtp mode {client | server | transparent | off} {vlan | mst | unknown}

4.    vtp password password

5.    end

6.    show vtp status

7.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vtp domain domain-name

Example:

(config)# vtp domain eng_group

Configures the VTP administrative-domain name. The name can be 1 to 32 characters. All controllersdevices operating in VTP server or client mode under the same administrative responsibility must be configured with the same domain name.

This command is optional for modes other than server mode. VTP server mode requires a domain name. If the controllerdevice has a trunk connection to a VTP domain, the controllerdevice learns the domain name from the VTP server in the domain.

You should configure the VTP domain before configuring other VTP parameters.

Note:

Step 3

vtp mode {client | server | transparent | off} {vlan | mst | unknown}

Example:

(config)# vtp mode server

Configures the controllerdevice for VTP mode (client, server, transparent, or off).

- vlan—The VLAN database is the default if none are configured.

- mst—The multiple spanning tree (MST) database.

- unknown—An unknown database type.

Step 4

vtp password password

Example:

(config)# vtp password mypassword

(Optional) Sets the password for the VTP domain. The password can be 8 to 64 characters. If you configure a VTP password, the VTP domain does not function properly if you do not assign the same password to each controllerdevice in the domain.

Step 5

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 6

show vtp status

Example:

# show vtp status

Verifies your entries in the VTP Operating Mode and the VTP Domain Name fields of the display.

Step 7

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves the configuration in the startup configuration file.

Only VTP mode and domain name are saved in the controllerdevice running configuration and can be copied to the startup configuration file.

Related References

VTP Modes

VTP Modes

VTP Modes

VTP Mode

Description

VTP server

In VTP server mode, you can create, modify, and delete VLANs, and specify other configuration parameters (such as the VTP version) for the entire VTP domain. VTP servers advertise their VLAN configurations to other controllersdevices in the same VTP domain and synchronize their VLAN configurations with other controllersdevices based on advertisements received over trunk links.

VTP server is the default mode.

In VTP server mode, VLAN configurations are saved in NVRAM. If the controllerdevice detects a failure while writing a configuration to NVRAM, VTP mode automatically changes from server mode to client mode. If this happens, the controllerdevice cannot be returned to VTP server mode until the NVRAM is functioning.

VTP client

A VTP client functions like a VTP server and transmits and receives VTP updates on its trunks, but you cannot create, change, or delete VLANs on a VTP client. VLANs are configured on another controllerdevice in the domain that is in server mode.

In VTP versions 1 and 2 in VTP client mode, VLAN configurations are not saved in NVRAM. In VTP version 3, VLAN configurations are saved in NVRAM in client mode.

VTP transparent

VTP transparent controllersdevices do not participate in VTP. A VTP transparent controllerdevice does not advertise its VLAN configuration and does not synchronize its VLAN configuration based on received advertisements. However, in VTP version 2 or version 3, transparent controllersdevices do forward VTP advertisements that they receive from other controllersdevices through their trunk interfaces. You can create, modify, and delete VLANs on a controllerdevice in VTP transparent mode.

When the controllerdevice is in VTP transparent mode, the VTP and VLAN configurations are saved in NVRAM, but they are not advertised to other controllersdevices. In this mode, VTP mode and domain name are saved in the controllerdevice running configuration, and you can save this information in the controllerdevice startup configuration file by using the copy running-config startup-config privileged EXEC command.

VTP off

A controllerdevice in VTP off mode functions in the same manner as a VTP transparent controllerdevice, except that it does not forward VTP advertisements on trunks.

Related Tasks

Configuring VTP Mode

Creating or Modifying an Ethernet VLAN

Before You Begin
With VTP version 1 and 2, if the controllerdevice is in VTP transparent mode, you can assign VLAN IDs greater than 1006, but they are not added to the VLAN database.

The controllerdevice supports only Ethernet interfaces. Because FDDI and Token Ring VLANs are not locally supported, you only configure FDDI and Token Ring media-specific characteristics for VTP global advertisements to other controllersdevices.

Although the controllerdevice does not support Token Ring connections, a remote device with Token Ring connections could be managed from one of the supported controllersdevices. ControllersDevices running VTP Version 2 advertise information about these Token Ring VLANs:

- Token Ring TrBRF VLANs

- Token Ring TrCRF VLANs

SUMMARY STEPS

1.    configure terminal

2.    vlan vlan-id

3.    name vlan-name

4.    media { ethernet | fd-net | fddi | tokenring | trn-net }

5.    remote-span

6.    end

7.    show vlan {name vlan-name | id vlan-id}

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vlan vlan-id

Example:

(config)# vlan 20

Enters a VLAN ID, and enters VLAN configuration mode. Enter a new VLAN ID to create a VLAN, or enter an existing VLAN ID to modify that VLAN.

Note:
The available VLAN ID range for this command is 1 to 4094.

Step 3

name vlan-name

Example:

(config-vlan)# name test20

(Optional) Enters a name for the VLAN. If no name is entered for the VLAN, the default is to append the vlan-id value with leading zeros to the word VLAN. For example, VLAN0004 is a default VLAN name for VLAN 4.

Step 4

media { ethernet | fd-net | fddi | tokenring | trn-net }

Example:

(config-vlan)# media ethernet

Configures the VLAN media type. Command options include:

- ethernet—Sets the VLAN media type as Ethernet.

- fd-net—Sets the VLAN media type as FDDI net.

- fddi—Sets the VLAN media type as FDDI.

- tokenring—Sets the VLAN media type as Token Ring.

- trn-net—Sets the VLAN media type as Token Ring net.

Step 5

remote-span

Example:

(config-vlan)# remote-span

(Optional) Configures the VLAN as the RSPAN VLAN for a remote SPAN session. For more information on remote SPAN, see the Catalyst 3850 Network Management Configuration Guide.

Step 6

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 7

show vlan {name vlan-name | id vlan-id}

Example:

# show vlan name test20 id 20

Verifies your entries.

Related Concepts

Normal-Range VLAN Configuration Guidelines

Related References

Monitoring VLANs

Normal-Range VLAN Configuration Guidelines

Normal-range VLANs are VLANs with IDs from 1 to 1005.

Follow these guidelines when creating and modifying normal-range VLANs in your network:

- Normal-range VLANs are identified with a number between 1 and 1001. VLAN numbers 1002 through 1005 are reserved for Token Ring and FDDI VLANs.

- VLAN configurations for VLANs 1 to 1005 are always saved in the VLAN database. If the VTP mode is transparent, VTP and VLAN configurations are also saved in the controllerdevice running configuration file.

- If the controllerdevice is in VTP server or VTP  transparent mode, you can add, modify or remove configurations for VLANs 2 to 1001 in the VLAN database. (VLAN IDs 1 and 1002 to 1005 are automatically created and cannot be removed.)

- Extended-range VLANs created in VTP transparent mode are not saved in the VLAN database and are not propagated. VTP version 3 supports extended range VLAN (VLANs 1006 to 4094) database propagation in VTP server mode.

- Before you can create a VLAN, the controllerdevice must be in VTP server mode or VTP transparent mode. If the controllerdevice is a VTP server, you must define a VTP domain or VTP will not function.

- The controllerdevice does not support Token Ring or FDDI media. The controllerdevice does not forward FDDI, FDDI-Net, TrCRF, or TrBRF traffic, but it does propagate the VLAN configuration through  VTP.

- The controllerdevice supports 128 spanning tree instances. If a controllerdevice has more active VLANs than supported spanning-tree instances, spanning tree can be enabled on 128 VLANs and is disabled on the remaining VLANs. If you have already used all available spanning-tree instances on a controllerdevice, adding another VLAN anywhere in the VTP domain creates a VLAN on that controllerdevice that is not running spanning-tree. If you have the default allowed list on the trunk ports of that controllerdevice (which is to allow all VLANs), the new VLAN is carried on all trunk ports. Depending on the topology of the network, this could create a loop in the new VLAN that would not be broken, particularly if there are several adjacent controllersdevices that all have run out of spanning-tree instances. You can prevent this possibility by setting allowed lists on the trunk ports of controllersdevices that have used up their allocation of spanning-tree instances. If the number of VLANs on the controllerdevice exceeds the number of supported spanning-tree instances, we recommend that you configure the IEEE 802.1s Multiple STP (MSTP) on your controllerdevice to map multiple VLANs to a single spanning-tree instance.

Related Tasks

Creating or Modifying an Ethernet VLAN

Related References

Monitoring VLANs

Monitoring VLANs

Privileged EXEC show Commands

Command

Purpose

show interfaces [vlan vlan-id]

Displays characteristics for all interfaces or for the specified VLAN configured on the controllerdevice .

show vlan [ access-map name | brief | dot1q { tag native } | filter [ access-map | vlan ] | group [ group-name name ] | id vlan-id | ifindex | mtu | name name | remote-span | summary ]

Displays parameters for all VLANs or the specified VLAN on the controllerdevice. The following command options are available:

- access-map—Displays the VLAN access-maps.

- brief—Displays VTP VLAN status in brief.

- dot1q—Displays the dot1q parameters.

- filter—Displays VLAN filter information.

- group—Displays the VLAN group with its name and the connected VLANs that are available.

- id—Displays VTP VLAN status by identification number.

- ifindex—Displays SNMP ifIndex.

- mtu—Displays VLAN MTU information.

- name—Displays the VTP VLAN information by specified name.

- remote-span–Displays the remote SPAN VLANs.

- summary—Displays a summary of VLAN information.

Related Concepts

Normal-Range VLAN Configuration Guidelines

Related Tasks

Creating or Modifying an Ethernet VLAN

Deleting a VLAN

When you delete a VLAN from a controllerdevice that is in VTP server mode, the VLAN is removed from the VLAN database for all controllersdevices in the VTP domain. When you delete a VLAN from a controllerdevice that is in VTP transparent mode, the VLAN is deleted only on that specific controllerdevice .

You cannot delete the default VLANs for the different media types: Ethernet VLAN 1 and FDDI or Token Ring VLANs 1002 to 1005.

Caution

When you delete a VLAN, any ports assigned to that VLAN become inactive. They remain associated with the VLAN (and thus inactive) until you assign them to a new VLAN.

SUMMARY STEPS

1.    configure terminal

2.    no vlan vlan-id

3.    end

4.    show vlan brief

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

no vlan vlan-id

Example:

(config)# no vlan 4

Removes the VLAN by entering the VLAN ID.

Step 3

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 4

show vlan brief

Example:

# show vlan brief

Verifies the VLAN removal.

Related References

Monitoring VLANs

Monitoring VLANs

Privileged EXEC show Commands

Command

Purpose

show interfaces [vlan vlan-id]

Displays characteristics for all interfaces or for the specified VLAN configured on the controllerdevice .

show vlan [ access-map name | brief | dot1q { tag native } | filter [ access-map | vlan ] | group [ group-name name ] | id vlan-id | ifindex | mtu | name name | remote-span | summary ]

Displays parameters for all VLANs or the specified VLAN on the controllerdevice. The following command options are available:

- access-map—Displays the VLAN access-maps.

- brief—Displays VTP VLAN status in brief.

- dot1q—Displays the dot1q parameters.

- filter—Displays VLAN filter information.

- group—Displays the VLAN group with its name and the connected VLANs that are available.

- id—Displays VTP VLAN status by identification number.

- ifindex—Displays SNMP ifIndex.

- mtu—Displays VLAN MTU information.

- name—Displays the VTP VLAN information by specified name.

- remote-span–Displays the remote SPAN VLANs.

- summary—Displays a summary of VLAN information.

Related Tasks

Deleting a VLAN

Assigning Static-Access Ports to a VLAN

You can assign a static-access port to a VLAN without having VTP globally propagate VLAN configuration information by disabling VTP (VTP transparent mode).

If you assign an interface to a VLAN that does not exist, the new VLAN is created.

SUMMARY STEPS

1.    configure terminal

2.    interface interface-id

3.    switchport mode access

4.    switchport access vlan vlan-id

5.    end

6.    show running-config interface interface-id

7.    show interfaces interface-id switchport

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global configuration mode

Step 2

interface interface-id

Example:

(config)# interface gigabitethernet2/0/1

Enters the interface to be added to the VLAN.

Step 3

switchport mode access

Example:

(config-if)# switchport mode access

Defines the VLAN membership mode for the port (Layer 2 access port).

Step 4

switchport access vlan vlan-id

Example:

(config-if)# switchport access vlan 2

Assigns the port to a VLAN. Valid VLAN IDs are 1 to 4094.

Step 5

end

Example:

(config-if)# end

Returns to privileged EXEC mode.

Step 6

show running-config interface interface-id

Example:

# show running-config interface gigabitethernet2/0/1

Verifies the VLAN membership mode of the interface.

Step 7

show interfaces interface-id switchport

Example:

# show interfaces gigabitethernet2/0/1 switchport

Verifies your entries in the Administrative Mode and the Access Mode VLAN fields of the display.

Related References

VLAN Port Membership Modes

Monitoring VLANs

VLAN Port Membership Modes

You configure a port to belong to a VLAN by assigning a membership mode that specifies the kind of traffic the port carries and the number of VLANs to which it can belong.

When a port belongs to a VLAN, the controllerdevice learns and manages the addresses associated with the port on a per-VLAN basis.

Port Membership Modes and Characteristics

Membership Mode

VLAN Membership Characteristics

VTP Characteristics

Static-access

A static-access port can belong to one VLAN and is manually assigned to that VLAN.

VTP is not required. If you do not want VTP to globally propagate information, set the VTP mode to transparent. To participate in VTP, there must be at least one trunk port on the controllerdevice connected to a trunk port of a second controllerdevice.

Trunk (IEEE 802.1Q) :

- IEEE 802.1Q— Industry-standard trunking encapsulation.

A trunk port is a member of all VLANs by default, including extended-range VLANs, but membership can be limited by configuring the allowed-VLAN list. You can also modify the pruning-eligible list to block flooded traffic to VLANs on trunk ports that are included in the list.

VTP is recommended but not required. VTP maintains VLAN configuration consistency by managing the addition, deletion, and renaming of VLANs on a network-wide basis. VTP exchanges VLAN configuration messages with other controllersdevices over trunk links.

Dynamic access

A dynamic-access port can belong to one VLAN (VLAN ID 1 to 4094) and is dynamically assigned by a VLAN Member Policy Server (VMPS).

You can have dynamic-access ports and trunk ports on the same controllerdevice, but you must connect the dynamic-access port to an end station or hub and not to another controllerdevice.

VTP is required.

Configure the VMPS and the client with the same VTP domain name.

To participate in VTP, at least one trunk port on the controllerdevice must be connected to a trunk port of a second controllerdevice .

Voice VLAN

A voice VLAN port is an access port attached to a Cisco IP Phone, configured to use one VLAN for voice traffic and another VLAN for data traffic from a device attached to the phone.

VTP is not required; it has no effect on a voice VLAN.

Related Tasks

Assigning Static-Access Ports to a VLAN

Related References

Monitoring VLANs

Monitoring VLANs

Privileged EXEC show Commands

Command

Purpose

show interfaces [vlan vlan-id]

Displays characteristics for all interfaces or for the specified VLAN configured on the controllerdevice .

show vlan [ access-map name | brief | dot1q { tag native } | filter [ access-map | vlan ] | group [ group-name name ] | id vlan-id | ifindex | mtu | name name | remote-span | summary ]

Displays parameters for all VLANs or the specified VLAN on the controllerdevice. The following command options are available:

- access-map—Displays the VLAN access-maps.

- brief—Displays VTP VLAN status in brief.

- dot1q—Displays the dot1q parameters.

- filter—Displays VLAN filter information.

- group—Displays the VLAN group with its name and the connected VLANs that are available.

- id—Displays VTP VLAN status by identification number.

- ifindex—Displays SNMP ifIndex.

- mtu—Displays VLAN MTU information.

- name—Displays the VTP VLAN information by specified name.

- remote-span–Displays the remote SPAN VLANs.

- summary—Displays a summary of VLAN information.

Related Tasks

Assigning Static-Access Ports to a VLAN

Related References

VLAN Port Membership Modes

Creating an Extended-Range VLAN

SUMMARY STEPS

1.    configure terminal

2.    vlan vlan-id

3.    remote-span

4.    exit

5.    end

6.    show vlan id vlan-id

7.    copy running-config startup config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

vlan vlan-id

Example:

(config)# vlan 2000
(config-vlan)#

Enters an extended-range VLAN ID and enters VLAN configuration mode. The range is 1006 to 4094.

Step 3

remote-span

Example:

(config-vlan)# remote-span

(Optional) Configures the VLAN as the RSPAN VLAN.

Step 4

exit

Example:

(config-vlan)# exit
(config)#

Returns to configuration mode.

Step 5

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 6

show vlan id vlan-id

Example:

# show vlan id 2000

Verifies that the VLAN has been created.

Step 7

copy running-config startup config

Example:

# copy running-config startup-config

Saves your entries in the controllerdevice startup configuration file. To save an extended-range VLAN configuration, you need to save the VTP transparent mode configuration and the extended-range VLAN configuration in the controllerdevice startup configuration file. Otherwise, if the controllerdevice resets, it will default to VTP server mode, and the extended-range VLAN IDs will not be saved.

Note:
This step is not required for VTP version 3 because VLANs are saved in the VLAN database.

Related Concepts

Extended-Range VLAN Configuration Guidelines

Related References

Monitoring VLANs

Extended-Range VLAN Configuration Guidelines

Extended-range VLANs are VLANs with IDs from 1006 to 4094.

Follow these guidelines when creating extended-range VLANs:

- VLAN IDs in the extended range are not saved in the VLAN database and are not recognized by VTP unless the controllerdevice is running VTP version 3.

- You cannot include extended-range VLANs in the pruning eligible range.

- For VTP version 1 or 2, you can set the VTP mode to transparent in global configuration mode. You should save this configuration to the startup configuration so that the controllerdevice boots up in VTP transparent mode. Otherwise, you lose the extended-range VLAN configuration if the controllerdevice resets. If you create extended-range VLANs in VTP version 3, you cannot convert to VTP version 1 or 2.

Related Tasks

Creating an Extended-Range VLAN

Related References

Monitoring VLANs

Monitoring VLANs

Privileged EXEC show Commands

Command

Purpose

show interfaces [vlan vlan-id]

Displays characteristics for all interfaces or for the specified VLAN configured on the controllerdevice .

show vlan [ access-map name | brief | dot1q { tag native } | filter [ access-map | vlan ] | group [ group-name name ] | id vlan-id | ifindex | mtu | name name | remote-span | summary ]

Displays parameters for all VLANs or the specified VLAN on the controllerdevice. The following command options are available:

- access-map—Displays the VLAN access-maps.

- brief—Displays VTP VLAN status in brief.

- dot1q—Displays the dot1q parameters.

- filter—Displays VLAN filter information.

- group—Displays the VLAN group with its name and the connected VLANs that are available.

- id—Displays VTP VLAN status by identification number.

- ifindex—Displays SNMP ifIndex.

- mtu—Displays VLAN MTU information.

- name—Displays the VTP VLAN information by specified name.

- remote-span–Displays the remote SPAN VLANs.

- summary—Displays a summary of VLAN information.

Related Concepts

Extended-Range VLAN Configuration Guidelines

Related Tasks

Creating an Extended-Range VLAN

Creating VLAN Groups (CLI)

SUMMARY STEPS

1.    configure terminal

2.    vlan group WORD vlan-list vlan-ID

3.    end

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global command mode.

Step 2

vlan group WORD vlan-list vlan-ID

Example:

(config)#vlan group vlangrp1 vlan-list 91-95

Creates a VLAN group with the given group name (vlangrp1) and adds all the VLANs listed in the command. The VLAN list ranges from 1 to 4096 and the recommended number of VLANs in a group is 32.

Step 3

end

Example:

(config)#end

Exits the global configuration mode and returns to privileged EXEC mode. Alternatively, press CTRL-Z to exit the global configuration mode.

Related References

Information About VLAN Groups

Information About VLAN Groups

Whenever a wireless client connects to a wireless network (WLAN), the client is placed in a VLAN that is associated with the WLAN. In a large venue such as an auditorium, a stadium, or a conference room where there are numerous wireless clients, having only a single WLAN to accommodate many clients might be a challenge.

The VLAN group feature uses a single WLAN that can support multiple VLANs. The clients can get assigned to one of the configured VLANs. This feature maps a WLAN to a single VLAN or multiple VLANs using the VLAN groups. When a wireless client associates to the WLAN, the VLAN is derived by an algorithm based on the MAC address of the wireless client. A VLAN is assigned to the client and the client gets the IP address from the assigned VLAN. This feature also extends the current AP group architecture and AAA override architecture, where the AP groups and AAA override can override a VLAN or a VLAN group to which the WLAN is mapped.

Related Concepts

Creating VLAN Groups (CLI)

Defining the Allowed VLANs on a Trunk

VLAN 1 is the default VLAN on all trunk ports in all Cisco controllersdevices, and it has previously been a requirement that VLAN 1 always be enabled on every trunk link. You can use the VLAN 1 minimization feature to disable VLAN 1 on any individual VLAN trunk link so that no user traffic (including spanning-tree advertisements) is sent or received on VLAN 1.

SUMMARY STEPS

1.    configure terminal

2.    interface interface-id

3.    switchport mode trunk

4.    end

5.    show interfaces interface-id switchport

6.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

interface interface-id

Example:

(config)# interface gigabitethernet1/0/1

Specifies the port to be configured, and enters interface configuration mode.

Step 3

switchport mode trunk

Example:

(config-if)# switchport mode trunk

Configures the interface as a VLAN trunk port.

Step 4

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 5

show interfaces interface-id switchport

Example:

# show interfaces gigabitethernet1/0/1 switchport

Verifies your entries in the Trunking VLANs Enabled field of the display.

Step 6

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Related Concepts

Allowed VLANs on a Trunk

Allowed VLANs on a Trunk

By default, a trunk port sends traffic to and receives traffic from all VLANs. All VLAN IDs, 1 to 4094, are allowed on each trunk. However, you can remove VLANs from the allowed list, preventing traffic from those VLANs from passing over the trunk.

To reduce the risk of spanning-tree loops or storms, you can disable VLAN 1 on any individual VLAN trunk port by removing VLAN 1 from the allowed list. When you remove VLAN 1 from a trunk port, the interface continues to send and receive management traffic, for example, Cisco Discovery Protocol (CDP), Port Aggregation Protocol (PAgP), Link Aggregation Control Protocol (LACP), DTP, and VTP in VLAN 1.

If a trunk port with VLAN 1 disabled is converted to a nontrunk port, it is added to the access VLAN. If the access VLAN is set to 1, the port will be added to VLAN 1, regardless of the switchport trunk allowed setting. The same is true for any VLAN that has been disabled on the port.

A trunk port can become a member of a VLAN if the VLAN is enabled, if VTP knows of the VLAN, and if the VLAN is in the allowed list for the port. When VTP detects a newly enabled VLAN and the VLAN is in the allowed list for a trunk port, the trunk port automatically becomes a member of the enabled VLAN. When VTP detects a new VLAN and the VLAN is not in the allowed list for a trunk port, the trunk port does not become a member of the new VLAN.

Related Tasks

Defining the Allowed VLANs on a Trunk

Configuring a Trunk Port

Because trunk ports send and receive VTP advertisements, to use VTP you must ensure that at least one trunk port is configured on the controllerdevice and that this trunk port is connected to the trunk port of a second controllerdevice. Otherwise, the controllerdevice cannot receive any VTP advertisements.

Before You Begin

SUMMARY STEPS

1.    configure terminal

2.    interface interface-id

3.    switchport mode {dynamic {auto | desirable} | trunk}

4.    switchport access vlan vlan-id

5.    switchport trunk native vlan vlan-id

6.    end

7.    show interfaces interface-id switchport

8.    show interfaces interface-id trunk

9.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters the global configuration mode.

Step 2

interface interface-id

Example:

(config)# interface gigabitethernet1/0/2

Specifies the port to be configured for trunking, and enters interface configuration mode.

Step 3

switchport mode {dynamic {auto | desirable} | trunk}

Example:

(config-if)# switchport mode dynamic desirable

Configures the interface as a Layer 2 trunk (required only if the interface is a Layer 2 access port or tunnel port or to specify the trunking mode).

- dynamic auto—Sets the interface to a trunk link if the neighboring interface is set to trunk or desirable mode. This is the default.

- dynamic desirable—Sets the interface to a trunk link if the neighboring interface is set to trunk, desirable, or auto mode.

- trunk—Sets the interface in permanent trunking mode and negotiate to convert the link to a trunk link even if the neighboring interface is not a trunk interface.

Step 4

switchport access vlan vlan-id

Example:

(config-if)# switchport access vlan 200

(Optional) Specifies the default VLAN, which is used if the interface stops trunking.

Step 5

switchport trunk native vlan vlan-id

Example:

(config-if)# switchport trunk native vlan 200

Specifies the native VLAN for IEEE 802.1Q trunks.

Step 6

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 7

show interfaces interface-id switchport

Example:

# show interfaces gigabitethernet1/0/2 switchport

Displays the switch port configuration of the interface in the Administrative Mode and the Administrative Trunking Encapsulation fields of the display.

Step 8

show interfaces interface-id trunk

Example:

# show interfaces gigabitethernet1/0/2 trunk

Displays the trunk configuration of the interface.

Step 9

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Related Concepts

Trunking Modes

Related References

Layer 2 Interface Modes

Trunking Modes

Ethernet trunk interfaces support different trunking modes. You can set an interface as trunking or nontrunking or to negotiate trunking with the neighboring interface. To autonegotiate trunking, the interfaces must be in the same VTP domain.

Trunk negotiation is managed by the Dynamic Trunking Protocol (DTP), which is a Point-to-Point Protocol (PPP). However, some internetworking devices might forward DTP frames improperly, which could cause misconfigurations.

Related Tasks

Configuring a Trunk Port

Related References

Layer 2 Interface Modes

Layer 2 Interface Modes

Layer 2 Interface Modes

Mode

Function

switchport mode access

Puts the interface (access port) into permanent nontrunking mode and negotiates to convert the link into a nontrunk link. The interface becomes a nontrunk interface regardless of whether or not the neighboring interface is a trunk interface.

switchport mode dynamic auto

Makes the interface able to convert the link to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk or desirable mode. The default switchport mode for all Ethernet interfaces is dynamic auto.

switchport mode dynamic desirable

Makes the interface actively attempt to convert the link to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode.

switchport mode trunk

Puts the interface into permanent trunking mode and negotiates to convert the neighboring link into a trunk link. The interface becomes a trunk interface even if the neighboring interface is not a trunk interface.

switchport nonegotiate

Prevents the interface from generating DTP frames. You can use this command only when the interface switchport mode is access or trunk. You must manually configure the neighboring interface as a trunk interface to establish a trunk link.

Related Concepts

Trunking Modes

Related Tasks

Configuring a Trunk Port

Configuring Load Sharing Using STP Path Cost

These steps describe how to configure a network with load sharing using STP path costs.

SUMMARY STEPS

1.    configure terminal

2.    interface interface-id

3.    switchport mode trunk

4.    exit

5.    Repeat Steps 2 through 4 on a second interface in ControllerDevice A .

6.    end

7.    show running-config

8.    show vlan

9.    configure terminal

10.    interface interface-id

11.    spanning-tree vlan vlan-range cost cost-value

12.    end

13.    Repeat Steps 9 through 13 on the other configured trunk interface on ControllerDevice A, and set the spanning-tree path cost to 30 for VLANs 8, 9, and 10.

14.    exit

15.    show running-config

16.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global configuration mode on ControllerDevice A.

Step 2

interface interface-id

Example:

(config)# interface gigabitethernet1/0/1

Defines the interface to be configured as a trunk, and enters interface configuration mode.

Step 3

switchport mode trunk

Example:

(config-if)# switchport mode trunk

Configures the port as a trunk port.

Step 4

exit

Example:

(config-if)# exit

Returns to global configuration mode.

Step 5

Repeat Steps 2 through 4 on a second interface in ControllerDevice A .

Step 6

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 7

show running-config

Example:

# show running-config

Verifies your entries. In the display, make sure that the interfaces are configured as trunk ports.

Step 8

show vlan

Example:

# show vlan

When the trunk links come up, ControllerDevice A receives the VTP information from the other controllersdevices. This command verifies that ControllerDevice A has learned the VLAN configuration.

Step 9

configure terminal

Example:

# configure terminal

Enters global configuration mode.

Step 10

interface interface-id

Example:

(config)# interface gigabitethernet1/0/1

Defines the interface on which to set the STP cost, and enters interface configuration mode.

Step 11

spanning-tree vlan vlan-range cost cost-value

Example:

(config-if)# spanning-tree vlan 2-4 cost 30

Sets the spanning-tree path cost to 30 for VLANs 2 through 4.

Step 12

end

Example:

(config-if)# end

Returns to global configuration mode.

Step 13

Repeat Steps 9 through 13 on the other configured trunk interface on ControllerDevice A, and set the spanning-tree path cost to 30 for VLANs 8, 9, and 10.

Step 14

exit

Example:

(config)# exit

Returns to privileged EXEC mode.

Step 15

show running-config

Example:

# show running-config

Verifies your entries. In the display, verify that the path costs are set correctly for both trunk interfaces.

Step 16

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Related Concepts

Network Load Sharing Using STP Path Cost

Network Load Sharing Using STP Path Cost

You can configure parallel trunks to share VLAN traffic by setting different path costs on a trunk and associating the path costs with different sets of VLANs, blocking different ports for different VLANs. The VLANs keep the traffic separate and maintain redundancy in the event of a lost link.

Related Tasks

Configuring Load Sharing Using STP Path Cost

Configuring Load Sharing Using STP Port Priorities

These steps describe how to configure a network with load sharing using STP port priorities.

SUMMARY STEPS

1.    configure terminal

2.    vtp domain domain-name

3.    vtp mode server

4.    end

5.    show vtp status

6.    show vlan

7.    configure terminal

8.    interface interface-id

9.    switchport mode trunk

10.    end

11.    show interfaces interface-id switchport

12.    Repeat the above steps on ControllerDevice A for a second port in the controllerdevice.

13.    Repeat the above steps on ControllerDevice B to configure the trunk ports that connect to the trunk ports configured on ControllerDevice A.

14.    show vlan

15.    configure terminal

16.    interface interface-id

17.    spanning-tree vlan vlan-range port-priority priority-value

18.    exit

19.    interface interface-id

20.    spanning-tree vlan vlan-range port-priority priority-value

21.    end

22.    show running-config

23.    copy running-config startup-config

DETAILED STEPS

Command or Action

Purpose

Step 1

configure terminal

Example:

# configure terminal

Enters global configuration mode on ControllerDevice A.

Step 2

vtp domain domain-name

Example:

(config)# vtp domain workdomain

Configures a VTP administrative domain.

The domain name can be 1 to 32 characters.

Step 3

vtp mode server

Example:

(config)# vtp mode server

Configures ControllerDevice A as the VTP server.

Step 4

end

Example:

(config)# end

Returns to privileged EXEC mode.

Step 5

show vtp status

Example:

# show vtp status

Verifies the VTP configuration on both ControllerDevice A and ControllerDevice B.

In the display, check the VTP Operating Mode and the VTP Domain Name fields.

Step 6

show vlan

Example:

# show vlan

Verifies that the VLANs exist in the database on ControllerDevice A.

Step 7

configure terminal

Example:

# configure terminal

Enters global configuration mode.

Step 8

interface interface-id

Example:

(config)# interface gigabitethernet1/0/1

Defines the interface to be configured as a trunk, and enters interface configuration mode.

Step 9

switchport mode trunk

Example:

(config-if)# switchport mode trunk

Configures the port as a trunk port.

Step 10

end

Example:

(config-if)# end

Returns to privileged EXEC mode.

Step 11

show interfaces interface-id switchport

Example:

# show interfaces gigabitethernet1/0/1 switchport

Verifies the VLAN configuration.

Step 12

Repeat the above steps on ControllerDevice A for a second port in the controllerdevice.

Step 13

Repeat the above steps on ControllerDevice B to configure the trunk ports that connect to the trunk ports configured on ControllerDevice A.

Step 14

show vlan

Example:

# show vlan

When the trunk links come up, VTP passes the VTP and VLAN information to ControllerDevice B. This command verifies that ControllerDevice B has learned the VLAN configuration.

Step 15

configure terminal

Example:

# configure terminal

Enters global configuration mode on ControllerDevice A.

Step 16

interface interface-id

Example:

(config)# interface gigabitethernet1/0/1

Defines the interface to set the STP port priority, and enters interface configuration mode.

Step 17

spanning-tree vlan vlan-range port-priority priority-value

Example:

(config-if)# spanning-tree vlan 8-10 port-priority 16

Assigns the port priority for the VLAN range specified. Enter a port priority value from 0 to 240. Port priority values increment by 16.

Step 18

exit

Example:

(config-if)# exit

Returns to global configuration mode.

Step 19

interface interface-id

Example:

(config)# interface gigabitethernet1/0/2

Defines the interface to set the STP port priority, and enters interface configuration mode.

Step 20

spanning-tree vlan vlan-range port-priority priority-value

Example:

(config-if)# spanning-tree vlan 3-6 port-priority 16

Assigns the port priority for the VLAN range specified. Enter a port priority value from 0 to 240. Port priority values increment by 16.

Step 21

end

Example:

(config-if)# end

Returns to privileged EXEC mode.

Step 22

show running-config

Example:

# show running-config

Verifies your entries.

Step 23

copy running-config startup-config

Example:

# copy running-config startup-config

(Optional) Saves your entries in the configuration file.

Related Concepts

Network Load Sharing Using STP Priorities

Network Load Sharing Using STP Priorities

When two ports on the same controllerdevice form a loop, the controllerdevice uses the STP port priority to decide which port is enabled and which port is in a blocking state. You can set the priorities on a parallel trunk port so that the port carries all the traffic for a given VLAN. The trunk port with the higher priority (lower values) for a VLAN is forwarding traffic for that VLAN. The trunk port with the lower priority (higher values) for the same VLAN remains in a blocking state for that VLAN. One trunk port sends or receives all traffic for the VLAN.

Related Tasks

Configuring Load Sharing Using STP Port Priorities