Table Of Contents

Configuring VLANs

Understanding How VLANs Work

Understanding VLANs in a VTP Domain

Understanding Token Ring VLANs

Token Ring TrBRF VLANs

Token Ring TrCRF VLANs

VLAN Default Configuration

VLAN Configuration Guidelines

Configuring VLANs

Creating or Modifying an Ethernet VLAN

Creating or Modifying an FDDI VLAN

Creating or Modifying a Token Ring TrBRF VLAN

Creating or Modifying a Token Ring TrCRF VLAN

Assigning Switch Ports to a VLAN

Deleting a VLAN

Configuring VLANs

---

This chapter describes how to configure virtual LANs (VLANs).

---

Note   For complete syntax and usage information for the commands used in this chapter, refer to the Command Reference for your switch.

---

This chapter consists of these sections:

•Understanding How VLANs Work

•VLAN Default Configuration

•VLAN Configuration Guidelines

•Configuring VLANs

Understanding How VLANs Work

A VLAN is a group of end stations with a common set of requirements, independent of physical location. VLANs have the same attributes as a physical LAN but allow you to group end stations even if they are not located physically on the same LAN segment.

The following sections describe how VLANs work:

•Understanding VLANs in a VTP Domain

•Understanding Token Ring VLANs

Understanding VLANs in a VTP Domain

VLANs allow you to group ports on a switch to limit unicast, multicast, and broadcast traffic flooding. Flooded traffic originating from a particular VLAN is only flooded out other ports belonging to that VLAN.

---

Note   Before you create VLANs, you must decide whether to use VTP to maintain global VLAN configuration information for your network. For complete information on VTP, refer to "."

---

Figure 10-1 shows an example of VLANs segmented into logically defined networks.

Figure 10-1 VLANs as Logically Defined Networks

VLANs are often associated with IP subnetworks. For example, all the end stations in a particular IP subnet belong to the same VLAN. Traffic between VLANs must be routed. Port VLAN membership on the switch is assigned manually on a port-by-port basis. When you assign switch ports to VLANs using this method, it is known as port-based, or static, VLAN membership.

---

Note   Catalyst 5000, 2926G, and 2926 series switches support dynamic VLAN membership using the VLAN Membership Policy Server (VMPS). For information on how to configure VMPS and dynamic port VLAN membership, refer to "."

---

The in-band (sc0) interface of a switch can be assigned to any VLAN, so you can access another switch on the same VLAN directly without a router. Only one IP address at a time can be assigned to the in-band interface. If you change the IP address and assign the interface to a different VLAN, the previous IP address and VLAN assignment are overwritten.

You can set these parameters when you create a VLAN in the management domain:

•VLAN number

•VLAN name

•VLAN type (Ethernet, Fiber Distributed Data Interface [FDDI], FDDI network entity title [NET], TrBRF, or TrCRF)

•VLAN state (active or suspended)

•Maximum transmission unit (MTU) for the VLAN

•Security Association Identifier (SAID)

•Bridge identification number for TrBRF VLANs

•Ring number for FDDI and TrCRF VLANs

•Parent VLAN number for TrCRF VLANs

•Spanning-Tree Protocol (STP) type for TrCRF VLANs

•VLAN number to use when translating from one VLAN type to another

---

Note   When translating from one VLAN type to another, the switch software requires a different VLAN number for each media type.

---

Understanding Token Ring VLANs

Two Token Ring VLAN types are supported on switches running VTP version 2:

•Token Ring TrBRF VLANs

•Token Ring TrCRF VLANs

Token Ring TrBRF VLANs

Token Ring Bridge Relay Function (TrBRF) VLANs interconnect multiple Token Ring Concentrator Relay Function (TrCRF) VLANs in a switched Token Ring network (see ). The TrBRF can be extended across a network of switches interconnected via trunk links. The connection between the TrCRF and the TrBRF is referred to as a logical port.

Figure 10-2 Interconnected Token Ring TrBRF and TrCRF VLANs

For source routing, the switch appears as a single bridge between the logical rings. The TrBRF can function as a source-route bridge (SRB) or source-route transparent (SRT) bridge running either the IBM or IEEE STP. If SRB is used, you can define duplicate Media Access Control (MAC) addresses on different logical rings.

The Token Ring software runs an instance of STP for each TrBRF VLAN and each TrCRF VLAN. For TrCRF VLANs, STP removes loops in the logical ring. For TrBRF VLANs, STP interacts with external bridges to remove loops from the bridge topology, similar to STP operation on Ethernet VLANs.

Caution   Certain parent TrBRF STP and TrCRF bridge mode configurations can place the logical ports (the connection between the TrBRF and the TrCRF) of the TrBRF in a blocked state. For more information, refer to the "VLAN Configuration Guidelines" section.

For source routing, the switch appears as a single bridge between the logical rings. The TrBRF can function as an SRB or SRT bridge running either the IBM or IEEE STP. If SRB is used, duplicate MAC addresses can be defined on different logical rings.

To accommodate IBM System Network Architecture (SNA) traffic, you can use a combination of SRT and SRB modes. In a mixed mode, the TrBRF considers some ports (logical ports connected to TrCRFs) to operate in SRB mode while others operate in SRT mode.

Token Ring TrCRF VLANs

Token Ring Concentrator Relay Function (TrCRF) VLANs define port groups with the same logical ring number. You can configure two types of TrCRFs in your network: undistributed and backup.

Typically, TrCRFs are undistributed, which means each TrCRF is limited to the ports on a single switch. Multiple undistributed TrCRFs on the same or separate switches can be associated with a single parent TrBRF (see ). The parent TrBRF acts as a multiport bridge, forwarding traffic between the undistributed TrCRFs.

---

Note   To pass data between rings located on separate switches, you can associate the rings to the same TrBRF and configure the TrBRF for SRB.

---

Figure 10-3 Undistributed TrCRFs

---

Note   By default, Token Ring ports are associated with the default TrCRF (VLAN 1003, trcrf-default), which has the default TrBRF (VLAN 1005, trbrf-default) as its parent. In this configuration, a distributed TrCRF is possible (see ), and traffic is passed between the default TrCRFs located on separate switches provided that the switches are connected through an ISL trunk.

---

Figure 10-4 Distributed TrCRF

Within a TrCRF, source-route switching forwards frames based on either MAC addresses or route descriptors. The entire VLAN can operate as a single ring, with frames switched between ports within a single TrCRF.

You can specify the maximum hop count for All-Routes and Spanning-Tree Explorer frames for each TrCRF. This limits the maximum number of hops an explorer is allowed to traverse. If a port determines that the explorer frame it is receiving has traversed more than the number of hops specified, it does not forward the frame. The TrCRF determines the number of hops an explorer has traversed based on the number of bridge hops in the route information field.

A backup TrCRF enables you to configure an alternate route for traffic between undistributed TrCRFs located on separate switches that are connected by a TrBRF, in the event that the ISL connection between the switches fails. Only one backup TrCRF for a TrBRF is allowed, and only one port per switch can belong to a backup TrCRF.

If the ISL connection between the switches fails, the port in the backup TrCRF on each affected switch automatically becomes active, rerouting traffic between the undistributed TrCRFs through the backup TrCRF. When the ISL connection is reestablished, all but one port in the backup TrCRF is disabled. illustrates the backup TrCRF.

Figure 10-5 Backup TrCRF

VLAN Default Configuration

shows the default VLAN configuration.

Table 10-1 VLAN Default Configuration

Feature	Default Value
Native (default) VLAN	VLAN 1
Port VLAN assignments	All ports assigned to VLAN 1 Token Ring ports assigned to VLAN 1003 (trcrf-default)
VLAN state	Enabled
MTU size	1500 bytes 4472 bytes for Token Ring VLANs
SAID value	100,000 plus the VLAN number (for example, the SAID for VLAN VLAN 3 is 100003)
Pruning eligibility	VLAN 2-1000 are pruning-eligible
Default FDDI VLAN	VLAN 1002
Default FDDI NET VLAN	VLAN 1004
Default Token Ring TrBRF VLAN	VLAN 1005 (trbrf-default) with bridge number 0F
Default Token Ring TrCRF VLAN	VLAN 1003 (trcrf-default)
TrBRF STP	IBM
TrCRF bridge mode	SRB

VLAN Configuration Guidelines

Follow these guidelines when creating and modifying VLANs in your network:

•A maximum of 250 VLANs can be active at any time.

•Before you can create a VLAN, the switch must be in VTP server mode or VTP transparent mode. If the switch is a VTP server, you must define a VTP domain. For information on configuring VTP, refer to "."

•The default TrBRF (VLAN 1005) can only be the parent of the default TrCRF (VLAN 1003). You cannot specify the default TrBRF as the parent of a user-configured TrCRF.

•You must configure a TrBRF before you configure the TrCRF (the parent TrBRF VLAN you specify must exist).

•In a Token Ring environment, the logical ports (the connection between the TrBRF and the TrCRF) of the TrBRF are placed in a blocked state if either of these conditions exists:

•The TrBRF is running the IBM STP, and the TrCRF is in SRT mode.

•The TrBRF is running the IEEE STP, and the TrCRF is in SRB mode.

Configuring VLANs

---

Note   VLANs support a number of parameters that are not discussed in detail in this section. For complete information on the set vlan command and its parameters, refer to the Command Reference for your switch.

---

These sections describe how to configure VLANs:

•Creating or Modifying an Ethernet VLAN

•Creating or Modifying an FDDI VLAN

•Creating or Modifying a Token Ring TrBRF VLAN

•Creating or Modifying a Token Ring TrCRF VLAN

•Assigning Switch Ports to a VLAN

•Deleting a VLAN

Creating or Modifying an Ethernet VLAN

To create a new Ethernet VLAN, perform this task in privileged mode:

Task	Command
Step 1 Create a new Ethernet VLAN.	set vlan vlan_num [name name] [said said] [mtu mtu] [translation vlan_num]
Step 2 Verify the VLAN configuration.	show vlan [vlan_num]

---

Note   The default VLAN type is Ethernet; if you do not specify the VLAN type, the VLAN is an Ethernet VLAN.

---

This example shows how to create an Ethernet VLAN and verify the configuration:

Console> (enable) set vlan 500 name Engineering

Vlan 500 configuration successful

Console> (enable) show vlan 500

VLAN Name                             Status    IfIndex Mod/Ports, Vlans

---- -------------------------------- --------- ------- ------------------------

500  Engineering                      active    344

VLAN Type  SAID       MTU   Parent RingNo BrdgNo Stp  BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------

500  enet  100500     1500  -      -      -      -    -        0      0

VLAN AREHops STEHops Backup CRF

---- ------- ------- ----------

Console> (enable)

To modify the VLAN parameters on an existing Ethernet VLAN, perform this task in privileged mode:

Task	Command
Step 1 Modify an existing Ethernet VLAN.	set vlan vlan_num [name name] [state {active | suspend}] [said said] [mtu mtu] [translation vlan_num]
Step 2 Verify the VLAN configuration.	show vlan [vlan_num]

Creating or Modifying an FDDI VLAN

To create a new FDDI VLAN, perform this task in privileged mode:

Task	Command
Step 1 Create a new FDDI or FDDI NET-type VLAN.	set vlan vlan_num [name name] type {fddi | fddinet} [said said] [mtu mtu]
Step 2 Verify the VLAN configuration.	show vlan [vlan_num]

To modify the VLAN parameters on an existing FDDI VLAN, perform this task in privileged mode:

Task	Command
Step 1 Modify an existing FDDI or FDDI NET-type VLAN.	set vlan vlan_num [name name] [state {active | suspend}] [said said] [mtu mtu]
Step 2 Verify the VLAN configuration.	show vlan [vlan_num]

Creating or Modifying a Token Ring TrBRF VLAN

---

Note   You must enable VTP version 2 before you create Token Ring VLANs. For information on enabling VTP version 2, refer to "."

---

To create a new Token Ring TrBRF VLAN, perform this task in privileged mode:

Task	Command
Step 1 Create a new Token Ring TrBRF-type VLAN.	set vlan vlan_num [name name] type trbrf [said said] [mtu mtu] bridge bridge_number [stp {ieee | ibm}]
Step 2 Verify the VLAN configuration.	show vlan [vlan_num]

---

Note   You must specify a bridge number when creating a new TrBRF.

---

This example shows how to create a new Token Ring TrBRF VLAN and verify the configuration:

Console> (enable) set vlan 999 name TrBRF_999 type trbrf bridge a

Vlan 999 configuration successful

Console> (enable) show vlan 999

VLAN Name                             Status    IfIndex Mod/Ports, Vlans

---- -------------------------------- --------- ------- ------------------------

999  TrBRF_999                        active    

VLAN Type  SAID       MTU   Parent RingNo BrdgNo Stp  BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------

999  trbrf 100999     4472  -      -      0xa    ibm  -        0      0

VLAN AREHops STEHops Backup CRF

---- ------- ------- ----------

Console> (enable)

To modify the VLAN parameters on an existing Token Ring TrBRF VLAN, perform this task in privileged mode:

Task	Command
Step 1 Modify an existing Token Ring TrBRF-type VLAN.	set vlan vlan_num [name name] [state {active | suspend}] [said said] [mtu mtu] [bridge bridge_number] [stp {ieee | ibm}]
Step 2 Verify the VLAN configuration.	show vlan [vlan_num]

Creating or Modifying a Token Ring TrCRF VLAN

---

Note   You must enable VTP version 2 before you create Token Ring VLANs. For information on enabling VTP version 2, refer to "."

---

To create a new Token Ring TrCRF VLAN, perform this task in privileged mode:

Task	Command
Step 1 Create a new Token Ring TrCRF-type VLAN.	set vlan vlan_num [name name] type trcrf [said said] [mtu mtu] {ring hex_ring_number | decring decimal_ring_number} parent vlan_num
Step 2 Verify the VLAN configuration.	show vlan [vlan_num]

---

Note   You must specify a ring number (either in hexadecimal or in decimal) and a parent TrBRF VLAN when creating a new TrCRF.

---

This example shows how to create a Token Ring TrCRF VLAN and verify the configuration:

Console> (enable) set vlan 998 name TrCRF_998 type trcrf decring 10 parent 999

Vlan 998 configuration successful

Console> (enable) show vlan 998

VLAN Name                             Status    IfIndex Mod/Ports, Vlans

---- -------------------------------- --------- ------- ------------------------

998  TrCRF_998                        active    352     

VLAN Type  SAID       MTU   Parent RingNo BrdgNo Stp  BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------

998  trcrf 100998     4472  999    0xa    -      -    srb      0      0

VLAN AREHops STEHops Backup CRF

---- ------- ------- ----------

998  7       7       off

Console> (enable)

To modify the VLAN parameters on an existing Token Ring TrCRF VLAN, perform this task in privileged mode:

Task	Command
Step 1 Modify an existing Token Ring TrCRF-type VLAN.	set vlan vlan_num [name name] [state {active | suspend}] [said said] [mtu mtu] [ring hex_ring_num] [decring decimal_ring_num] [bridge bridge_num] [parent vlan_num]
Step 2 Verify the VLAN configuration.	show vlan [vlan_num]

To create a backup TrCRF, assign one port on each switch that the TrBRF traverses to the backup TrCRF.

To configure a TrCRF VLAN as a backup TrCRF, perform this task in privileged mode:

Task	Command
Step 1 Configure a TrCRF VLAN as a backup TrCRF.	set vlan vlan_num backupcrf on
Step 2 Verify the VLAN configuration.	show vlan [vlan_num]

Caution   If the backup TrCRF port is attached to a Token Ring multistation access unit (MSAU), it does not provide a backup path unless the ring speed and port mode are set by another device. We recommend that you configure the ring speed and port mode for the backup TrCRF.

To specify the maximum number of hops for All-Routes Explorer frames or Spanning-Tree Explorer frames in the TrCRF, perform this task in privileged mode:

Task	Command
Step 1 Specify the maximum number of hops for All-Routes Explorer frames in the TrCRF.	set vlan vlan_num aremaxhop hopcount
Step 2 Specify the maximum number of hops for Spanning-Tree Explorer frames in the TrCRF.	set vlan vlan_num stemaxhop hopcount
Step 3 Verify the VLAN configuration.	show vlan [vlan_num]

This example shows how to limit All-Routes Explorer frames and Spanning-Tree Explorer frames to ten hops, and how to verify the configuration:

Console> (enable) set vlan 998 aremaxhop 10 stemaxhop 10

Vlan 998 configuration successful

Console> (enable) show vlan 998

VLAN Name                             Status    IfIndex Mod/Ports, Vlans

---- -------------------------------- --------- ------- ------------------------

998  VLAN0998                         active    357

VLAN Type  SAID       MTU   Parent RingNo BrdgNo Stp  BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------

998  trcrf 100998     4472  999    0xff   -      -    srb      0      0

VLAN AREHops STEHops Backup CRF

---- ------- ------- ----------

998  10      10      off

Console> (enable)

Assigning Switch Ports to a VLAN

A VLAN created in a management domain remains unused until you assign one or more switch ports to the VLAN. If you specify a VLAN that does not exist, the VLAN is created and the specified ports are assigned to it.

---

Note   Make sure you assign switch ports to a VLAN of the proper type. For example, assign Ethernet, Fast Ethernet, and Gigabit Ethernet ports to Ethernet-type VLANs, Token Ring ports to Token Ring TrCRF-type VLANs, and so forth.

---

To assign one or more switch ports to a VLAN, perform this task in privileged mode:

Task	Command
Step 1 Assign one or more switch ports to a VLAN.	set vlan vlan_num mod_num/port_num
Step 2 Verify the port VLAN membership.	show vlan [vlan_num] show port [mod_num[/port_num]]

This example shows how to assign switch ports to a VLAN and verify the assignment:

Console> (enable) set vlan 560 4/10

VLAN 560 modified.

VLAN 1 modified.

VLAN  Mod/Ports

---- -----------------------

560   4/10

Console> (enable) show vlan 560

VLAN Name                             Status    IfIndex Mod/Ports, Vlans

---- -------------------------------- --------- ------- ------------------------

560  Engineering                      active    348     4/10

VLAN Type  SAID       MTU   Parent RingNo BrdgNo Stp  BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------

560  enet  100560     1500  -      -      -      -    -        0      0

VLAN AREHops STEHops Backup CRF

---- ------- ------- ----------

Console> (enable) show port 4/10

Port  Name               Status     Vlan       Level  Duplex Speed Type

----- ------------------ ---------- ---------- ------ ------ ----- ------------

 4/10                    notconnect 560        normal   half    10 10BaseT

<...output truncated...>

Last-Time-Cleared

--------------------------

Wed Jun 24 1998, 12:16:41

Console> (enable)

Deleting a VLAN

When you delete a VLAN in VTP server mode, the VLAN is removed from all switches in the VTP domain. When you delete a VLAN in VTP transparent mode, the VLAN is deleted only on the current switch.

Caution   When you delete a VLAN, any ports assigned to that VLAN become inactive. Such ports remain associated with the VLAN (and thus inactive) until you assign them to a new VLAN.

To delete a VLAN on the switch, perform this task in privileged mode:

Task	Command
Delete a VLAN.	clear vlan vlan_num

---

Note   You cannot delete a Token Ring TrBRF VLAN without first reassigning its child TrCRFs to another parent TrBRF, or deleting the child TrCRFs.

---

This example shows how to delete a VLAN (in this case, the switch is a VTP server):

Console> (enable) clear vlan 500

This command will deactivate all ports on vlan 500

in the entire management domain

Do you want to continue(y/n) [n]?y

Vlan 500 deleted

Console> (enable)