-
Catalyst 6500 Series Software Configuration Guide, 7.6
-
Preface
-
Product Overview
-
Command-Line Interfaces
-
Configuring the Switch IP Address and Default Gateway
-
Configuring Ethernet, Fast Ethernet, Gigabit Ethernet, and 10-Gigabit Ethernet Switching
-
Configuring Ethernet VLAN Trunks
-
Configuring EtherChannel
-
Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling
-
Configuring Spanning Tree
-
Configuring Spanning Tree PortFast, UplinkFast, BackboneFast, and Loop Guard
-
Configuring VTP
-
Configuring VLANs
-
Configuring InterVLAN Routing
-
Configuring CEF for PFC2
-
Configuring MLS
-
Configuring NDE
-
Configuring Access Control
-
Configuring GVRP
-
Configuring Dynamic Port VLAN Membership with VMPS
-
Checking Status and Connectivity
-
Administering the Switch
-
Configuring Switch Access Using AAA
-
Configuring Redundancy
-
Modifying the Switch Boot Configuration
-
Working with the Flash File System
-
Working with System Software Images
-
Working with Configuration Files
-
Configuring System Message Logging
-
Configuring DNS
-
Configuring CDP
-
Configuring UDLD
-
Configuring NTP
-
Configuring Broadcast Suppression
-
Configuring Layer 3 Protocol Filtering
-
Configuring the IP Permit List
-
Configuring Port Security
-
Configuring 802.1x Authentication
-
Configuring Unicast Flood Blocking
-
Configuring SNMP
-
Configuring RMON
-
Configuring SPAN and RSPAN
-
Using Switch TopN Reports
-
Configuring Multicast Services
-
Configuring QoS
-
Configuring Automatic QoS
-
Configuring ASLB
-
Configuring the Switch Fabric Module
-
Configuring a VoIP Network
-
Acronyms
-
Table Of Contents
Configuring Normal-Range VLANs on the Switch
Normal-Range VLAN Configuration Guidelines
Configuring Extended-Range VLANs on the Switch
Extended-Range VLAN Configuration Guidelines
Mapping Reserved VLANs to Nonreserved VLANs
Deleting Reserved-to-Nonreserved VLAN Mappings
Mapping 802.1Q VLANs to ISL VLANs
Deleting 802.1Q-to-ISL VLAN Mappings
Assigning Switch Ports to a VLAN
Configuring Private VLANs on the Switch
Understanding How Private VLANs Work
Private VLAN Configuration Guidelines
Creating a Primary Private VLAN
Viewing the Port Capability of a Private VLAN Port
Deleting an Isolated, Community, or Two-Way Community VLAN
Deleting a Private VLAN Mapping
Private VLAN Support on the MSFC
Configuring FDDI VLANs on the Switch
Configuring Token Ring VLANs on the Switch
Understanding How Token Ring TrBRF VLANs Work
Understanding How Token Ring TrCRF VLANs Work
Token Ring VLAN Configuration Guidelines
Creating or Modifying a Token Ring TrBRF VLAN
Creating or Modifying a Token Ring TrCRF VLAN
Configuring VLANs for the Firewall Services Module
Configuring VLANs
This chapter describes how to configure VLANs for the Catalyst 6500 series switches.
Note
For complete syntax and usage information for the commands used in this chapter, refer to the Catalyst 6500 Series Switch Command Reference publication.
This chapter consists of these sections:
•
•
•
•
•
•
•
Understanding How VLANs Work
A VLAN is a group of end stations with a common set of requirements, independent of their physical location. A VLAN has the same attributes as a physical LAN but allows you to group end stations even if they are not located physically on the same LAN segment.
VLANs allow you to group ports on a switch to limit unicast, multicast, and broadcast traffic flooding. Flooded traffic originating from a particular VLAN is only flooded out ports belonging to that VLAN.
Figure 11-1 shows an example of VLANs segmented into logically defined networks.
These sections describe VLANs:
Figure 11-1 VLANs as Logically Defined Networks
VLANs are often associated with IP subnetworks. For example, all the end stations in a particular IP subnet belong to the same VLAN. Traffic between VLANs must be routed. Port VLAN membership on the switch is assigned manually on a port-by-port basis. When you assign switch ports to VLANs using this method, it is known as port-based, or static, VLAN membership.
The in-band (sc0) interface of a switch can be assigned to any VLAN, so you can access another switch on the same VLAN directly without a router. Only one IP address at a time can be assigned to the in-band interface. If you change the IP address and assign the interface to a different VLAN, the previous IP address and VLAN assignment are overwritten.
VLAN Ranges
Catalyst 6500 series switches support 4096 VLANs in accordance with the IEEE 802.1Q standard. These VLANs are organized into several ranges; you use each range slightly differently. Some of these VLANs are propagated to other switches in the network when you use a management protocol, such as the VLAN Trunking Protocol (VTP). Other VLANs are not propagated and you must configure them on each applicable switch.
There are three ranges of VLANs:
•
•
•
Table 11-1 describes the VLAN ranges.
Configurable VLAN Parameters
Whenever you create or modify VLANs 2-1005, you can set the parameters as follows:
Note
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Default VLAN Configuration
Table 11-2 shows the default VLAN configuration for the Catalyst 6500 series switches.
Configuring Normal-Range VLANs on the Switch
These sections describe how to configure normal-range VLANs 2-1000:
•
Note
Normal-Range VLAN Configuration Guidelines
This section describes the guidelines for creating and modifying normal-range VLANs 2-1000 in your network:
•
•
•
Creating Normal-Range VLANs
You can create one VLAN at a time or you can create a range of VLANs with a single command. If you create a range of VLANs, you cannot specify a name; VLAN names must be unique.
To create a normal-range VLAN, perform this task in privileged mode:
Step 1
Create a normal-range Ethernet VLAN.
set vlan vlan [name name] [said said] [mtu mtu] [translation vlan]
Step 2
Verify the VLAN configuration.
show vlan [vlan]
This example shows how to create normal-range VLANs and verify the configuration when the switch is in Per VLAN Spanning Tree + (PVST+) mode:
Console> (enable) set vlan 500-520Vlan 500 configuration successfulVlan 501 configuration successfulVlan 502 configuration successfulVlan 503 configuration successful...Vlan 520 configuration successfulConsole> (enable) show vlan 500-520VLAN Name Status IfIndex Mod/Ports, Vlans---- -------------------------------- --------- ------- ------------------------500 active 342501 active 343502 active 344503 active 345...520 active 362VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------500 enet 100500 1500 - - - - - 0 0501 enet 100501 1500 - - - - - 0 0502 enet 100502 1500 - - - - - 0 0503 enet 100503 1500 - - - - - 0 0...520 enet 100520 1500 - - - - - 0 0VLAN AREHops STEHops Backup CRF---- ------- ------- ----------Console> (enable)Modifying Normal-Range VLANs
To modify the VLAN parameters on an existing normal-range VLAN, perform this task in privileged mode:
Configuring Extended-Range VLANs on the Switch
These sections explain how to configure extended-range VLANs 1025-4094:
•
•
Extended-Range VLAN Configuration Guidelines
This section describes the guidelines for creating extended-range VLANs 1025-4094:
•
•
•
•
•
•
•
Caution
Caution
Creating Extended-Range VLANs
To create extended-range VLANs, you must first enable MAC address reduction, which provides IDs for extended-range VLANs. After you enable MAC address reduction, you cannot disable it as long as any extended-range VLANs exist.
Note
To enable MAC address reduction and create an Ethernet VLAN in the extended range, perform this task in privileged mode:
Step 1
Enable MAC address reduction.
set spantree macreduction {enable | disable}
Step 2
Create a VLAN.
set vlan vlan
Step 3
Verify the VLAN configuration.
show vlan [vlan]
This example shows how to enable MAC address reduction and create an extended-range Ethernet VLAN:
Console> (enable) set spantree macreduction enableMAC address reduction enabledConsole> (enable) set vlan 2000Vlan 2000 configuration successfulConsole> (enable) show vlan 2000VLAN Name Status IfIndex Mod/Ports, Vlans---- -------------------------------- --------- ------- ------------------------2000 VLAN2000 active 61VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------2000 enet 102000 1500 - - - - - 0 0VLAN Inst DynCreated RSPAN---- ---- ---------- --------2000 - static disabledConsole> (enable)This example shows how to display a summary of active, suspended, and extended VLANs:
Console> (enable) show vlan summaryVlan status Count Vlans------------- --------------------------------------------------------VTP Active 504 1-100,102-500,1000,1002-1005VTP Suspended 1 101Extended 1 2000Console> (enable)Mapping VLANs to VLANs
You can map VLANs to other VLANs on the Catalyst 6500 series switches in two ways:
1.
2.
Note
This section describes how to map VLANs to VLANs:
•
•
•
•
Mapping Reserved VLANs to Nonreserved VLANs
You can map reserved-range VLANs to any nonreserved VLANs that are not in use. Nonreserved VLANs are any VLANs that are not reserved by Cisco; this includes normal-range and extended-range VLANs.
Note
These restrictions apply when mapping reserved VLANs to nonreserved VLANs:
•
•
•
To map a reserved VLAN to a nonreserved VLAN, perform this task in privileged mode:
This example shows how to clear old VLAN mappings, map a reserved VLAN, and verify the mappings on the mapping table:
Console> (enable) clear vlan mapping dot1q allAll dot1q vlan mapping entries deletedConsole> (enable) set vlan mapping reserved 1020 non-reserved 4070Vlan 1020 successfully mapped to 4070.Console> (enable) show vlan mappingReserved vlan Non-Reserved vlan Effective----------------------------------------------------1008 63 false1010 4065 true1011 4066 true1020 4070 trueThe Effective column in the mapping table indicates whether the mapping has taken effect (that is, true or false). Mappings that are marked true can be used by the system. Mappings that are marked false cannot be used by the system.
Note
Deleting Reserved-to-Nonreserved VLAN Mappings
To delete the mappings for reserved-to-nonreserved VLAN mappings, you can delete the mappings one at a time or all at once.
When you delete all entries from the mapping table at once, the table is completely cleared and the nonreserved VLANs still exist in the list of VLANs.
To delete reserved VLAN mappings, perform this task in privileged mode:
This example shows how to delete a single mapping:
Console> (enable) clear vlan mapping reserved 1010Vlan 1010 mapping entry deletedConsole> (enable)This example shows how to delete all reserved VLAN mappings:
Console> (enable) clear vlan mapping reserved allAll reserved vlan mapping entries deletedConsole> (enable)Mapping 802.1Q VLANs to ISL VLANs
Your network might have non-Cisco devices that are connected to the Catalyst 6500 series switches through 802.1Q trunks or traffic from a non-Cisco switch that has VLANs in the Catalyst 6500 series reserved range, 1002-1024.
The valid range of user-configured Inter-Switch Link (ISL) VLANs is 1 to 1000 and 1025 to 4094. The valid range of VLANs that are specified in the IEEE 802.1Q standard is 0-4095. In a network environment with non-Cisco devices that are connected to Cisco switches through 802.1Q trunks, you can map 802.1Q VLAN numbers greater than 1000 to ISL VLAN numbers. Note that if you use any VLANs in the extended range (1025-4094) for dot1q mappings, you cannot use any of the extended-range VLANs for any other purpose.
802.1Q VLANs in the range 1-1000 are automatically mapped to the corresponding ISL VLAN. 802.1Q VLAN numbers greater than 1000 must be mapped to an ISL VLAN in order to be recognized and forwarded by Cisco switches.
These restrictions apply when mapping 802.1Q VLANs to ISL VLANs:
•
•
•
•
•
VLAN 200, traffic on 802.1Q VLAN 200 is blocked.•
To map an 802.1Q VLAN to an ISL VLAN, perform this task in privileged mode:
This example shows how to map 802.1Q VLANs 2000, 3000, and 4000 to ISL VLANs 200, 300, and 400, and verify the configuration:
Console> (enable) set vlan mapping dot1q 2000 isl 200802.1q vlan 2000 is existent in the mapping tableConsole> (enable) set vlan mapping dot1q 3000 isl 300Vlan mapping successfulConsole> (enable) set vlan mapping dot1q 4000 isl 400Vlan mapping successfulConsole> (enable) show vlan mapping802.1q vlan ISL vlan Effective------------------------------------------2000 200 true3000 300 true4000 400 trueConsole> (enable)Deleting 802.1Q-to-ISL VLAN Mappings
To delete an 802.1Q-to-ISL VLAN mapping, perform this task in privileged mode:
Step 1
Delete an 802.1Q-to-ISL VLAN mapping.
clear vlan mapping dot1q {dot1q_vlan | all}
Step 2
Verify the VLAN mapping.
show vlan mapping
This example shows how to delete the VLAN mapping for 802.1Q VLAN 2000:
Console> (enable) clear vlan mapping dot1q 2000Vlan 2000 mapping entry deletedConsole> (enable)This example shows how to delete all 802.1Q-to-ISL VLAN mappings:
Console> (enable) clear vlan mapping dot1q allAll vlan mapping entries deletedConsole> (enable)Assigning Switch Ports to a VLAN
A VLAN that is created in a management domain remains unused until you assign one or more switch ports to the VLAN. You can create a new VLAN and then specify the module and ports later, or you can create the VLAN and specify the module and ports in a single step.
Note
To assign one or more switch ports to a VLAN, perform this task in privileged mode:
Step 1
Assign one or more switch ports to a VLAN.
set vlan vlan mod/port
Step 2
Verify the port VLAN membership.
show vlan [vlan]
show port [mod[/port]]
This example shows how to assign switch ports to a VLAN and verify the assignment:
Console> (enable) set vlan 560 4/10VLAN 560 modified.VLAN 1 modified.VLAN Mod/Ports---- -----------------------560 4/10Console> (enable) show vlan 560VLAN Name Status IfIndex Mod/Ports, Vlans---- -------------------------------- --------- ------- ------------------------560 Engineering active 348 4/10VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------560 enet 100560 1500 - - - - - 0 0VLAN AREHops STEHops Backup CRF---- ------- ------- ----------Console> (enable) show port 4/10Port Name Status Vlan Duplex Speed Type----- ------------------ ---------- ---------- ------ ----- ------------4/10 connected 560 a-half a-100 10/100BaseTXPort AuxiliaryVlan AuxVlan-Status----- ------------- --------------4/10 none none...Last-Time-Cleared--------------------------Tue Jun 6 2000, 16:45:18Console> (enable)Deleting a VLAN
Follow these guidelines for deleting VLANs:
•
•
•
•
Caution
You can delete a single VLAN or a range of VLANs. To delete a VLAN on the switch, perform this task in privileged mode:
This example shows how to delete a VLAN (in this case, the switch is a VTP server):
Console> (enable) clear vlan 500This command will deactivate all ports on vlan(s) 500Do you want to continue(y/n) [n]?yVlan 500 deletedConsole> (enable)This command will deactivate all ports on vlan(s) 10All ports on normal range vlan(s) 10will be deactivated in the entire management domain.Do you want to continue(y/n) [n]?Configuring Private VLANs on the Switch
These sections describe how private VLANs work:
•
•
•
•
•
•
•
Understanding How Private VLANs Work
Private VLANs provide Layer-2 isolation between ports within the same private VLAN on the Catalyst 6500 series switches. Ports belonging to a private VLAN are associated with a common set of supporting VLANs that are used to create the private VLAN structure.
The three types of private VLAN ports are as follows:
•
•
•
Privacy is granted at Layer 2 by blocking outgoing traffic to all isolated ports. All isolated ports are assigned to an isolated VLAN where this hardware function occurs. Traffic that is received from an isolated port is forwarded to all promiscuous ports only.
A private VLAN has four distinct classifications: a single primary VLAN, a single isolated VLAN, and a series of community or two-way community VLANs.
You must define each supporting VLAN within a private VLAN structure before you can configure the private VLAN:
•
•
•
•
Note
To create a private VLAN, you assign two or more normal VLANs in the normal VLAN range: one VLAN is designated as a primary VLAN, and a second VLAN is designated as either an isolated, community, or two-way community VLAN. If you choose, you can then designate additional VLANs as separate isolated, community, or two-way community VLANs in this private VLAN. After designating the VLANs, you must bind them together and associate them to the promiscuous port.
You can extend private VLANs across multiple Ethernet switches by trunking the primary, isolated, and any community or two-way community VLANs to other switches that support private VLANs.
In an Ethernet-switched environment, you can assign an individual VLAN and associated IP subnet to each individual or common group of stations. The servers only require the ability to communicate with a default gateway to gain access to end points outside the VLAN itself. By incorporating these stations, regardless of ownership, into one private VLAN, you can do the following:
•
•
•
On an MSFC port or a nontrunk promiscuous port, you can remap as many isolated or community VLANs as desired; however, while a nontrunk promiscuous port can remap to only one primary VLAN, an MSFC port can only connect an MSFC router. With a nontrunk promiscuous port, you can connect a wide range of devices as "access points" to a private VLAN. For example, you can connect a nontrunk promiscuous port to the "server port" of a LocalDirector to remap a number of isolated or community VLANs to the server VLAN so that the LocalDirector can load balance the servers that are present in the isolated or community VLANs, or you can use a nontrunk promiscuous port to monitor and/or back up all the private VLAN servers from an administration workstation.
Note
Private VLAN Configuration Guidelines
This section describes the guidelines for configuring private VLANs:
Note
•
•
•
•
–
–
–
–
•
•
•
•
•
•
•
•
•
–
Note
–
–
If you attempt such a configuration, a warning message displays and the command is rejected.
•
•
•
–
–
•
•
•
•
•
•
•
•
•
Note
•
•
•
•
•
•
Creating a Primary Private VLAN
To create a primary private VLAN, perform this task in privileged mode:
Note
Note
Note
Note
This example shows how to specify VLAN 7 as the primary VLAN:
Console> (enable) set vlan 7 pvlan-type primaryVlan 7 configuration successfulConsole> (enable)This example shows how to specify VLAN 901 as the isolated VLAN and VLANs 902 and 903 as community VLANs:
Console> (enable) set vlan 901 pvlan-type isolatedVlan 901 configuration successfulConsole> (enable) set vlan 902 pvlan-type communityVlan 902 configuration successfulConsole> (enable) set vlan 903 pvlan-type communityVlan 903 configuration successfulConsole> (enable)This example shows how to bind VLAN 901 to primary VLAN 7 and assign port 4/3 as the isolated port:
Console> (enable) set pvlan 7 901 4/3Successfully set the following ports to Private Vlan 7,901: 4/3Console> (enable)This example shows how to bind VLAN 902 to primary VLAN 7 and assign ports 4/4 through 4/6 as the community port:
Console> (enable) set pvlan 7 902 4/4-6Successfully set the following ports to Private Vlan 7,902:4/4-6Console> (enable)This example shows how to bind VLAN 903 to primary VLAN 7 and assign ports 4/7 through 4/9 as the community ports:
Console> (enable) set pvlan 7 903Successfully set association between 7 and 903.Console> (enable) set pvlan 7 903 4/7-9Successfully set the following ports to Private Vlan 7,903:4/7-9Console> (enable)This example shows how to map the isolated/community VLAN to the primary VLAN on the promiscuous port, 3/1, for each isolated or community VLAN:
Console> (enable) set pvlan mapping 7 901 3/1Successfully set mapping between 7 and 901 on 3/1Console> (enable) set pvlan mapping 7 902 3/1Successfully set mapping between 7 and 902 on 3/1Console> (enable) set pvlan mapping 7 903 3/1Successfully set mapping between 7 and 903 on 3/1This example shows how to verify the private VLAN configuration:
Console> (enable) show vlan 7VLAN Name Status IfIndex Mod/Ports, Vlans---- -------------------------------- --------- ------- ------------------------7 VLAN0007 active 35 4/4-6VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------7 enet 100010 1500 - - - - - 0 0VLAN DynCreated RSPAN---- ---------- --------7 static disabledVLAN AREHops STEHops Backup CRF 1q VLAN---- ------- ------- ---------- -------Primary Secondary Secondary-Type Ports------- --------- ----------------- -----------------7 901 Isolated 4/37 902 Community 4/4-67 903 Community 4/7-9Console> (enable) show vlan 902VLAN Name Status IfIndex Mod/Ports, Vlans---- -------------------------------- --------- ------- ------------------------902 VLAN0007 active 38 4/4-6VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------7 enet 100010 1500 - - - - - 0 0VLAN DynCreated RSPAN---- ---------- --------7 static disabledVLAN AREHops STEHops Backup CRF 1q VLAN---- ------- ------- ---------- -------Primary Secondary Secondary-Type Ports------- --------- ----------------- -----------------7 902 Isolated 4/4-6Console> (enable) show pvlanPrimary Secondary Secondary-Type Ports------- --------- -------------- ------------7 901 isolated 4/37 902 community 4/4-67 903 community 4/7-9Console> (enable) show pvlan mappingPort Primary Secondary----- -------- ----------3/1 7 901-903Console> (enable) show portPort Name Status Vlan Duplex Speed Type----- ------------------ ---------- ---------- ------ ----- ------------...truncated output...4/3 notconnect 7,901 half 100 100BaseFX MM4/4 notconnect 7,902 half 100 100BaseFX MM4/5 notconnect 7,902 half 100 100BaseFX MM4/6 notconnect 7,902 half 100 100BaseFX MM4/7 notconnect 7,903 half 100 100BaseFX MM4/8 notconnect 7,903 half 100 100BaseFX MM4/9 notconnect 7,903 half 100 100BaseFX MM... truncated output...Viewing the Port Capability of a Private VLAN Port
You can view the port capability of a port in a private VLAN using the show pvlan capability mod/port command.
This example shows the port capability for several ports in the following configuration:
Console> (enable) set pvlan 10 20Console> (enable) set pvlan mapping 10 20 3/1Console> (enable) set pvlan mapping 10 20 5/2Console> (enable) set trunk 5/1 desirable isl 1-1005,1025-4094Console> (enable) show pvlan capability 5/20Ports 5/13 - 5/24 are in the same ASIC range as port 5/20.Port 5/20 can be made a private vlan port.Console> (enable) show pvlanPrimary Secondary Secondary-Type Ports------- --------- -------------- ------------10 20 isolatedConsole> (enable) show pvlan capability 3/1Port 3/1 cannot be made a private vlan port due to:------------------------------------------------------Promiscuous ports cannot be made private vlan ports.Console> (enable) show pvlan capability 5/1Ports 5/1 - 5/12 are in the same ASIC range as port 5/1.Port 5/1 cannot be made a private vlan port due to:------------------------------------------------------Trunking ports are not Private Vlan capable.Conflict with Promiscuous port(s) : 5/2Console> (enable) show pvlan capability 5/2Ports 5/1 - 5/12 are in the same ASIC range as port 5/2.Port 5/2 cannot be made a private vlan port due to:------------------------------------------------------Promiscuous ports cannot be made private vlan ports.Conflict with Trunking port(s) : 5/1Console> (enable) show pvlan capability 5/3Ports 5/1 - 5/12 are in the same ASIC range as port 5/3.Port 5/3 cannot be made a private vlan port due to:------------------------------------------------------Conflict with Promiscuous port(s) : 5/2Conflict with Trunking port(s) : 5/1Console> (enable) show pvlan capability 15/1Port 15/1 cannot be made a private vlan port due to:------------------------------------------------------Only ethernet ports can be added to private vlans.Deleting a Private VLAN
You can delete a private VLAN by deleting the primary VLAN. If you delete a primary VLAN, all bindings to the primary VLAN are broken, all ports in the private VLAN become inactive, and any related mappings on the promiscuous port(s) are deleted.
To delete a private VLAN, perform this task in privileged mode:
This example shows how to delete primary VLAN 7:
Console> (enable) clear vlan 7This command will de-activate all ports on vlan 7Do you want to continue(y/n) [n]?yVlan 7 deletedConsole> (enable)Deleting an Isolated, Community, or Two-Way Community VLAN
If you delete an isolated, community, or two-way community VLAN, the binding with the primary VLAN is broken, any isolated, community, or two-way community ports that are associated to the VLAN become inactive, and any related mappings on the promiscuous port(s) are deleted.
To delete a VLAN on the switch, perform this task in privileged mode:
Delete an isolated or community VLAN.
clear vlan {isolated_vlan | community_vlan | twoway_community_vlan}
This example shows how to delete the community VLAN 902:
Console> (enable) clear vlan 902This command will de-activate all ports on vlan 902Do you want to continue(y/n) [n]?yVlan 902 deletedConsole> (enable)Deleting a Private VLAN Mapping
If you delete the private VLAN mapping, the connectivity breaks between the isolated, community, or two-way community ports and the promiscuous port. If you delete all the mappings on a promiscuous port, the promiscuous port becomes inactive. When a private VLAN port is set to inactive, it displays "pvlan-" as its VLAN number in the show port output.
You might set a private VLAN port to inactive for the following reasons:
•
•
•
To delete a port mapping from a private VLAN, perform this task in privileged mode:
Delete the port mapping from the private VLAN.
clear pvlan mapping primary_vlan {isolated | community | twoway-community} {mod/ports}
This example shows how to delete the mapping of VLANs 902 to 901, previously set on ports 3/2 through 3/5:
Console> (enable) clear pvlan mapping 901 902 3/2-5Successfully cleared mapping between 901 and 902 on 3/2-5 Console> (enable)Private VLAN Support on the MSFC
These items describe private VLAN support on the MSFC:
•
•
%PV-6-PV_MSG:Created a private vlan mapping, Primary 100, Secondary 101%PV-6-PV_MSG:Created a private vlan mapping, Primary 200, Secondary 201%PV-6-PV_MSG:Purged a private vlan mapping, Primary 100, Secondary 101•
•
•
•
•
•
obelix-rp(config)# no arp 11.1.3.30IP ARP:Deleting Sticky ARP entry 11.1.3.30obelix-rp(config)# arp 11.1.3.30 0000.5403.2356 arpaIP ARP:Overwriting Sticky ARP entry 11.1.3.30, hw:00d0.bb09.266e by hw:0000.5403.2356•
obelix-rp(config)# xns routingobelix-rp(config)#%PV-6-PV_MSG:Purged a private vlan mapping, Primary 100, Secondary 101%PV-6-PV_MSG:Purged a private vlan mapping, Primary 100, Secondary 102%PV-6-PV_MSG:Purged a private vlan mapping, Primary 100, Secondary 103%PV-6-PV_MSG:Created a private vlan mapping, Primary 100, Secondary 101%PV-6-PV_MSG:Created a private vlan mapping, Primary 100, Secondary 102%PV-6-PV_MSG:Created a private vlan mapping, Primary 100, Secondary 103Configuring FDDI VLANs on the Switch
To create a new FDDI VLAN, perform this task in privileged mode:
Step 1
Create a new FDDI or FDDI NET-type VLAN.
set vlan vlan [name name] type {fddi | fddinet} [said said] [mtu mtu]
Step 2
Verify the VLAN configuration.
show vlan [vlan]
To modify the VLAN parameters on an existing FDDI VLAN, perform this task in privileged mode:
Step 1
Modify an existing FDDI or FDDI NET-type VLAN.
set vlan vlan [name name] [state {active | suspend}] [said said] [mtu mtu]
Step 2
Verify the VLAN configuration.
show vlan [vlan]
Configuring Token Ring VLANs on the Switch
These sections describe the two Token Ring VLAN types that are supported on switches running VTP version 2:
•
•
•
•
•
You must use VTP version 2 to configure and manage Token Ring VLANs.
Note
Understanding How Token Ring TrBRF VLANs Work
Token Ring Bridge Relay Function (TrBRF) VLANs interconnect multiple Token Ring Concentrator Relay Function (TrCRF) VLANs in a switched Token Ring network (see Figure 11-2). The TrBRF can be extended across a network of switches interconnected through trunk links. The connection between the TrCRF and the TrBRF is referred to as a logical port.
Figure 11-2 Interconnected Token Ring TrBRF and TrCRF VLANs
For source routing, the switch appears as a single bridge between the logical rings. The TrBRF can function as a source-route bridge (SRB) or as a source-route transparent (SRT) bridge running either the IBM or IEEE STP. If SRB is used, you can define duplicate MAC addresses on different logical rings.
The Token Ring software runs an instance of STP for each TrBRF VLAN and each TrCRF VLAN. For TrCRF VLANs, STP removes loops in the logical ring. For TrBRF VLANs, STP interacts with external bridges to remove loops from the bridge topology, similar to STP operation on Ethernet VLANs.
Caution
For source routing, the switch appears as a single bridge between the logical rings. The TrBRF can function as an SRB or SRT bridge running either the IBM or IEEE STP. If SRB is used, duplicate MAC addresses can be defined on different logical rings.
To accommodate IBM System Network Architecture (SNA) traffic, you can use a combination of SRT and SRB modes. In a mixed mode, the TrBRF considers some ports (logical ports connected to TrCRFs) to operate in SRB mode while others operate in SRT mode.
Understanding How Token Ring TrCRF VLANs Work
TrCRF VLANs define port groups with the same logical ring number. You can configure two TrCRF types in your network: undistributed and backup.
Typically, TrCRFs are undistributed, which means that each TrCRF is limited to the ports on a single switch. Multiple undistributed TrCRFs on the same or separate switches can be associated with a single parent TrBRF (see Figure 11-3). The parent TrBRF acts as a multiport bridge, forwarding traffic between the undistributed TrCRFs.
Note
Figure 11-3 Undistributed TrCRFs
Note
Figure 11-4 Distributed TrCRF
Within a TrCRF, source-route switching forwards frames based on either MAC addresses or route descriptors. The entire VLAN can operate as a single ring, with frames that are switched between ports within a single TrCRF.
You can specify the maximum hop count for All-Routes and Spanning Tree Explorer frames for each TrCRF to limit the maximum number of hops that an explorer is allowed to traverse. If a port determines that the explorer frame it is receiving has traversed more than the number of hops specified, it does not forward the frame. The TrCRF determines the number of hops an explorer has traversed based on the number of bridge hops in the route information field.
A backup TrCRF enables you to configure an alternate route for traffic between undistributed TrCRFs located on separate switches that are connected by a TrBRF in the event that the ISL connection between the switches fails. Only one backup TrCRF for a TrBRF is allowed, and only one port per switch can belong to a backup TrCRF.
If the ISL connection between the switches fails, the port in the backup TrCRF on each affected switch automatically becomes active, rerouting traffic between the undistributed TrCRFs through the backup TrCRF. When the ISL connection is reestablished, all but one port in the backup TrCRF is disabled. Figure 11-5 shows the backup TrCRF.
Figure 11-5 Backup TrCRF
Token Ring VLAN Configuration Guidelines
This section describes the guidelines for creating or modifying Token Ring VLANs:
•
•
•
–
–
Creating or Modifying a Token Ring TrBRF VLAN
You must enable VTP version 2 before you create Token Ring VLANs. For information on enabling VTP version 2, see "Configuring VTP."
You must specify a bridge number when you create a new TrBRF.
To create a new Token Ring TrBRF VLAN, perform this task in privileged mode:
This example shows how to create a new Token Ring TrBRF VLAN and verify the configuration:
Console> (enable) set vlan 999 name TrBRF_999 type trbrf bridge aVlan 999 configuration successfulConsole> (enable) show vlan 999VLAN Name Status IfIndex Mod/Ports, Vlans---- -------------------------------- --------- ------- ------------------------999 TrBRF_999 activeVLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------999 trbrf 100999 4472 - - 0xa ibm - 0 0VLAN AREHops STEHops Backup CRF---- ------- ------- ----------Console> (enable)To modify the VLAN parameters on an existing Token Ring TrBRF VLAN, perform this task in privileged mode:
Creating or Modifying a Token Ring TrCRF VLAN
Note
To create a new Token Ring TrCRF VLAN, perform this task in privileged mode:
Note
This example shows how to create a Token Ring TrCRF VLAN and verify the configuration:
Console> (enable) set vlan 998 name TrCRF_998 type trcrf decring 10 parent 999Vlan 998 configuration successfulConsole> (enable) show vlan 998VLAN Name Status IfIndex Mod/Ports, Vlans---- -------------------------------- --------- ------- ------------------------998 TrCRF_998 active 352VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------998 trcrf 100998 4472 999 0xa - - srb 0 0VLAN AREHops STEHops Backup CRF---- ------- ------- ----------998 7 7 offConsole> (enable)To modify the VLAN parameters on an existing Token Ring TrCRF VLAN, perform this task in privileged mode:
To create a backup TrCRF, assign one port on each switch that the TrBRF traverses to the backup TrCRF.
To configure a TrCRF VLAN as a backup TrCRF, perform this task in privileged mode:
Step 1
Configure a TrCRF VLAN as a backup TrCRF.
set vlan vlan backupcrf on
Step 2
Verify the VLAN configuration.
show vlan [vlan]
Caution
To specify the maximum number of hops for All-Routes Explorer frames or Spanning Tree Explorer frames in the TrCRF, perform this task in privileged mode:
This example shows how to limit All-Routes Explorer frames and Spanning Tree Explorer frames to ten hops and how to verify the configuration:
Console> (enable) set vlan 998 aremaxhop 10 stemaxhop 10Vlan 998 configuration successfulConsole> (enable) show vlan 998VLAN Name Status IfIndex Mod/Ports, Vlans---- -------------------------------- --------- ------- ------------------------998 VLAN0998 active 357VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------998 trcrf 100998 4472 999 0xff - - srb 0 0VLAN AREHops STEHops Backup CRF---- ------- ------- ----------998 10 10 offConsole> (enable)Configuring VLANs for the Firewall Services Module
You use the set vlan {vlans} firewall-vlan {mod} command to specify VLANs that are secured by a Firewall Services Module (WS-SVC-FWM-1-K9).
To secure a range of VLANs on a Firewall Services Module, these conditions must be satisfied:
Note
1.
2.
3.
VLANs that do not satisfy condition number 2 in the list above are discarded from the range of VLANs that you attempt to secure on the Firewall Services Module.
VLANs that meet condition number 2 and condition number 3 but do not meet condition number 1 are stored in the supervisor engine database; these VLANs are sent to the Firewall Services Module as soon as they meet condition number 1.
This example shows how to secure a range of VLANs on a Firewall Services Module:
Console> (enable) set vlan 2-55 firewall-vlan 7Console> (enable)
Note
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/mod_icn/fwsm/index.htm
