Create Ethernet VLANs on Catalyst Switches

Available Languages

Download Options

  • PDF     (134.4 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (94.0 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (102.7 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:November 15, 2022
Document ID:10023

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes how to create VLANs on Catalyst switches that run Cisco IOS® System Software.

    Prerequisites

    Requirements

    Cisco recommends that you have knowledge of the information in this section.

    VLANs are a mechanism to allow network administrators to create logical broadcast domains that can span across a single switch or multiple switches, regardless of physical proximity. This function is useful to reduce the size of broadcast domains or to allow groups or users to be logically grouped without the need to be physically located in the same place.

    In order to create VLANs, you must decide how to configure these items:

    • What VLAN Trunk Protocol (VTP) domain name and VTP mode to use on this switch

    • Which ports on the switch belong to which VLAN

    • If you need to have communication between VLANs, or if they are isolated

      If you require communication between VLANs, you must use a Layer 3 routing device, such as an external Cisco router or an internal router module. Here are examples:

      • WS-X4232-Layer 3 card for Catalyst 4500/4000 Switches with Supervisor Engine I and Supervisor Engine II

      • Multilayer Switch Module (MSM) or Multilayer Switch Feature Card (MSFC) for Catalyst 6500/6000 Switches

      Some of the switches have built-in support in software and hardware to do inter-VLAN routing. With inter-VLAN routing, no external device, modules, or daughter cards are required. Here are examples of such switches:

      • Catalyst 3550/3750/6500 with Supervisor Engine 720

      • Catalyst 4500 with Supervisor Engine II+, Supervisor Engine III, and Supervisor Engine IV

    Refer to these documents for more information on inter-VLAN routing configuration on an MSFC, RSM, RSFC, or external router:

    Note: This document assumes that you have basic connectivity to the switch, either through the console or through Telnet access. Refer to these documents for more information on how to get basic connectivity to the switches.

    Components Used

    The information in this document is based on these hardware and software versions:

    • Catalyst 3524XL Switch that runs Cisco IOS Software Release 12.0(5.x)XU

    • Catalyst 4507 Switch with Supervisor Engine IV (WS-X4515) that runs Cisco IOS Software Release 12.1(13)EW1

    The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

    Conventions

    Refer to Cisco Technical Tips Conventions for more information on document conventions.

    Related Products

    The information in this document can also be used with these or other Catalyst switches that run Cisco IOS:

    • Catalyst 4500/4000/2948G/2980G/4912G Switches

    • Catalyst 6500/6000 Series Switches

    • Catalyst 2900XL/3500XL/2950/3550/3750 Switches

    Background Information

    This document describes how to create VLANs on Catalyst switches that run Cisco IOS® System Software. The sample commands for each section use one Catalyst switch from each configuration section.

    Configure the VLAN on Catalyst 2900XL, 3500XL, 2950, 2970, and 2940 Series Switches

    Create VLANs and Ports

    Note: The output that you see can be different from some of the command output that this section displays. The difference depends on the model of your switch.

    Complete these steps in order to create a VLAN.

    1. Decide whether to use VTP in your network.

      With VTP, you can make configuration changes centrally on a single switch, and you can automatically communicate those changes to all the other switches in the network. The default VTP mode on the Catalyst 2900XL, 3500XL, 2950, 2970, and 2940 Switches is the server mode. Refer to Understanding VLAN Trunk Protocol (VTP) for more information on VTP.

      Note: Issue the show vtp status command in order to check the VTP status on XL Series Switches.

      3524XL#show vtp status

VTP Version                     : 2
Configuration Revision          : 0
Maximum VLANs supported locally : 254
Number of existing VLANs        : 5
VTP Operating Mode              : Server

!--- This is the default mode.

VTP Domain Name                 : 
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0xBF 0x86 0x94 0x45 0xFC 0xDF 0xB5 0x70 
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00

    2. After you set and verify the VTP domain, begin to create VLANs on the switch.

      By default, there is only a single VLAN for all ports. This VLAN is called default . You cannot rename or delete VLAN 1.

      Issue the show vlan command in order to check the VLAN information.

      3524XL#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4,
                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8,
                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12,
                                                Fa0/13, Fa0/14, Fa0/15, Fa0/16,
                                                Fa0/17, Fa0/18, Fa0/19, Fa0/20,
                                                Fa0/21, Fa0/22, Fa0/23, Fa0/24,
                                                Gi0/1, Gi0/2
1002 fddi-default                     active
1003 token-ring-default               active
1004 fddinet-default                  active
1005 trnet-default                    active

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        1002   1003
1002 fddi  101002     1500  -      -      -        -    -        1      1003
1003 tr    101003     1500  1005   0      -        -    srb      1      1002
1004 fdnet 101004     1500  -      -      1        IBM  -        0      0
1005 trnet 101005     1500  -      -      1        IBM  -        0      0

      Issue this set of commands in privileged mode in order to create another VLAN:

      3524XL#vlan database

!--- You must enter into VLAN database in order to configure any VLAN.

3524XL(vlan)#vtp server

Device mode already VTP SERVER.

!--- You can skip this command if the switch is already in server mode and you 
      !--- want the switch to be in server mode.

      Note: A switch can only create VLANs if it is in VTP server mode or VTP transparent mode. Refer to Understanding VLAN Trunk Protocol (VTP) for more information on VTP.

      524XL(vlan)#vlan ?

  <1-1005>  ISL VLAN index

3524XL(vlan)#vlan 2 ?

  are        Maximum number of All Route Explorer hops for this VLAN
  backupcrf  Backup CRF mode of the VLAN
  bridge     Bridging characteristics of the VLAN
  media      Media type of the VLAN
  mtu        VLAN Maximum Transmission Unit
  name       Ascii name of the VLAN
  parent     ID number of the Parent VLAN of FDDI or Token Ring type VLANs
  ring       Ring number of FDDI or Token Ring type VLANs
  said       IEEE 802.10 SAID
  state      Operational state of the VLAN
  ste        Maximum number of Spanning Tree Explorer hops for this VLAN
  stp        Spanning tree characteristics of the VLAN
  tb-vlan1   ID number of the first translational VLAN for this VLAN (or zero
             if none)
  tb-vlan2   ID number of the second translational VLAN for this VLAN (or zero
             if none)

3524XL(vlan)#vlan 2 name ?

  WORD  The ASCII name for the VLAN

3524XL(vlan)#vlan 2 name cisco_vlan_2

VLAN 2 added:
    Name: cisco_vlan_2

3524XL(vlan)#exit

!--- You must exit from the VLAN database in order for the changes 
      !--- to be committed.

APPLY completed.
Exiting....
3524XL#

      Note: The VTP mode can change from client mode to transparent mode if the switch attempts to learn or pass a greater number of VLANs than it supports. Always check that the switches that run in client mode support the same number of VLANs that the switches in server mode send.

    3. Issue the show vlan command in order to ensure that the VLAN is created.

      3524XL#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4,
                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8,
                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12,
                                                Fa0/13, Fa0/14, Fa0/15, Fa0/16,
                                                Fa0/17, Fa0/18, Fa0/19, Fa0/20,
                                                Fa0/21, Fa0/22, Fa0/23, Fa0/24,
                                                Gi0/1, Gi0/2
2    cisco_vlan_2                     active    
1002 fddi-default                     active
1003 token-ring-default               active
1004 fddinet-default                  active
1005 trnet-default                    active

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        1002   1003
2    enet  100002     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        1      1003
1003 tr    101003     1500  1005   0      -        -    srb      1      1002
1004 fdnet 101004     1500  -      -      1        IBM  -        0      0
1005 trnet 101005     1500  -      -      1

    4. You can add ports (interfaces) in the newly created VLAN.

      You must go to interface configuration mode for each of the interfaces that you want to add into the new VLAN.

      Note: You can assign the ports of a Layer 2 Catalyst Switch to multiple VLANs, but the switch only supports one active management VLAN interface at a time and other switched virtual interfaces (SVIs) do not up/up because of Layer 2 functionality. Therefore, the switch supports only one active management Layer 3 address. On a Layer 2 Catalyst Switch, you can issue the optional management command under the new SVI in order to automatically shut down VLAN 1 and transfer the IP address to the new VLAN.

      Switch#configure terminal

      Switch(config)#interface vlan 2

      Switch(config-subif)#management

      Switch(config-subif)#^Z

      Switch#show ip interface brief
Interface                  IP-Address      OK? Method Status   Protocol
VLAN1                      10.0.0.2        YES manual up       down    
VLAN2                      10.0.0.22        YES manual up       up      
FastEthernet0/1            unassigned      YES unset  up       up      
FastEthernet0/2            unassigned      YES unset  up       up

!--- Output suppressed.

      Issue this set of commands in privileged mode in order to add a particular interface in the VLAN:

      3524XL#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

3524XL(config)#interface fastethernet 0/2
3524XL(config-if)#switchport access ?

  vlan  Set VLAN when interface is in access mode

3524XL(config-if)#switchport access vlan ?

  <1-1001>  VLAN ID of the VLAN when this port is in access mode
  dynamic   When in access mode, this interfaces VLAN is controlled by VMPS

3524XL(config-if)#switchport access vlan 2

!--- These commands assign interface Fast Ethernet 0/2 to VLAN 2.

3524XL(config-if)#exit
3524XL(config)#interface fastethernet 0/3
3524XL(config-if)#switchport access vlan 2

!--- These commands assign interface Fast Ethernet 0/3 to VLAN 2.

3524XL(config-if)#end

3524XL#
00:55:26: %SYS-5-CONFIG_I: Configured from console by console

3524XL#write memory

!--- This saves the configuration.

Building configuration...

    5. Issue the show vlan command in order to verify the VLAN configuration.

      3524XL#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/4, Fa0/5, Fa0/6,
                                                Fa0/7, Fa0/8, Fa0/9, Fa0/10,
                                                Fa0/11, Fa0/12, Fa0/13, Fa0/14,
                                                Fa0/15, Fa0/16, Fa0/17, Fa0/18,
                                                Fa0/19, Fa0/20, Fa0/21, Fa0/22,
                                                Fa0/23, Fa0/24, Gi0/1, Gi0/2
2    cisco_vlan_2                     active    Fa0/2, Fa0/3
1002 fddi-default                     active
1003 token-ring-default               active
1004 fddinet-default                  active
1005 trnet-default                    active

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        1002   1003
2    enet  100002     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        1      1003
1003 tr    101003     1500  1005   0      -        -    srb      1      1002
1004 fdnet 101004     1500  -      -      1        IBM  -        0      0
1005 trnet 101005     1500  -      -      1        IBM  -        0      0

    Remove Ports or VLANs

    In order to remove ports from the VLAN, issue the no switchport access vlan vlan_number command in interface configuration mode. After the port is removed from a VLAN that is not VLAN 1 (the default VLAN), that port is automatically added back to the default VLAN.

    For example, if you want to remove interface Fast Ethernet 0/2 from cisco_vlan_2 (VLAN 2), issue this set of commands in privileged mode:

    3524XL#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

3524XL(config)#interface fastethernet 0/2
3524XL(config-if)#no switchport access vlan 2

!--- These two commands remove interface Fast Ethernet 0/2 from VLAN 2.

3524XL(config-if)#end
3524XL#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/4, Fa0/5,

!--- Note: Fast Ethernet 0/2 is added back to the default VLAN.

                                                Fa0/6, Fa0/7, Fa0/8, Fa0/9,
                                                Fa0/10, Fa0/11, Fa0/12, Fa0/13,
                                                Fa0/14, Fa0/15, Fa0/16, Fa0/17,
                                                Fa0/18, Fa0/19, Fa0/20, Fa0/21,
                                                Fa0/22, Fa0/23, Fa0/24, Gi0/1,
                                                Gi0/2
2    cisco_vlan_2                     active    Fa0/3
1002 fddi-default                     active
1003 token-ring-default               active
1004 fddinet-default                  active
1005 trnet-default                    active

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        1002   1003
2    enet  100002     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        1      1003
1003 tr    101003     1500  1005   0      -        -    srb      1      1002
1004 fdnet 101004     1500  -      -      1        IBM  -        0      0
1005 trnet 101005     1500  -      -      1        IBM  -        0      0

    In order to delete the VLAN, issue the no vlan vlan_number command in VLAN database mode. Interfaces in that VLAN remain a part of that VLAN and are deactivated because they no longer belong to any VLAN.

    For example, if you want to delete cisco_vlan_2 from the switch, issue this set of commands in privileged mode:

    3524XL#vlan database

!--- This command enters you into the VLAN database mode.

3524XL(vlan)#no vlan 2

!--- This command removes the VLAN from the database.

Deleting VLAN 2...

3524XL(vlan)#exit

APPLY completed.
Exiting....

3524XL#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/4, Fa0/5,
                                                Fa0/6, Fa0/7, Fa0/8, Fa0/9,
                                                Fa0/10, Fa0/11, Fa0/12, Fa0/13,
                                                Fa0/14, Fa0/15, Fa0/16, Fa0/17,
                                                Fa0/18, Fa0/19, Fa0/20, Fa0/21,
                                                Fa0/22, Fa0/23, Fa0/24, Gi0/1,
                                                Gi0/2
1002 fddi-default                     active
1003 token-ring-default               active
1004 fddinet-default                  active
1005 trnet-default                    active

!--- Output suppressed.

    Notice that port Fast Ethernet 0/3 is not displayed in the show vlan command output. The removal of VLAN 2 deactivates this port. Unless you add the port back in another VLAN, the port is neither displayed or usable.

    3524XL#show interfaces fastethernet 0/3
FastEthernet0/3 is down, line protocol is down

!--- Output suppressed.

    In order to make the interface usable, you must ensure that it belongs to some VLAN. In the case in this section of the document, you must add interface Fast Ethernet 0/3 to the default VLAN (VLAN 1) in order to make this interface usable.

    Note: If you have the output of a show-tech support command from your Cisco device, you can use Output Interpreter in order to display potential issues and fixes.

    Note: Only registered Cisco users can access internal tools and information.

    Note: In the case of Catalyst 3550 Switches, you can still use the interface without the addition of the interface to a VLAN. However, you need to make that interface a Layer 3 interface. 

    Configure a Multi-VLAN Port on Catalyst 2900XL/3500XL

    The multi-VLAN port feature on Catalyst 2900XL/3500XL Switches allows you to configure a single port in two or more VLANs. This feature allows users from different VLANs to access a server or router without the implementation of inter-VLAN routing capability. A multi-VLAN port performs normal switching functions in all of its assigned VLANs. VLAN traffic on the multi-VLAN port is not encapsulated as it is in trunking.

    Note: These are the limitations to the implementation of multi-VLAN port features:

    • You cannot configure a multi-VLAN port when a trunk is configured on the switch. You can connect the multi-VLAN port only to a router or server. The switch automatically transitions to VTP transparent mode when the multi-VLAN port feature is enabled, which disables the VTP. No VTP configuration is necessary.

    • The multi-VLAN port feature is supported only on Catalyst 2900XL/3500XL Series Switches. This feature is not supported on Catalyst 4500/4000, 5500/5000, or 6500/6000 Series Switches or any other Catalyst switches.

    1. Determine which port to configure as a multi-VLAN port.

      Here, three VLANs are created on a Catalyst 3512XL Switch, and one port of the switch is connected to an external router. This example configures the port that is connected to the router as a multi-VLAN port.

      6-3512xl#show vlan

VLAN Name                             Status      Ports
---- -------------------------------- ---------   -----------------------------
1    default                          active      Fa0/1, Fa0/3, Fa0/6, Fa0/7,
                                                  Fa0/8, Fa0/9, Fa0/10, Fa0/11,
                                                  Fa0/12, Gi0/1, Gi0/2
2    VLAN0002                         active      Fa0/2, Fa0/4
3    VLAN0003                         active      Fa0/5
4    VLAN0004                         active
5    VLAN0005                         active
6    VLAN0006                         active

      In the example, port Fast Ethernet 0/1 is connected to an external router. For more information about how to create VLANs and assign ports to VLANs, see the Configure the VLAN on Catalyst 2900XL, 3500XL, 2950, 2970, and 2940 Series Switches section of this document.

    2. Configure the Fast Ethernet 0/1 port in multi-VLAN mode, and add assigned VLANs to the multi-VLAN port.

      6-3512xl#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

6-3512xl(config)#interface fastethernet 0/1
6-3512xl(config-if)#switchport mode multi

!--- This command changes the port Fast Ethernet 0/1 mode to multi.

6-3512xl(config-if)#switchport multi vlan ?

  LINE    VLAN IDs of VLANs to be used in multi-VLAN mode
  add     add VLANs to the current list
  remove  remove VLANs from the current list

6-3512xl(config-if)#switchport multi vlan 1,2,3

!--- This command assigns VLANs 1, 2, and 3 to multi-VLAN port Fast Ethernet 0/1.

6-3512xl(config-if)#^Z
 
6-3512xl#

    3. Issue the show interface interface_id switchport command and the show vlan command in order to verify the configuration.

      6-3512xl#show interface fastethernet 0/1 switchport

Name: Fa0/1
Operational Mode: multi

!--- The port is in multi-VLAN mode.

Administrative Trunking Encapsulation: isl
Operational Trunking Encapsulation: isl
Negotiation of Trunking: Disabled
Access Mode VLAN: 0 ((Inactive))
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: NONE
Pruning VLANs Enabled: NONE

Priority for untagged frames: 0

Override vlan tag priority: FALSE

Voice VLAN: none

Appliance trust: none

6-3512xl#show vlan brief

VLAN Name                             Status       Ports
---- -------------------------------- ---------    ----------------------------
1    default                          active       Fa0/1, Fa0/3, Fa0/6, Fa0/7,
                                                   Fa0/8, Fa0/9, Fa0/10, Fa0/1
                                                   Fa0/12, Gi0/1, Gi0/2
2    VLAN0002                         active       Fa0/1, Fa0/2, Fa0/4

      !--- Note: Previously, port Fast Ethernet 0/1 was only in VLAN 1. 
      !--- Now the port is assigned to multiple VLANs 1, 2, and 3.
      
      3    VLAN0003                         active       Fa0/1, Fa0/5
4    VLAN0004                         active
5    VLAN0005                         active

    4. Issue the ping command from the switch to the router in order to verify the multi-VLAN operation.

      The ping command receives a reply from the router each time the management IP address is assigned to any of the VLANs 1, 2, or 3.

      6-3512xl#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

6-3512xl(config)#interface vlan 1
6-3512xl(config-if)#ip address 192.168.1.1 255.255.255.0

!--- The management IP address is assigned to VLAN 1.

6-3512xl(config-if)#^Z
6-3512xl#
23:56:54: %SYS-5-CONFIG_I: Configured from console by console

6-3512xl#ping 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/3 ms

6-3512xl#ping 192.168.1.2

!--- You can ping the router from VLAN 1.

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/3 ms

6-3512xl#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

6-3512xl(config)#interface vlan 1
6-3512xl(config-if)#no ip address

!--- The management IP address is removed from VLAN 1.

6-3512xl(config-if)#shutdown
6-3512xl(config-if)#exit
6-3512xl(config)#interface vlan 2
6-3512xl(config-subif)#ip address 192.168.1.1 255.255.255.0
6-3512xl(config-subif)#no shutdown

!--- The management IP address is assigned to VLAN 2.

6-3512xl(config-subif)#exit
6-3512xl(config)#exit
6-3512xl#ping 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/3 ms

6-3512xl#ping 192.168.1.2

!--- You can ping the router from VLAN 2.

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/202/1004 ms

6-3512xl#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

6-3512xl(config)#interface vlan 2
6-3512xl(config-subif)#no ip address

!--- The management IP address is removed from VLAN 2.

6-3512xl(config-subif)#shutdown
6-3512xl(config-subif)#exit
6-3512xl(config)#interface vlan 3
6-3512xl(config-subif)#ip address 192.168.1.1 255.255.255.0
6-3512xl(config-subif)#no shut

!--- The management IP address is assigned to VLAN 3.

6-3512xl(config-subif)#exit
6-3512xl(config)#exit
6-3512xl#ping 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/3 ms

6-3512xl#ping 192.168.1.2

!--- You can ping the router from VLAN 3.

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/205/1004 ms

    Configure the VLAN on Catalyst 3550, 3750, 4500/4000, and 6500/6000 Switches that Run Cisco IOS Software

    Create VLANs and Ports

    This section uses the Catalyst 4500 Switch for sample configuration commands, but the configuration tasks also apply to other switches that run Layer 3 (or Cisco IOS Software). These other switches include the Catalyst 3550, 3570, and 6500 Series Switches that run Cisco IOS Software. Before you can create a VLAN, the switch must be in VTP server mode or VTP transparent mode. If the switch is a VTP server, you must define a VTP domain name before you add any VLANs. You must define a VTP domain name regardless of:

    • The number of switches in the network, whether one or many

    • Whether you use VTP in order to propagate VLANs to other switches in the network

    You can create VLANs in either VLAN database mode or global configuration mode. You must create VLANs that are numbered higher than 1005 in global configuration mode. The VTP mode must be set to transparent in order to create these VLANs. VLANs that are numbered higher than 1005 are not advertised by VTP. Furthermore, VLANs that are numbered higher than 1005 are stored in the switch configuration file and not in the VLAN .dat file. The default location of the VLAN .dat file in Catalyst 4000 Switches with Supervisor Engine IV is the cat4000_flash directory.

    Switch#dir cat4000_flash:
Directory of cat4000_flash:/

1 -rw- 676 <no date> vlan.dat

524260 bytes total (523584 bytes free)

    Note: A Catalyst 6500 Switch that runs Cisco IOS Software allows you to create VLANs in server mode without a VTP domain name.

    The show vtp status command shows the VTP information in the switch.

    Switch#show vtp status

VTP Version : 2
Configuration Revision : 0
Maximum VLANs supported locally : 1005
Number of existing VLANs : 8
VTP Operating Mode : Server
VTP Domain Name : cisco
VTP Pruning Mode : Enabled
VTP V2 Mode : Disabled
VTP Traps Generation : Disabled
MD5 digest : 0xA4 0x18 0x78 0x52 0x5A 0x1B 0x2E 0x14
Configuration last modified by 0.0.0.0 at 5-28-01 05:17:02
Local updater ID is 10.10.10.1 on interface Vl1 (lowest numbered VLAN interface)

    1. Issue the show vlan command in order to check the VLAN information.

      Switch#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi1/1, Gi1/2, Gi3/1, Gi3/2
                                                Gi3/3, Gi3/4, Gi3/5, Gi3/6
                                                Gi3/7, Gi3/8, Gi3/9, Gi3/10
                                                Gi3/11, Gi3/12, Gi3/13, Gi3/14
                                                Gi3/15, Gi3/16, Gi3/17, Gi3/18

!--- Output suppressed.

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    -        0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trnet 101005     1500  -      -      -        ibm  -        0      0

Primary Secondary Type              Ports 
------- --------- ----------------- ------------------------------------------

    2. Enter the correct mode, either database mode or global configuration mode.

      Issue the vlan database command in privileged mode in order to enter VLAN database mode.

      Switch#vlan database
Switch(vlan)#

    3. Issue the vlan vlan_number command in order to configure a VLAN.

      Switch(vlan)#vlan 2

VLAN 2 added:
Name: VLAN0002

Switch(vlan)#apply

APPLY completed.

      Note: For the configuration to take effect, you can either issue the apply command or exit out of VLAN database mode. The end keyword and Ctrl-Z exit methods do not work in VLAN database mode. Issue the exit command in order to exit out of VLAN database mode.

      Issue these commands in order to perform the VLAN configuration in global configuration mode:

      Switch(config)#vlan 3
Switch(config-vlan)#exit
Switch(config)#

    4. Issue the show run command in order to view VLANs that are numbered higher than 1005 in the configurationt hat currently runs.

      Switch#show running-config

Building configuration...

Current configuration : 2975 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
service compress-config
!
hostname Switch
!
!
ip subnet-zero
!
spanning-tree extend system-id
!
redundancy
mode rpr
main-cpu
auto-sync standard
!
!
vlan 2000
!
interface GigabitEthernet1/1
!
interface GigabitEthernet1/2
!

!--- Output suppressed.

    In Cisco IOS Software, interfaces are in the shutdown state by default.

    By default, Cisco IOS Software interfaces are Layer 2 interfaces on Catalyst 3550, 3750, and 4500 Series Switches. The interfaces are Layer 3 interfaces on Catalyst 6500/6000 Series Switches. You can configure the interface as a Layer 2 interface with the switchport command in interface configuration mode. You must issue this command before you assign an interface to a VLAN, if the interface is in Layer 3 mode. The command to assign an interface to a VLAN is switchport access vlan vlan_number .

    Note: If the interface is configured as a Layer 3 interface, which means that the no switchport command is configured, you cannot assign the interface to a VLAN.

    In order to associate the ports to VLANs in Cisco IOS Software, this minimum configuration is required:

    Switch(config)#interface gigabitethernet 3/1
Switch(config-if)#switchport

!--- This command is required if the interface is in Layer 3 mode.

Switch(config-if)#switchport access vlan 2
Switch(config-if)#no shutdown

    Issue the show interface gigabitethernet module interface switchport command in order to check the Layer 2 interface status.

    Switch#show interface gigabitethernet 3/1 switchport

Name: Gi3/1
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: static access
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 2 (VLAN0002)
Trunking Native Mode VLAN: 1 (default)
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk private VLANs: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL
Voice VLAN: none (Inactive)
Appliance trust: none

    If the port is set up as a trunk, which is a port that can carry more than one VLAN, the switchport trunk native vlan command can be useful. The command is useful if the native VLAN of the interface has been changed or needs to be changed from its defaults. The native VLAN is the VLAN that is used if the interface is to become a Layer 2 interface. If you do not explicitly define a native VLAN, VLAN 1 becomes the native VLAN by default. Be aware that an IEEE 802.1Q header is not added when data are sent on the native VLAN. Ensure that the trunk ports on both of the connected devices have the same native VLAN. A mismatch in native VLANs can cause inter-VLAN routing issues, among other problems.

    This message appears when the native VLAN is mismatched on the two Cisco switches:

    %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEhernet1/1 (2),
 with D-R3550-9B GigabitEthernet0/1 (1)

    In this example message, the native VLAN is VLAN 2 on one of the switches, but the neighboring switch has native VLAN 1.

    Issue the show interfaces module interface trunk command in order to see the native VLAN, encapsulation, and trunking VLAN information.

    Switch#show interfaces gigabitethernet 3/1 trunk

Port Mode Encapsulation Status Native vlan
Gi3/1 on 802.1q trunking 1
 Port Vlans allowed on trunk
Gi3/1 1-4094
 Port Vlans allowed and active in management domain
Gi3/1 1-4,2000,3000
 Port Vlans in spanning tree forwarding state and not pruned
Gi3/1 none

    If you use the default configuration, native VLAN is set to VLAN 1. In order to change the native VLAN on the interface that is trunking, issue the switchport trunk native vlan vlan_number command.

    Switch(config)#interface gigabitethernet 3/1
Switch(config-if)#switchport trunk native vlan 2

    Issue this command in order to verify:

    Switch#show interfaces gigabitethernet 3/1 trunk

Port Mode Encapsulation Status Native vlan
Gi3/1 on 802.1q trunking 2
 Port Vlans allowed on trunk
Gi3/1 1-4094
 Port Vlans allowed and active in management domain
Gi3/1 1-4,2000,3000
 Port Vlans in spanning tree forwarding state and not pruned
Gi3/1 none

    Assign Multiple Ports to a Single VLAN

    You can assign the multiple interfaces on a switch to a single VLAN. Issue these commands:

    1. Switch(config)#interface range fastethernet [mod/slot - mod/slot]

    2. Switch(config-if-range)#switchport access vlan vlan_number

    3. Switch(config-if-range)#switchport mode access

    4. Switch(config-if-range)#no shut

    Note: The interface range command is not supported in all software releases. The interface range command is supported in Cisco IOS Software Release 12.1(13)EW and later.

    Remove VLANs

    In order to remove a VLAN from the VLAN database, issue the no vlan vlan_number command in either VLAN database mode or global configuration mode. This example uses the VLAN database mode to remove VLAN 2.

    Switch#vlan database
Switch(vlan)#no vlan 2
Deleting VLAN 2...
Switch(vlan)#apply
APPLY completed.

    The global configuration mode does not log any message on the console that indicates the deletion of the VLAN. However, you can issue the show vlan command in order to verify the deletion of the VLAN.

    Rename VLANs

    In order to rename a VLAN from the VLAN database, issue the name vlan_name command in either VLAN database mode or global configuration mode.

    This example uses VLAN database mode to rename VLAN 3:

    Switch#vlan database
Switch(vlan)#vlan 3
Switch(vlan)#name CISCO
Switch(vlan)#apply
APPLY completed.

    This example uses global configuration mode to rename the VLAN 3:

    Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.

Switch(vlan)#vlan 3
Switch(vlan)#name CISCO

    In order to verify, issue the show vlan brief or show vlan-switch brief command.

    switch#show vlan brief

VLAN  Name                             Status    Ports
---- -------------------------------- --------- -----------
 3    CISCO                            active    Fa0/3

    Note: When you rename the VLAN, it is not necessary to remove the VLAN assigned to the port with the switchport access vlan vlan_number command.

    How to Isolate the Communication Between Two VLANs

    This section does not discuss private VLANs. Private VLANs provide Layer 2 isolation between ports within the same private VLAN (isolated VLAN) or between the private VLANs (community VLANs).

    There are two scenarios for when you try to isolate two VLANs.

    Isolation Between Two Layer 2 VLANs

    A Layer 2 VLAN is the VLAN created in the switch and not configured with the interface vlan <vlan_number> command. Hosts in the different Layer 2 VLANs cannot communicate with each other.

    Complete these steps in order to create a Layer 2 VLAN and isolate it from older VLANs:

    1. Create the new VLAN in the database. When you exit VLAN database mode, the configuration changes are applied.

      Switch#vlan database

!--- You must enter into VLAN database mode in order to 
      !--- configure any VLAN.
      
Switch(vlan)#vlan 5
VLAN 5 added:
    Name: VLAN0005
Switch(vlan)#vlan 6
VLAN 6 added:
    Name: VLAN0006
Switch(vlan)#exit
APPLY completed.
Exiting....

    2. Ensure the VLAN is created in the VLAN database. The new VLAN must appear in the output of the show vlan command.

    3. Do not set an IP address to the newly created VLANs.

    4. Configure physical interfaces that connect the clients to the corresponding VLAN.

      Switch(config)#interface fastEthernet 2/1
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 5
Switch(config-if)#no shut

witch(config)#interface fastEthernet 2/2
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 6
Switch(config-if)#no shut

    5. Assign to each host a static IP address, subnet mask, and do not set a default gateway. This causes hosts on the ports fa 2/1 and 2/2 to not communicate with each other. Devices that belong to one VLAN do not reach anything else but devices within the same VLAN.

    Isolation Between Two Layer 3 VLANs

    When you create a VLAN and assign an IP address with the interface vlan <vlan_number> command, the VLAN becomes a Layer 3 VLAN. In Layer 3 switches, the hosts between the two VLANs can communicate with each other (if the hosts are configured with the default gateway as the VLAN interface IP address). You can use ACLs to deny communication between the VLANs.

    This section shows an example of how to isolate the communication between a newly created Layer 3 VLAN and an older VLAN.

    In this example, the 3750 switch has two old VLANs (VLAN 1 and VLAN 2). The newly created VLAN is VLAN 5. VLAN 1, VLAN 2 and VLAN 5 are Layer 3 VLANs. ACLs are implemented to deny traffic so that VLAN 1 and VLAN 2 cannot communicate with VLAN 5 and so that VLAN 5 does not communicate either with VLAN 1 or VLAN 2.

    • VLAN 1 - 10.10.10.0 /24

    • VLAN 2 - 172.16.1.0 /24

    • VLAN 5 - 192.168.1.0 /24

    1. Create the new VLAN in the database. In this case the new VLAN is VLAN

      5. When you exit VLAN database mode, the configuration changes are applied. 
      Switch#vlan database

!--- You must enter into VLAN database mode 
      !--- in order to configure any VLAN.

Switch(vlan)#vlan 5
VLAN 5 added:
    Name: VLAN0005
Switch(vlan)#exit
APPLY completed.
Exiting....

    2. Ensure the VLAN is created in the VLAN database. Check the output of the show vlan command.

    3. Set an IP address for the newly created VLAN.

      Switch(config)#interface vlan 5
Switch(config-if)#ip address 192.168.1.1 255.255.255.0
Switch(config)#no shut

    4. Configure physical interfaces that connect the clients to the corresponding VLAN.

      Switch(config)#interface fastEthernet 2/1 
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 5
Switch(config-if)#no shut

      You need to configure three access-lists, one for each VLAN.

      • This access list denies traffic that comes from VLAN 1 to get to VLAN 5.

        !--- Some of the commands in this output are wrapped 
        !--- to a second line due to spatial reasons.

Switch#configure terminal
Switch(config)#access-list 101 deny 
ip 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255
Switch(config)#access-list 101 permit ip 10.10.10.0 0.0.0.255 any

      • This access list denies traffic that comes from VLAN 2 to get to VLAN 5.

        Switch#configure terminal
Switch(config)#access-list 102 deny ip 172.16.1.0 0.0.0.255 192.168.1.0 0.0.0.255
Switch(config)#access-list 102 permit ip 172.16.1.0 0.0.0.255 any

      • This access list denies traffic that comes from VLAN 5 to get to VLAN 1 and VLAN 2.

        Switch#configure terminal
Switch(config)#access-list 105 deny ip 192.168.1.0 0.0.0.255 10.10.10.0 0.0.0.255
Switch(config)#access-list 105 deny ip 192.168.1.0 0.0.0.255 172.16.1.0 0.0.0.255
Switch(config)#access-list 105 permit ip 192.168.1.0 0.0.0.255 any

      And once they are configured, apply the access lists to interface VLAN 1, interface VLAN 2 and interface VLAN 5.

      Switch#configure terminal
Switch(config)#interface vlan 1
Switch(config-if)#ip access-group 101 in
Switch(config-if)#exit

Switch#configure terminal
Switch(config)#interface vlan 2
Switch(config-if)#ip access-group 102 in
Switch(config-if)#exit

Switch#configure terminal
Switch(config)#interface vlan 5
Switch(config-if)#ip access-group 105 in
Switch(config-if)#end

    How to Configure Extended Range VLANs in a Catalyst 6500 Series Switch

    In order to configure extended VLANs on the Catalyst 6500 Series Switches that run Cisco IOS, you need to enter the spanning-tree extend system-id command. Then the extended VLAN must be created in the configuration mode and not from the vlan database mode.

    Complete these steps in order to create extended VLANs on the Catalyst 6500 Series Switches that run Cisco IOS:

    1. Console into the switch:

      Switch>enable
Switch#

    2. Enter configuration mode:

      Switch#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#

    3. Enter the spanning-tree extend system-id command in configuration mode:

      Switch(config)#spanning-tree extended system-id

    4. Enter the vtp mode transparent command in configuration mode:

      Switch(config)#vtp mode transparent

    5. Create the VLAN in configuration mode:

      Switch(config)#vlan 1311
Notice
Switch(config-vlan)#exit

    6. Exit configuration mode:

      Switch(config)#exit

    7. Issue the show vlan command in order to check the VLAN information.

      Switch#show vlan
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    
101  VLAN0101                         active    Gi4/8, Gi4/10
1002 fddi-default                     act/unsup 
1003 token-ring-default               act/unsup 
1004 fddinet-default                  act/unsup 
1005 trnet-default                    act/unsup 
1311 VLAN1311                         active    

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0   
101  enet  100101     1500  -      -      -        -    -        0      0   
1002 fddi  101002     1500  -      -      -        -    -        0      0   
1003 tr    101003     1500  -      -      -        -    -        0      0   
1004 fdnet 101004     1500  -      -      -        ieee -        0      0   
1005 trnet 101005     1500  -      -      -        ibm  -        0      0   
1311 enet  101311     1500  -      -      -        -    -        0      0

    Tips

    This section provides tips to troubleshoot common problems that you can encounter during the creation of VLANs on Catalyst switches that run Cisco IOS Software.

    On switches that run Cisco IOS Software, you can use the switch itself for interVLAN routing, instead of an external router. When an SVI is created, it does not automatically create a VLAN in the Layer 2 database. In order for an SVI to come up, a VLAN must be created in VLAN database mode or (in later Cisco IOS Software releases) in global configuration mode. In order for the SVI to be fully active, which means that it is administratively up, and line protocol is up, make sure to have at least one port as a member of that VLAN, with an active device connected to the port.

    This same issue applies when you copy configurations from a different switch or restore configurations with VLANs that were created in VLAN database mode. You must also replace the VLAN database file (vlan.dat), or you must recreate the VLANs, as the procedure in the Create VLANs and Ports section of this document shows. If you copy the configuration from another switch, the VLAN database is not copied.

    If the Layer 2 VLAN is not created on the switch, SVI interfaces show as UP/DOWN in the show ip interface brief command output when the configuration is applied to the switch. Ensure that all previous VLANs that were created in VLAN database mode or global configuration mode still exist after the configuration is copied to the switch.

    Verify

    There is currently no verification procedure available for this configuration.

    Troubleshoot

    Recover the vlan.dat File on Cisco IOS Switches

    For Cisco Catalyst Switches that run Cisco IOS software, the VLAN information is on a separate file named vlan.dat . If the vlan.dat file is deleted accidently and the switch gets reloaded, all the VLANs that were available on the switch are lost. Until the switch is reloaded, the VLAN information is present in the switch.

    Complete these steps in order to recover the vlan.dat file:

    1. Issue the show vlan command in order to confirm the availability of VLAN information.

      Switch#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                                Fa0/10, Fa0/11, Fa0/12, Gi0/1
                                                Gi0/2
10   VLAN0010                         active
11   VLAN0011                         active
20   VLAN0020                         active
21   VLAN0021                         active
30   VLAN0030                         active
31   VLAN0031                         active
40   VLAN0040                         active
41   VLAN0041                         active
50   Vlan50                           active
100  100thVLAN                        active

    2. If the switch is in VTP Server or Transparent mode, make any modifications to the VLAN database.

      Modifications to the VLAN database can be any of these:

      • Create any VLAN.

      • Delete any VLAN.

      • Modify the properties of any current VLAN.

      If the switch is in VTP Client mode, make modifications to the VLAN database at any VTP Server of the same domain.

      Switch#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#vlan 50

Switch(config-vlan)#name 50thVLAN

Switch(config-vlan)#end
Switch#

      Once any change has been done to the VLAN database, the switch automatically creates the vlan.dat file.

    3. Issue the show flash: command in order to verify the creation of the vlan.dat file.

      Switch#show flash:

Directory of flash:/

    2  -rwx           5   Mar 01 1993 00:04:47  private-config.text
    3  -rwx     2980487   Mar 02 1993 06:08:14  c2950-i6q4l2-mz.121-19.EA1a.bin
    4  -rwx        1156   Mar 01 1993 01:51:27  vlan.dat
   16  -rwx        1014   Mar 01 1993 00:04:47  config.text
    6  drwx        4096   Mar 02 1993 03:49:26  html
    7  -rwx     3121383   Mar 02 1993 03:47:52  c2950-i6q4l2-mz.121-22.EA9.bin

7741440 bytes total (65536 bytes free)

    Failed to Create VLANs in Extended Range

    Error 1

    % Failed to create VLANs [dec]
VLAN(s) not available in Port Manager.

    Layer 3 LAN ports, WAN interfaces and subinterfaces, and some software features, such as RSPAN, use internal VLANs in the extended range. You cannot use an extended range VLAN that is allocated for internal use.

    In order to display the VLANs used internally, issue the show vlan internal usage command. You can configure ascending internal VLAN allocation (from 1006 and up) or descending internal VLAN allocation (from 4094 and down).

    Switch(config)#vlan internal allocation policy {ascending | descending}

!--- Enter the ascending keyword to allocate internal VLANs from 1006 and up. 
    !--- Enter the descending keyword to allocate internal VLAN from 4094 and down.
    
    Switch(config)#end 
Switch#reload

    Caution: You do not need to issue the reload command immediately. Issue the reload command during a planned maintenance window. The internal VLAN allocation policy is applied only after a reload.

    If a device reload is not an option, as a workaround, you can use VLAN Translation. On trunk ports, you can translate one VLAN number to another VLAN number, which transfers all traffic received in one VLAN to the other VLAN. Refer to the Configuring VLAN Translation section of Catalyst 6500 Release 12.2SXF and Rebuilds Software Configuration Guide for more information.

    Note: Switches that run Catalyst product family software do not support the configuration of VLANs 1006-1024. If you configure VLANs 1006-1024, ensure that the VLANs do not extend to any switches that run Catalyst product family software.

    Error 2

    %Failed to commit extended VLAN(s) changes

    You can receive this message when you try to create Extended VLANs in Server or Client mode of VTP. Ensure that the device (Switch or Router) is in Transparent mode when you create extended range VLANs

    Failed to Configure VLAN from Startup-Config

    SW-VLAN-4-BAD-STARTUP-VLAN-CONFIG-FILE: Failed to configure VLAN from 
startup-config. Fallback to use VLAN configuration file from non-volatile memory

    This message indicates that the VLAN software failed to use the VLAN configuration from the startup configuration file. The VLAN configuration is stored in the vlan.dat file. The vlan.dat file resides in non-volatile memory. When the Supervisor module is replaced, vlan.dat is empty (0). On bootup, the switch compares the VTP domain name and VTP mode in the startup configuration file and the vlan.dat file. If the values do not match, the switch uses the configuration in the vlan.dat file.

    In order to perform a complete backup of your configuration, the vlan.dat file must be included in the backup with the configuration. The network administrator must upload both the vlan.dat file and the configuration file in order to restore the complete configuration.

    Backup and Restore of vlan.dat on Cisco IOS Switches

    In order to back up the vlan.dat, complete this step:

    Copy the vlan.dat file from the device NVRAM to a TFTP server or an external PCMCIA card.

    copy const_nvram:vlan.dat tftp:

    Note: The memory location where the vlan.dat file is stored varies from device to device. In Cisco Catalyst 6500/6000 Series Switches, it is const_nvram:. Similarily for Catalyst 4500/4000 Switches, it is cat4000_flash:. Refer to the respective product documentation before you issue the copy command

    In order to restore the vlan.dat file, complete these steps:

    1. Copy the vlan.dat file into the device NVRAM from a TFTP server or an external PCMCIA card.

      copy tftp: const_nvram:

    2. Reload the switch, as vlan.dat is read only during the booting process.

    VLAN Creation Fails with VLAN 1003 Parent VLAN Missing Error Message

    Switch#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)#vlan 102
Switch(config-vlan)#name marketing
Switch(config-vlan)#exit
VLAN 1003 parent VLAN missing
APPLY VLAN changes failed.
Switch(config)#end
Switch#

    A misconfiguration on a switch can cause the configuration updates of the VTP to fail. In most cases, the problem is that the new VLAN created in the VTP server switch does not propagate to the VTP client switches, which creates host connectivity issues.

    A common cause for this issue is a VTP version mismatch between the switches in a VTP domain. VTP version 1 and VTP version 2 are not interoperable on the network devices in the same VTP domain. A VTP version 2 capable network device can operate with a network device that runs VTP version 1, provided that VTP version 2 is disabled on the VTP version 2 capable network device. VTP version 2 is disabled by default. Every network device in the VTP domain must use the same VTP version. Verify the VTP version that runs on a switch. If VTP version 2 is enabled, disable it in order to resolve this issue.

    Verify if the switch is configured properly for other VTP parameters:

    • Verify that the switches are connected through trunk links, because VTP updates are only exchanged over trunk links.

    • Verify that the VTP domain name is exactly the same on the appropriate switches. The name is case sensitive. The VTP updates are only exchanged between switches in the same VTP domain.

    • Verify that the VTP password is exactly the same on all the switches in the domain. The password is case sensitive. If a password is configured, it must be configured on all switches in the domain and the password must be the same.

    In case of a VTP convergence issue, where a VTP client does not update the VLAN information, the workaround is to force a VTP convergence by the creation, then the removal of a dummy VLAN on the VTP server. This increments the revision number and forces all VTP clients to update their VLAN database.

    Related Information

    Revision History

    Revision Publish Date Comments
    1.0
    27-Nov-2001
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    • Julio Jimenez
      Cisco Project Manager

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco