'
PC(w/ Cisco Secure Services Client)--------EdgeSwitch----------ACS(TACACS)---------DomainControler
Edge switch interface configuration below depending on the Cisco Catalyst Switch Model.
For Cisco Catalyst Switch 4500 series:
interface Fa1/1
switchport mode access
switchport voice vlan <Voice VLAN>
speed 100
duplex full
qos trust cos
authentication event no-response action authorize vlan <Guest VLAN>
authentication host-mode multi-host
authentication port-control auto
authentication timer reauthenticate 60
dot1x pae authenticator
dot1x timeout quiet-period 5
dot1x max-req 10
storm-control broadcast level 20.00
storm-control action trap
no cdp enable
spanning-tree portfast
spanning-tree bpduguard enable
end
For Cisco Catalyst Switch 6500 series:
interface Fa1/1
switchport
switchport mode access
switchport voice vlan <Voice VLAN>
speed 100
duplex full
mls qos trust cos
dot1x pae authenticator
dot1x port-control auto
dot1x host-mode multi-host
dot1x timeout quiet-period 5
dot1x timeout reauth-period 60
dot1x max-req 10
dot1x guest-vlan <Guest VLAN>
storm-control broadcast level 20.00
spanning-tree portfast
spanning-tree bpduguard enable
end
Showing posts with label Switching. Show all posts
Showing posts with label Switching. Show all posts
Tuesday, March 23, 2010
Monday, March 22, 2010
Change trunk native VLAN from 1 to 2
'
SwitchB |----------------trunk---------------|SwitchA
Current Trunk Configuration:
SwitchA:
SwitchA#sh int g0/1 trunk
Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Gi0/1 1-4094
Port Vlans allowed and active in management domain
Gi0/1 1-2,10,20,30
Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1-2,10,20,30
SwitchB:
SwitchB#sh int g0/1 trun
Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Gi0/1 1-4094
Port Vlans allowed and active in management domain
Gi0/1 1-2,10,20,30
Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1-2,10,20,30
Change Native VLAN on SwitchA:
SwitchA:
SwitchA#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SwitchA(config)#int g0/1
SwitchA(config-if)#switchport trunk native vlan 2
SwitchA(config-if)#
23:32:19: %SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan i
d 1 on GigabitEthernet0/1 VLAN2.
23:32:19: %SPANTREE-2-BLOCK_PVID_PEER: Blocking GigabitEthernet0/1 on VLAN0001.
Inconsistent peer vlan.
23:32:19: %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet0/1 on VLAN0002.
Inconsistent local vlan.
SwitchB:
SwitchB#
23:32:58: %SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan i
d 2 on GigabitEthernet0/1 VLAN1.
23:32:58: %SPANTREE-2-BLOCK_PVID_PEER: Blocking GigabitEthernet0/1 on VLAN0002.
Inconsistent peer vlan.
23:32:58: %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet0/1 on VLAN0001.
Inconsistent local vlan.
Change Native VLAN on SwitchB:
SwitchA:
23:35:22: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking GigabitEthernet0/1 on VLA
N0001. Port consistency restored.
23:35:22: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking GigabitEthernet0/1 on VLA
N0002. Port consistency restored.
SwitchB:
SwitchB#conf t
SwitchB(config)#int g0/1
SwitchB(config-if)#switchport trunk native vlan 2
SwitchB(config-if)#
23:36:01: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking GigabitEthernet0/1 on VLA
N0002. Port consistency restored.
23:36:01: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking GigabitEthernet0/1 on VLA
N0001. Port consistency restored.
Final Trunk Status:
SwitchA:
SwitchA#sh int g0/1 trunk
Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 2
Port Vlans allowed on trunk
Gi0/1 1-4094
Port Vlans allowed and active in management domain
Gi0/1 1-2,10,20,30
Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1-2,10,20,30
SwitchB:
SwitchB#sh int g0/1 trunk
Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 2
Port Vlans allowed on trunk
Gi0/1 1-4094
Port Vlans allowed and active in management domain
Gi0/1 1-2,10,20,30
Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1-2,10,20,30
Analysis:
When you change the native end of the trunk’s native VLAN both switch will detect VLAN inconsistency (native VLAN mismatch) and put the interface on blocking state on both VLAN 1 and 2, I think other VLAN will continue forwarding data and will not be affected with the configuration. When you then move forward and configure the other end, then the switches detect that the native VLAN mach and consistent the switch then move and unblock the interface forward traffic.
SwitchB |----------------trunk---------------|SwitchA
Current Trunk Configuration:
SwitchA:
SwitchA#sh int g0/1 trunk
Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Gi0/1 1-4094
Port Vlans allowed and active in management domain
Gi0/1 1-2,10,20,30
Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1-2,10,20,30
SwitchB:
SwitchB#sh int g0/1 trun
Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Gi0/1 1-4094
Port Vlans allowed and active in management domain
Gi0/1 1-2,10,20,30
Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1-2,10,20,30
Change Native VLAN on SwitchA:
SwitchA:
SwitchA#conf t
Enter configuration commands, one per line. End with CNTL/Z.
SwitchA(config)#int g0/1
SwitchA(config-if)#switchport trunk native vlan 2
SwitchA(config-if)#
23:32:19: %SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan i
d 1 on GigabitEthernet0/1 VLAN2.
23:32:19: %SPANTREE-2-BLOCK_PVID_PEER: Blocking GigabitEthernet0/1 on VLAN0001.
Inconsistent peer vlan.
23:32:19: %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet0/1 on VLAN0002.
Inconsistent local vlan.
SwitchB:
SwitchB#
23:32:58: %SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan i
d 2 on GigabitEthernet0/1 VLAN1.
23:32:58: %SPANTREE-2-BLOCK_PVID_PEER: Blocking GigabitEthernet0/1 on VLAN0002.
Inconsistent peer vlan.
23:32:58: %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet0/1 on VLAN0001.
Inconsistent local vlan.
Change Native VLAN on SwitchB:
SwitchA:
23:35:22: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking GigabitEthernet0/1 on VLA
N0001. Port consistency restored.
23:35:22: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking GigabitEthernet0/1 on VLA
N0002. Port consistency restored.
SwitchB:
SwitchB#conf t
SwitchB(config)#int g0/1
SwitchB(config-if)#switchport trunk native vlan 2
SwitchB(config-if)#
23:36:01: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking GigabitEthernet0/1 on VLA
N0002. Port consistency restored.
23:36:01: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking GigabitEthernet0/1 on VLA
N0001. Port consistency restored.
Final Trunk Status:
SwitchA:
SwitchA#sh int g0/1 trunk
Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 2
Port Vlans allowed on trunk
Gi0/1 1-4094
Port Vlans allowed and active in management domain
Gi0/1 1-2,10,20,30
Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1-2,10,20,30
SwitchB:
SwitchB#sh int g0/1 trunk
Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 2
Port Vlans allowed on trunk
Gi0/1 1-4094
Port Vlans allowed and active in management domain
Gi0/1 1-2,10,20,30
Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1-2,10,20,30
Analysis:
When you change the native end of the trunk’s native VLAN both switch will detect VLAN inconsistency (native VLAN mismatch) and put the interface on blocking state on both VLAN 1 and 2, I think other VLAN will continue forwarding data and will not be affected with the configuration. When you then move forward and configure the other end, then the switches detect that the native VLAN mach and consistent the switch then move and unblock the interface forward traffic.
Subscribe to:
Posts (Atom)