Only normal-range VLANs (1-1005) can be configured and stored in a flash file called vlan.dat.
Switch#vlan databaseSwitch(vlan)#vlan 10 name ccieSwitch(vlan)#show current! proposed or difference Switch(vlan)#show proposedSwitch(vlan)#apply! reset or abort
Private VLANs
A private VLAN has a primary VLAN and one or more secondary VLANs.
The ports in the primary VLAN are promiscuous.
Secondary VLANs are community VLANs or isolated VLANs.
VLAN Trunking Protocol
VTP advertises the VLAN ID, VLAN name and VLAN media type (Ethernet, FDDI, Token Ring).
VTP Modes: Server (default mode), Client, Transparent and off (only in CatOS).
Originates VTP advertisements: server and client
Processes received advertisements to update its VLAN configuration: server and client
Forwards received VTP advertisements: server, client and transparent
Saves VLAN configuration in NVRAM or vlan.dat: server, client and transparent
Can create, modify or delete VLANs using configuration commands: server and transparent
VTP Process
VTP server needs a VTP domain name before to start sending VTP updates.
A VTP client without a VTP domain will assume the VTP domain in the first received VTP update.
VTP configuration is stored in vlan.dat (flash memory).
VTP updates are propagated throughout trunk ports.
If md5 is configured then the VTP advertisement carries the validation (hash) of the VTP update.
VTP Configuration
Server and client switches must match the same VTP version.
Transparent switches at version 2 forward version 1 (default version) or 2 VTP updates.
Pruning (disabled by default) prevents flooding on a per-VLAN basis. When pruning is enabled on a VTP server, pruning is enable for the entire VTP domain. VLANs 1, 1002-1005 and 1006-4094 (extended-range) are pruning-ineligible.
Normal-Range and extended-range VLANs
Normal-range VLANs (1-1005) can be configured in VLAN database mode with the details stored in vlan.dat (flash memory).
Extended-range VLANs (1006-4096) cannot be configured in VLAN database mode, nor stored in vlan.dat, nor advertised via VTP. In fact, to configure then, the switch must be in VTP transparent mode.
Storing VLAN configuration
Normal-range VLANs can be configured from VLAN database mode or configuration mode (server and transparent).
Extended-range VLANs can only be configured from configuration mode (transparent).
VTP and normal-range VLAN configuration are stored in vlan.dat (server and transparent) and NVRAM (transparent). If VTP mode or domain name in vlan.dat file and startup-config file differ, the switch uses only the vlan.dat file for VLAN configuration.
Extended-range VLAN configuration are only stored in NVRAM (transparent).
ISL and 802.1Q Concepts
Support normal and extended range (ISL, 802.1Q)
ISL is a protocol defined by Cisco. 802.1Q by IEEE.
ISL encapsulates the original frame. 802.1Q inserts a tag.
ISL does not support native VLAN but 802.1Q does.
ISL adds a new 26 byte header and a 4 byte trailer (new CRC).
This header uses the source address of the device doing the trunk and a multicast destination address (0100.0C00.0000 or 0300.0C00.0000).
802.1Q inserts a 4 byte tag (Etype and Tag), right after the source address, and a new calculated FCS.
With an 802.1Q tag, the first 2 bytes are a registered Ethernet type (0x8100) and the last 2 bytes contain the priority and VLAN-ID.
ISL and 802.1Q Configuration
Switches default to use the DTP desirable mode.
If both switches support both types of trunking, they negotiate to use ISL.
Allowed, Active and Pruned VLANs
Allowed VLANs are those allowed by using the
switchport trunk allowed command.Allowed and active are those VLANs configured on the switch.
Active and pruned are those with any VTP-pruned VLANs removed.
Trunk Configuration Compatibility
trunk =
switchport mode trunktrunk+DTP =
switchport mode trunk; switchport nonegotiatedesirable =
switchport mode dynamic desirableauto =
switchport mode dynamic autoaccess =
switchport mode accessaccess+DTP =
switchport mode access; switchport nonegotiatetrunk trunk+DTP desirable auto access access+DTP trunk trunk trunk fail fail fail fail trunk+DTP trunk trunk trunk trunk fail fail desirable fail trunk trunk trunk access access auto fail trunk trunk access access access access fail fail access access access access access+DTP fail fail access access access access
isl =
switchport trunk encapsulation isldot1q =
switchport trunk encapsulation dot1qnegotiate =
switchport trunk encapsulation negotiateisl dot1q negotiate isl isl fail isl dot1q fail dot1q dot1q negotiate isl dot1q isl->dot1q
Configuring Trunking on Routers
Routers and hosts do not support DTP.
ISL configuration:
Router(config)#interface fa0/1.1Router(config-if)#ip address 10.1.1.1 255.255.255.0Router(config-if)#encapsulation isl 11Router(config)#interface fa0/1.2Router(config-if)#ip address 10.1.2.1 255.255.255.0Router(config-if)#encapsulation isl 12
802.1Q configuration:
Router(config)#interface fa0/2Router(config-if)#description native_vlan_1Router(config-if)#ip address 10.2.0.1 255.255.255.0Router(config)#interface fa0/2.1Router(config-if)#ip address 10.2.1.1 255.255.255.0Router(config-if)#encapsulation dot1q 21! [native] Router(config)#interface fa0/2.2Router(config-if)#ip address 10.2.2.1 255.255.255.0Router(config-if)#encapsulation dot1q 22
802.1Q-in-Q Tunneling
SwitchSP1(config)#interface fa0/1SwitchSP1(config-if)#description to_SwitchCustomer1SwitchSP1(config-if)#switchport access vlan 10SwitchSP1(config-if)#switchport mode dot1q-tunnelSwitchSP1(config-if)#no l2protocol-tunnel cdp! enables cdp, stp and vtp SwitchSP1(config)#interface fa0/2SwitchSP1(config-if)#description to_SwitchCustomer2SwitchSP1(config-if)#switchport access vlan 20SwitchSP1(config-if)#switchport mode dot1q-tunnelSwitchSP1(config-if)#no l2protocol-tunnel cdp! enables cdp, stp and vtp SwitchSP1(config)#interface fa0/3SwitchSP1(config-if)#description to_SwitchSP2SwitchSP1(config-if)#switchport mode trunkSwitchSP1(config-if)#switchport trunk encapsulation dot1qSwitchSP2(config)#interface fa0/1SwitchSP2(config-if)#description to_SwitchCustomer1SwitchSP2(config-if)#switchport access vlan 10SwitchSP2(config-if)#switchport mode dot1q-tunnelSwitchSP2(config-if)#no l2protocol-tunnel cdp! enables cdp, stp and vtp SwitchSP2(config)#interface fa0/2SwitchSP2(config-if)#description to_SwitchCustomer2SwitchSP2(config-if)#switchport access vlan 20SwitchSP2(config-if)#switchport mode dot1q-tunnelSwitchSP2(config-if)#no l2protocol-tunnel cdp! enables cdp, stp and vtp SwitchSP2(config)#interface fa0/3SwitchSP2(config-if)#description to_SwitchSP1SwitchSP2(config-if)#switchport mode trunkSwitchSP2(config-if)#switchport trunk encapsulation dot1q
Configuring PPPoE
ISP(config)#ip local pool MyPool 10.0.0.2 10.0.0.254ISP(config)#bba-group pppoe MyGroupISP(config-bba-group)#virtual-template 1ISP(config-bba-group)#sessions per-mac limit 2ISP(config)#interface virtual-template 1ISP(config-if)#ip address 10.0.0.1 255.255.255.0ISP(config-if)#peer default ip address pool MyPoolISP(config-if)#ppp authentication chap callinISP(config)#interface f0/0ISP(config-if)#no ip addressISP(config-if)#pppoe enable group MyGroupISP(config-if)#no shutdownISP(config)#username CPE password MyPasswordCPE(config)#interface dialer1CPE(config-if)#dialer pool 1CPE(config-if)#dialer-group 1CPE(config-if)#encapsulation pppCPE(config-if)#ip address negotiatedCPE(config-if)#ppp chap password MyPasswordCPE(config-if)#mtu 1492CPE(config)#interface f0/0CPE(config-if)#no ip addressCPE(config-if)#pppoe enableCPE(config-if)#pppoe-client dial-pool-number 1CPE(config-if)#no shutdownCPE(config)#dialer-list 1 protocol ip permit