When do you use "passive-interface vlanX"

Answered Question
Aug 27th, 2008
User Badges:

Is this a command that is normally used? I see it on my two core switches but not on the core switches at my other two sites. I understand that it is used for an interface that does not participate in eigrp but its network is advertised. Is this command necessary only behind a ACL/firewall? If no firewall exists can this command be removed? Does this command cut down on the amount traffic on the switches?

Correct Answer by Jon Marshall about 8 years 9 months ago

The command can be used for a number of reasons but on core switches it is usually because you have a lot of vlan interfaces and if you do not make any of them passive then they all form eigrp neighborships between the core switches. So when you do a "sh ip eigrp neigh" you get a huge list with all the vlan interfaces. It also means each vlan interface will be exchanging keepalives etc.


So in order to cut down the neighborships and make it eaiser to troubleshoot often 2 vlans are used to peer and then all other vlan interfaces are made passive.


In this case it has nothing to do with firewalls. You can remove it and nothing disastrous will happen but unless it is causing you problems i would leave as is. Just make sure you are using at least 2 vlans for neighborships in case one of them accidentally gets shutdown.


Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Jon Marshall Wed, 08/27/2008 - 05:06
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

The command can be used for a number of reasons but on core switches it is usually because you have a lot of vlan interfaces and if you do not make any of them passive then they all form eigrp neighborships between the core switches. So when you do a "sh ip eigrp neigh" you get a huge list with all the vlan interfaces. It also means each vlan interface will be exchanging keepalives etc.


So in order to cut down the neighborships and make it eaiser to troubleshoot often 2 vlans are used to peer and then all other vlan interfaces are made passive.


In this case it has nothing to do with firewalls. You can remove it and nothing disastrous will happen but unless it is causing you problems i would leave as is. Just make sure you are using at least 2 vlans for neighborships in case one of them accidentally gets shutdown.


Jon

Actions

This Discussion