Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Vlan 1 question

We have recently migrated our management vlan off vlan 1, to a new dedicated vlan. Our network consists of 2 6500 at the core, and the rest 3560, snd 3548 all running L2. Some of the switches have vlan 1 admin down, and some admin up, is it necessary to still have vlan 1 up or down on all switches?

Thanks.

  • LAN Switching and Routing
1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Silver

Re: Vlan 1 question

Hello David,

L2 only devices like a 2950 can have only one active vlan so on those platforms you will see only the new management vlan SVI up/up and the SVI for Vlan1 will be admin down.

Some switches that actually have some L3 capabilities can have both SVI up/up.

My suggestion is to shut down the SVI of Vlan1 manually on devices that have it still up/up.

The main reason for moving away from vlan1 as management vlan are security reasons: leaving an alive L3 interface in vlan1 would expose the switches to some threats as it was before the migration.

Hope to help

Giuseppe

1 REPLY
Hall of Fame Super Silver

Re: Vlan 1 question

Hello David,

L2 only devices like a 2950 can have only one active vlan so on those platforms you will see only the new management vlan SVI up/up and the SVI for Vlan1 will be admin down.

Some switches that actually have some L3 capabilities can have both SVI up/up.

My suggestion is to shut down the SVI of Vlan1 manually on devices that have it still up/up.

The main reason for moving away from vlan1 as management vlan are security reasons: leaving an alive L3 interface in vlan1 would expose the switches to some threats as it was before the migration.

Hope to help

Giuseppe

117
Views
0
Helpful
1
Replies
This widget could not be displayed.