VLAN/STP Config

[danpwalker]

Hi,

Were running a network of 2550 switches and have come across the following configs for customer and trunk connections. These configs haven?t been uniformly rolled out across the network and we?ve also been experiencing issues whereby were having to clear tables and reset interfaces to bring back certain rings in the network.

interface FastEthernet0/1

description ** TRUNK TO NETWORK SWITCH **

switchport trunk allowed vlan 10,50,56,58,80,90,91,96,100-102,150,200,208,216

switchport trunk allowed vlan add 218,802,805,806,809

switchport trunk pruning vlan none

switchport mode trunk

storm-control broadcast level 0.30

storm-control action trap

spanning-tree cost 110

interface FastEthernet0/2

description **CUSTOMER CONNECTION**

switchport access vlan 10

switchport trunk native vlan 10

switchport trunk allowed vlan 10,56,806

switchport trunk pruning vlan none

switchport mode trunk

storm-control broadcast level 0.10

storm-control action trap

no cdp enable

interface Vlan1 shutdown

!

interface Vlan10 ip address x.x.x.x x.x.x.x

Questions are:

a) The trunk interface config ? the ?allowed VLAN? cmd is self explanatory but what are the real benefits? Obvioulsy this command isn?t scalable with a large number of VLANs and Id like to drop this config.

b) Does the ?allowed VLAN? cmd effect STP .. ie if a VLAN is allowed on a fwding trunk port but not configured on a blocked port , if the blocked port switches to fwding is this VLAN still allowed to traverse this trunk?

c) The customer connection port appears to make little sense. Its configured as an access port but has trunking cmds configured? Again, is there any benefit to this command?

d)

Im looking to tidy up the config to isolate the issues weve been experiencing. Any help would be much appreciated.

Many thanks.

[Jon Marshall]

Hi

a) By only allowing certain vlans on your trunks you are increasing you security within your switch environment. More importantly your are also restricting STP propogation as STP traffic is not sent down the trunk links for vlans that are not allowed.

b) See a.

c) It is a bit of a mess. What shows up when you run a "sh int trunk" command. Does the customer need a trunk link or are all the ports in vlan 10 only. Also who manages this switch. You may find that your management IP address is in a different vlan than vlan 10 and hence even tho all the customer ports are in vlan 10 only you still may need a trunk link.

HTH

Jon

[danpwalker]

Hi Jon,

The switch is managed by ourselves and VLAN 10 is required for our internal mgt. The connecting switch is the customers. Output below:

B2MP_2950_01# sh int fa0/12 trunk

Port Mode Encapsulation Status Native vlan

Fa0/12 on 802.1q trunking 10

Port Vlans allowed on trunk

Fa0/12 10,56,806

Port Vlans allowed and active in management domain

Fa0/12 10,56,806

Port Vlans in spanning tree forwarding state and not pruned

Fa0/12 10,56,806

Youre right .. its a mess! :)

[Jon Marshall · Accepted solution]

Hi

Then yes, the connection needs to be configured as a trunk and i can't see why you need the switchport access vlan 10 part of the configuration.

Also, just for reference it is suggested as best practice that your native vlan should be a completely unused vlan that is non-routable. On our data centre switches we use vlan 2 for management which is obviously routable and then we use vlan 999 as the native vlan. No switchports are placed into this vlan and there is no layer 3 SVI for vlan 999.

Jon

[danpwalker]

Thanks Jon for such a thorough and informed explanation.