Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Dedicated VLAN ID's on trunk ports

I was reading the SAFE:Security Blueprint for Enterprise Networks. This document addresses in its "Switches are targets" section on Page 6 that "Always use a dedicated VLAN ID for all trunk ports"...

I am trying to understand this concept fully.

If I consider my trunk ports, most are physical fiber "links" that interconnect the switches. Some trunk links connect Distribution L to Access L; some Distribution to Core.

Where do I put the VLAN ID on thes?? Should I translate this to mean that on Gig0/0 on SW.1 i place this interface in VLAN 23 and on the switch on the other end of the link I also place the Gig0/0 in VLAN 23 as well??

Also I am not sure why this helps secure the switch. Can someone pls assist. I am grateful.

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Dedicated VLAN ID's on trunk ports

I am not exactly sure what they mean by a dedicated vlan ID for a trunk port.I really dont think, it means dividing the trunk port into subinterfaces and putting them in individual vlans. That would kill the purpose of a trunk port.

On trunk ports you generally leave all vlans to be trunked. If you have three vlans (say) in your network you dont need all 1000+ vlans to be trunked between switches. Instead trunk only the required vlans say 10,20,30 and deny all other vlans if they dont exist in your network. This will prevent somebody to propagate traffic from a rogue vlan into the rest of the network.

3 REPLIES

Re: Dedicated VLAN ID's on trunk ports

I am not exactly sure what they mean by a dedicated vlan ID for a trunk port.I really dont think, it means dividing the trunk port into subinterfaces and putting them in individual vlans. That would kill the purpose of a trunk port.

On trunk ports you generally leave all vlans to be trunked. If you have three vlans (say) in your network you dont need all 1000+ vlans to be trunked between switches. Instead trunk only the required vlans say 10,20,30 and deny all other vlans if they dont exist in your network. This will prevent somebody to propagate traffic from a rogue vlan into the rest of the network.

New Member

Re: Dedicated VLAN ID's on trunk ports

Yeah, that's it!! What a great answer... I even remember it now. From BCSN.. VLAN pruning... Well I gotta get to work. This will be fun.

It is an interesting statement from the SAFE Blueprint. If anything I will know the answer for the SAFE exam.

Thanks Shanky

Re: Dedicated VLAN ID's on trunk ports

Hi,

This is not actually the VLAN pruning.This is just specifically allowing some vlans on the trunk ports and removing other unwanted vlans.

Prunning works in a diff way and it will save the bandwidth on the trunk links by prunning the unwanted broadcast on the trunks for a particular vlan if no host is active on that vlan on a particular switch. I.e If you dont have any active host on a vlan on a particular switch and if there is a broadcast on that vlan which will come over the trunk so if no host is active that broadcast is prunned on the trunk where no host is active on the switch.

HTH,

-amit singh

1142
Views
0
Helpful
3
Replies
CreatePlease to create content