Build VLANs and a hardened trunk between two switches, then verify with LLDP

Cisco IOSCore

Create the same VLAN plan on SW1 and SW2, lock every edge port to access mode, and join the switches with a static 802.1Q trunk that carries only the user VLANs, uses an unused native VLAN and never negotiates. Use LLDP to prove the cabling matches the plan.

Same port plan on both switches:

VLAN	Name	Ports
10	USERS	Gi1/0/1 to 12
20	SALES	Gi1/0/13 to 20
30	PRINTERS	Gi1/0/21 to 24
998	PARKING	Gi1/0/25 to 47, shut down
999	NATIVE-UNUSED	none, native VLAN on the trunk only

Policy: neither switch may change the other's VLANs, and discovery protocols run only on the trunk.

Tasks

Put both switches in VTP transparent mode and create the five VLANs with names.
Configure user and printer ports as static access ports with PortFast and no DTP.
Park unused ports in VLAN 998 and shut them down.
Make Gi1/0/48 a static trunk with no DTP, native VLAN 999, the native VLAN tagged, and only VLANs 10, 20 and 30 allowed.
Enable LLDP, keep CDP and LLDP off the edge ports, and confirm the neighbor on Gi1/0/48.

Solution

1VTP mode and VLANsSW1
SW1 on Cisco IOS
```
vtp mode transparent
vlan 10
 name USERS
vlan 20
 name SALES
vlan 30
 name PRINTERS
vlan 998
 name PARKING
vlan 999
 name NATIVE-UNUSED
```
Identical on SW2. In transparent mode the VLANs are part of the running config, so copy running-config startup-config saves them.

2Edge portsSW1

SW1 on Cisco IOS

interface range GigabitEthernet1/0/1 - 12
 switchport mode access
 switchport access vlan 10
 switchport nonegotiate
 spanning-tree portfast
interface range GigabitEthernet1/0/13 - 20
 switchport mode access
 switchport access vlan 20
 switchport nonegotiate
 spanning-tree portfast
interface range GigabitEthernet1/0/21 - 24
 switchport mode access
 switchport access vlan 30
 switchport nonegotiate
 spanning-tree portfast
interface range GigabitEthernet1/0/25 - 47
 description unused
 switchport mode access
 switchport access vlan 998
 shutdown

Identical on SW2.

3Static trunkSW1

SW1 on Cisco IOS

vlan dot1q tag native
!
interface GigabitEthernet1/0/48
 description Trunk to SW2 Gi1/0/48
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30

Mirror it on SW2 with the description pointing back at SW1. Both ends must agree on the native VLAN, or CDP logs a mismatch and spanning tree blocks the port.

4Discovery on the trunk onlySW1
SW1 on Cisco IOS
```
lldp run
interface range GigabitEthernet1/0/1 - 47
 no cdp enable
 no lldp transmit
 no lldp receive
```
Identical on SW2. LLDP is off by default on Cisco IOS, so lldp run is required; CDP stays on for Gi1/0/48.

Verify

SW1 output

SW1# show vlan brief | include USERS|SALES|PRINTERS|PARKING|NATIVE
10   USERS                            active    Gi1/0/1, Gi1/0/2, Gi1/0/3, Gi1/0/4
20   SALES                            active    Gi1/0/13, Gi1/0/14, Gi1/0/15, Gi1/0/16
30   PRINTERS                         active    Gi1/0/21, Gi1/0/22, Gi1/0/23, Gi1/0/24
998  PARKING                          active    Gi1/0/25, Gi1/0/26, Gi1/0/27, Gi1/0/28
999  NATIVE-UNUSED                    active

All five VLANs exist and are active. The filter shows only the first line of each port list. VLAN 999 has no ports, and the trunk never appears in this list.

SW1 output

SW1# show interfaces GigabitEthernet1/0/48 switchport | include Operational Mode|Negotiation|Trunking Native
Operational Mode: trunk
Negotiation of Trunking: Off
Trunking Native Mode VLAN: 999 (NATIVE-UNUSED)

A trunk with DTP off and the unused native VLAN.

SW1 output

SW1# show interfaces trunk | begin Vlans allowed on
Port        Vlans allowed on trunk
Gi1/0/48    10,20,30

Port        Vlans allowed and active in management domain
Gi1/0/48    10,20,30

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/48    10,20,30

Only the three user VLANs, present in all three lists.

SW1 output

SW1# show lldp neighbors detail | include Local Intf|Port id|System Name
Local Intf: Gi1/0/48
Port id: Gi1/0/48
System Name: SW2

SW1's Gi1/0/48 reaches SW2's Gi1/0/48, as the cabling plan says. No neighbors appear on edge ports.

PC1 output

PC1# ping 10.10.0.12
Reply from 10.10.0.12: bytes=32 time<1ms TTL=128

TTL 128 is the Windows default, untouched. The packet was switched across the trunk in VLAN 10, not routed.

Mistakes people make

Editing the trunk later with switchport trunk allowed vlan 40, which replaces the list. Use add.
Setting nonegotiate on one end while the other stays dynamic. The dynamic side hears no DTP and stays an access port.
Different native VLANs on the two ends. Untagged frames leak between VLANs and spanning tree blocks the port.
Leaving VTP in its default server mode with an empty domain. The first VTP advertisement the switch hears sets its domain.
Disabling CDP and LLDP on phone ports. Phones use them to learn the voice VLAN.

On other platforms

The SW2 side on Arista EOS. Ports default to access mode, there is no DTP, and LLDP runs by default.

Arista EOS

vlan 10
   name USERS
vlan 20
   name SALES
vlan 30
   name PRINTERS
vlan 999
   name NATIVE-UNUSED
!
interface Ethernet1
   switchport access vlan 10
!
interface Ethernet48
   description Trunk to SW1 Gi1/0/48
   switchport mode trunk
   switchport trunk native vlan 999
   switchport trunk allowed vlan 10,20,30

Say it in the interview

"Same VLAN plan on both switches with VTP transparent so neither can overwrite the other. Every edge port is static access with nonegotiate and PortFast, unused ports are shut in a parking VLAN, and the trunk is static with DTP off, an unused native VLAN that is tagged anyway, and an explicit allowed list. Then I check the four trunk lists and use LLDP to prove the right ports are cabled together."

Book 3.2 Switched Ethernet