Octet

Hosts in one VLAN cannot reach each other across a trunk, but other VLANs work. What do you check?

Show the answer

Say this first

I walk that VLAN through every filter on both ends of the link: is the link really trunking, does the VLAN exist and is it active on both switches, is it in the allowed list on both sides, is it pruned, is spanning tree blocking it on that port only, and do the native VLANs match. Most often the VLAN is missing on one switch or an allowed list was edited without add.

Go deeper

Order of checks

  1. show interfaces trunk on both ends. Status trunking, and the VLAN present in all four sections.
  2. show vlan id 30 on both switches. The VLAN must exist and be active. act/lshut means someone typed shutdown under vlan 30; sus means suspended.
  3. VTP: a client that never received the VLAN, or a transparent switch where nobody created it.
  4. show spanning-tree vlan 30. Is this port blocking for this VLAN alone? Look for *ROOT_Inc, *LOOP_Inc or *PVID_Inc in the type column.
  5. Native VLAN mismatch: CDP logs %CDP-4-NATIVE_VLAN_MISMATCH, and untagged traffic lands in the wrong VLAN.
  6. If the far end is not a switch: the port group VLAN on the hypervisor, the subinterface on the firewall or router.
  7. show mac address-table vlan 30 on each switch. Do the hosts' MACs appear on the trunk port at the far end?

Each step tells you which side to look at next, so you never change anything blind.

Traps

  • Checking only one end. The allowed list and the VLAN database are per switch, and either side can drop the VLAN.
How did you do?