Switching and VLANs

The four actions

• Learn. Source MAC plus VLAN maps to the ingress port. If the same MAC shows up on another port, the entry moves.
• Forward. Destination known and on another port: send it out that one port.
• Filter. Destination known and on the same port it arrived on: drop it. You only see this behind a hub or another unmanaged switch.
• Flood. Unknown unicast, broadcast, and multicast the switch has no snooping state for: send to every port in the VLAN, trunks included, except the ingress port.

Aging

The default is 300 seconds on Cisco IOS (mac address-table aging-time). Every frame from that MAC resets the timer. Topology changes flush or shorten it, which is why a busy spanning tree causes flooding.

Looking at it

SW1# show mac address-table dynamic vlan 10
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    0050.56a1.0101    DYNAMIC     Gi1/0/1
  10    0050.56a1.0202    DYNAMIC     Gi1/0/48
Total Mac Addresses for this criterion: 2

The table is keyed on VLAN plus MAC, so the same MAC can live in two VLANs at once.

The latency math

A store-and-forward switch must receive the full frame before sending. A 1500-byte frame at 1 Gbps takes 1500 x 8 / 10^9 = 12 microseconds to arrive; at 10 Gbps it takes 1.2 microseconds. That cost is paid at every hop. For a campus user it is noise; for trading, HPC and some storage it matters.

When cut-through falls back

• The egress port is busy, so the frame has to be queued anyway.
• The egress port is faster than the ingress port (10G in, 40G out). Starting early would run out of data mid-frame, so the switch buffers the whole frame first.

Error behavior

A cut-through switch has already sent most of a frame when it sees a bad FCS. It cannot drop it, so it ends the frame with a deliberately invalid FCS (Nexus calls this stomping). The bad frame is then counted as a CRC error on every hop downstream, and you have to trace it back to the port where it starts.

Fragment-free

A historic middle ground: wait for the first 64 bytes, which covers a collision fragment on half-duplex Ethernet, then cut through.

Field by field

After every frame there is a 12-byte interframe gap. So a 64-byte frame really occupies 84 bytes of wire time, which is why 1 Gbps line rate is 1,488,095 frames per second at minimum size.

EtherTypes worth knowing

0x0800 IPv4, 0x86DD IPv6, 0x0806 ARP, 0x8100 802.1Q, 0x88A8 802.1ad outer tag, 0x8847 MPLS, 0x88CC LLDP, 0x8809 slow protocols (LACP).

Address bits

The lowest bit of the first byte is the I/G bit: 1 means group (multicast or broadcast). The next bit is U/L: 1 means locally administered. ffff.ffff.ffff is broadcast; IPv4 multicast maps to 0100.5exx.xxxx and IPv6 multicast to 3333.xxxx.xxxx.

Setup: PC1 10.10.0.11 (0050.56a1.0011) on SW1 Gi1/0/1, PC2 10.10.0.12 (0050.56a1.0012) on SW2 Gi1/0/2, trunk on Gi1/0/48 at both ends.

1. PC1 ANDs 10.10.0.12 with its /24 mask: same subnet, so deliver directly. Its ARP cache has no entry for PC2.
2. PC1 sends an ARP request: destination ffff.ffff.ffff, source 0050.56a1.0011.
3. SW1 learns 0050.56a1.0011 on Gi1/0/1 in VLAN 10 and floods the broadcast to its other VLAN 10 ports and out Gi1/0/48 with an 802.1Q tag, VLAN ID 10.
4. SW2 learns PC1's MAC on Gi1/0/48 in VLAN 10, strips the tag and floods to its VLAN 10 access ports.
5. PC2 recognizes its IP and replies with a unicast ARP reply to 0050.56a1.0011.
6. SW2 learns PC2 on Gi1/0/2, already knows PC1 is behind Gi1/0/48, and sends the reply tagged. SW1 learns PC2 on Gi1/0/48 and forwards to Gi1/0/1.
7. PC1 caches the ARP entry and sends the ICMP echo request as unicast. Both switches forward it without flooding, and the reply comes back the same way.

Each switch recomputes the FCS when it adds or removes the tag, because the frame contents change.

Find the reason

SW1# show interfaces status err-disabled

Port         Name               Status       Reason               Err-disabled Vlans
Gi1/0/5      Desk 3.12          err-disabled bpduguard

The log line at the moment it happened is just as useful:

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port Gi1/0/5 with BPDU Guard enabled. Disabling port.
%PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/5, putting Gi1/0/5 in err-disable state

Common reasons

Automatic recovery

errdisable recovery cause bpduguard
errdisable recovery cause psecure-violation
errdisable recovery interval 300

show errdisable recovery lists enabled causes and the time left per port.

Side by side

LLDP has four mandatory TLVs (chassis ID, port ID, TTL, end) and optional ones such as system name, port description, capabilities and management address. CDPv2 also carries native VLAN and duplex, and logs %CDP-4-NATIVE_VLAN_MISMATCH and %CDP-4-DUPLEX_MISMATCH when neighbors disagree.

Defaults elsewhere

NX-OS runs CDP by default and needs feature lldp. Arista EOS and Junos on EX switches run LLDP by default.

Configuration

lldp run
interface GigabitEthernet1/0/1
 no cdp enable

SW1# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,
                  D - Remote, C - CVTA, M - Two-port Mac Relay

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
SW2              Gig 1/0/48        157              S I   C9300-48P Gig 1/0/48

What you get

• Smaller broadcast domains. ARP, DHCP and other broadcasts stay inside the VLAN.
• A policy point. Traffic between VLANs has to cross a router, layer 3 switch or firewall, which is where ACLs and inspection happen.
• Per-group treatment. Voice gets its own VLAN and QoS; guests get a VLAN that only reaches the internet.
• Flexibility. Two people on different floors can share a VLAN, two people at adjacent desks can be in different ones.

Conventions

One VLAN maps to one IP subnet. Hosts decide "local or via the gateway" by subnet, so mixing subnets in a VLAN or splitting one subnet across VLANs causes confusing failures.

The cost

A VLAN stretched across a whole campus is one large failure domain: a loop or broadcast storm in it reaches every switch. Modern campus designs keep VLANs inside one access block and route above it.

The vlan.dat trap

write erase clears the startup config but not vlan.dat. A switch "reset to defaults" still boots with its old VLANs, VTP domain and revision number. To really clear it:

SW1# write erase
SW1# delete flash:vlan.dat
SW1# reload

In the running config or not

In VTP server or client mode, show running-config does not list VLANs; back up vlan.dat or use show vlan brief. In transparent or off mode, VLANs appear in the running config and are saved with it.

Configuration

interface GigabitEthernet1/0/1
 description PC
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
!
interface GigabitEthernet1/0/48
 description Uplink to DSW1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 999
 switchport nonegotiate

Checking what a port really is

SW1# show interfaces GigabitEthernet1/0/1 switchport
Name: Gi1/0/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 10 (USERS)
Trunking Native Mode VLAN: 1 (default)

Administrative mode is what you configured; operational mode is what it actually became. A port in dynamic mode can show "dynamic auto" and "trunk" at the same time.

Who needs a trunk

A hypervisor host with VMs in several VLANs, a firewall with one subinterface per VLAN, an AP that switches several SSIDs locally to their VLANs. An AP that tunnels all client traffic to a controller only needs an access port.

| Dest MAC 6 | Src MAC 6 | TPID 0x8100 (2) | PCP 3b | DEI 1b | VID 12b | EtherType 2 | Payload | FCS 4 |

The fields in practice

• PCP / CoS. Layer 2 priority. Voice media is usually CoS 5, call signaling CoS 3. It only exists while the frame is tagged, which is why QoS designs carry the marking in DSCP at layer 3 as well.
• DEI. Marks a frame as a candidate to drop first under congestion. Rarely used in enterprise.
• VID. 0 means priority-tagged (a CoS value with no VLAN; the port's VLAN applies). 4095 is reserved.

ISL, for history

Cisco's older trunking protocol encapsulated the whole frame with a 26-byte header and a 4-byte CRC, 30 bytes in all. It is proprietary and gone from current platforms; Catalyst 9000 supports only 802.1Q.

Result for each pair

"Mismatch" means one side tags frames and the other does not: only untagged traffic works, and STP may flag inconsistencies. A side set to trunk with nonegotiate against a dynamic side gives the same mismatch, because the dynamic side never hears DTP.

Details interviewers like

• Dynamic trunking fails when the two switches have different VTP domain names; the switch logs %DTP-5-DOMAINMISMATCH.
• In show interfaces trunk, an encapsulation of n-802.1q means the trunk was negotiated.
• Older platforms such as the Catalyst 2950 and 3550 defaulted to dynamic desirable.
• NX-OS and most other vendors do not run DTP. Against them, set the Cisco side to trunk.

SW1# show interfaces GigabitEthernet1/0/24 switchport | include Administrative Mode|Operational Mode
Administrative Mode: dynamic auto
Operational Mode: static access

Modes

In server and client mode the VLANs are not in the running config. In transparent and off mode they are, and they are saved with it.

Versions

• v1: the original.
• v2: adds consistency checks, and a transparent switch relays advertisements without checking the domain name.
• v3: adds a primary server, extended VLANs, private VLANs, MST region sync and a hidden password.

Mechanics

Advertisements go to 0100.0ccc.cccc on trunks only: a summary every 5 minutes and right after every change. Every change on a server raises the configuration revision number. VTP pruning, if enabled, stops flooding a VLAN over a trunk toward switches with no ports in it.

Many networks run every switch transparent or off and push VLANs with automation instead.

Side by side

Configurations

! Router-on-a-stick
interface GigabitEthernet0/0/0.10
 encapsulation dot1Q 10
 ip address 10.10.0.1 255.255.255.0

! Layer 3 switch
ip routing
interface Vlan10
 ip address 10.10.0.1 255.255.255.0

The hairpin

A packet from VLAN 10 to VLAN 20 goes up the trunk tagged 10 and comes back down tagged 20. The trunk carries all inter-VLAN traffic plus everything headed to the WAN, so it saturates early.

Mode combinations

Why not static

on cannot see the far end. If the neighbor is not bundled or is cabled to the wrong switch, on still bundles, and you get MAC flapping, blackholed traffic or a loop. LACP only bundles a port after exchanging LACPDUs with the same partner.

LACP basics

LACPDUs go to 0180.c200.0002 (EtherType 0x8809), every 30 seconds by default or every second with fast rate. Up to 8 members are active; many platforms allow up to 8 more as hot-standby.

interface range GigabitEthernet1/0/47 - 48
 switchport mode trunk
 channel-group 1 mode active
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

Configuration

vlan 10
 name DATA
vlan 110
 name VOICE
!
interface GigabitEthernet1/0/5
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 110
 spanning-tree portfast
 trust device cisco-phone

trust device cisco-phone (Catalyst 9000 syntax; older switches use mls qos trust device cisco-phone) trusts markings only while CDP sees a Cisco phone on the port.

Verify

SW1# show interfaces GigabitEthernet1/0/5 switchport | include Access Mode|Voice
Access Mode VLAN: 10 (DATA)
Voice VLAN: 110 (VOICE)

show cdp neighbors shows the phone with capability P.

Non-Cisco phones

They read the voice VLAN from the LLDP-MED network policy TLV. Enable lldp run, and on some platforms define a network-policy profile that names the voice VLAN and apply it to the port.

With 802.1X

Multi-domain authentication (MDA) authenticates the phone into the voice domain and the PC into the data domain on the same port.

The classic case: asymmetric routing

DSW1 and DSW2 both have an SVI in VLAN 10. Traffic to server SRV1 leaves through DSW1, but SRV1 replies through its HSRP gateway on DSW2. DSW1 never sees a frame sourced by SRV1, so its MAC entry expires after 300 seconds. Its ARP entry is still valid for hours, so DSW1 keeps routing packets to SRV1's MAC, misses in the MAC table, and floods every one of them to all of VLAN 10.

Fixes, in order of preference:

• Make routing symmetric (align HSRP active with the routing path).
• Make MAC aging at least as long as the ARP timeout, or shorten ARP on the SVI below 300 seconds (arp timeout 240 under interface Vlan10).

Other causes

• Topology changes. 802.1D shortens aging to 15 seconds after a TCN; RSTP flushes at once. Access ports without PortFast create a topology change every time a PC boots.
• Full MAC table, from an attack or simply too many VMs for the platform.
• Silent receivers, such as a syslog collector that never transmits.
• Microsoft NLB in unicast mode, which floods by design.

How to spot it

Look for output traffic on access ports whose hosts are idle, or capture on a quiet port and look for unicast frames to other MACs.

Why the mask matters

An ACL entry permit tcp 10.10.0.0 0.0.0.255 any eq 443 becomes a TCAM row where the first 24 bits of the source must match and the last 8 are don't-care, alongside protocol and port fields. A packet is compared against every row at once and the first matching row (highest priority) wins. A route lookup works the same way, with longer prefixes placed first.

Carving up TCAM

Catalyst switches divide TCAM with SDM templates: more space for routes, or for ACLs, or for IPv6. show sdm prefer shows the current split, and changing it needs a reload. Nexus uses TCAM carving commands for the same idea.

When it runs out

The switch logs a resource error. Routes or ACL entries that do not fit are either not installed or handled by the CPU in software, which is many times slower and can push the CPU to 100%. Symptoms look random: some prefixes are slow, some ACL lines do not work.

Layer 2 MTU and IP MTU

• Layer 2 MTU: largest frame payload a switch port accepts and forwards.
• IP MTU: largest IP packet a routed interface sends without fragmenting. A layer 3 switch has both: a switching MTU and an ip mtu on each SVI or routed port.
• Only a router can fragment or send ICMP "fragmentation needed". A switch just drops.

Syntax differs a lot by platform

What breaks

• Ping works, SSH works, file copies or iSCSI stall: the handshake is small, the data is not.
• VXLAN adds 50 bytes over IPv4, so the underlay needs at least 1550 for 1500-byte guest frames.
• On routed links an IP MTU mismatch also blocks OSPF adjacencies in EXSTART.

Test it properly

SW1# ping 10.0.0.2 size 9000 df-bit

ping -M do -s 8972 10.0.0.2

8972 = 9000 minus 20 (IP header) minus 8 (ICMP header).

%SW_MATM-4-MACFLAP_NOTIF: Host 0050.56a1.2c3d in vlan 10 is flapping between port Gi1/0/12 and port Gi1/0/47

Read the pattern

• Many MACs, between an uplink and some access port, high CPU, line-rate broadcast: a loop. Contain it first by shutting the access port, then find out why STP did not block.
• One or two MACs, between two ports cabled to the same server: NIC teaming or Linux bonding in a mode that needs a port-channel (balance-rr, balance-xor, 802.3ad) against plain access ports. Fix it with LACP on both sides or switch to active-backup.
• MACs moving between the members of what should be a bundle: the far side is not bundled.
• The HSRP virtual MAC flapping between two uplinks: both routers think they are active, usually because their hellos do not reach each other.

Tools

show mac address-table address 0050.56a1.2c3d shows where it is now. Follow the MAC hop by hop toward the port where it really lives, and look at show spanning-tree and interface rates along the way.

How a Catalyst stack behaves

• Members are numbered, and the number is in the interface name: Gi2/0/1 is port 1 on member 2. A Catalyst 9300 stack holds up to 8 members.
• Roles are active, standby and member. At stack formation the highest stack priority wins (1 to 15, default 1), with the lowest MAC as the final tie breaker. A running active is not pre-empted when you add a higher-priority switch.
• Active and standby run SSO. Every member forwards in hardware locally, so traffic between two ports on the same member never crosses the stack ring.
• Cross-stack EtherChannel: one uplink from each of two members, so losing a member keeps the uplink.

Tradeoffs to say out loud

StackWise Virtual on Catalyst 9000 joins two switches over ordinary Ethernet links into one control plane, the modern form of VSS.

Switch spoofing

Tools such as Yersinia send DTP desirable frames. If the access port is dynamic auto or desirable, it becomes a trunk. The attacker then tags frames with any VLAN ID and sees broadcast and flooded traffic from all allowed VLANs.

Double tagging

1. The attacker is in VLAN 1, which is also the native VLAN on the uplink trunk.
2. They send a frame with an outer tag of 1 and an inner tag of 20.
3. SW1 accepts the frame into VLAN 1 and consumes the outer tag. VLAN 1 is native on the trunk, so SW1 sends the frame out without adding a tag, which leaves the inner tag 20 as the first tag on the wire.
4. SW2 reads tag 20 and delivers the frame into VLAN 20.

It is one way only: replies go back with a single tag and never reach the attacker's VLAN. It is still enough for a crafted UDP attack.

Hardening

interface range GigabitEthernet1/0/1 - 44
 switchport mode access
 switchport nonegotiate
 switchport access vlan 10
interface range GigabitEthernet1/0/45 - 46
 description unused
 switchport mode access
 switchport access vlan 998
 shutdown
interface GigabitEthernet1/0/48
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30
!
vlan dot1q tag native

VLAN 999 has no access ports; VLAN 998 is a parking lot for unused ports.

How it unfolds

1. A switch comes back from the lab or an RMA. It still has domain CORP, the same password, and revision 41 from months of lab changes. Production is at revision 12.
2. Someone plugs it into a free port. Both sides are dynamic, so DTP forms a trunk on its own.
3. The lab switch advertises revision 41. Every switch in CORP accepts it and replaces its VLAN list.
4. VLANs that only existed in production vanish. Access ports in them show as inactive, SVIs go down, trunks stop carrying them. The whole site loses those VLANs at once.

Check before connecting

SW9# show vtp status | include Mode|Domain|Revision
VTP Domain Name                 : CORP
VTP Pruning Mode                : Disabled
VTP Operating Mode                : Server
Configuration Revision            : 41

Reset the revision to 0

Change the domain to a dummy name and back, or switch to transparent and back:

SW9(config)# vtp mode transparent
SW9(config)# vtp mode client

Recovery if it already happened

Disconnect the culprit first. Recreate the missing VLANs on a real server; the revision rises again and every switch learns them back. Ports return as soon as their VLAN exists. Keep VLAN lists in backups or a source of truth so you can rebuild names quickly.

Prevention

Transparent or off mode everywhere, or VTPv3 with a primary server, plus switchport mode access and nonegotiate so a stray switch cannot form a trunk in the first place.

SW1# show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi1/0/48    on               802.1q         trunking      999

Port        Vlans allowed on trunk
Gi1/0/48    10,20,30,40

Port        Vlans allowed and active in management domain
Gi1/0/48    10,20,30

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/48    10,20

• VLAN 40 is allowed but does not exist in SW1's VLAN database, so it drops out of the second list.
• VLAN 30 exists but is either blocked by spanning tree on this port or pruned. show spanning-tree vlan 30 tells you which: an Altn BLK role on Gi1/0/48 means STP.

Editing the allowed list safely

interface GigabitEthernet1/0/48
 switchport trunk allowed vlan add 50
 switchport trunk allowed vlan remove 40

Without add or remove, the command replaces the whole list.

VTP pruning

Enabled domain-wide with vtp pruning on a server. VLAN 1 and 1002 to 1005 are never pruned. switchport trunk pruning vlan limits which VLANs are eligible on a trunk.

Order of checks

1. show interfaces trunk on both ends. Status trunking, and the VLAN present in all four sections.
2. show vlan id 30 on both switches. The VLAN must exist and be active. act/lshut means someone typed shutdown under vlan 30; sus means suspended.
3. VTP: a client that never received the VLAN, or a transparent switch where nobody created it.
4. show spanning-tree vlan 30. Is this port blocking for this VLAN alone? Look for *ROOT_Inc, *LOOP_Inc or *PVID_Inc in the type column.
5. Native VLAN mismatch: CDP logs %CDP-4-NATIVE_VLAN_MISMATCH, and untagged traffic lands in the wrong VLAN.
6. If the far end is not a switch: the port group VLAN on the hypervisor, the subinterface on the firewall or router.
7. show mac address-table vlan 30 on each switch. Do the hosts' MACs appear on the trunk port at the far end?

Each step tells you which side to look at next, so you never change anything blind.

Configuration

interface Vlan10
 description Users gateway
 ip address 10.10.0.1 255.255.255.0
!
interface GigabitEthernet1/0/48
 description Routed uplink to CORE1
 no switchport
 ip address 10.0.0.1 255.255.255.254

Why routed uplinks converge faster

• An SVI stays up while any port in its VLAN is up and forwarding. If an uplink in a "transit VLAN" fails but another port in that VLAN is up, the SVI never goes down and the routing protocol waits for its dead timer.
• A routed port goes down with the link. OSPF or EIGRP drop the neighbor and reroute immediately.
• No spanning tree runs on a routed port, so there is no blocked link and no loop risk between the layer 3 switches.

Where SVIs still belong between switches

A layer 2 trunk between two distribution switches that share VLANs (for HSRP and for stretched access VLANs) still needs SVIs on both. The routed uplinks go north to the core.

DSW1# show ip interface brief | include Vlan
Vlan10                 10.10.0.2       YES NVRAM  up                    up
Vlan30                 10.30.0.2       YES NVRAM  up                    down

Checklist for a down SVI

1. Does the VLAN exist? show vlan id 30. On IOS, creating interface Vlan30 does not create VLAN 30.
2. Is any access port in VLAN 30 up? show interfaces status vlan 30.
3. Is VLAN 30 allowed, active and forwarding on some trunk? show interfaces trunk.
4. Is spanning tree blocking every port in VLAN 30 on this switch?
5. Is the SVI itself shut? That shows administratively down instead.

Excluding ports from the calculation

switchport autostate exclude on a port stops it from counting, for example a SPAN destination or a monitoring port that should not keep a VLAN's SVI alive. NX-OS can turn autostate off per SVI with no autostate.

The line is blurring. Campus switches now do VXLAN and some MPLS, data center switches hold large tables, and routers carry switch modules. The useful question is: what must this box do, at what scale, with which features in the forwarding path?

What a suspended member looks like

ASW2# show etherchannel summary | begin Group
Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         LACP      Gi1/0/47(P)     Gi1/0/48(s)

%EC-5-CANNOT_BUNDLE2: Gi1/0/48 is not compatible with Gi1/0/47 and will be suspended (vlan mask is different)

Someone added a VLAN on Gi1/0/48 directly instead of on Po1.

Flags worth knowing

P bundled, s suspended, I stand-alone, H hot-standby, D down. On the port-channel, SU is layer 2 and in use, RU layer 3 and in use, SD layer 2 and down.

Partner checks

LACP also checks that every member reaches the same partner system ID. A member cabled to a different switch cannot join the bundle. On Catalyst 9000, a member whose far end does not run LACP logs %ETC-5-L3DONTBNDL2: Gi1/0/47 suspended: LACP currently not enabled on the remote port.

Changing a live bundle

interface Port-channel1
 switchport trunk allowed vlan add 40

Done on the port-channel, the change reaches both members at once and nothing gets suspended.

Choosing inputs

Defaults vary by platform, and many Catalyst switches default to a MAC-based method, so check and change it.

DSW1(config)# port-channel load-balance src-dst-ip

DSW1# show etherchannel load-balance
EtherChannel Load-Balancing Configuration:
        src-dst-ip

EtherChannel Load-Balancing Addresses Used Per-Protocol:
Non-IP: Source XOR Destination MAC address
  IPv4: Source XOR Destination IP address
  IPv6: Source XOR Destination IP address
DSW1# test etherchannel load-balance interface port-channel 1 ip 10.10.0.10 10.20.0.10
Would select Gi1/0/48 of Po1

Why 2, 4 or 8 links

Many Catalyst ASICs hash into 8 buckets. With 2, 4 or 8 members each gets an equal share. With 3 members the split is 3:3:2; with 5 it is 2:2:2:1:1.

Polarization

If every layer in a design uses the same hash on the same fields, the second layer receives only flows that already hashed one way, and some of its links sit idle. Use different inputs at different layers, or a per-switch hash seed where the platform offers one.

What it does

802.1Q inserts a 4-byte tag after the source MAC. Frames in the native VLAN skip the tag. A switch that receives an untagged frame on a trunk puts it in its own configured native VLAN.

Why it matters

• Double tagging. An attacker in the native VLAN sends a frame with two tags. The first switch strips the outer tag (it matches the native VLAN) and forwards the frame, still tagged with the inner VLAN, across the trunk. The next switch delivers it into the victim VLAN. It is one way only, but it works.
• Mismatch. If one side uses native VLAN 1 and the other uses 99, untagged frames jump between VLAN 1 and VLAN 99. CDP logs %CDP-4-NATIVE_VLAN_MISMATCH, and STP blocks the port for PVST+ with an inconsistent state.

What I configure

interface GigabitEthernet1/0/48
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30
 switchport nonegotiate
!
vlan dot1q tag native

VLAN 999 has no access ports. vlan dot1q tag native makes the switch tag even the native VLAN.

Setup

SW1(config)# vtp domain CORP
SW1(config)# vtp version 3
SW1(config)# vtp mode server
SW1(config)# vtp password Str0ngSecret hidden
SW1(config)# end
SW1# vtp primary vlan

vtp primary is an EXEC command, not a config line. It asks for confirmation and for the password. Other switches run vtp mode server (secondary servers) or client.

Separate features

The VLAN database and the MST region config are separate VTPv3 features, each with its own primary (vtp primary mst). That lets you keep the MST name, revision and VLAN-to-instance mapping identical on every switch, which is the hardest part of running MST.

Per-port control

no vtp on an interface stops VTP on that trunk, useful at the edge of the domain.

Would I run it

It is safe from the stray-switch problem, and MST sync is a real benefit. The remaining risk is human: a VLAN deleted on the primary disappears from every switch. Shops with good automation often prefer transparent or off mode plus a source of truth that pushes VLANs.

Who can talk to whom

Configuration on a Catalyst

Needs VTP transparent or off mode (or VTPv3).

vtp mode transparent
vlan 201
 private-vlan isolated
vlan 202
 private-vlan community
vlan 200
 private-vlan primary
 private-vlan association 201,202
!
interface GigabitEthernet1/0/10
 switchport mode private-vlan host
 switchport private-vlan host-association 200 201
!
interface GigabitEthernet1/0/48
 description Firewall
 switchport mode private-vlan promiscuous
 switchport private-vlan mapping 200 201,202
!
interface Vlan200
 ip address 10.200.0.1 255.255.255.0
 private-vlan mapping 201,202

The SVI mapping lets hosts in the secondary VLANs reach their gateway. Across switches, secondary VLANs ride a normal trunk as ordinary VLANs, and every switch needs the same PVLAN definitions.

Hosts going through the router

Isolated hosts cannot ARP each other. If you want them to talk only through the gateway, where an ACL can inspect it, enable ip local-proxy-arp on the SVI.

Where it fits

• Metro Ethernet: one service VLAN per customer, with the customer's own VLANs untouched inside it.
• Multi-tenant data centers and labs that need to overlap VLAN IDs between tenants.
• Scale: 4094 outer by 4094 inner identifiers.

Catalyst provider edge port

vlan 100
 name CUST-A
!
interface GigabitEthernet1/0/10
 description Customer A handoff
 switchport access vlan 100
 switchport mode dot1q-tunnel
 l2protocol-tunnel cdp
 l2protocol-tunnel stp
 l2protocol-tunnel vtp
!
system mtu 1504

Every frame from the customer, tagged or not, gets an outer tag of 100 on the provider trunks and loses it again at the far tunnel port.

Layer 2 protocol tunneling

Without l2protocol-tunnel, the provider switch would process or drop the customer's CDP, STP and VTP. With it, those frames are carried across so the customer's sites see each other as directly connected.

Case 1: on against unbundled ports

The unbundled neighbor floods a broadcast received on one link out its other link, straight back into the bundle. The bundled side relearns its own hosts' MACs on the port-channel and starts sending their traffic the wrong way. The guard catches it:

%SPANTREE-2-CHNL_MISCFG: Detected loop due to etherchannel misconfiguration of Gi1/0/47
%PM-4-ERR_DISABLE: channel-misconfig (STP) error detected on Gi1/0/47, putting Gi1/0/47 in err-disable state
%PM-4-ERR_DISABLE: channel-misconfig (STP) error detected on Gi1/0/48, putting Gi1/0/48 in err-disable state

Case 2: on against LACP

The LACP side never hears a partner. On Catalyst 9000 it suspends its members:

%ETC-5-L3DONTBNDL2: Gi1/0/47 suspended: LACP currently not enabled on the remote port.

The on side shows Po1(SU) with both members (P) and keeps sending flooded traffic into links the neighbor drops. Redundancy is gone and nothing on the on side says so.

Recovery

Make both ends match, ideally LACP active, then bounce the port-channel to clear the err-disable:

DSW1(config)# interface Port-channel1
DSW1(config-if)# shutdown
DSW1(config-if)# no shutdown

The guard itself is spanning-tree etherchannel guard misconfig, enabled by default.

Controls

lacp system-priority 100
!
interface GigabitEthernet1/0/1
 lacp port-priority 100
 lacp rate fast
 channel-group 1 mode active
!
interface Port-channel1
 lacp max-bundle 4
 port-channel min-links 2

• lacp max-bundle caps active members; the rest wait in hot-standby.
• port-channel min-links takes the whole bundle down when fewer members are up, so routing moves traffic to another path instead of squeezing it into half the bandwidth.
• lacp rate fast catches a member that stays up but stops passing frames, for example through a media converter, in about 3 seconds instead of 90.

Reading the neighbor

DSW1# show lacp 1 neighbor
Flags:  S - Device is requesting Slow LACPDUs
        F - Device is requesting Fast LACPDUs
        A - Device is in Active mode       P - Device is in Passive mode

Channel group 1 neighbors

                     LACP port                      Admin  Oper   Port    Port
Port          Flags  Priority  Dev ID          Age  key    Key    Number  State
Gi1/0/47      SA     32768     aabb.cc00.0500  12s  0x0    0x1    0x130   0x3D
Gi1/0/48      SA     32768     aabb.cc00.0500   9s  0x0    0x1    0x131   0x3D

Same Dev ID on both members means both reach the same partner. State 0x3D means active, aggregatable, in sync, collecting and distributing.

Step by step

PC1 10.10.0.10 in VLAN 10 sends to PC2 10.20.0.10 in VLAN 20. Both gateways are SVIs on DSW1.

1. PC1 sends the frame to the MAC of interface Vlan10, with PC2's IP as destination.
2. DSW1 receives it in VLAN 10. The destination MAC is its router MAC, so the frame goes to the layer 3 lookup instead of the MAC table.
3. The FIB returns the host entry for 10.20.0.10, learned from ARP, pointing at an adjacency on Vlan20.
4. The adjacency holds the new header: destination MAC of PC2, source MAC of the Vlan20 SVI, VLAN 20.
5. The MAC table for VLAN 20 gives the egress port. TTL goes from 128 to 127 and the frame leaves.

What goes to the CPU (punted)

• No ARP entry yet for PC2: the glean adjacency sends the packet to the CPU, which ARPs.
• TTL expiring (traceroute), packets addressed to the switch itself, IP options.
• Features the hardware cannot do on that platform.

Commands

show ip cef 10.20.0.10 detail shows the FIB entry, show adjacency vlan 20 detail the rewrite, and show ip arp vlan 20 the ARP entries the adjacencies are built from.