|
|
This chapter describes how to configure virtual LANs (VLANs).
This chapter consists of these sections:
A VLAN is a group of end stations with a common set of requirements, independent of physical location. VLANs have the same attributes as a physical LAN but allow you to group end stations even if they are not located physically on the same LAN segment.
The following sections describe how VLANs work:
VLANs allow you to group ports on a switch to limit unicast, multicast, and broadcast traffic flooding. Flooded traffic originating from a particular VLAN is only flooded out other ports belonging to that VLAN.
Figure 10-1 shows an example of VLANs segmented into logically defined networks.
You can set these parameters when you create a VLAN in the management domain:
Two Token Ring VLAN types are supported on switches running VTP version 2:
Token Ring Bridge Relay Function (TrBRF) VLANs interconnect multiple Token Ring Concentrator Relay Function (TrCRF) VLANs in a switched Token Ring network (see Figure 10-2). The TrBRF can be extended across a network of switches interconnected via trunk links. The connection between the TrCRF and the TrBRF is referred to as a logical port.
For source routing, the switch appears as a single bridge between the logical rings. The TrBRF can function as a source-route bridge (SRB) or source-route transparent (SRT) bridge running either the IBM or IEEE STP. If SRB is used, you can define duplicate Media Access Control (MAC) addresses on different logical rings.
The Token Ring software runs an instance of STP for each TrBRF VLAN and each TrCRF VLAN. For TrCRF VLANs, STP removes loops in the logical ring. For TrBRF VLANs, STP interacts with external bridges to remove loops from the bridge topology, similar to STP operation on Ethernet VLANs.
| Caution Certain parent TrBRF STP and TrCRF bridge mode configurations can place the logical ports (the connection between the TrBRF and the TrCRF) of the TrBRF in a blocked state. For more information, refer to the "VLAN Configuration Guidelines" section. |
For source routing, the switch appears as a single bridge between the logical rings. The TrBRF can function as an SRB or SRT bridge running either the IBM or IEEE STP. If SRB is used, duplicate MAC addresses can be defined on different logical rings.
To accommodate IBM System Network Architecture (SNA) traffic, you can use a combination of SRT and SRB modes. In a mixed mode, the TrBRF considers some ports (logical ports connected to TrCRFs) to operate in SRB mode while others operate in SRT mode.
Token Ring Concentrator Relay Function (TrCRF) VLANs define port groups with the same logical ring number. You can configure two types of TrCRFs in your network: undistributed and backup.
Typically, TrCRFs are undistributed, which means each TrCRF is limited to the ports on a single switch. Multiple undistributed TrCRFs on the same or separate switches can be associated with a single parent TrBRF (see Figure 10-3). The parent TrBRF acts as a multiport bridge, forwarding traffic between the undistributed TrCRFs.
Within a TrCRF, source-route switching forwards frames based on either MAC addresses or route descriptors. The entire VLAN can operate as a single ring, with frames switched between ports within a single TrCRF.
You can specify the maximum hop count for All-Routes and Spanning-Tree Explorer frames for each TrCRF. This limits the maximum number of hops an explorer is allowed to traverse. If a port determines that the explorer frame it is receiving has traversed more than the number of hops specified, it does not forward the frame. The TrCRF determines the number of hops an explorer has traversed based on the number of bridge hops in the route information field.
A backup TrCRF enables you to configure an alternate route for traffic between undistributed TrCRFs located on separate switches that are connected by a TrBRF, in the event that the ISL connection between the switches fails. Only one backup TrCRF for a TrBRF is allowed, and only one port per switch can belong to a backup TrCRF.
If the ISL connection between the switches fails, the port in the backup TrCRF on each affected switch automatically becomes active, rerouting traffic between the undistributed TrCRFs through the backup TrCRF. When the ISL connection is reestablished, all but one port in the backup TrCRF is disabled. Figure 10-5 illustrates the backup TrCRF.
Table 10-1 shows the default VLAN configuration.
| Feature | Default Value |
|---|---|
Native (default) VLAN | VLAN 1 |
Port VLAN assignments | All ports assigned to VLAN 1 Token Ring ports assigned to VLAN 1003 (trcrf-default) |
VLAN state | Enabled |
MTU size | 1500 bytes 4472 bytes for Token Ring VLANs |
SAID value | 100,000 plus the VLAN number (for example, the SAID for VLAN VLAN 3 is 100003) |
Pruning eligibility | VLAN 2-1000 are pruning-eligible |
Default FDDI VLAN | VLAN 1002 |
Default FDDI NET VLAN | VLAN 1004 |
Default Token Ring TrBRF VLAN | VLAN 1005 (trbrf-default) with bridge number 0F |
Default Token Ring TrCRF VLAN | VLAN 1003 (trcrf-default) |
TrBRF STP | IBM |
TrCRF bridge mode | SRB |
Follow these guidelines when creating and modifying VLANs in your network:
These sections describe how to configure VLANs:
To create a new Ethernet VLAN, perform this task in privileged mode:
| Task | Command |
|---|---|
Step 1 Create a new Ethernet VLAN. | set vlan vlan_num [name name] [said said] [mtu mtu] [translation vlan_num] |
Step 2 Verify the VLAN configuration. | show vlan [vlan_num] |
This example shows how to create an Ethernet VLAN and verify the configuration:
Console> (enable) set vlan 500 name Engineering Vlan 500 configuration successful Console> (enable) show vlan 500 VLAN Name Status IfIndex Mod/Ports, Vlans ---- -------------------------------- --------- ------- ------------------------ 500 Engineering active 344 VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------ 500 enet 100500 1500 - - - - - 0 0 VLAN AREHops STEHops Backup CRF ---- ------- ------- ---------- Console> (enable)
To modify the VLAN parameters on an existing Ethernet VLAN, perform this task in privileged mode:
| Task | Command |
|---|---|
Step 1 Modify an existing Ethernet VLAN. | set vlan vlan_num [name name] [state {active | suspend}] [said said] [mtu mtu] [translation vlan_num] |
Step 2 Verify the VLAN configuration. | show vlan [vlan_num] |
To create a new FDDI VLAN, perform this task in privileged mode:
| Task | Command |
|---|---|
Step 1 Create a new FDDI or FDDI NET-type VLAN. | set vlan vlan_num [name name] type {fddi | fddinet} [said said] [mtu mtu] |
Step 2 Verify the VLAN configuration. | show vlan [vlan_num] |
To modify the VLAN parameters on an existing FDDI VLAN, perform this task in privileged mode:
| Task | Command |
|---|---|
Step 1 Modify an existing FDDI or FDDI NET-type VLAN. | set vlan vlan_num [name name] [state {active | suspend}] [said said] [mtu mtu] |
Step 2 Verify the VLAN configuration. | show vlan [vlan_num] |
To create a new Token Ring TrBRF VLAN, perform this task in privileged mode:
| Task | Command |
|---|---|
Step 1 Create a new Token Ring TrBRF-type VLAN. | set vlan vlan_num [name name] type trbrf [said said] [mtu mtu] bridge bridge_number [stp {ieee | ibm}] |
Step 2 Verify the VLAN configuration. | show vlan [vlan_num] |
This example shows how to create a new Token Ring TrBRF VLAN and verify the configuration:
Console> (enable) set vlan 999 name TrBRF_999 type trbrf bridge a Vlan 999 configuration successful Console> (enable) show vlan 999 VLAN Name Status IfIndex Mod/Ports, Vlans ---- -------------------------------- --------- ------- ------------------------ 999 TrBRF_999 active VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------ 999 trbrf 100999 4472 - - 0xa ibm - 0 0 VLAN AREHops STEHops Backup CRF ---- ------- ------- ---------- Console> (enable)
To modify the VLAN parameters on an existing Token Ring TrBRF VLAN, perform this task in privileged mode:
| Task | Command |
|---|---|
Step 1 Modify an existing Token Ring TrBRF-type VLAN. | set vlan vlan_num [name name] [state {active | suspend}] [said said] [mtu mtu] [bridge bridge_number] [stp {ieee | ibm}] |
Step 2 Verify the VLAN configuration. | show vlan [vlan_num] |
To create a new Token Ring TrCRF VLAN, perform this task in privileged mode:
| Task | Command |
|---|---|
Step 1 Create a new Token Ring TrCRF-type VLAN. | set vlan vlan_num [name name] type trcrf [said said] [mtu mtu] {ring hex_ring_number | decring decimal_ring_number} parent vlan_num |
Step 2 Verify the VLAN configuration. | show vlan [vlan_num] |
This example shows how to create a Token Ring TrCRF VLAN and verify the configuration:
Console> (enable) set vlan 998 name TrCRF_998 type trcrf decring 10 parent 999 Vlan 998 configuration successful Console> (enable) show vlan 998 VLAN Name Status IfIndex Mod/Ports, Vlans ---- -------------------------------- --------- ------- ------------------------ 998 TrCRF_998 active 352 VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------ 998 trcrf 100998 4472 999 0xa - - srb 0 0 VLAN AREHops STEHops Backup CRF ---- ------- ------- ---------- 998 7 7 off Console> (enable)
To modify the VLAN parameters on an existing Token Ring TrCRF VLAN, perform this task in privileged mode:
| Task | Command |
|---|---|
Step 1 Modify an existing Token Ring TrCRF-type VLAN. | set vlan vlan_num [name name] [state {active | suspend}] [said said] [mtu mtu] [ring hex_ring_num] [decring decimal_ring_num] [bridge bridge_num] [parent vlan_num] |
Step 2 Verify the VLAN configuration. | show vlan [vlan_num] |
To configure a TrCRF VLAN as a backup TrCRF, perform this task in privileged mode:
| Task | Command |
|---|---|
Step 1 Configure a TrCRF VLAN as a backup TrCRF. | set vlan vlan_num backupcrf on |
Step 2 Verify the VLAN configuration. | show vlan [vlan_num] |
| Caution If the backup TrCRF port is attached to a Token Ring multistation access unit (MSAU), it does not provide a backup path unless the ring speed and port mode are set by another device. We recommend that you configure the ring speed and port mode for the backup TrCRF. |
| Task | Command |
|---|---|
Step 1 Specify the maximum number of hops for All-Routes Explorer frames in the TrCRF. | set vlan vlan_num aremaxhop hopcount |
Step 2 Specify the maximum number of hops for Spanning-Tree Explorer frames in the TrCRF. | set vlan vlan_num stemaxhop hopcount |
Step 3 Verify the VLAN configuration. | show vlan [vlan_num] |
This example shows how to limit All-Routes Explorer frames and Spanning-Tree Explorer frames to ten hops, and how to verify the configuration:
Console> (enable) set vlan 998 aremaxhop 10 stemaxhop 10 Vlan 998 configuration successful Console> (enable) show vlan 998 VLAN Name Status IfIndex Mod/Ports, Vlans ---- -------------------------------- --------- ------- ------------------------ 998 VLAN0998 active 357 VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------ 998 trcrf 100998 4472 999 0xff - - srb 0 0 VLAN AREHops STEHops Backup CRF ---- ------- ------- ---------- 998 10 10 off Console> (enable)
A VLAN created in a management domain remains unused until you assign one or more switch ports to the VLAN. If you specify a VLAN that does not exist, the VLAN is created and the specified ports are assigned to it.
To assign one or more switch ports to a VLAN, perform this task in privileged mode:
| Task | Command |
|---|---|
Step 1 Assign one or more switch ports to a VLAN. | set vlan vlan_num mod_num/port_num |
Step 2 Verify the port VLAN membership. | show vlan [vlan_num] |
This example shows how to assign switch ports to a VLAN and verify the assignment:
Console> (enable) set vlan 560 4/10
VLAN 560 modified.
VLAN 1 modified.
VLAN Mod/Ports
---- -----------------------
560 4/10
Console> (enable) show vlan 560
VLAN Name Status IfIndex Mod/Ports, Vlans
---- -------------------------------- --------- ------- ------------------------
560 Engineering active 348 4/10
VLAN Type SAID MTU Parent RingNo BrdgNo Stp BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ ------ ---- -------- ------ ------
560 enet 100560 1500 - - - - - 0 0
VLAN AREHops STEHops Backup CRF
---- ------- ------- ----------
Console> (enable) show port 4/10
Port Name Status Vlan Level Duplex Speed Type
----- ------------------ ---------- ---------- ------ ------ ----- ------------
4/10 notconnect 560 normal half 10 10BaseT
<...output truncated...>
Last-Time-Cleared
--------------------------
Wed Jun 24 1998, 12:16:41
Console> (enable)
When you delete a VLAN in VTP server mode, the VLAN is removed from all switches in the VTP domain. When you delete a VLAN in VTP transparent mode, the VLAN is deleted only on the current switch.
| Caution When you delete a VLAN, any ports assigned to that VLAN become inactive. Such ports remain associated with the VLAN (and thus inactive) until you assign them to a new VLAN. |
To delete a VLAN on the switch, perform this task in privileged mode:
| Task | Command |
|---|---|
Delete a VLAN. | clear vlan vlan_num |
This example shows how to delete a VLAN (in this case, the switch is a VTP server):
Console> (enable) clear vlan 500 This command will deactivate all ports on vlan 500 in the entire management domain Do you want to continue(y/n) [n]?y Vlan 500 deleted Console> (enable)
Posted: Tue Mar 30 15:58:42 PST 1999
Copyright 1989-1999©Cisco Systems Inc.