Trunk ports-
- Trunk ports are used to connect layer 2 devices together (when you need to expand your network)
- This video shows you how to initially configure trunk ports.
How to add and remove VLANs on a trunk-
- It's probably a good sign when your network needs to expand
- It's also a good thing to limit broadcast traffic and control bandwidth utilization across your layer 2 links
- Manually pruning the VLANs on trunk ports will help control that excess traffic
DTP - Dynamic Trunking Protocol (DTP)-
- Dynamic Trunking Protocol is how switchports automatically negotiate their mode before you ever configure them
- A switchport can be set to one of four modes - Dynamic Auto (default), Dynamic Desirable, Trunk or Access
- The chart below shows which mode a switchport will negotiate to (in white) given the starting mode of both switches (gray)
|
Dynamic Auto
|
Dynamic Desirable
|
Trunk
|
Access
|
Dynamic Auto
|
Access
|
Trunk
|
Trunk
|
Access
|
Dynamic Desirable
|
Trunk
|
Trunk
|
Trunk
|
Access
|
Trunk
|
Trunk
|
Trunk
|
Trunk
|
Limited
Connectivity
|
Access
|
Access
|
Access
|
Limited
Connectivity
|
Access
|
- It's good to know how it works, but I recommend just turning it off completely to maintain more control over your switches and what is connecting to your network. By turning DTP off completely, you avoid switch spoofing and VLAN hopping.
VTP (v1 & v2) - VLAN Trunking Protocol (VTP)-
- VTP is responsible for synchronizing VLAN information within a VTP domain and reduces the need to configure the same VLAN information on each switch thereby minimizing the possibility of configuration inconsistencies that arise when changes are made
- Cisco proprietary protocol
- Propagates vlan information to other layer 2 devices on the local area network
- Switches must be in the same domain to receive updates
- Switches can be in one of four modes
- server - maintains vlan database and sends out updates
- client - receives updates from server, modifies its vlan database, forwards on VTP messages
- transparent - receives updates from server, does not modify its own vlan database, forwards on VTP messages
- off - turns off VTP (added in 12.2(52)SE)
- Switches by default are configured as VTP servers, but with no VTP domain or password
- Switches in server mode with the highest revision number take precedence
- VTP provides the following benefits:
- VLAN configuration consistency across the layer 2 network
- Dynamic distribution of added VLANs across the network
- Plug-and-play configuration when adding new VLANs
- VTP has the following drawbacks:
- The potential exists for a switch that is being added to the network to wipe out existing VLAN databases if the new switch is in server mode, is configured for the proper VTP domain and has a higher revision number than other servers
- Switches in different domains do not share VTP information. Non-matching VTP settings might result in issues in negotiating VLAN trunks, port-channels or Virtual Port Channels.
802.1Q-
- 802.1Q, or dot1q for short, is a way to tag vlans on an Ethernet frame
- It is an open standard and more popularly used than Cisco's proprietary VLAN encapsulation protocol called Inter-Switch Link (ISL)
- ISL is not even mentioned on the CCNA exam topics so focus on 802.1Q!
- Network devices that are vlan aware can add a vlan tag to the Ethernet frame that represents the vlan membership of the frame.
- Each frame must belong to only one vlan
- The vlan tag is 4 bytes in length (32 bits)
- Tag protocol identifier (TPID) - 16 bits - set to 0x8100 to identify the frame as IEEE 802.1Q-tagged frame
- Tag control information (TCI) - 16 bits
- Priority code point (PCP) - 3 bits - 802.1p class of service stating the frame's priority
- Drop eligible indicator (DEI) - 1 bit - indicate frames eligible to be dropped
- VLAN identifier (VID) - 12 bits - 4,094 vlans available from 0x001 to 0xFFE
Native VLAN-
- On a trunk link, each frame must be distinguishable as being within exactly one VLAN
- If a frame does not carry an 802.1Q VLAN tag, it is considered to be in the Native VLAN
- By default the Native VLAN is 1
- You should change the native vlan to an unused vlan - read about double tagging.