Skip to main content
Xsec

LAYER 2 Vlan, Spanning-tree, Trunk, EtherChannel, and Dot1Q Encapsulation

Published on 12 min read

Updated on

Seriesnetwork-engineering
Part 1 of 6
In this series39 min read in total
  1. LAYER 2 Vlan, Spanning-tree, Trunk, EtherChannel, and Dot1Q Encapsulation
  2. LAYER 3 Static Routing, RIPv2, OSPF, NAT
  3. The hierarchy of CLI cisco
  4. Help, autocompletion, monitoring, shortcuts
  5. Alcatel Switch Configuration
  6. Remote Access
Next post in the seriesLAYER 3 Static Routing, RIPv2, OSPF, NAT

A switch out of the box is one single, wide broadcast domain: everything plugged into it can see, hear and receive everyone else’s broadcasts. The five features in this article correct that behaviour, and each one answers the problem created by the previous one.

FeatureThe problem it solves
VLANa single switch lumps everyone into the same broadcast domain
Trunka segmented VLAN does not cross the boundary between two switches
Spanning-treewiring switches together creates loops that saturate the network
EtherChannela single link between switches is both a bottleneck and a single point of failure
Dot1Q encapsulationproperly separated VLANs cannot talk to each other at all

We will follow that chain in order.

VLANs: segmenting the switch

A VLAN splits a physical switch into several logical switches. Ports in a VLAN only see other ports in the same VLAN, which brings three immediate benefits.

  • Security: workstations in one department can no longer listen to another department’s traffic.
  • Performance: broadcasts stay contained, the broadcast domain shrinks accordingly.
  • Cost and flexibility: one switch replaces several separate devices, and moving a workstation to another department takes one command, with no cabling change.
DefinitionBroadcast domain

This is the set of machines that receive a broadcast frame sent by any one of them. An ARP request, a DHCP Discover or a NetBIOS announcement go out to every port in the domain. The wider it is, the more time each machine spends processing traffic that does not concern it. Segmenting into VLANs means segmenting that domain.

  1. Create the VLAN

    Switch(config)#
    vlan 10
    name ACCOUNTING

    The name is optional but strongly recommended: six months from now, VLAN0010 will mean nothing to anyone.

  2. Assign a port to the VLAN

    Switch(config)#
    interface FastEthernet0/1
    Switch(config-if)#
    switchport mode access
    switchport access vlan 10

    Interface Fa0/1 now belongs to VLAN 10.

    TipCreating the VLAN on the fly

    Assigning a port to a non-existent VLAN creates it automatically, with an explicit warning:

    Switch(config-if)#
    switchport access vlan 10
    % Access VLAN does not exist. Creating vlan 10

    Handy in a lab, to be avoided in production: a VLAN created by a typo stays in the configuration and has no name.

  3. Verify

    Switch#
    show vlan brief

    This command lists existing VLANs and the ports assigned to each. It is the check to run before looking any further when two machines cannot see each other.

The no prefix deletes a VLAN:

Switch(config)#
no vlan 10
WarningDeleting a VLAN does not move its ports

The interfaces that were assigned to it do not fall back to VLAN 1: they stay attached to a VLAN that no longer exists and stop forwarding. Reassign the ports explicitly before deleting, or you will find out about the outage when a user calls.

NoteTwo roles for a port

A port is either access, tied to a single VLAN and meant for an end device, or trunk, able to carry several. Everything that follows rests on that distinction.

The segmentation works, as long as everything fits on one switch. As soon as there are two, VLAN 10 stops at the boundary.

Trunks: letting VLANs cross the boundary

A trunk link carries several VLANs over one cable between two devices. Put another way, it extends each VLAN from one switch to the other, as if the two were only one.

Physical viewLogical view
Two switches joined by a single cableVLANs crossing the link as if it were a single switch

To tell VLANs apart on a single cable, the switch adds a 4-byte tag to each frame, carrying the VLAN number. This is the IEEE 802.1Q standard, also called dot1Q. The switch on the far side reads the tag, strips it, and puts the frame back into the right VLAN.

  1. Switch the port to trunk mode

    Switch(config)#
    interface FastEthernet0/1
    Switch(config-if)#
    switchport mode trunk

  2. Limit the carried VLANs

    Switch(config-if)#
    switchport trunk allowed vlan 10,20,30

    By default, a trunk carries every VLAN. Restricting the list keeps a sensitive VLAN from wandering onto links that have no use for it, and cuts broadcast traffic across the network.

  3. Verify

    Switch#
    show interfaces trunk

    The output confirms the mode, the encapsulation, the native VLAN and the list of VLANs actually allowed and active on the link.

ExplanationThe native VLAN, the untagged frame

On a trunk, one VLAN escapes tagging: the native VLAN, which is 1 by default. Its frames travel bare, which keeps compatibility with devices that do not understand dot1Q. Two practical consequences. First, the native VLAN must be identical at both ends of the trunk, otherwise traffic silently hops from one VLAN to another. Second, it is a known attack surface: changing the native VLAN to an unused one, with switchport trunk native vlan 999, is a common hardening practice.

WarningAuto-negotiation is convenient and risky

Recent Cisco devices negotiate the link mode between themselves with DTP, which lets a trunk come up on its own. Handy in a lab. In production, an attacking host can pretend to be a switch and obtain a trunk, hence access to every VLAN. On any port meant for an end device, pin the behaviour down with switchport mode access then switchport nonegotiate.

VLANs now cross several switches. But adding a second cable between them for redundancy brings the network down.

Spanning-tree: surviving loops

An Ethernet frame carries no time-to-live counter, unlike an IP packet. A broadcast frame caught in a physical loop therefore circles forever, duplicates at every switch it crosses, and saturates the whole network within seconds. This is the broadcast storm, and it makes the network entirely unusable, not merely slow.

The Spanning Tree Protocol (STP) solves this without removing cables: it computes a loop-free topology and logically blocks the extra links, keeping them ready to take over if the main one goes down.

DefinitionElecting the root bridge

All switches elect a single reference point, the root bridge, and each one then computes its best path towards it. Ports that lie on no best path are blocked.

The election is decided by the BID (Bridge ID), made of two parts: a configurable priority, then the device’s MAC address. The lowest BID wins. Since the priority is 32768 everywhere by default, the smallest MAC address takes it, and therefore often the oldest switch on site, which is rarely the desirable choice.

That is why the priority gets configured explicitly.

Switch(config)#
spanning-tree vlan 10 priority 8000
% Bridge Priority must be in increments of 4096.
% Allowed values are:
0 4096 8192 12288 16384 20480 24576 28672
32768 36864 40960 45056 49152 53248 57344 61440
NoteWhy multiples of 4096

The priority field is 16 bits, but only the 4 high-order bits are configurable. The remaining 12 bits carry the extended VLAN identifier, which lets each VLAN have its own topology. That leaves only 16 possible values, 4096 apart. The value 8000 is rejected because it is not one of them, not because it would be too large.

Two commands save you from doing the arithmetic yourself:

Switch(config)#
spanning-tree vlan 10 root primary
Switch(config)#
spanning-tree vlan 10 root secondary

The first lowers the priority just enough to win the election, the second designates a stand-in that takes over if the first goes down.

TipChoosing the root bridge is not a detail

All inter-VLAN and outbound traffic goes through the root bridge. Letting it be elected at random means letting chance decide where the company’s traffic flows. The root should be the most central and most reliable switch, typically the core one, never an access-layer switch.

Each port is then given a role, visible with show spanning-tree:

RoleMeaning
Rootthe port leading to the root bridge over the best path
Designatedthe port serving a segment, downstream of the root
Blocking or Alternatethe port put on hold to break the loop
WarningPortFast on end-device ports only

A port coming up goes through several states before forwarding, which takes up to 30 seconds in classic STP. A DHCP client may give up before that. The spanning-tree portfast command removes that delay. It must only be applied to a port connected to an end device: on a port connected to a switch, it restores exactly the loop STP was there to prevent.

The network now supports redundancy. Except the backup link sits idle as long as the main one works.

Spanning-tree solves loops by wasting bandwidth: with two cables between two switches, only one works. EtherChannel changes that by presenting several physical links as one single logical link, which STP sees as unique and therefore does not block.

Two physical links aggregated into a single logical link

Up to 8 active links can be aggregated. Bandwidth adds up, and losing a cable reduces throughput without ever cutting the link or triggering an STP reconvergence.

  1. Select the interface range

    Switch(config)#
    interface range FastEthernet0/1-2

  2. Create the group

    Switch(config-if-range)#
    channel-group 1 mode active

    LACP is the open standard (IEEE 802.3ad), the one to prefer. Mode active negotiates actively, passive waits for the other side to offer. At least one side must be active.

    Switch(config-if-range)#
    channel-group 1 mode desirable

    PAgP is the Cisco proprietary protocol, equivalent to LACP but limited to that vendor’s devices. desirable negotiates actively, auto waits.

    Switch(config-if-range)#
    channel-group 1 mode on

    No negotiation at all: the group is forced on both sides. It works, but if the configuration opposite is incomplete or different, nothing reports it and a loop can form. Keep it for cases where the remote device speaks neither LACP nor PAgP.

    The commands must be repeated identically on the second switch.

  3. Verify

    Switch#
    show etherchannel summary

    The SU flag on the Port-channel means an operational layer 2 group, and P on each interface confirms it does take part in the group.

ImportantEvery interface in the group must be identical

Speed, duplex, access or trunk mode, list of allowed VLANs: the slightest difference between two members prevents the group from forming, or silently drops an interface from it. This is by far the leading cause of EtherChannel failure, and show etherchannel summary reveals it immediately.

ExplanationTwo 1 Gb/s links do not make one 2 Gb/s link

Load balancing works per flow, not per packet, based on a computation over source and destination addresses. Every frame of a given conversation therefore always takes the same physical link, which avoids delivering them out of order. A single file transfer between two machines stays capped at 1 Gb/s: it is the sum of many simultaneous flows that exploits the aggregation. An EtherChannel increases total throughput, never the throughput of one isolated conversation.

The network is now segmented, extended, redundant and fast. One thing is missing: the VLANs cannot talk to each other at all.

Dot1Q encapsulation: letting VLANs talk

This is the direct and intended consequence of the first chapter: two VLANs are two distinct networks, and moving from one network to another is routing, hence layer 3. A router is needed.

Rather than dedicating one router port to each VLAN, a single physical link is used as a trunk, split into logical subinterfaces, one per VLAN. That setup is known as router-on-a-stick.

  1. Create the subinterface

    Router(config)#
    interface GigabitEthernet0/0/0.10

    The suffix after the dot is merely a subinterface number. Reusing the VLAN number is not mandatory, but it is a universal convention that keeps the configuration readable.

  2. Declare the encapsulation

    Router(config-subif)#
    encapsulation dot1Q 10

    This is where, and only where, the link to VLAN 10 is made. The router will know how to read frames tagged 10 and will tag its own answers the same way.

  3. Address the subinterface

    Router(config-subif)#
    ip address 192.168.10.1 255.255.255.0

    192.168.10.1 becomes the default gateway to configure on every machine in VLAN 10.

  4. Bring up the physical interface

    Router(config)#
    interface GigabitEthernet0/0/0
    no shutdown
    DangerThe classic omission

    Subinterfaces come up automatically, but they stay inert as long as the physical interface carrying them is administratively down. On a router, interfaces are shut down by default. This is by far the most frequent mistake on this configuration.

  5. Repeat for each VLAN

    Terminal
    conf t
    int g0/0/0.20
     encapsulation dot1Q 20
     ip address 192.168.20.1 255.255.255.0
    exit
    int g0/0/0
     no shut
    end
    write memory
WarningThe switch port must be a trunk

On the switch side, the interface facing the router carries several VLANs: it must therefore be configured as switchport mode trunk. A port left in access mode will pass a single VLAN, and a single VLAN will be routed. Symmetrically, the native VLAN must match on both sides.

TipThe limit of router-on-a-stick

All inter-VLAN traffic goes up to the router then back down, over the same cable. That link becomes a bottleneck as soon as inter-VLAN traffic is significant. Beyond a handful of VLANs, a layer 3 switch does the same job at switching speed, with virtual interfaces (interface vlan 10) instead of subinterfaces.

These five mechanisms form the base of any switched enterprise network. The next article in the series moves up to layer 3 and to routing between these now properly separated networks.

Use with an AI

Read next

Actions

Go to