How to configure trunk on Cisco Catalyst Switch

Trunks are required to carry VLAN traffic from one switch to another. In this lesson I will demonstrate how to configure a trunk between Cisco Catalyst switches. Let me show you the topology that we’ll use:

Above you see a topology with a computer connected to each switch. We’ll put the computers in the same VLAN and create a trunk between the two switches.

Let’s start by creating a VLAN:

SW1(config)#vlan 50
SW1(config-vlan)#name Computers
SW1(config-vlan)#exit

SW2(config)#vlan 50
SW2(config-vlan)#name Computers
SW2(config-vlan)#exit

And let’s put the interfaces connected to the computers in the correct VLAN:

SW1(config)#interface fa0/1
SW1(config-if)#switchport access vlan 50

SW2(config)#interface fa0/2
SW2(config-if)#switchport access vlan 50

The next step is to create a trunk between the two switches. Technically the interfaces between the two switches can also be in access mode right now because I only have a single VLAN.

SW1(config)#interface fa0/14
SW1(config-if)#switchport mode trunk
Command rejected: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode.

SW2(config)#interface fa0/14
SW2(config-if)#switchport mode trunk
Command rejected: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode.

I try to change the interface to trunk mode with the switchport mode trunk command. Depending on the switch model you might see the same error as me. If we want to change the interface to trunk mode we need to change the trunk encapsulation type. Let’s see what options we have:

SW1(config-if)#switchport trunk encapsulation ?
  dot1q      Interface uses only 802.1q trunking encapsulation when trunking
  isl        Interface uses only ISL trunking encapsulation when trunking
  negotiate  Device will negotiate trunking encapsulation with peer on interface

This is where you can choose between 802.1Q or ISL encapsulation. By default our switch will negotiate about the trunk encapsulation type.

SW1(config-if)#switchport trunk encapsulation dot1q

SW2(config-if)#switchport trunk encapsulation dot1q

Let‟s change it to 802.1Q by using the switchport trunk encapsulation command.

SW1#show interfaces fa0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: dynamic auto 
Operational Mode: static access 
Administrative Trunking Encapsulation: dot1q

SW2#show interfaces fa0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: dynamic auto 
Operational Mode: static access 
Administrative Trunking Encapsulation: dot1q

As you can see the trunk encapsulation is now 802.1Q.

SW1(config)#interface fa0/14
SW1(config-if)#switchport mode trunk

SW2(config)#interface fa0/14
SW2(config-if)#switchport mode trunk

Now I can successfully change the switchport mode to trunk.

SW1#show interfaces fa0/14 switchport
Name: Fa0/14
Switchport: Enabled Administrative Mode: trunk Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q

SW2#show interfaces fa0/14 switchport
Name: Fa0/14
Switchport: Enabled Administrative Mode: trunk Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q

We can confirm we have a trunk because the operational mode is “dot1q”.

Let’s try if H1 and H2 can reach each other:

C:\Documents and Settings\H1>ping 192.168.1.2

Pinging 192.168.1.2 with 32 bytes of data:

Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.1.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

Excellent! H1 and H2 can reach each other! Does this mean we are
done? Not quite yet…there is more I want to show to you:

SW2#show vlan
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/3, Fa0/4, Fa0/5
                                                Fa0/6, Fa0/7, Fa0/8, Fa0/9
                                                Fa0/10, Fa0/11, Fa0/12, Fa0/13
                                                Fa0/15, Fa0/22, Fa0/23, Fa0/24
                                                Gi0/1, Gi0/2
50   Computers                        active    Fa0/2

First of all, if we use the show vlan command we don’t see the Fa0/14 interface. This is completely normal because the show vlan command only shows interfaces in access mode and no trunk interfaces.

SW2#show interface fa0/14 trunk 
Port        Mode             Encapsulation  Status        Native vlan
Fa0/14      on               802.1q         trunking      1
Port        Vlans allowed on trunk
Fa0/14      1-4094
Port        Vlans allowed and active in management domain
Fa0/14      1,50
Port        Vlans in spanning tree forwarding state and not pruned
Fa0/14      50

The show interface trunk command is very useful. You can see if an interface is in trunk mode, which trunk encapsulation protocol it is using (802.1Q or ISL) and what the native VLAN is. We can also see that VLAN 1 – 4094 are allowed on this trunk.

We can also see that currently only VLAN 1 (native VLAN) and VLAN 50 are active. Last but not least you can see something which VLANs are in the forwarding state for spanning-tree.

I want to show you one more thing about access and trunk interfaces:

SW2#show interface fa0/2 switchport
Name: Fa0/2
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access

An interface can be in access mode or in trunk mode. The interface above is connected to H2 and you can see that the operational mode is “static access” which means it’s in access mode.

SW2#show interfaces fa0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk

This is our trunk interface which is connected to SW1. You can see the operational mode is trunk mode.

SW2(config-if)#switchport mode ?
  access        Set trunking mode to ACCESS unconditionally
  dot1q-tunnel  set trunking mode to TUNNEL unconditionally
  dynamic       Set trunking mode to dynamically negotiate access or trunk 
  private-vlan  Set private-vlan mode
  trunk         Set trunking mode to TRUNK unconditionally

If I go to the interface configuration to change the switchport mode you can see I have more options than access or trunk mode. There is also a dynamic method. Don’t worry about the other options for now.

SW2(config-if)#switchport mode dynamic ?
  auto       Set trunking mode dynamic negotiation parameter to AUTO
  desirable  Set trunking mode dynamic negotiation parameter to DESIRABLE

We can choose between dynamic auto and dynamic desirable. Our switch will automatically find out if the interface should become an access or trunk port. So what’s the difference between dynamic auto and dynamic desirable? Let’s find out!

I’m going to play with the switchport mode on SW1 and SW2 and we’ll see what the result will be.

SW1(config)#interface fa0/14
SW1(config-if)#switchport mode dynamic auto

SW2(config)#interface fa0/14
SW2(config-if)#switchport mode dynamic auto

First I’ll change both interfaces to dynamic auto.

SW1(config-if)#do show interface f0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: static access

SW2(config-if)#do show interface f0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: static access

Our administrative mode is dynamic auto and as a result we now have an access port.

SW1(config)#interface fa0/14
SW1(config-if)#switchport mode dynamic desirable

SW2(config)#interface fa0/14
SW2(config-if)#switchport mode dynamic desirable

SW1#show interfaces fa0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: dynamic desirable
Operational Mode: trunk

SW2#show interfaces fa0/14 switchport 
Name: Fa0/14
Switchport: Enabled
Administrative Mode: dynamic desirable
Operational Mode: trunk

Once we change both interfaces to dynamic desirable we end up with a trunk link. What do you think will happen if we mix the switchport types? Maybe dynamic auto on one side and dynamic desirable on the other side? Let’s find out!

SW1(config)#interface fa0/14
SW1(config-if)#switchport mode dynamic desirable

SW2(config)#interface fa0/14
SW2(config-if)#switchport mode dynamic auto

SW1#show interfaces f0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: dynamic desirable
Operational Mode: trunk

SW2#show interfaces fa0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: trunk

It seems our switch has a strong desire to become a trunk. Let’s see what happens with other combinations!

SW1(config)#interface fa0/14
SW1(config-if)#switchport mode dynamic auto

SW2(config)#interface fa0/14
SW2(config-if)#switchport mode trunk

SW1#show interfaces f0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: trunk

SW2#show interfaces fa0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk

Dynamic auto will prefer to become an access port but if the other interface has been configured as trunk we will end up with a trunk.

SW1(config)#interface fa0/14
SW1(config-if)#switchport mode dynamic auto

SW2(config)#interface fa0/14
SW2(config-if)#switchport mode access

SW1#show interfaces f0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: static access

SW2#show interfaces fa0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access

Configuring one side as dynamic auto and the other one as access and the result will be an access port.

SW1(config)#interface fa0/14
SW1(config-if)#switchport mode dynamic desirable

SW2(config)#interface fa0/14
SW2(config-if)#switchport mode trunk

SW1#show interfaces f0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: dynamic desirable
Operational Mode: trunk

SW2#show interfaces fa0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk

Dynamic desirable and trunk mode offers us a working trunk.

What do you think will happen if I set one interface in access mode and the other one as trunk? Doesn’t sound like a good idea but let’s push our luck:

SW1(config)#interface fa0/14
SW1(config-if)#switchport mode access

SW2(config)#interface fa0/14
SW2(config-if)#switchport mode trunk

SW1#show interfaces f0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: static access
Operational Mode: trunk

SW2#show interfaces fa0/14 switchport
Name: Fa0/14
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk

SW1#
%SPANTREE-7-RECV_1Q_NON_TRUNK: Received 802.1Q BPDU on non trunk FastEthernet0/14 VLAN1.
%SPANTREE-7-BLOCK_PORT_TYPE: Blocking FastEthernet0/14 on VLAN0001. Inconsistent port type.
%SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking FastEthernet0/14 on VLAN0001. Port consistency restored.

As soon as I change the switchport mode I see these spanning-tree error messages on SW1. Spanning-tree is a protocol that runs on switches that prevents loops in our network.

Let me give you an overview of the different switchport modes and the result:

	Trunk	Access	Dynamic Auto	Dynamic Desirable
Trunk	Trunk	Limited	Trunk	Trunk
Access	Limited	Access	Access	Access
Dynamic Auto	Trunk	Access	Access	Trunk
Dynamic Desirable	Trunk	Access	Trunk	Trunk

That’s all I have for you now about trunking. I hope this was useful to you. It’s best if you try some of these commands on your own switches so that you become familiar with the different commands. If you enjoyed this lesson, please leave a comment or share it with your friends!

hostname SW1
!
vlan 50
 name Computers
!
interface FastEthernet0/1
 switchport access vlan 50
!
interface FastEthernet0/14
 switchport mode trunk
 switchport trunk encapsulation dot1q
!
end

hostname SW2
!
vlan 50
 name Computers
!
interface FastEthernet0/2
 switchport access vlan 50
!
interface FastEthernet0/14
 switchport mode trunk
 switchport trunk encapsulation dot1q
!
end

802.1Q Encapsulation Explained

When you want VLAN traffic between two switches then there is one problem we run into…take a look at the image below:

This is a normal Ethernet frame…do you see any field where we can specify to which VLAN our Ethernet frame belongs? Well there isn’t! So how does a switch know to what VLAN something belongs when it receives a frame? It has no clue so that’s why we need another protocol to help us.

If you want to VLAN traffic between switches we have to use a trunk. A trunk connection is simply said nothing more but a normal link but it is able to pass traffic from different VLANs and has a method to separate traffic between VLANs. Here’s an example:

As you can see we have computers on both sides and they are in different VLANs, by using trunks we can make sure all VLAN traffic can be sent between the switches. Because our regular Ethernet frames don’t have anything to show to which VLAN they belong we will need another protocol.

There are two trunking protocols:

• 802.1Q: This is the most common trunking protocol. It’s a standard and supported by many vendors.
• ISL: This is the Cisco trunking protocol. Not all switches support it.

Let’s take a look at 802.1Q:

Here’s an example of an 802.1Q Ethernet frame. As you can see it’s the same as a normal Ethernet frame but we have added a tag in the middle (that’s the blue field). In our tag you will find a “VLAN identifier” which is the VLAN to which this Ethernet frame belongs. This is how switches know to which VLAN our traffic belongs.

There’s also a field called “Priority” which is how we can give a different priority to the different types of traffic. This is useful when you have one VLAN for voice over IP traffic and another VLAN for data traffic, you probably want to give the VoIP traffic priority or your call quality might suffer.

I hope this has been helpful to understand 802.1Q.

If you want to know how to configure trunks…take a look at this tutorial that I wrote earlier. It explains how to configure trunks on Cisco Catalyst switches.

How to configure VLANs on Cisco Catalyst Switch

In this lesson I will show you how to configure VLANs on Cisco Catalyst Switches and how to assign interfaces to certain VLANs. Let’s start with a simple network topology:

Let’s start with a simple example. H1 and H2 are connected to SW1.

First we will look at the default VLAN configuration on SW1:

SW1#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                                Fa0/9, Fa0/10, Fa0/12
                                                Fa0/13, Fa0/14, Fa0/22
                                                Fa0/23, Fa0/24, Gi0/1, Gi0/2
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

Interesting…VLAN 1 is the default LAN and you can see that all active interfaces are assigned to VLAN 1.

VLAN information is not saved in the running-config or startup-config but in a separate file called vlan.dat on your flash memory. If you want to delete the VLAN information you should delete this file by typing delete flash:vlan.dat. I configured an IP address on H1 and H2 so they are in the same subnet.

Let’s see if H1 and H2 can reach each other:

C:\Documents and Settings\H1>ping 192.168.1.2

Pinging 192.168.1.2 with 32 bytes of data:

Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.1.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

Even with the default switch configuration H1 is able to reach H2. Let’s see if I can create a new VLAN for H1 and H2:

SW1(config)#vlan 50
SW1(config-vlan)#name Computers
SW1(config-vlan)#exit

This is how you create a new VLAN. If you want you can give it a name but this is optional. I’m calling my VLAN “Computers”.

SW1#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------

1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12
                                                Fa0/13, Fa0/14, Fa0/15,
                                                Fa0/23, Fa0/24, Gi0/1, Gi0/2
50   Computers                        active

VLAN 50 was created on SW1 and you can see that it’s active. However no ports are currently in VLAN 50. Let’s see if we can change this…

SW1(config)interface fa0/1
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 50

SW1(config)interface fa0/2
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 50

First I will configure the switchport in access mode with the switchport mode access command. By using the switchport access vlan command we can move our interfaces to another VLAN.

SW1#show vlan 

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------

1    default                          active    Fa0/3, Fa0/4
                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                                Fa0/9, Fa0/10,, Fa0/12
                                                Fa0/13, Fa0/14, Fa0/15,
                                                Fa0/23, Fa0/24, Gi0/2

50   Computers                        active    Fa0/1, Fa0/2

Excellent! Both computers are now in VLAN 50. Let’s verify our configuration by checking if they can ping each other:

C:\Documents and Settings\H1>ping 192.168.1.2 

Pinging 192.168.1.2 with 32 bytes of data:
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128 

Ping statistics for 192.168.1.2:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

Our computers are able to reach each other within VLAN 50. Besides pinging each other we can also use another show command to verify our configuration:

SW1#show interfaces fa0/1 switchport
Name: Fa0/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 50 (Computers)
Trunking Native Mode VLAN: 1 (default)

SW1#show interfaces fa0/2 switchport
Name: Fa0/2
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 50 (Computers)
Trunking Native Mode VLAN: 1 (default)

By using the “show interfaces switchport” command we can see that the operational mode is “static access” which means it’s in access mode. We can also verify that the interface is assigned to VLAN 50.

hostname SW1
!
vlan 50
 name Computers
!
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 50
!
interface FastEthernet0/2
 switchport mode access
 switchport access vlan 50
!
end

This is all I wanted to show you, in the next lesson I’ll show you how to configure trunks so that you can carry VLAN traffic from one switch to another. If you enjoyed this lesson please leave a comment!

Introduction to VLANs

In this lesson we will take a look at VLANs (Virtual LANs) and I will explain what they are and why we need them.

First of all let me show you a picture of a network:

Look at this picture for a minute, we have many departments and every department has its own switch. Users are grouped physically together and are connected to their switch. what do you think of it? Does this look like a good network design? If you are unsure let me ask you some questions to think about:

• What happens when a computer connected to the Research switch sends a broadcast like an ARP request?
• What happens when the Helpdesk switch fails?
• Will our users at the Human Resource switch have fast network connectivity?
• How can we implement security in this network?

Now let me explain you why this is a bad network design. If any of our computers sends a broadcast what will our switches do? They flood it! This means that a single broadcast frame will be flooded on this entire network. This also happens when a switch hasn’t learned about a certain MAC address, the frame will be flooded.

If our helpdesk switch would fail this means that users from Human Resource are “isolated” from the rest and unable to access other departments or the internet, this applies to other switches as well. Everyone has to go through the Helpdesk switch in order to reach the Internet which means we are sharing bandwidth, probably not a very good idea performance-wise.

Last but not least, what about security? We could implement port-security and filter on MAC addresses but that’s not a very secure method since MAC addresses are very easy to spoof. VLANs are one way to solve our problems.

One more question I’d like to ask you to refresh your knowledge:

• How many broadcast domains do we have here?

What about broadcast domains? We didn’t talk about this before but I think you can answer it. If a computer from the sales switch would send a broadcast frame we know that all other switches will forward it. Did you spot the router on top of the picture? What about it…do you think a router will forward a broadcast frame?

The answer is that routers don’t forward broadcast frames so they effectively “limit” our broadcast domain. Of course on the right side of our router where we have an Internet connection this would be another broadcast domain…so we have 2 broadcast domains here. Let’s see how we can improve things…

When you work with switches you have to keep in mind there’s a big difference between physical and logical topology. Physical is just the way our cables are connected while logical is how we have setup things ‘virtually’. In the example above we have 4 switches and I have created 3 VLANs called Research, Engineering and Sales. A VLAN is a Virtual LAN so it’s like having a “switch inside a switch”.

What are the advantages of using VLANs?

• A VLAN is a single broadcast domain which means that if a user in the research VLAN would send a broadcast frame only users in the same VLAN will receive it.
• Users are only able to communicate within the same VLAN unless you use a router.
• Users don’t have to be grouped physically together, as you can see we have users in the Engineering VLAN sitting on the 1st, 2nd and 3rd floor.

That’s all for now. I hope this has given you an idea of what VLANs are and why we use them! If you enjoyed this lesson please leave a comment.