CCNA Edge Ports: Access VLANs, Voice VLAN, PoE, APs, Hosts and LACP

An edge port is a switch port that connects an end device (a desktop, printer, IoT sensor, camera, IP phone, access point, server or appliance) rather than another switch or router. For a device that sends ordinary untagged Ethernet frames, the edge port is a static access port, built with two commands: switchport mode access fixes the port's role, and switchport access vlan chooses the VLAN that every untagged frame received on it joins.

interface GigabitEthernet2/0/31
 description Floor2-MFP
 switchport mode access
 switchport access vlan 65

Why the mode is hard-coded

Many Catalyst ports default to a dynamic DTP mode (dynamic auto on most current models). A dynamic port becomes a trunk if the device on the other end asks for one with DTP, so a rogue switch, or a laptop running a DTP attack tool, can turn a desk port into a trunk and reach every VLAN on it (switch spoofing). switchport mode access stops that: the port can never trunk. A static access port still sends DTP frames announcing that it will not trunk; to suppress them too, add switchport nonegotiate, which IOS accepts only on a port whose mode is static (access or trunk), not on a dynamic one. Neither command is related to spanning tree: PortFast and BPDU guard are separate edge-port features (exam topic 2.5), and PoE is configured independently.

Which settings apply in which mode

A port stores both its access and its trunk settings, but only the ones for its current mode take effect. On an access port, switchport trunk native vlan and switchport trunk allowed vlan are kept in the configuration and ignored. On a trunk port, switchport access vlan is ignored, and the port's untagged frames go to the trunk's native VLAN instead. A classic fault is a host port left in switchport mode trunk with an access VLAN configured: the device's untagged frames land in the native VLAN (VLAN 1 by default), so it gets an address from the wrong subnet or none at all. The fix is the mode, not a native VLAN change.

Reading the port's state

• show interfaces status lists every port with its VLAN; a port operating as a trunk shows trunk in the VLAN column instead of a number.
• show interfaces <port> switchport shows Administrative Mode and Operational Mode (for example static access), the Access Mode VLAN and the Voice VLAN, and marks a VLAN that no longer exists as (Inactive).
• show vlan brief lists each VLAN in the database with its access ports. Trunk ports never appear there, and nor does an access port whose VLAN is missing from the database.

It depends on the order of events. If you assign a port to a VLAN that has never been created, IOS creates it for you; if the VLAN existed and is later deleted, the ports stay assigned to it and stop forwarding.

The fix for the second case is to recreate the VLAN in global configuration (vlan 75); the ports become active again without any interface change. Bringing up an SVI or adding the VLAN to an uplink trunk does not help, because neither creates the VLAN in the database. The symptom is distinctive: link lights are on, the port is up, yet the hosts reach nothing, not even their gateway.

Give each device group its own access VLAN with its own subnet and gateway (an SVI or router subinterface). A VLAN is a separate broadcast domain, so traffic between, say, IoT sensors in VLAN 85 and user PCs in VLAN 15 has to be routed by the gateway, which is where an ACL or firewall policy can filter it. That is what "Layer 3 separation" means.

Things that look like segmentation but are not:

• Different address ranges in the same VLAN, including a secondary subnet on the same SVI. The devices still share one broadcast domain: a device that is readdressed into the other range can ARP for its neighbours and reach them directly, bypassing the gateway.
• A port ACL on each port in a shared VLAN. It filters at the switch port, but both groups stay in one subnet and their traffic never reaches the gateway to be filtered there.
• Port security. It limits which MAC addresses may use a port; it does not separate groups.
• The voice VLAN. It only serves devices that tag their own frames (phones); a sensor or printer sends untagged frames and lands in the access VLAN.

Consequences of moving devices into a new VLAN

• Addressing. A device with a static address from the old subnet cannot reach a gateway after its port moves VLANs. Give it an address and gateway from the new subnet (or use DHCP). A switch also refuses a secondary SVI address that overlaps a subnet already configured on another of its interfaces, so "keeping the old gateway" in the new VLAN is not an option.
• Discovery. Unicast traffic, such as printing to a printer's IP address, is routed between VLANs normally. But automatic printer and device discovery uses broadcasts or link-local multicast, which routers do not forward, so devices in another VLAN stop appearing when users browse. That is a trade-off of segmentation, solved by deploying printer addresses by policy or with a discovery gateway, not by undoing the VLAN design.

IP cameras and many IoT appliances are both VLAN-assigned and PoE-powered, so one port configuration often combines switchport mode access, switchport access vlan and a power inline mode, each meeting a separate requirement.

A voice VLAN lets one access port carry two VLANs for a desk with an IP phone and a PC daisy-chained behind it: the phone tags its own voice frames with 802.1Q using the voice VLAN ID, while the PC's frames pass through the phone's internal switch untagged and join the access VLAN. The port remains an access port, not a trunk.

interface GigabitEthernet2/0/17
 switchport mode access
 switchport access vlan 25
 switchport voice vlan 225

The phone does not tag the PC's traffic, and DHCP does not tell the phone its VLAN: the phone learns the voice VLAN first, at Layer 2, and then requests an address in the voice subnet. If the access and voice VLANs are swapped in the configuration, the symptoms are mirrored: PCs get addresses from the voice subnet and the phone gets one from the data subnet. show interfaces <port> switchport shows both values (Access Mode VLAN and Voice VLAN), which makes the swap easy to spot.

The switch does not verify that the sender is a phone: any device that sends frames tagged with the voice VLAN ID is placed in the voice VLAN. An access port without a voice VLAN drops tagged frames; with a voice VLAN configured it accepts frames tagged with the voice VLAN ID (and only that ID), whatever device sent them. Keeping other devices out of the voice VLAN needs an additional control such as 802.1X.

Other keywords: switchport voice vlan dot1p makes the phone send 802.1p-priority frames with VLAN ID 0, so voice travels in the access VLAN (with priority marking); switchport voice vlan untagged sends voice untagged. Neither puts voice in a separate VLAN.

How the phone learns the voice VLAN

The switch advertises the voice VLAN to the phone with a discovery protocol:

• Cisco IP phones read it from CDP, which is enabled globally and on every interface by default. CDP therefore has to stay enabled on phone ports: with CDP turned off at the interface, a Cisco phone has no way to learn the voice VLAN and its voice traffic ends up untagged in the access VLAN.
• Third-party (standards-based) phones read it from the LLDP-MED network-policy TLV, which the switch fills from the same switchport voice vlan setting. LLDP is disabled by default on Catalyst switches, so these phones need lldp run globally (and LLDP not disabled on the port). Enabling CDP does nothing for a phone that does not run it.

DTP, VTP and STP are switch-to-switch protocols and never tell an end device which VLAN to use. CDP and LLDP as neighbour-documentation tools are exam topic 2.3.

Power over Ethernet (PoE) delivers DC power over the data cable from the switch (the power sourcing equipment, PSE) to a powered device (PD) such as a phone, AP or camera. The switch detects a PD, reads its IEEE class, and allocates power from the switch's (or module's) PoE budget. By default Catalyst switches allocate the class maximum at the port, measured at the switch, and a port is powered only if that allocation fits in the remaining budget.

Per class: Class 1 is allocated 4 W, Class 2 7 W, Class 3 15.4 W, Class 4 30 W. A Class 0 device gives no class information, so the switch allocates the full 15.4 W. Figures such as 12.95 W (af) and 25.5 W (at) are what the device receives after cable loss; the switch allocates the higher at-the-switch figures.

Budget arithmetic

With class-based allocation, a 500 W budget holding twenty-five Class 3 phones has 25 × 15.4 = 385 W allocated and 115 W left: enough for three more Class 4 devices (3 × 30 = 90 W) but not a fourth (120 W). Allocation counts the class maximum, not what the devices actually draw at that moment.

Reading show power inline

ACC-07# show power inline
Module   Available     Used     Remaining
          (Watts)     (Watts)    (Watts)
------   ---------   --------   ---------
1           740.0      727.6        12.4
Interface Admin  Oper    Power   Device  Class Max
--------- ------ ------- ------- ------- ----- ----
Gi2/0/9   auto   off     0.0     n/a     n/a   30.0

The top block is the budget; the per-port lines show the configured mode (Admin), whether power is being delivered (Oper: on, off, faulty, power-deny and so on), the allocation, the detected device and class, and the port's maximum. To diagnose an unpowered port, compare three things: the mode (must not be never), the port maximum (must be at least the device's class allocation) and the module's Remaining figure (must cover that allocation). In this output the mode and the 30 W maximum would allow a PoE+ device, but 12.4 W remaining is less than any Class 4 allocation, so such a device stays off until budget is freed. CDP or LLDP power negotiation can refine an allocation, but only after the device has been powered at its class level.

When the port cannot supply enough

The power inline commands set limits within what the port's hardware supports; they cannot make a PoE+ port deliver 60 W. A Class 6 AP on 802.3at ports needs an 802.3bt (Type 3 or Type 4) switch port or an 802.3bt midspan injector between the switch and the AP. Bundling two ports in a port channel aggregates bandwidth, not power. (Cisco's pre-standard UPOE also reaches 60 W, but it relies on Cisco-specific negotiation with the device; 802.3bt is the standard to look for.)

Each PoE port has a mode, set with the power inline interface command, that decides whether the port detects and powers devices and whether its power is guaranteed.

Choose by requirement: "must keep power even if the budget runs out" means static; "never power anything here" means never; "stay powered but alert on overdraw" means police action log. A max value only caps and policing only enforces; neither reserves power. errdisable recovery cause inline-power merely re-enables the port after a policing shutdown, so the device still loses power each time.

It depends on where the AP's client traffic enters the wired network. If client traffic is tunnelled to a controller, the AP port needs only the AP's management VLAN as an access port; if the AP bridges client traffic onto the wire itself, the port must be a trunk carrying each client VLAN.

A trunk to a local-mode AP would work, but it carries VLANs the AP never uses, which fails a least-privilege or "fewest VLANs" requirement. The port type must follow the AP's switching mode. When an AP's WLANs become locally switched, an access port drops the tagged client frames, so wireless clients fail while the AP's own untagged management traffic, and its controller join, still work.

The native VLAN on an AP trunk

APs usually send their own management (and CAPWAP) traffic untagged. A trunk places every untagged frame in its native VLAN, which is VLAN 1 unless changed. So on an AP trunk:

• the native VLAN must be the AP management VLAN (switchport trunk native vlan 150 in the example below), and
• that VLAN must be in the allowed list.

interface GigabitEthernet2/0/14
 switchport mode trunk
 switchport trunk native vlan 150
 switchport trunk allowed vlan 150,210,220

If the native VLAN is left at 1, the AP's management traffic lands in VLAN 1 (it gets an address from the VLAN 1 scope) or, when VLAN 1 is not allowed, is dropped, while clients on the tagged VLANs keep working. Allowing VLAN 1 forwards the frames into the wrong subnet; adding the management VLAN to the allowed list does not change where untagged frames go. The access VLAN and voice VLAN settings have no effect on a trunk. Native VLAN behaviour between switches is covered in exam topic 2.1.

A hypervisor host carries many VMs in different VLANs over the same uplinks, so its switch ports are usually trunks allowing every VLAN its port groups use. How the VLAN tag is applied, and whether the uplinks are bundled, are set on the host and must match the switch.

Port group VLAN IDs (vSphere standard switch)

VMs in a port group with VLAN ID 0 on a default trunk end up in VLAN 1 (the native VLAN); setting the port group's VLAN ID to the intended VLAN fixes it from the host side. Readdressing a VM never changes its VLAN.

When one VLAN is missing from a host trunk, add it with switchport trunk allowed vlan add 235. Typing switchport trunk allowed vlan 235 without add replaces the list and cuts the VMs in every other VLAN; except 235 allows everything but 235.

NIC teaming and the switch

IP hash spreads one VM's flows across both uplinks, so the switch must see the two ports as one logical link; with separate ports it would see the VM's MAC flap between them. LACP toward a standard switch never forms because the host sends no LACPDUs, so if negotiation is required the uplinks must move to a distributed switch LAG. Microsoft's Switch Embedded Teaming supports only switch-independent mode: requests to bundle its ports with LACP or a static channel cannot be met while SET stays. A port channel can only be built across two switches if they act as one (a stack or similar); two independent switches each need ordinary trunks.

An appliance such as a firewall or router that uses 802.1Q subinterfaces sends and expects tagged frames, so its switch port must be a trunk allowing every subinterface VLAN. An access port sends only untagged frames and drops the appliance's tagged ones, so none of the VLANs work. Most appliances (firewalls, servers) do not run DTP, so set switchport mode trunk explicitly.

Watch the native VLAN. The switch sends native VLAN traffic untagged, and untagged frames arrive on the appliance's physical interface, not on a subinterface. If the physical interface has no address and a user VLAN such as VLAN 115 is the trunk's native VLAN, VLAN 115 fails while every tagged VLAN works. Fix it on the switch by moving the native VLAN to an unused VLAN (for example switchport trunk native vlan 888), so VLAN 115 is tagged like the others, or on the appliance by marking the matching subinterface as native. Making a different user VLAN native just moves the fault.

interface GigabitEthernet2/0/44
 switchport mode trunk
 switchport trunk native vlan 888
 switchport trunk allowed vlan 115,125,135

If the appliance bundles two ports with LACP and carries its subinterfaces on the bundle, both requirements apply at once: the switch's Port-channel interface is a trunk allowing those VLANs, and its members use an LACP mode compatible with the appliance (see the next section).

A port channel (EtherChannel) bundles several physical links into one logical link; toward a server or appliance it is usually negotiated with LACP (IEEE 802.3ad/802.1AX), configured with channel-group <n> mode <mode> on each member. Building switch-to-switch EtherChannels is covered in exam topic 2.1; this section focuses on the host side.

• Passive + passive: nobody initiates, so the links stay individual. If the appliance is fixed in passive, set the switch to active.
• On + passive: the switch bundles and hashes traffic across both links without negotiating, but the passive device never receives an LACPDU, so it does not bundle and uses only one port. Frames hashed to the other port are lost, giving intermittent packet loss. Use active.
• Changing the LACP rate (lacp rate fast) only changes how often LACPDUs are sent; it does not create an initiator.

Member consistency

Every member must be compatible with the port channel: the same switchport mode, the same access VLAN (or allowed and native VLANs on a trunk), and the same speed and duplex. A mismatched member is suspended, shown as (s) in show etherchannel summary, while working members show (P) (bundled). Descriptions and LACP port priority do not have to match, and on a stack the members may sit on different stack members.

DIST-2# show etherchannel summary | begin Group
Group  Port-channel  Protocol    Ports
------+-------------+-----------+---------------------
6      Po6(SU)         LACP      Gi2/0/27(P) Gi2/0/28(s)

Make Layer 2 changes on the interface Port-channel, which pushes them to every member together. Changing members one at a time suspends the first until the second matches, and removing the channel-group rebuilds the bundle from scratch.

Load balancing is per flow, at each end

A port channel does not split a flow across members. The sender hashes header fields (MAC, IP and/or Layer 4 port, depending on the method) to choose a member, so every frame of one flow takes the same link and stays in order. Consequences:

• A single TCP session never exceeds one member's speed, whatever the hash method or member count. Only a faster link (or several sessions) raises it.
• port-channel load-balance is a global command on Catalyst switches, applying to every port channel on the switch, and it steers only frames the switch transmits. The server or appliance hashes its own outbound traffic with its own policy; the two do not have to match and LACP does not compare them.
• The hash method has to vary for the traffic to spread. A MAC-based hash (the Linux bond default, layer2) sees one destination MAC for all off-subnet traffic, the default gateway's, so it picks one member for all of it; an IP- or port-based hash (layer3+4) varies per flow. Whichever end transmits the traffic is the end whose hash method matters.
• When a member fails, the bundle stays up and its flows are rehashed onto the surviving members. The logical port stays up, so losing one member triggers no spanning-tree topology change (some platforms recalculate the port-channel cost); only frames in flight on the failed link are lost.