CCNA Trunks, LACP EtherChannel, Routed Ports and SVIs

A Layer 2 interface (a switchport) forwards Ethernet frames inside one or more VLANs and cannot hold an IP address; a Layer 3 interface (a routed port) behaves like a router interface: it takes an IP address directly, belongs to no VLAN and takes no part in spanning tree. Catalyst switch ports are switchports by default. The command no switchport turns a physical port on a multilayer switch into a routed port, and switchport turns it back.

interface GigabitEthernet1/0/48
 no switchport
 ip address 10.0.0.1 255.255.255.252

If you type ip address on a port that is still a switchport, IOS rejects it, because only Layer 3 interfaces (routed ports, SVIs, Layer 3 port-channels and router interfaces) accept an address. ip routing is a different thing: it is a global command that lets the switch route between its Layer 3 interfaces, and it does not change any port's type.

To tell which kind a port is, read show interfaces <port> switchport. A routed port reports Switchport: Disabled; the interface can still be up/up, but no VLAN crosses it. That is the usual explanation when a link that "should be a trunk" is up yet carries none of its VLANs after a change.

Three ways to connect a multilayer switch to a router

All three forward traffic. When a design says no VLAN or spanning-tree instance may extend onto the router link, only the routed port meets it.

An 802.1Q trunk carries several VLANs over one link by inserting a 4-byte tag holding the VLAN ID into each frame (except the native VLAN, covered below). A trunk forms either because both ends are configured statically, or because the Dynamic Trunking Protocol (DTP), a Cisco protocol, negotiates it. Cisco recommends configuring trunks statically and turning DTP off.

The rule behind the table: at least one end must ask. Dynamic auto on both ends never trunks, because neither asks; both ports operate as access ports in their access VLAN (VLAN 1 by default), and only that VLAN crosses. On many Catalyst models the factory default is dynamic auto, which is why two new switches cabled together often fail to trunk. show interfaces <port> switchport shows both the configured Administrative Mode and the result, the Operational Mode (for example dynamic auto / static access).

switchport nonegotiate stops a port sending DTP frames. A trunk with nonegotiate therefore only pairs correctly with another static trunk: a dynamic auto neighbour never hears a request, and a dynamic desirable neighbour asks but gets no answer, so in both cases the neighbour stays an access port while the nonegotiate side trunks and tags frames, a mismatched link. To harden a link and still trunk, configure switchport mode trunk and switchport nonegotiate on both ends.

Some older platforms that support ISL also need switchport trunk encapsulation dot1q before a port can be set to trunk; current Catalyst switches support 802.1Q only. Encapsulation, allowed lists and native VLANs only matter once the link is actually trunking.

A trunk carries only the VLANs in its allowed VLAN list, which defaults to all VLANs (1–4094). The command form decides whether you replace the list or edit it, and that difference causes real outages.

Typing a bare list when you meant to add one VLAN leaves only that VLAN on the trunk and cuts every other VLAN; the repair is add with the missing VLANs. add and remove work relative to what is configured now, so remove on a short explicit list cannot produce "everything except". A hand-written range such as 1–1005 looks equivalent to except but misses the extended range (1006–4094). The native, access and voice VLAN commands also take a VLAN number, but none of them changes which VLANs a trunk carries.

Reading show interfaces trunk

show interfaces trunk narrows the VLAN list in three stages, and the stage where a VLAN disappears tells you the cause:

1. Vlans allowed on trunk: the configured allowed list.
2. Vlans allowed and active in management domain: allowed and existing (active) in the local VLAN database. A VLAN that is allowed but missing here has not been created on this switch; fix it with vlan <id>.
3. Vlans in spanning tree forwarding state and not pruned: of those, the VLANs this trunk is actually forwarding. A VLAN that exists and is allowed but is missing here is blocked by spanning tree on this port (or pruned).

A VLAN crosses a trunk only if it passes these checks on both switches, so each end must be read separately: one VLAN can fail the allowed-list check on one switch while another VLAN fails the "exists" check on the other. Note that show vlan brief lists access ports only and never shows trunk ports, so a VLAN that looks empty there may still be carried on a trunk.

The native VLAN is the one VLAN whose frames cross an 802.1Q trunk untagged; every other VLAN is tagged. It is VLAN 1 by default and is changed per trunk with switchport trunk native vlan 999. Many security standards move it to an unused VLAN. Each end puts untagged frames it receives into its own native VLAN, so both ends must agree. If they differ, untagged frames sent in one VLAN can be received into a different VLAN. On Cisco switches running PVST+ or Rapid PVST+ (the default), spanning tree usually catches this first and puts the affected VLANs on that port into a blocking (port VLAN ID inconsistent) state, so the practical symptom is often lost connectivity rather than leaked traffic. Either way, the configuration is wrong until both ends match.

CDP detects the mismatch and logs it, local side first and neighbour second:

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on
 TenGigabitEthernet1/1/3 (1), with DIST-B TenGigabitEthernet1/1/4 (777).

Here the local switch still uses the default native VLAN 1 and DIST-B uses 777. Changing either end removes the message; a site standard tells you which end is wrong. (CDP itself is covered in the CDP and LLDP lesson.)

Two details trip people up:

• The native VLAN is still subject to the allowed list. Setting a native VLAN does not add it to the trunk: if the native VLAN is left out of an explicit allowed list, that VLAN is not carried at all, and anything that lives only in it (often a management SVI) becomes unreachable across the trunk. Allowing the VLAN with add restores it.
• Untagged means untagged at the far end too. A device that expects VLAN 10 to arrive tagged, such as a router subinterface, will not receive VLAN 10 if the switch has made 10 its native VLAN (next section).

The global command vlan dot1q tag native makes a switch tag the native VLAN as well; it is a hardening option and does not take a VLAN off or onto the allowed list.

Router-on-a-stick routes between VLANs over one physical link: the switch port is an 802.1Q trunk, and the router splits its interface into one subinterface per VLAN, each with an encapsulation dot1Q VLAN ID and the gateway address for that VLAN.

interface GigabitEthernet0/0/1
 no shutdown
interface GigabitEthernet0/0/1.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0/1.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

What each side must get right:

• The switch port must be a static trunk (switchport mode trunk). Cisco routers do not run DTP, so a dynamic auto port facing a router waits for a request that never comes, stays an access port, and sends untagged frames that no tagged subinterface accepts.
• A subinterface needs its encapsulation before it accepts an IP address, and encapsulation dot1Q 10 without the native keyword matches only frames tagged 10.
• Untagged (native VLAN) traffic is received either by a subinterface configured with encapsulation dot1Q <vlan> native or by an IP address on the physical interface itself. If the switch's native VLAN is a VLAN the router expects tagged, that VLAN breaks while the others work; fix it by matching the native VLAN on both sides or by moving the switch's native VLAN to an unused one.
• Subinterfaces follow the physical interface. If the physical port is administratively down, every subinterface is down; no shutdown goes on the physical interface, which needs no IP address of its own.
• switchport commands do not exist on router interfaces, and a router routes IPv4 without any extra global command; ip routing is a multilayer-switch concern.

A switch virtual interface (SVI) is a logical Layer 3 interface for a VLAN, created with interface vlan <id>. It gives the switch an address in that VLAN: as the default gateway for the VLAN's hosts on a multilayer switch, or as the management address on a Layer 2 switch. An SVI serves the VLAN whose number it carries: the gateway for VLAN n belongs on interface Vlann, and an address on any other SVI sits in a different VLAN however similar the numbers look.

vlan 70
 name USERS-70
interface Vlan70
 ip address 192.168.70.1 255.255.255.0
 no shutdown

An SVI that is not shut down is up/up only when:

1. its VLAN exists and is active in the local VLAN database, and
2. at least one Layer 2 port carrying that VLAN is up and in spanning-tree forwarding: an access port in the VLAN, or a trunk that allows it.

This behaviour is called autostate. It means an SVI goes down when the last port carrying its VLAN goes down, and with it the connected route for that subnet leaves the routing table, so routing protocols stop advertising it. On a distribution switch with no access ports, the trunk is the only candidate, so a VLAN missing from the trunk's allowed list keeps the SVI down. IP routing, routes and native VLAN choices do not affect an SVI's line protocol.

IOS refuses an address whose subnet overlaps one already configured on another interface and names that interface, for example % 172.16.40.0 overlaps with Vlan30. To move an address between SVIs, remove it from the old SVI first, from the console or another management path, because removing it cuts any session using it.

A multilayer switch routes between its SVIs and routed ports only when ip routing is enabled. Without it the switch acts as a host: each SVI still answers pings from its own VLAN, but nothing is forwarded between VLANs, and show ip route shows a default gateway and an ICMP redirect cache instead of a routing table. IPv6 is controlled separately by ipv6 unicast-routing; until it is entered the switch answers pings to its own IPv6 addresses but does not forward IPv6 between interfaces or send router advertisements, so hosts learn no default router. ip cef selects the forwarding method and does not enable routing.

A routing switch ignores ip default-gateway. So once routing is on, off-subnet reachability depends on the routing table: a routing switch with only connected routes forwards between its own subnets and nowhere else, whatever ip default-gateway says. Disabling routing would make the default gateway apply again, but would also stop all inter-VLAN forwarding.

Managing a Layer 2 switch

A switch that does not route is managed through an SVI in the management VLAN. It needs:

• the management VLAN carried to it (usually on the uplink trunk),
• an address in the management subnet on that VLAN's SVI, with no shutdown (a physical switchport cannot hold an address), and
• ip default-gateway pointing at the router address on the management subnet, so it can answer hosts in other subnets.

If management access works from inside the management subnet but not from elsewhere, look at the default gateway first: it is missing, or it points at an address that is not on any subnet the switch is connected to, which IOS cannot use.

An EtherChannel (port-channel) bundles several physical links into one logical link: spanning tree sees one interface, so all members forward instead of all but one being blocked, and a member failure only reduces bandwidth. LACP (IEEE 802.3ad, now 802.1AX) is the standard protocol that negotiates the bundle; PAgP is Cisco's older proprietary one. The mode is set per member with channel-group <n> mode <mode>.

Failures follow from the table: passive on both ends never starts negotiation; desirable facing active means two different protocols that cannot recognise each other; on facing active leaves the active side waiting for LACPDUs that never come. The port-channel number is local to each switch and does not need to match the neighbour's.

show etherchannel summary gives two sets of flags:

So Po1(SD) with (I) members points to a negotiation problem, (s) to a parameter mismatch, and Po1(RU) with (P) members is a working routed bundle.

A port joins a bundle only if it is compatible with the other members on the same switch: same speed and duplex, same switchport mode (access, trunk or routed), and the same VLAN settings (access VLAN, or trunk allowed and native VLANs). A port that differs is suspended (flag s). A link that auto-negotiated 100 Mb/s instead of 1 Gb/s, usually a bad cable or a slower peer port, is suspended for the speed difference, which show interfaces status reveals. Descriptions, CDP settings and port numbering do not matter, and LACP port priorities are meant to differ when you rank ports.

The reliable way to keep members consistent is to configure trunk and VLAN settings on the port-channel interface (for example interface Port-channel1), which applies them to every member, including ones added later.

The consistency check is local. LACP does not exchange VLAN lists, so if two switches' port-channels allow different VLANs, the bundle still forms; each side applies its own allowed list, and a VLAN works only if both ends allow it.

Layer 3 EtherChannel

A Layer 3 port-channel is one routed interface over several links: one subnet, one routing adjacency, no spanning tree on the links, and no reconvergence when a member fails. Make the members routed ports first, bundle them, and put the address on the logical interface:

interface range GigabitEthernet1/0/1 - 2
 no switchport
 channel-group 1 mode active
interface Port-channel1
 ip address 10.0.0.1 255.255.255.252

If the members are still switchports, the port-channel is created as a Layer 2 interface (flag S) and rejects an IP address; convert the port-channel and its members with no switchport. An address on the member ports does not create a routed bundle. Compared with the alternatives: two separate routed links need two subnets and two adjacencies and rely on routing to react to a failure; a Layer 2 bundle with an SVI keeps a VLAN and spanning tree on the link.

EtherChannel does not split a single flow across links. Each switch hashes header fields chosen by port-channel load-balance <method> (global) and sends every frame with the same hash down the same member, which avoids reordering. A single flow therefore never exceeds one member's speed, however many members the bundle has; it is the mix of many flows that shares the total.

The method must use fields that vary across the traffic:

• Traffic from one server to many remote clients through a gateway always has the same source MAC, source IP and destination MAC (the gateway), so only dst-ip (or a combination including it) spreads it.
• Traffic that a multilayer switch has routed has its Ethernet header rewritten: source MAC = the switch's SVI, destination MAC = the next hop. MAC-based methods then hash everything the same, and a method that includes the varying IPs, such as src-dst-ip, is needed.

The method is a local, outbound decision. It is not negotiated by LACP and need not match between the two switches; each direction is simply spread by its sender's method.

Active links, hot-standby and min-links

An LACP port-channel can have up to sixteen compatible ports, but at most eight are active; the rest are hot-standby (flag H) and replace a failed active member. When more ports are offered than can be active, the switch with the better (lower) lacp system-priority decides which are active, using its own lacp port-priority values (lower is better) and then the lower port number. The other switch's port priorities are ignored.

Combine them by counting: hot-standby ports are promoted first, and only if the number of bundled members then falls below min-links does the port-channel go down. For example, with eight links, max-bundle 6 and min-links 5, losing four active links promotes both standbys to give four bundled members, below the floor of five, so the port-channel goes down. It is an ordinary down state, not an err-disable, so traffic can fail over to another path and the bundle returns on its own.