Virtual LANs (VLAN) | 631
To configure a port so that it can be a member of an untagged and tagged VLANs, follow these steps:
Enable Null VLAN as the Default VLAN
In a Carrier Ethernet for Metro Service environment, service providers who perform frequent
reconfigurations for customers with changing requirements occasionally enable multiple interfaces, each
connected to a different customer, before the interfaces are fully configured. This presents a vulnerability
because both interfaces are initially placed in the native VLAN (VLAN 1) and for that period customers
are able to access each other's networks. FTOS has a null VLAN to eliminate this vulnerability.
When you enable the null VLAN, all ports are placed into by it default, so that even if you activate the
physical ports of multiple customers, no traffic is allowed to traverse the links until each port is place in
another VLAN.
To disable the default VLAN, use the following command:
Step Task Command Command Mode
1 Remove any Layer 2 or Layer 3 configurations from the interface. INTERFACE
2 Configure the interface for hybrid mode.
portmode hybrid
INTERFACE
3 Configure the interface for switchport mode.
switchport
INTERFACE
4 Add the interface to a tagged or untagged VLAN.
[tagged | untagged]
VLAN INTERFACE
Note: You cannot configure an existing switchport or port channel interface for Native VLAN. Interfaces
must have no other Layer 2 or Layer 3 configurations when entering the command portmode hybrid or a
message similar to Message 1 is displayed.
Message 1 Native VLAN Error
% Error: Port is in Layer-2 mode Tengig 5/6.
Task Command Syntax Command Mode
Disable the default VLAN, so that all ports belong to
the Null VLAN until configured as a member of another
VLAN.
default-vlan disable
Default: the default VLAN is enabled
(no default-vlan disable).
CONFIGURATION
To Next Page
Loading...
