1.1.c i Access ports

Access ports are the port type that a client device would typically connect to and are assigned only one VLAN. Access ports carry traffic from the assigned VLAN to and from the client device. 802.1Q tags are not included on packets transmitted or received on access ports.

Setting a port into access mode can be done with one command: switchport host

SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#int gi0/0
SW1(config-if)#switchport host
switchport mode will be set to access
spanning-tree portfast will be enabled
channel group will be disabled

1.1.c ii Trunk Ports (802.1q)

Ports configured as trunks, are capable of carrying multiple VLANs, typically between switches or between a switch and a router or firewall. When a packet arrives at a trunk port, the header is examined and traffic is associated with the appropriate VLAN contained in the VLAN ID. The 802.1Q headers are removed and then the traffic is forwarded toward the destination, based on the MAC address for that VLAN. 

As well as manually configuring trunk ports, switches by default, will dynamically attempt to form trunks with neighboring switches utilizing DTP (Dynamic Trunking Protocol). 

If both participating ports in a DTP conversation can successfully negotiate an agreement, the port will become a trunk.  DTP will send advertisements every 30s to neighbours.  In order for DTP to work, it requires the VTP domain to match on participating neighbours.  DTP has three modes: 

Trunk	This mode statically defines an interface as a trunk port and will advertise DTP packets to the other side of the connection in order to establish a dynamic trunk.  Command: switchport mode trunk
Dynamic Desirable	In this mode, the interface will act as an access port but will listen and advertise DTP packets in order to establish a dynamic trunk. Command: switchport mode dynamic desirable
Dynamic Auto	For Dynamic Auto, the interface will act as an access port, but will only listen for DTP packets, it will not advertise them. Command: switchport mode dynamic auto

DTP port modes

From the table above, you can see that the only way a trunk will not form, is if both ends of a link are in Dynamic Auto state, as neither side will ever advertise a DTP packet. 

DTP can be disabled on an interface with the command switchport nonegotiate.  This will prevent an access port ever changing its mode to trunk, and vice-versa. 

1.1.c iii Native VLAN

Traffic arriving at a trunk port that does not have a 802.1Q VLAN tag in the header is associated to the native VLAN. By default, this is VLAN 1, but can be configured on a per-interface basis to be any legal VLAN ID.

SW1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#int gi0/0
SW1(config-if)#switchport trunk native vlan ?
  <1-4094>  VLAN ID of the native VLAN when this port is in trunking mode

1.1.c iv Manual VLAN pruning

On trunk links, it is recommended to manually prune the VLANs that are not used. You can use VTP pruning if VTP is in use, but manual pruning (using a switchport trunk allowed VLAN) is a secure way of allowing only those VLANs that are expected and allowed on the link.

SW1(config)#int po 1
SW1(config-if)#switchport trunk allowed vlan ?
  WORD    VLAN IDs of the allowed VLANs when this port is in trunking mode
  add     add VLANs to the current list
  all     all VLANs
  except  all VLANs except the following
  none    no VLANs
  remove  remove VLANs from the current list

1.1.c v VLAN database

Configuration for VLAN IDs 1-1005 are saved in the ‘vlan.dat’ file located in flash memory. To display the contents of this file, use command; “show vlan”.

Note: If the device is running VTP in Transparent Mode, then VLAN configuration is also written to the running and startup configuration files.

1.1.c vi Normal range and extended range VLANs

Normal Range VLANs

• Identified by a VLAN ID between 1 and 1005.
• IDs 1002 through 1005 are reserved for Token Ring and FDDI VLANs.
• IDs 1 and 1002 to 1005 are automatically created and cannot be removed
• Configurations are stored within a VLAN database file, called vlan.dat.

Extended Range VLANs

• Are identified by a VLAN ID between 1006 and 4094.
• Support fewer VLAN features than normal range VLANs.
• Are, by default, saved in the running configuration file.
• VTP Version 1 & 2 do not learn extended range VLANs (VTP V3 supports extended VLANs).

1.1.c vii Voice VLAN

The Voice VLAN on a switch allows us to deploy two VLANs to an interface.  One for use by the VOIP handset, and the other is a data VLAN that can be used by a PC by plugging an ethernet cable into the appropriate spare port on the VOIP handset. 

Voice packets will be tagged by the IP phone/handset based on the CDP information advertised from the switch, these packets will only be consumed by the phone/handset.  The other VLAN present, will be untagged traffic. 

Although on first appearance, this would be considered a trunk port, it is actually defined by Cisco as a “multi-VLAN access port” and not a trunk port. 

1.1.c viii VTP

You can configure a switch to operate in any one of these VTP (VLAN Trunking protocol) modes:

• Server—In VTP server mode, you can create, modify, and delete VLANs and specify other configuration parameters, such as VTP version and VTP pruning, for the entire VTP domain. VTP servers advertise their VLAN configuration to other switches in the same VTP domain and synchronize their VLAN configuration with other switches based on advertisements received over trunk links. VTP server is the default mode.
• Client—VTP clients behave the same way as VTP servers, but you cannot create, change, or delete VLANs on a VTP client.
• Transparent—VTP transparent switches do not participate in VTP. A VTP transparent switch does not advertise its VLAN configuration and does not synchronize its VLAN configuration based on received advertisements, but transparent switches do forward VTP advertisements that they receive out their trunk ports in VTP Version 2.

VTP V2

VTP V2 is not much different than VTP V1. The major difference is that VTP V2 introduces support for Token Ring VLANs. VTPv2 supports a normal range of VLANs from VLAN 1 – VLAN 1005 (as does VTP V1)

VTP V3

Compared with VTP version 2, VTP version 3 is more secure and reliable (Fixes configuration revision overwrite problem). VTPv3 is able to support a VLAN ranges from VLAN 1006 to VLAN 4096.

VTPv3 has 2 roles in Server Mode:

• Primary Server Role
• Secondary Server Role

The Primary Server Role of VTPv3 retains all the features of VTPv2 Server Mode, it can modify VLANs and advertises the update to its switch members in the same domain. However, there is a restriction that in a VTP domain, only one switch can run the Server Mode. The Primary Server Role changes to Secondary Server Role when a switch is reloaded.

The Secondary Server Role of VTPv3 is not able to modify VLANs and their attributes. It is played as a back-up of the Primary Server Role switch and can be promoted to Primary Server Role when it is configured to be.

VTP Password

If you configure a password for VTP, you must configure the password on all switches in the VTP domain. The password must be the same password on all those switches. The VTP password that you configure is translated by algorithm into a 16-byte word (MD5 value) that is carried in all summary-advertisement VTP packets.

VTP Pruning

VTP pruning (Cisco proprietary) is a feature that you use in order to eliminate or prune unnecessary VLAN from a trunk and therefore all unnecessary traffic (sending traffic across the link if no one needs it makes no sense) .

In VTP versions 1 and 2, only VLANs 2-1001 are eligible for pruning.