No need of "no shut" command in SVI remote management of switch,why?

[Mumit]

In layer 3 switch , SVIs are by default shutdown. So, we have to enable it. But in layer 2 switch which we want to remotely manage, we don't need to type "no shut" command. 

For example:

int vlan 99
ip address 172.16.2.1 255.255.255.240
exit

Why? Why no need to type "no shut" command here? I had searched this questions' answer in many places, but the answer didn't convince me. So please help me. TIA.

[Gagandeep_Singh_1997]

when we configure routed vlan by default vlan interface is down . we manually up this interface in Layer 2 switch

[Aref Alsouqi]

I don't think that would be the case. For instance if you try to create a new SVI on an L2 or L3 switch that SVI wouldn't be up by default as soon as you finish its config without having to un shut it manually?

I think the default shutdown you would see is more for VLAN 1 SVI, and I think the reason behind it is more related to security rather than anything else. For instance an attacker could try to leverage VLAN 1 for a double tagging VLAN hopping attack, because it's the default VLAN the attacker would inject the outer 802.1q tag with VLAN 1 ID.

[pieterh]

on a L2 switch you have limited configuration options for an SVI compared to L3 switch
you may want to do more configuration (access-lists, routing-propagation, etc) before bringing the SVI "up". 

[Joseph W. Doherty]

If you're seeing the behavior you describe, possibly it's due to the logical difference in the two use cases.

On a L2 switch, such an interface provides an address for host management.

On a L3 switch, such an interface supports routing via it.

So, as the L2 case just provides connectivity to management of the switch, possibly it makes sense to default it to no shut, as it doesn't directly impact network operations.

Conversely, no shutting a L3 port, assuming routing is enabled, can very much impact the network.  Perhaps, it defaulting to being shut, is the equivalent of "are you sure?" when you no shut the interface.

Also, it somewhat mimics Cisco L2  switch ports which also default to no shut while router ports also default to shut.

[Ramblin Tech]

In ancient times (25+ years ago), the common belief within Cisco's routing and switching Business Units was that a switch customer wanted to pull a new switch out of the box, plug in all the Ethernet cables, power up, and have this new network more or less functional. This led to all ports defaulting to "up", being associated with VLAN 1, and being untagged access ports. These defaults covered a great number of new customer installations, particularly those replacing hubs with switches for the first time. More sophisticated customers could enable the more sophisticated features as they were needed.

Router customers, OTOH, were always seen as needing to be more sophisticated starting with the initial installation. That is, there was no default configuration for a router that would be useful for any meaningful set of customers. This led to all ports defaulting to "shutdown" (for security purposes) and no initial configs. Router customers, in addition to plugging in cables, would have to actively make configuration changes to get anything to work, rather than more passively just plugging in cables as with a switch. We can still see artifacts of those philosophical beliefs today in different defaults of switches vs routers.

[Joseph W. Doherty]

"Ancient", 25+ years, eh?  Like, last century!?  Ouch, you're making me feel old; I resemble that, laugh.

Additionally, also keep in mind, ancient hubs or switches (and even consumer current switches) may come without management capability, so they wouldn't work very well with shut ports.  ; )

Routers, though, sort of "demand" configuration, both back in ye olde tymes, and today.

[MHM Cisco World]

Vlan have two port 

-Vlan in vlan db is UP when there is l2 port assign to this vlan or this vlan allow in trunk 

-vlan svi' this depend if it vlan1 I think you dont need "no shut" if other vlan ypu sure need "no shut"

MHM