MGMT vlan

[avilt]

I have 2 L2 switches, one in DMZ and one in LAN. I would like to set a single dedicated vlan for these tqo switches. What is the best option?

a) Is it by creating a same vlan on both switches and then connect a cable between DMZ and LAN switch. Configure this port as access port to prevent vlan from DMZ crossing into LAN switch.

b) Is it by defining the port as trunk and define allowed vlan?

c) What is the best option?

[James Leinweber · Accepted solution]

If you are only sharing a single vlan across the switches, you could connect them using access ports.  More commonly you are sharing multiple vlan's, and that requires using 802.1q tags and trunk ports.  On catalyst switches the trunk configuration can look like:

vtp mode transparent

!

vlan internal allocation policy ascending

vlan dot1q tag native

!

vlan 400

name SECURITY_NATIVE

vlan 500

name V500

vlan 501

name V501

vlan 502

name V502

!

interface FastEthernet0/1

description Fa0/1_TRK

switchport trunk encapsulation dot1q

switchport trunk native vlan 400

switchport trunk allowed vlan 1,500-502

switchport mode trunk

switchport nonegotiate

-- Jim Leinweber, WI State Lab of Hygiene