Data center

[prakashkamte]

Hi everybody,

What is the best practice in creating vlan for data center which is into data hosting and web hosting services

[Danilo Dy]

Hi,

Here are some

- Disable the default management VLAN1, use another (i.e. VLAN123) for management. This however may not be doable if you create a VTP Domain

- One VLAN per network/subnet or security segment

- Name the VLAN to their use/purpose or security segment

- Use VTP transparent mode if you are not creating a VTP Domain (by default all switch VTP is in server mode)

If you are creating a VTP Domain, the best practices recommendation differs. Some of them are;

- Configure primary and backup root bridge (don't make the election choose them)

- Set a VTP Domain password

- Choosing between ISL and 802.1Q depends on the feature (MST, PVST) that you want to use and also depends on the other equipment to be use (Netscreen, Checpoint, ASA VLAN Trunking).

Regards,

Dandy

[sbhadrav@cisco.com]

If you assign an access VLAN that is also a primary VLAN for a private VLAN, all access ports with that access VLAN will also receive all the broadcast traffic for the primary VLAN in the private VLAN mode
When you configure a port in access mode, you can specify which VLAN will carry the traffic for that interface. If you do not configure the VLAN for a port in access mode, or an access port, the interface carries traffic for the default VLAN (VLAN1).

You can change the access port membership in a VLAN by specifying the new VLAN. You must create the VLAN before you can assign it as an access VLAN for an access port. If you change the access VLAN on an access port to a VLAN that is not yet created, the system shuts that access port down.

If an access port receives a packet with an 802.1Q tag in the header other than the access VLAN value, that port drops the packet without learning its MAC source address.