VLAN creep.

[cmatthias]

I have a Lan to Lan service connecting a remote office ( fiber metro area network) to our central office. I have the central office uplink switch port Te1/1/25 assigned to Vlan 242, the switch port at remote office does not have a VLAN assignment.  However workstations at the remote office are picking up other Vlans like 116 and 245. Do I need to assign VLAN 242 to the remote switch port Te1/1/1 also? 

Remote office uplink port is configured as follows
interface TenGigabitEthernet1/1/1
description  Uplink to CO
switchport mode access
device-tracking attach-policy IPDT_MAX_10
spanning-tree portfast
end

Central office uplink port is configured as follows

Interface TenGigabitEthernet1/1/25
description Uplink to RO
switchport
switchport mode access
switchport access vlan 242
end

VLAN 242 configuration

Interface Vlan242
description RO 
ip address 10.0.242.254 255.255.255.0
ip helper-address 10.1.1.100
end

[Richard Burts · Accepted solution]

We do not have enough information about your situation to be able to identify your issue. Perhaps if we had more detail to work with we might provide better suggestions. But based on what we know so far I have these comments:

- you comment that "the switch port at remote office does not have a VLAN assignment" The remote office might not have a specific vlan assignment but it would have a default vlan assignment which is to vlan 1.

- it might look like an issue if the remote office port is assigned to vlan 1 while the central office is in vlan 242. But as long as both ports are configured as access ports then the difference in vlan membership does not matter. You ask if the remote switch port should be assigned to vlan 242. The answer to that depends on how the remote switch is configured. If the remote switch ports are all in the default vlan (vlan 1) then there is no benefit in assigning the switch port to vlan 242 (and if you do that then all the other switch ports need to be assigned to that vlan.

- you say "are picking up other Vlans like 116 and 245". This is puzzling. If they are picking up other vlans then it suggests that something is configured as a trunk. To understand this we need more information about how the remote switch is configured. As a starting point it might be helpful to see the output of these commands on the remote switch

show vlan

show interface trunk

At some point we will probably need to see the complete configuration of the remote switch.