03-25-2018 12:59 PM - edited 03-08-2019 02:23 PM
Hello, I have a pair of ports on opposing switches configured as port channels. One side has a different native VLAN to the other.
From switch 1, I cannot ping devices on switch 2 in VLAN 46. What exactly is causing this to fail ?
Thank you.
Switch 1:
interface Port-channel5
switchport trunk native vlan 46
switchport trunk allowed vlan 10,46
switchport mode trunk
end
Switch 2:
interface Port-channel5
switchport mode trunk
switchport trunk allowed vlan 10,46
switchport mode trunk
end
03-25-2018 01:37 PM
Hi,
With your configuration, when you ping hosts in VLAN 46 from Switch1, the frames leave Switch1 untagged - this is because VLAN 46 is the native VLAN on Port-channel5 of Switch1. However, when Switch2 receives the untagged frames, it will treat them according to its own native VLAN on Port-channel5, which is 1. And, since VLAN 1 is not present in the list of allowed VLANs on Po5 of Switch2, the switch will drop these frames. This is why your ping - nor any other connectivity in VLAN 46 - does not work.
In addition, STP on trunks would also be able to detect a mismatch in native VLANs, and block the ports for the mismatched pair of VLANs.
Obviously, the correct solution is to make the native VLAN on both ends of the trunk the same.
Best regards,
Peter
03-25-2018 11:14 PM
I hope you checked the logs on your switch as getting "CDP: Native VLAN mismatch"(If CDP enabled) for the particular port-channel. Add same native VLAN at both switches as below:
Switch 1:
interface Port-channel5
switchport trunk native vlan 46
switchport trunk allowed vlan 10,46
switchport mode trunk
end
Switch 2:
interface Port-channel5
switchport mode trunk
switchport trunk native vlan 46
switchport trunk allowed vlan 10,46
switchport mode trunk
end
Regards,
Deepak Kumar
03-26-2018 07:47 AM
Hello,
to ping from SW1, it requires:
On my switches, the default for trunks is to tag the native VLAN
SW#show vlan dot1q tag native dot1q native vlan tagging is enabled
If not enabled, enabling this features on both switches prevents VLAN hopping attacks (and the native VLAN mismatch do not break connectivity)
Regards, Guillaume
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide