Switch Control Plane Traffic

[parthrawat979]

I want to know about how a Switch forward it's control plane traffic like cdp/vtp/dtp messages on a trunk. Will they be forwarded with tag or untagged and why??

[Joseph W. Doherty]

I believe (?) they are always untagged.

If true, as to why that might be, possibly for multiple reasons.  As you've mentioned, they are control plane traffic intended for physically connected peers.  I.e. they shouldn't be forwarded as logically they really don't belong to a VLAN (although Cisco docs describe them as being part of VLAN 1).

If untagged, it likely saves some processing overhead.  (One might laugh at that, today, but consider hardware, especially small routers, at the time these protocols were defined.  Additionally, ISL tagging consumes more bandwidth too, especially very low bandwidth WAN links, like dial-up.)

[Joseph W. Doherty]

Just to muddy the waters, say you have an access port on VLAN 5 with a voice VLAN of 10, and a Cisco VoIP phone operating on, as might be expected, VLAN 10.  Optionally, perhaps another device, attached to the phone, CDP capable.

What CDP packets are present, and are they tagged, and if tagged, with what VLAN ID?

[Cristian Matei]

Hi,

    In order for it to make sense, you have to first ask yourself. Which control-plane protocols have any kind of dependency with the concept of a VLAN?

1. ARP is one protocol that has VLAN dependency. As ARP packet travels from one switch to another, you want the receiving switch to associate that ARP request packet with a specific VLAN, so that it known in which ports is allowed to forward it; thus ARP packets will be either untagged (if traveling across access ports), either untagged (if travelling across trunk ports but packet belongs to the native vlan), either tagged (if travelling across trunk ports but packet does not belong to the native vlan).

2. STP, if running 802.1d or 802.1w, as Cisco runs one STP instance for each VLAN, result being the STP port role and state is per VLAN, thus there needs to be STP packets being sent for each VLAN and the receiving switch needs to associate each of the received BPDU's with the correct VLAN, based on STP packets being untagged or tagged with correct tag number; in which case STP packets will either untagged (if traveling across access ports), either untagged (if travelling across trunk ports but packet belongs to the native vlan), either tagged (if travelling across trunk ports but packet does not belong to the native vlan); e.g on a trunk port with VLAN's 1,100,200 allowed and native vlan being 1, STP packets for VLAN 1 will be untagged, STP packets for VLAN's 100 and 200 will be tagged

All other layer 2 control-plane packets are untagged, always, regardless of the port type (access or trunk) and regardless which VLAN's are allowed or not for the trunk type, as these protocols serve functions and scopes that have no dependency with the concept of a VLAN.

Thanks,

Cristian.

[Joseph W. Doherty]

OP didn't mention ARP or PVST, but nice distinction how those are VLAN specific, and have a scope beyond just a need to exchange data beyond a direct neighbor.

Hmm, if Cisco only supported classical STP, i.e. not VLAN aware, it too might always be untagged.  (Hmm, wonder what other hardware vendors do?  Also, wonder about LLDP, LACP, etc.?  Still, I agree you can make a distinction that most protocols that logically function within a VLAN domain, need to be tagged if on a trunk.  Those that don't logically function within a VLAN, wouldn't need to be tagged, they might be tagged, but it's logically unnecessary.)

[Cristian Matei]

Hi,

  As Cisco runs per VLAN STP / 802.1d and per VLAN RSTP / 8021.w, BPDU's for native VLAN are untagged, while BPDU's for all other VLAN's are tagged, this way the receiving switch can map incoming BPDU with VLAN / STP instance.

   The reason all other protocols are untagged is for simplicity, and because there's no need to tag it, not being VLAN dependent.

Thanks,

Cristian.

[Joseph W. Doherty]

As Cisco runs per VLAN STP / 802.1d and per VLAN RSTP / 8021.w, BPDU's for native VLAN are untagged, while BPDU's for all other VLAN's are tagged, this way the receiving switch can map incoming BPDU with VLAN / STP instance.

I agree, for PVST knowing the applicable VLAN, via a tag, is necessary.

The reason all other protocols are untagged is for simplicity, and because there's no need to tag it, not being VLAN dependent.

So you're saying for all protocols where there's no logical reason for a VLAN tag, Cisco NEVER tags such control plane protocol frames?

[Martin L]

untagged  on  dot1q (802.1Q) encapsulation by default but they could be tagged if you make manual changes (Native vlan is other then vlan #1).    Also, tagged on all ISL trunks.

Note that Vlan 1 is always used for control traffic (CDP, VTP, and PAgP,) !

Also see my reply to u in https://community.cisco.com/t5/switching/tagging/td-p/5357313

Regards, ML
**Have fun labbing!!!***
***Please Rate All Helpful Responses ***

[Cristian Matei]

Hi,

   Lots of documents make lots of statements. However, reality is that untagged layer 2 packets have nothing to do with native VLAN, as those layer 2 packet are not VLAN dependent, are just being sent over the interface, regardless of what the native VLAN is or if the native VLAN is allowed or not.

Thanks,

Cristian.

[Joseph W. Doherty]

Lots of documents make lots of statements. However, reality is that untagged layer 2 packets have nothing to do with native VLAN, as those layer 2 packet are not VLAN dependent, are just being sent over the interface, regardless of what the native VLAN is or if the native VLAN is allowed or not.

Agreed they do.  I would further stipulate even Cisco documentation isn't always error free.  Further, later IOS behavior might have been changed, so possibly newer platforms might have different behavior, but, again, you're saying unless the control plane protocol logically requires tagged frames, all such frames are never tagged, and any documentation saying otherwise is incorrect?

BTW, the first time someone mentioned ISL tagging such frames, which, I believe (?) expects all frames to be VLAN tagged, I can see perhaps why all control plane protocol frames being tagged as VLAN 1, being a default VLAN, being used for the VLAN ID.

[Cristian Matei]

Hi,

    Yes, any control-plane protocol that doesn't logically require tagged frames will go out untagged, regardless of what the native vlan is, if the native vlan is allowed on the trunk, or if any vlan is allowed at all over the trunk port; and any documentation stating otherwise, it' wrong.

    As for ISL, never bothered looking into it, however my 100% expectation for the protocol I've previously mentioned is the same, those will go out untagged, and without ISL encapsulation; as for protocols that are logically VLAN dependent, like STP, not sure how Cisco's STP implementation will behave over ISL trunk.

Thanks,

Cristian.

[Stefan Mihajlov]

@parthrawat979 On an IEEE 802.1Q trunk, control-plane protocols like CDP, VTP, and DTP are sent untagged, because they are Layer-2, switch-local control protocols. They are not associated with any user VLAN and must always be processed by the directly connected neighbor, so they are carried in the native VLAN (untagged) to guarantee interoperability and correct adjacency formation...

[balaji.bandi]

Cisco switch trunk port, control plane traffic like CDP, VTP, and DTP is handled differently based on whether it is VLAN-agnostic or VLAN-specific, and the specific configuration of your Native VLAN (if configured) - if not, always use VLAN1 as the default.

this my notes made long back 

[parthrawat979]

Which book is it from??

[M02@rt37]

Hello @parthrawat979 

On a trunk, control plane protocols like CDP, VTP, and DTP are sent untagged because they use reserved L2 multicast MAC addresses and are not associated with any VLAN.

Sending them untagged ensures they are always received and processed corectly by directly connected cisco devices, independent of vlan config...