vlan x traffic block on trunk

[lnrdnl78d]

Hi ,

Can someone please explain me why a trunk link, between two cisco switch, not allow a vlan x  traffic if vlan x is not locally configured ?

In my lab I have three switch (2950 but it is the same with 2960 3750 etc).

Switch 1 is connected by trunk to switch 2 and switch 2 is connected by trunk to switch 3.

Switch 1 and switch 3 has configured vlan 10 and interfaces vlan 10 instead Switch 2 has not configured vlan 10

Vtp is disabled (transparent mode) in all switch

Switch 2 not permit switch1 to ping switch3 until I not configure vlan 10.

2950#sh int fa 0/9 status

Port      Name               Status       Vlan       Duplex  Speed Type
Fa0/9                        connected    trunk      a-full  a-100 10/100BaseTX
2950#sh int fa 0/9 trun

Port        Mode         Encapsulation  Status        Native vlan
Fa0/9       on           802.1q         trunking      1

Port      Vlans allowed on trunk
Fa0/9       1-4094

Port        Vlans allowed and active in management domain
Fa0/9       1-2,11,101

Port        Vlans in spanning tree forwarding state and not pruned
Fa0/9       1-2,11,101
2950#sh vtp status
VTP Version                     : 2
Configuration Revision          : 0
Maximum VLANs supported locally : 128
Number of existing VLANs        : 8
VTP Operating Mode              : Transparent
VTP Domain Name                 : daniele
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0x63 0x6C 0xF9 0xF6 0xB9 0xDC 0xBE 0xF3
Configuration last modified by 192.168.0.103 at 0-0-00 00:00:00
2950#

It seem that vlan 10 is pruned but I don't understand why (vtp is disabled)

Thanks a lot for you help

Daniele

[Salman Aghayev · Accepted solution]

Hi lnrdnl78d,

Because all switches are in VTP transparent mode. None of them genereting vlan info and sending to other abount new vlan.

[lnrdnl78d]

Hi Salman

Thanks a lot for your time.

In my understanding switch 1 (has vlan 10 configured and int vlan 10)  to ping switch 3 (has vlan 10  and int vlan 10) send arp request frames untagged in all own "ports access vlan 10" and tagged frames to all trunk links.

When the tagged frames (tagged vlanID=10) arrived at switch 2 (has not vlan 10 ) It should forward tagged frames to all trunk port, except incoming port  and so these tagged frames should arrive at switch 3.

This not happens if switch 2 has not vlan10 in his vlan database
Is there something wrong in my understanding  ?

Thankyou in advanced

[Salman Aghayev]

Hi lnrdnl78d ,

Let me explain my understanding. you are right if switch doesn't know where to send frame it sends arp request to learn destination mac address. And after learning destination address switch adds  that mac to its mac address table. But in this situation there is no mac address table for vlan 10. In case if  switch learns mac address it would not be able to add that address anywhere. So switch dropps this frame

[whiteside998]

Hi lnrdnl78d,

so will give this ago not quite sure how a uploaded images looks,

i have mocked up what i have understood from your explanation so feel free to correct me if i have got this wrong :) 

however assuming in this situation that VTP is enabled (which i know you have disabled in yours, but hoping this helps)

in this situation client 1 sends a broadcast to client two.

with VTP pruning enable switch 2 will learn that switch 4 has no ports connected to VLAN 2

so the trunk link to Switch 4 will have VLAN 2 pruned from the trunk link

but   2 and 3 will receive the broadcast and switch 3 will be the only one to forward it out the connected port

from my understanding this is what you have configured in your lab apart from switch 4 but added it to fit the example

does this help demonstrate it at all or am i way off ?

[whiteside998 · Accepted solution]

Hi inrdni78d

with VTP in transparent mode the VLAN 10 will not be dynamically created on any switch.

you will need to manually create VLAN 10 on switch 2 to successfully pass traffic over the trunk from switch 1 to 3

without VLAN 10 on switch two the traffic will be dropped as VLAN 10 does not exsist.

this can be seen from the trunk output which i assume is from switch 2

Port        Vlans allowed and active in management domain
Fa0/9       1-2,11,101

but if i have miss understood let me know and happy to try again  :)

[Salman Aghayev]

whiteside is right,

if vlan doesnt exist on switch switch will not forward ethernet frame. because appropirate mac table doesnt exist and switch doesnt know to where forward the packet

[lnrdnl78d]

Hi,

The question is that when a switch has not the approprate mac address in his CAM it forwards the frames to entire  broadcast domain (vlan x layer 2 domain ) and in all trunk port.

This is the mechanism to fill the mac-address table.

My question is why switch need to has in its vlan-database a vlan that it have only to forward to trunk links

I've not found any Cisco documentation  that say it but pratically is so.
Do you know if other vendor switch works at the same way ?

Thanks a lot
Daniele

[lnrdnl78d]

Hi guys

I've read other Cisco documents and  I believe that it is a reasonable Cisco system behavior.

In fact for CIsco Vlan x can pass the trunk only if it is:

-1) Allowed

-2) Active

-3) Forwarded in stp and not pruned.

About point 2 Cisco permits to deny a vlan traffic over trunk using : (config-vlan)#shutdown command and so if a vlan doesn't exist in local database system doesn't know if permit or deny that vla.

About point 3 the question is that everytime that one vlan is created system run a new spanning-tree session (to avoid  loop). If vlan doesn't exist no spanning-tree session is active for that vlan.

So if system permits to unknown vlan to pass trunk it could happens loops without an way to detect or debug the cause. Furtermore this could be a door for denial of service attack.

So at the end I've undestood why is correct  that sytem block vlan not present il local database.

Thankyou to all for your support, I've have very appreciate your answers

Daniele

[Salman Aghayev]

lnrdnl78d you are welcome.