why would I limit specific vlans in a trunk with allowed vlan command?

[israelpadilla]

I mean, what could be a practical case of using this vlan limits

[Kasun Bandara]

saving bandwidth, improve security, increase performance of network

[Joseph W. Doherty · Accepted solution]

To expand a bit on what @Kasun Bandara described . . .

"saving bandwidth"

Blocking a VLAN, on a trunk, precludes broadcasts, unknown destination (switch) port unicast and unknown destination (switch) port multicast traffic from being sent across the trunk link.

"improve security"

If a VLANs traffic is not sent across the trunk, device on other side of the trunk, and all additional devices downstream do not have any way to tap into that VLAN traffic.  I.e. it's not physically present to access in any way.

"increase performance of network"

If trunk link and/or downstream device never physical "see" the excluded VLAN traffic, they never have to expend resources to process that traffic nor will that traffic contend/compete for resources.  Example of the former, receiving switch that doesn't have a need for the VLAN traffic to it, doesn't need to expend resources even dropping the undesired traffic.  Example of the latter, bandwidth on trunk link not used by excluded VLAN traffic available to other VLAN traffic.

[israelpadilla]

thank you all for the great explanation

[David Ruess]

...and in addition to what the above mentioned you don't have to run spanning-tree for a VLAN that doesn't exist on that part of the network. And since STP runs on a per VLAN instance (unless you're using MST) if you limit 20 VLANs from a trunk port you effectively stop 20 spanning-tree instances from running on that part of the network (this can be coupled with increased BW). Just trying to throw figures at the statements.

-David