VLAN

VLANs (Virtual LANs) can be viewed as a group of devices on different physical LAN segments that can communicate with each other as if they were all on the same physical LAN segment. That is, in VLAN, a network of computers behave as if they are connected to the same wire even though they may actually be physically located on different segments of a LAN. VLANs are configured through software rather than hardware, and that make them extremely flexible.

VLAN provides the following benefits for switched LANs:

Improved administration efficiency
Optimized broadcast/multicast activity
Enhanced network security

The prompt for the Config VLAN mode is:

iS5Comm(config-vlan)#

base
To configure the base mode as 802.1Q VLAN-aware bridge mode in which the VLAN feature should operate on the switch or set the bridge mode as transparent, use the command base in Global Configuration Mode. This configuration is globally applied on all ports of the switch.
clear garp counters
To clear GARP counters for all ports on the switch, use the command clear garp counters in Global Configuration Mode.
clear mac-address-table
To clear the dynamically learnt MAC Addresses, use the command clear mac-address-table in Global Configuration Mode.
clear vlan statistics
To clear VLAN counters that maintain statistics information on a per VLAN basis, use the command clear vlan statistics in Global Configuration Mode. The counter is cleared for all available VLANs or for the specified VLAN. The statistics information contains number of unicast, broadcast, and unknown unicast packets flooded.
debug garp
To enable the tracing of the GARP sub module as per the configured debug levels, use the command debug garp in Privileged EXEC Mode. This command allows combination of debug levels to be configured (that is, more than one level of trace can be enabled or disabled).The no form of the command disables the tracing of the GARP sub module as per the configured debug levels. The trace statements are not generated for the configured trace levels.
debug vlan
To enable the tracing of the VLAN sub module as per the configured debug levels, use the command debug vlan in Privileged EXEC Mode. This command allows combination of debug levels to be configured (that is, more than one level of trace can be enabled or disabled).The no form of the command disables the tracing of the VLAN sub module as per the configured debug levels. The trace statements are not generated for the configured trace levels.
forward-all
To configure the forward-all port details for a VLAN to specify the ports that forward or do not forward all multicast group-addressed frames, use the command forward-all in VLAN Configuration Mode. The VLAN can also be activated using the vlan active command.The no form of the command deletes the forward-all port details for the VLAN and sets as none.
forward-unregistered
To configure the forward-unregistered port details for a VLAN to specify the ports that forward or do not forward multicast group-addresses frames for which no more specific forwarding information applies, use the command forward-unregistered in VLAN Configuration Mode. The VLAN can also be activated using the vlan active command.The no form of the command sets the forward-unregistered port details for all VLAN to default value.
group restricted
To configure the restricted group registration feature in a port, use the command group restricted in Interface Configuration Mode. This feature enables you to restrict the multicast groups learnt through GMRP learning.
interface range
To select the range of physical interfaces and VLAN interfaces to be configured, use the command interface range in Global Configuration Mode. The no form of the command selects the range of VLAN interfaces to be removed.
mac-address-table
To configure a static unicast or multicast MAC address in the forwarding database or configure the timeout period (in seconds) for aging out of dynamically learned forwarding information entry and static entry in the MAC address table, use the command mac-address-table in Global Configuration Mode. The no form of the command deletes a configured static Multicast or Unicast MAC address from the forwarding database or resets the maximum age of an entry in the MAC address table to its default value.
mac-map
To configure VLAN- MAC address mapping that is used only for MAC-based VLAN membership classification, use the command mac-map in Interface Configuration Mode. The no form of the command deletes the specified VLAN- MAC address mapping entry.
map protocol
To create a protocol group with a specific protocol and encapsulation frame type combination, use the command map protocol in Global Configuration Mode. The no form of the command deletes all groups that have the specified protocol and encapsulation frame type combination. The created protocol group is used for protocol- VLAN based membership classification. The specified protocol is applied above the data-link layer in a protocol template, and the frame type is applied in the template.
map subnet
To configure VLAN-IP subnet address mapping that is used only for subnet-VLAN based membership classification, use the command map subnet in Global Configuration Mode. The no form of the command deletes the VLAN-IP subnet address mapping entry. In subnet- VLAN based membership classification, the source IP address in received packet is matched to a VLAN ID using this mapping entry to perform VLAN membership classification.
name
To configure a name for the VLAN, use the command name in VLAN Configuration Mode. The no form of the command deletes the configured name for the VLAN.
port
To enable MAC-based VLAN, protocol- VLAN based, and subnet-based VLAN membership classification in a port, use the command port in Interface Configuration Mode. The no form of the command disables all types of VLAN membership classification or a specified VLAN membership classification in the port.
ports
To statically configure a VLAN entry with the required member ports, untagged ports and/or forbidden ports, and activate the VLAN, use the command ports in VLAN Configuration Mode. The VLAN can also be activated using the vlan active command.The configuration defines the tagged and untagged member ports that are used for egress tagging of a VLAN at a port. The no form of the command deletes the specified port details for the VLAN. Static ARP cache entry related to the static MAC address of this specific port and VLAN should be removed while removing a port from the VLAN. The member ports cannot be set empty for the VLAN, once the member ports details are configured for that VLAN.
port-security trap-syslog
To configure the security violation trap and syslog with Max rate, use the command port-security trap-syslog in Global Configuration Mode.
port-security violation
To configure the security violation status for the specified port, use the command port-security violation in Global Configuration Mode.
protocol-vlan
To enable protocol- VLAN based membership classification on all ports of the switch, use the command protocol-vlan in Global Configuration Mode. The no form of the command disables protocol- VLAN based membership classification on all ports of the switch. VLAN membership classification is done for all untagged and priority-tagged frames based on the port-protocol group / higher layer protocol for the port.
set filtering-utility-criteria
To sets the filtering utility criteria to be applied on all ports, use the command set filtering-utility-criteria in Global Configuration Mode.
set garp timer
To enable or disable globally the GARP Multicast Registration Protocol ( GMRP) feature on all ports, use the command set garp timer in Interface Configuration Mode. GMRP uses the services of GARP to propagate multicast information to the bridges in a LAN. This information allows GMRP aware devices to reduce the transmission of multicast traffic to the LANs, which do not have any members of that multicast group. GMRP registers and de-registers the group membership information and group service requirement information with the GARP.
set gmrp
To enable or disable globally the GARP Multicast Registration Protocol ( GMRP) feature on all ports, use the command set gmrp in Global Configuration Mode. GMRP uses the services of GARP to propagate multicast information to the bridges in a LAN. This information allows GMRP aware devices to reduce the transmission of multicast traffic to the LANs, which do not have any members of that multicast group. GMRP registers and de-registers the group membership information and group service requirement information with the GARP.
set gvrp
To enable or disable globally the GVRP feature on all ports, use the command set gvrp in Global Configuration Mode. GVRP uses the services of GARP to propagate VLAN registration information to other VLAN-aware bridges in a LAN. This information allows GVRP aware devices to dynamically establish and update the information about the existence of the VLANs in a topology. The GVRP registers the created VLANs with GARP and de-registers the deleted VLANs from the GARP.
set mac-learning
To configure the global MAC learning status, use the command set mac-learning in Global Configuration Mode.
set packet-reflection
To enable or disable reflection status for the port, use the command set packet-reflection in Interface Configuration Mode.
set port
To enable or disable globally the GMRP or GVRP feature on a specified interface, use the command set port in Global Configuration Mode.
set sw-stats
To set the software statistics collection globally in the switch, use the command set sw-stats in Global Configuration Mode.
set unicast-mac learning
To enable or disable unicast- MAC learning feature for a VLAN, use the command set unicast-mac learning in VLAN Configuration Mode. The source MAC learning is not done in the switch when this feature is disabled for the VLAN.
set vlan traffic-classes
To enable or disable the traffic class feature on all ports, use the command set vlan traffic-classes in Global Configuration Mode.
show forward-all
To display all entries in the VLAN forward all table, use the command show forward-all in Privileged EXEC Mode. These entries contain forward-all details of all active VLANs in the switch. The details have VLAN ID and information regarding forwarding to all ports, all static ports, and all forbidden ports assigned to the VLAN.
show forward-unregistered
To display all entries in the VLAN forward unregistered table, use the command show forward-unregistered in Privileged EXEC Mode. These entries contain forward-unregistered port details of all active VLANs in the switch. The details have VLAN ID and information regarding unregistered ports, unregistered static ports and unregistered forbidden ports assigned to the VLAN.
show garp timer
To display the GARP timer information of all interfaces available in the switch / all contexts, use the command show garp timer in Privileged EXEC Mode.
show gmrp statistics
To display GMRP statistics for the specified port, use the command show gmrp statistics in Privileged EXEC Mode.
show gvrp statistics
To display GVRP statistics in the system or for the specified port, use the command show gvrp statistics in Privileged EXEC Mode.
show mac-address-table
To display all static / dynamic unicast or multicast MAC entries created in the MAC address table, use the command show mac-address-table in Privileged EXEC Mode. These entries contain VLAN ID, unicast / multicast MAC address, unicast backbone MAC address of peer backbone edge bridge, member ports, the type of entry (i.e. static, learn, etc.), and total number of entries displayed.
show port-security
To display port security related information for the specified interface or all interfaces created in the system, use the command show port-security in Privileged EXEC Mode.
show unicast port-security
To display port security related information for the specified MAC address and interface, use the command show unicast port-security in Privileged EXEC Mode.
show user-defined TPID
To display the configured user defined TPID allowable for Port/ Egress VLAN, use the command show user-defined TPID in Privileged EXEC Mode.
show vlan
To display all types of VLAN information, use the command show vlan in Privileged EXEC Mode.
shutdown garp
To shut down the Generic Attribute Registration Protocol ( GARP) module in the switch on all ports and release all memories used for the GARP module, use the command shutdown garp in Global Configuration Mode. The no form of the command starts and enables the GARP module in the switch on all ports. GMRP and GVRP are enabled explicitly, once the disabled GARP is enabled. GARP Multicast Registration Protocol ( GMRP) is a Generic Attribute Registration Protocol application that provides a constrained multicast flooding facility similar to IGMP snooping. GVRP (GARP VLAN Registration Protocol or Generic VLAN Registration Protocol) is the GARP -based protocol mechanism, maintaining the VLAN information in the switch dynamically. GARP is used to synchronize attribute information between the bridges in the LAN. It allows registering and unregistering of attribute values, which are disseminated into the backbone of the GARP participants.
shutdown vlan
To shut down the VLAN switching feature in the switch and release all resources allocated to the VLAN, use the command shutdown vlan in Global Configuration Mode. The no form of the command starts and enables VLAN switching feature in the switch. The resources required for the VLAN feature are also allocated to it.The VLAN feature allows to segment logically a shared media VLAN for forming virtual work groups.
switchport
To configure switch port related information, use the command switchport in Interface Configuration Mode. The no form of the command resets the configuration to default or disables the features.
user-defined TPID
To configure user defined TPID (Tag Protocol Identifier) allowable for Port/Egress VLAN, use the command user-defined TPID in Global Configuration Mode. The no form of this command deletes the configured user defined TPID allowable for a port/ Egress VLAN Ethertype.
vlan
To map an evaluated user priority to a traffic class on a port, configure the maximum number of traffic classes supported on a port, or set a restricted feature configuration, use the command vlan in Interface Configuration Mode. The maximum number of traffic classes supported on the port can be configured, only if the VLAN switching feature is started and enabled in the switch. The no form of the command resets the maximum traffic class value on the port to its default value and maps the default traffic class to the specified priority value on the port.
vlan
To activate a VLAN in the switch, set the VLAN egress Ethertype, set the loopback-related configuration, use the command vlan in VLAN Configuration Mode. The no form of this command resets the VLAN egress Ethertype to the default value.
vlan
To create a VLAN / VFI ID and enter into the config- VLAN mode in which VLAN specific configurations are done or configure the global MAC learning mode, use the command vlan in Global Configuration Mode. The no form of the command deletes the existing VLAN/ VFI and its corresponding configurations. Static ARP cache entry related to the static MAC address of this specific VLAN should be removed while removal of static VLAN.
Nested VLAN with sub-switch CLI command
The sub-switch command in the Global Configuration Mode provides a convenient way to create a nested VLAN that bridges tagged and untagged frames unaltered on chosen ports of the switch.
Nested VLAN with elementary CLI commands
While the high level sub-switch command provides an user-friendly way to set up a nested VLAN, such a VLAN can be also created with elementary CLI console or SNMP commands that will require more steps than these performed automatically by the sub-switch command.