Edge ports: VLANs, PoE, port channels and LACP for hosts, APs, phones and appliances

Why this matters

Most switch ports in a building face an end device, not another switch. A desk PC, a printer, a badge reader, an IP phone with a laptop behind it, a ceiling access point, a hypervisor host with two uplinks, a firewall. Each needs its port set up differently, and a network technician or help-desk analyst is the person who gets the ticket when one of them does not work: the phone that will not boot, the printer that cannot be reached, the virtual machine that lost its network after a change.

The settings are few: the VLAN, whether the port is an access port or a trunk, whether it supplies Power over Ethernet, and whether it is part of a port channel. Get them wrong and the faults are specific. A printer sits in a VLAN that does not exist. A phone draws no power. A controller-based access point is given a trunk it does not need, while a standalone one is given an access port that cannot carry its SSIDs. A server team is given a static bundle that its LACP never sees. This lesson works through each kind of device in turn.

The lesson

Desktop, printer, and IOT appliances

A desktop, a printer or an IoT device such as a camera or a badge reader sends untagged frames in a single VLAN. Its port should be a fixed access port:

SW1(config)# interface GigabitEthernet1/0/12
SW1(config-if)# description Desk 3.14 PC
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 20
SW1(config-if)# spanning-tree portfast
SW1(config-if)# power inline never

switchport mode access makes the port permanently an access port, so it never forms a trunk through DTP. Leaving it at the default, dynamic auto, would let a device that asks for a trunk get one. switchport access vlan 20 places the device's untagged frames in VLAN 20. A native VLAN setting does nothing on an access port.

spanning-tree portfast lets an edge port forward as soon as the link comes up. Without it, the port spends about 30 seconds in the listening and learning delays of classic spanning tree, and a desktop that asks for a DHCP address straight after boot can time out. PortFast is only for ports that face end devices; lesson 12 covers it with BPDU guard.

The VLAN must exist. If a port is assigned to a VLAN that is not in the VLAN database, it forwards nothing. show interfaces switchport gives it away:

SW1# show interfaces Gi1/0/6 switchport
Name: Gi1/0/6
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Access Mode VLAN: 30 (Inactive)

The fix for this printer is vlan 30 in global configuration. Making the port a trunk would not help, because the printer sends untagged frames in one VLAN.

IoT devices in their own VLAN. Cameras and badge readers are often poorly patched and should not share a broadcast domain with staff desktops. The simplest separation is to put them in their own access VLAN. Traffic between the IoT VLAN and the staff VLAN must then pass a router or a firewall, where it can be filtered (lesson 22). A voice VLAN is not a tool for this; it exists for IP phones.

Power over Ethernet. A switch can power an attached device over the same cable. The IEEE standards set the maximum power per port at the switch:

During classification, the powered device signals a class, which tells the switch which power range to reserve for it, so the switch can budget its total supply. Classes 1, 2 and 3 ask for up to about 4, 7 and 15.4 W; class 4 is PoE+, up to 30 W; classes 5 to 8 belong to 802.3bt. The class has nothing to do with QoS or VLANs.

The interface commands are:

• power inline auto: the default. Detect a powered device and power it.
• power inline never: no detection and no power. Use it on ports where policy says no powered device belongs.
• power inline static: reserve power for the port in advance.
• power inline police: limit how much a device may draw, and act if it draws more.

Wireless access points (standalone and controller based)

Access points draw power, often PoE+ or more, and their port depends on how they handle client traffic. Lesson 5 covers the wireless side.

A controller-based access point in local mode carries all client traffic inside CAPWAP tunnels to a wireless LAN controller such as a Catalyst 9800. The switch never sees the client VLANs; it sees only the AP's own management traffic. An access port in the AP management VLAN is enough:

SW1(config)# interface GigabitEthernet1/0/40
SW1(config-if)# description AP-3F-East (local mode)
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 60
SW1(config-if)# spanning-tree portfast

A standalone (autonomous) access point bridges each SSID onto its own VLAN by itself, so its port must be a trunk. Its management traffic is usually untagged, so the native VLAN is the management VLAN. For an AP that maps SSIDs to VLANs 10, 20 and 30 and manages itself untagged in VLAN 99:

SW1(config)# interface GigabitEthernet1/0/41
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# switchport trunk allowed vlan 10,20,30,99
SW1(config-if)# switchport nonegotiate

A native VLAN of 10 here would put the AP's management traffic into a client VLAN. A controller-based AP in FlexConnect mode that switches some SSIDs locally also needs a trunk, for the same reason: it is placing client traffic onto VLANs at the edge.

Voice over IP phone

An IP phone usually has a PC plugged into it, so one switch port carries two kinds of traffic. Cisco handles this with a voice VLAN on an access port:

SW1(config)# interface GigabitEthernet1/0/8
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# switchport voice vlan 150
SW1(config-if)# spanning-tree portfast

The access VLAN, 10, carries the PC's untagged frames. The voice VLAN, 150, is advertised to the phone, and the phone tags its own voice frames with 802.1Q VLAN 150. The port stays an access port:

SW1# show interfaces Gi1/0/8 switchport
Name: Gi1/0/8
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Access Mode VLAN: 10 (DATA)
Voice VLAN: 150 (VOICE)

Swapping the two numbers is a common error: the PC lands in the voice VLAN and the phone's voice traffic in the data VLAN.

A Cisco phone learns the voice VLAN through CDP. A third-party phone that does not run CDP learns it through LLDP-MED, whose network policy TLV advertises the voice VLAN and its priority. DTP only negotiates trunking, VTP shares VLAN databases between switches and PAgP builds port channels, so none of them tells a phone anything. Lesson 10 covers CDP and LLDP.

When a phone will not boot, check its power first. show power inline gives the administrative and operational state, the watts delivered, the device and its class:

SW1# show power inline GigabitEthernet1/0/9
Interface  Admin  Oper       Power   Device              Class Max
                             (Watts)
---------- ------ ---------- ------- ------------------- ----- ----
Gi1/0/9    auto   on         6.3     IP Phone 8841       2     30.0

show cdp neighbors is no help for an unpowered phone, because a phone sends CDP only after it has booted.

Virtualized hosts

A hypervisor host runs a virtual switch that tags each virtual machine's frames with its VLAN. The physical uplink therefore carries several tagged VLANs and must be a trunk. An access port carries only one data VLAN, and a voice VLAN is for phones, not virtual machines:

SW1(config)# interface GigabitEthernet1/0/20
SW1(config-if)# description esx-01 vmnic0
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 30,40
SW1(config-if)# switchport nonegotiate
SW1(config-if)# spanning-tree portfast trunk

switchport mode trunk on its own still sends DTP frames. switchport nonegotiate stops them, which suits a host that does not speak DTP. spanning-tree portfast trunk gives a trunk to an end host the same immediate forwarding as an edge access port.

When a new VM needs VLAN 50, enter switchport trunk allowed vlan add 50. Without add, the command replaces the list, and the VMs in VLANs 30 and 40 lose their network.

Hosts with two or more uplinks often team their NICs with LACP. The switch ports then become a port channel, as lesson 8 explained for switch-to-switch links. If the switch must start the negotiation, use mode active:

SW1(config)# interface range GigabitEthernet1/0/1 - 2
SW1(config-if-range)# channel-group 1 mode active
SW1(config-if-range)# exit
SW1(config)# interface Port-channel1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 30,40

Put the trunk settings on interface Port-channel1, which applies them to the logical link and its members. Configuring only Gi1/0/1 would leave Gi1/0/2 mismatched, and a mismatched member is suspended. Members must also match in speed and duplex. Their descriptions may differ. mode desirable is PAgP, which a server does not speak, and mode on builds a static bundle with no negotiation.

SW1# show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        S - Layer2      U - in use
Group  Port-channel  Protocol    Ports
------+-------------+-----------+------------------------
1      Po1(SU)         LACP      Gi1/0/1(P)  Gi1/0/2(s)

Here Gi1/0/2 was given a different allowed VLAN list from Po1, so it shows s, suspended. P marks a bundled member, I a stand-alone port that heard no LACP partner, and D a port that is down.

A two-link 1 Gbps bundle does not make one transfer run at 2 Gbps. The switch picks a member link by hashing fields such as source and destination addresses, so every frame of one flow follows one link. Both links stay active, and many flows between different hosts spread across them. The global command port-channel load-balance src-dst-ip hashes on both IP addresses. src-dst-mac also uses both ends, but for routed traffic every frame carries the same gateway MAC, so it spreads poorly.

Network appliances

Firewalls, load balancers and storage arrays connect to switches in the same ways as servers, and the same two decisions apply.

Trunk or access. A firewall that routes between VLANs 10, 20 and 30 using 802.1Q subinterfaces on one physical port expects tagged frames, so its switch port must be a trunk allowing VLANs 10, 20 and 30. An access port in VLAN 10 would leave the other two subinterfaces unreachable. A routed port with no switchport is wrong too: it would make the switch a Layer 3 peer instead of carrying the VLANs.

Which channel mode. If the appliance runs LACP, the switch must run LACP. Two switch ports set to channel-group 5 mode on toward a firewall configured for LACP never form a bundle on the firewall's side: mode on sends no LACP packets, so the firewall hears no partner. It does not send PAgP either; PAgP is only for desirable and auto. The pairs that form an LACP bundle are active with passive and active with active. Passive with passive never starts.

For a storage appliance on Gi1/0/3 and Gi1/0/4, the members must match in speed and duplex and in their access VLAN or allowed VLANs. The interface description, CDP state and port numbering do not matter.

What the exam is really asking

• Device to port type. Desktops, printers, IoT and local-mode APs get access ports. Standalone APs, hypervisors and appliances with subinterfaces get trunks.
• Access VLAN vs voice VLAN. The PC is untagged in the access VLAN; the phone tags voice frames with the voice VLAN. The port stays an access port.
• CDP vs LLDP-MED for telling a phone its voice VLAN.
• PoE figures. 15.4 W for 802.3af, 30 W for 802.3at, 60 W and 90 W for the two 802.3bt types. The class is a power request.
• power inline never vs auto. Never means no power; auto is the default.
• (Inactive) means the VLAN does not exist. Create it.
• allowed vlan add keeps the existing list.
• LACP pairs. Active forms with active or passive. Mode on never forms with LACP.
• Suspended means mismatched. Configure the port-channel interface, not one member.
• One flow, one link. A bundle adds capacity across flows, not to a single flow.