Connecting switches and routers: L2/L3 interfaces, 802.1Q trunks, LACP EtherChannel and SVIs

Why this matters

A campus network is a set of access switches joined to distribution switches, which are joined to routers. Every one of those joins is a link someone configured. A network technician patching a new access switch into a closet, a junior network engineer adding a VLAN for a new department, and a help-desk analyst asked why one floor cannot reach the printers are all working on the same few things: whether a port is Layer 2 or Layer 3, which VLANs a trunk carries, whether a bundle of links really is bundled, and whether the gateway interface for a VLAN is up.

When these links are wrong, the symptoms are rarely loud. A trunk whose allowed list was replaced instead of extended drops two VLANs without an error. A native VLAN mismatch leaks frames from one VLAN into another. An EtherChannel member that does not match the others is quietly suspended, so the bundle runs at half its capacity. An SVI that is up but line protocol down leaves a whole VLAN with no gateway. The switching and network access domain is 25% of the blueprint, and these links sit under almost all of it.

The lesson

Layer 2/Layer 3 physical interfaces

A Layer 2 interface (a switchport) forwards Ethernet frames by MAC address inside a VLAN. It has no IP address of its own. Every port on a Catalyst switch is a switchport by default, and it is enabled by default.

A Layer 3 interface has an IP address and routes packets between subnets. A router's built-in interfaces are normally Layer 3, and router interfaces are administratively down until you enter no shutdown.

A multilayer switch, such as a Catalyst 9300, can do both. To turn one of its ports into a routed port, enter no switchport first. A switchport refuses an ip address command, so the order matters:

SW1(config)# ip routing
SW1(config)# interface GigabitEthernet1/0/24
SW1(config-if)# description Uplink to R1 Gi0/0/0
SW1(config-if)# no switchport
SW1(config-if)# ip address 10.0.0.1 255.255.255.252
SW1(config-if)# no shutdown

Two commands here are easy to confuse. no switchport is an interface command that changes one port from Layer 2 to Layer 3. ip routing is a global command that lets the switch route between its Layer 3 interfaces at all. Neither does the other's job. A routed port belongs to no VLAN, does not take part in spanning tree and carries no trunk. show interfaces GigabitEthernet1/0/24 switchport reports Switchport: Disabled once the change is made.

Both ends of a physical link must also agree on speed and duplex, and the cable must suit the distance. Lesson 1 covers those faults.

Layer 2 802.1Q trunk interfaces

An access port carries one VLAN, untagged. A trunk carries many VLANs over one link. To keep them apart, IEEE 802.1Q inserts a 4-byte tag into each frame, holding a 12-bit VLAN ID.

One VLAN on each trunk is the native VLAN. Its frames cross the trunk untagged, and untagged frames that arrive are placed in it. The default is VLAN 1. If you set switchport trunk native vlan 99 on both ends, VLAN 99 frames cross with no 802.1Q header at all, and every other allowed VLAN is tagged. The global command vlan dot1q tag native changes this so that native VLAN frames are tagged too, but it is off by default. Both ends must use the same native VLAN. If they do not, untagged frames from one VLAN land in another, and CDP logs a native VLAN mismatch (lesson 10).

A static trunk with a restricted VLAN list:

SW1(config)# interface GigabitEthernet1/0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# switchport trunk allowed vlan 10,20,99
SW1(config-if)# switchport nonegotiate

On an older Catalyst model that can trunk with either ISL or 802.1Q, the encapsulation starts as Auto and switchport mode trunk is rejected. Enter switchport trunk encapsulation dot1q first. Switches that support only 802.1Q, such as the Catalyst 9000 family, do not need it.

The allowed list. switchport trunk allowed vlan 30 does not add VLAN 30. It replaces the whole list, so a trunk that carried VLANs 10 and 20 now carries only VLAN 30. To extend the list, use switchport trunk allowed vlan add 30. The other keywords are remove, except and all.

DTP. Cisco's Dynamic Trunking Protocol lets two switch ports negotiate whether to trunk. The modes are:

• switchport mode access: never trunks.
• switchport mode trunk: always trunks, and still sends DTP frames.
• switchport mode dynamic desirable: asks the neighbour to trunk.
• switchport mode dynamic auto: trunks only if the neighbour asks. This is the default on current Catalyst switches.

So desirable with auto, desirable with desirable, and trunk with either dynamic mode all form a trunk. Auto with auto does not: each end waits for the other, and the link stays an access link. Do not mix a static access port with a static trunk port.

switchport nonegotiate stops a port sending DTP frames. It is accepted only with switchport mode trunk or switchport mode access, and refused on a dynamic port, because a dynamic mode needs DTP to work. A port facing a router, a firewall or a server should be switchport mode trunk plus switchport nonegotiate, since those devices do not run DTP.

The command that shows what a trunk is really carrying is show interfaces trunk:

SW1# show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi1/0/1     on               802.1q         trunking      99

Port        Vlans allowed on trunk
Gi1/0/1     10,20,99

Port        Vlans allowed and active in management domain
Gi1/0/1     10,20,99

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/1     10,20,99

Mode on means a static trunk. The last list is the one that matters for traffic: a VLAN missing from it is not crossing this trunk. show interfaces status only labels the port trunk, with no VLAN lists.

Trunking to a router. A router can route for several VLANs over one physical link using subinterfaces, a design called router-on-a-stick. Each subinterface takes one VLAN with encapsulation dot1Q, and the native keyword tells the subinterface that its VLAN arrives untagged:

R1(config)# interface GigabitEthernet0/0/1
R1(config-if)# no shutdown
R1(config-if)# interface GigabitEthernet0/0/1.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 10.10.0.1 255.255.255.0
R1(config-subif)# interface GigabitEthernet0/0/1.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 10.20.0.1 255.255.255.0
R1(config-subif)# interface GigabitEthernet0/0/1.30
R1(config-subif)# encapsulation dot1Q 30
R1(config-subif)# ip address 10.30.0.1 255.255.255.0
R1(config-subif)# interface GigabitEthernet0/0/1.99
R1(config-subif)# encapsulation dot1Q 99 native
R1(config-subif)# ip address 10.99.0.1 255.255.255.0

The switch port facing it, Gi1/0/48 on SW1, must be an 802.1Q trunk allowing VLANs 10, 20, 30 and 99, with native VLAN 99. An access port would deliver only one VLAN, untagged. switchport commands do not exist on a router subinterface; switchport trunk native vlan 99 is the switch's half of the job and encapsulation dot1Q 99 native is the router's.

Layer 2/Layer 3 LACP port-channel/EtherChannel

An EtherChannel bundles several physical links into one logical link, a port channel. Spanning tree sees the bundle as one port, so it blocks none of the members, and if one member fails, traffic moves to the others without a topology change.

A bundle forms in one of three ways:

• LACP (Link Aggregation Control Protocol, IEEE 802.3ad, now 802.1AX), the open standard. Modes: active sends LACP packets and starts negotiation; passive only answers.
• PAgP, Cisco's older protocol. Modes: desirable and auto. PAgP and LACP cannot negotiate with each other.
• Mode on, a static bundle with no protocol at all.

LACP forms a bundle when at least one end is active: active with active and active with passive both work. Passive with passive never forms, because neither end starts. On with active does not form either: mode on sends no LACPDUs, so the active end never hears a partner.

On a Catalyst 9300, up to 16 ports can sit in one LACP channel group, but only 8 are active at once. The rest wait in hot-standby to replace a failed link. LACP port priority decides which ports are active. It may differ from port to port; that is its purpose.

Other settings must match on every member, or the mismatched port is suspended: speed and duplex, and the Layer 2 settings, meaning the access VLAN, or the trunk mode, native VLAN and allowed VLAN list. The description text does not matter. The safe habit is to configure the Layer 2 settings on the port-channel interface, which passes them to its members:

SW1(config)# interface range GigabitEthernet1/0/1 - 3
SW1(config-if-range)# channel-group 1 mode active
SW1(config-if-range)# exit
SW1(config)# interface Port-channel1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# switchport trunk allowed vlan 10,20,99

A Layer 3 EtherChannel makes the members routed ports and puts the single IP address on the port-channel interface. Addressing each member would create overlapping addresses, which IOS XE refuses:

SW1(config)# interface range TenGigabitEthernet1/1/1 - 2
SW1(config-if-range)# no switchport
SW1(config-if-range)# channel-group 2 mode active
SW1(config-if-range)# exit
SW1(config)# interface Port-channel2
SW1(config-if)# ip address 10.0.12.1 255.255.255.252

Worked example: the /30 on Po2. The mask 255.255.255.252 leaves 2 host bits, so the block size is 4. SW1's 10.0.12.1 sits in the block 10.0.12.0 to 10.0.12.3. The network address is 10.0.12.0, the broadcast is 10.0.12.3, and the only usable addresses are 10.0.12.1 and 10.0.12.2. So Po2 on SW2 takes 10.0.12.2. The address 10.0.12.4 already belongs to the next subnet.

Check the bundle with show etherchannel summary:

SW1# show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator

Number of channel-groups in use: 2
Number of aggregators:           2

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)         LACP        Gi1/0/1(P)  Gi1/0/2(P)  Gi1/0/3(s)
2      Po2(RU)         LACP        Te1/1/1(P)  Te1/1/2(P)

Po1 is SU, a Layer 2 port channel in use. Po2 is RU, a Layer 3 port channel in use. Gi1/0/1 and Gi1/0/2 are P, bundled. Gi1/0/3 is a lowercase s, suspended: it is in the group, but a setting such as its allowed VLAN list differs from the others. A hot-standby port would show H, a down port D, and a port that heard no LACP partner I. The protocol is in its own column, not in the flags.

Load balancing. A port channel does not split one conversation across its members. The switch hashes fields of each frame, such as the source and destination addresses, and every frame of one flow lands on the same member link, which keeps the frames in order. So one large transfer between two servers never exceeds the speed of one member. Many flows between many hosts spread across the bundle. The global command port-channel load-balance src-dst-ip hashes on both IP addresses.

Switch virtual interface (SVI)

A switch virtual interface is a Layer 3 interface for a whole VLAN, named interface Vlan40 for VLAN 40. On a multilayer switch, the SVI is the default gateway for the hosts in that VLAN, and the switch routes between its SVIs.

SW1(config)# ip routing
SW1(config)# vlan 40
SW1(config-vlan)# name STAFF
SW1(config-vlan)# exit
SW1(config)# interface Vlan40
SW1(config-if)# ip address 172.16.40.129 255.255.255.192
SW1(config-if)# no shutdown

An SVI comes up and up only when three things hold: it is not shut down, its VLAN exists in the VLAN database, and at least one access or trunk port carrying that VLAN is up and in the spanning tree forwarding state. If no active port carries the VLAN yet, the SVI shows status up and protocol down:

SW1# show ip interface brief | include Vlan
Vlan1                  unassigned      YES unset  administratively down down
Vlan40                 172.16.40.129   YES manual up                    up
Vlan50                 172.16.50.1     YES manual up                    down

ip routing does not decide whether an SVI is up. It decides whether the switch forwards between SVIs. Without it, the switch behaves like a host: hosts in VLAN 10 can ping their own SVI, and hosts in VLAN 20 theirs, but nothing crosses between them. A switch with routing off uses ip default-gateway to reach other subnets for its own management traffic, which does nothing for the hosts. An ip helper-address relays DHCP (lesson 7) and has no effect on the SVI's state.

Worked example: the VLAN 40 range. The SVI is 172.16.40.129 with mask 255.255.255.192, a /26.

1. The mask's last octet is 192, so the block size is 256 − 192 = 64.
2. The blocks in the last octet start at 0, 64, 128 and 192. The address .129 falls in the block that starts at 128.
3. The network is 172.16.40.128. The broadcast is one below the next block: 172.16.40.191.
4. Usable hosts run from 172.16.40.129 to 172.16.40.190, which is 64 − 2 = 62 addresses.

The same method gives VLAN 60 on SVI 10.60.0.1 255.255.255.224: a /27, block size 32, so 32 addresses and 30 usable, one of them the SVI itself. Lesson 3 practises this method in depth.

An SVI, a routed port and a router-on-a-stick each give a VLAN a gateway. Use an SVI when the switch routes for VLANs it also switches, a routed port for a point-to-point link to a router or another Layer 3 switch, and router subinterfaces when a separate router does the routing.

What the exam is really asking

• no switchport vs ip routing. One makes a single port Layer 3; the other turns routing on for the device.
• Native VLAN means untagged. Changing the native VLAN number does not make it tagged. A mismatch between the two ends is a fault, not a feature.
• allowed vlan vs allowed vlan add. Without add, the list is replaced.
• DTP pairs. Auto with auto stays access. nonegotiate is refused on a dynamic port.
• LACP vs PAgP vs on. Active/passive is LACP, desirable/auto is PAgP, on is neither. Passive with passive and on with active both fail.
• Flags. SU is Layer 2 in use, RU is Layer 3 in use, P is bundled, s is suspended, H is hot-standby, I is stand-alone.
• Members must match in speed, duplex and VLAN settings; LACP port priority may differ.
• One flow, one link. The hash keeps a conversation on one member.
• SVI up/down. Up/down usually means no active port in the VLAN, not a routing problem.
• Router vs switch commands. encapsulation dot1Q 20 belongs on a router subinterface; switchport commands belong on switch ports.