WEBVTT

1
00:00.000 --> 00:05.040
At this point, we can leave ISL behind and focus in on what we use in modern

2
00:05.040 --> 00:05.680
networks,

3
00:05.680 --> 00:07.960
which is 802.1q.

4
00:07.960 --> 00:14.790
And so let's say we configure a couple of switches, and we've got maybe 100 V

5
00:14.790 --> 00:15.160
LANs on

6
00:15.160 --> 00:16.840
both of these switches.

7
00:16.840 --> 00:21.220
And hey, now with trunking, of course, we can only just connect maybe a single

8
00:21.220 --> 00:22.200
connection.

9
00:22.200 --> 00:25.570
Maybe we'd use an ether channel here, but either way, it's going to be a single

10
00:25.570 --> 00:26.040
logical

11
00:26.040 --> 00:31.120
layer to link, which is now going to be configured as a trunk.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:26.040 --> 00:31.120
layer to link, which is now going to be configured as a trunk.

12
00:31.120 --> 00:37.800
And by default, all VLANs are going to be carried across this trunk.

13
00:37.800 --> 00:41.360
So they're all going to be allowed.

14
00:41.360 --> 00:44.160
Now in our situation with 100 VLANs, we might want that.

15
00:44.160 --> 00:46.840
We might want all 100 VLANs allowed.

16
00:46.840 --> 00:50.250
But even at that point, let's say we get onto this switch and we decide, you

17
00:50.250 --> 00:50.840
know, I'm going

18
00:50.840 --> 00:54.520
to add a VLAN, I'm going to add that 101st VLAN.

19
00:54.520 --> 01:00.070
Well, because all VLANs are allowed on the trunk, this automatically gets added
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:54.520 --> 01:00.070
Well, because all VLANs are allowed on the trunk, this automatically gets added

20
01:00.070 --> 01:00.640
to this

21
01:00.640 --> 01:01.640
trunk.

22
01:01.640 --> 01:06.310
And maybe 101, whatever that idea is, it just doesn't exist over on the other

23
01:06.310 --> 01:06.880
side.

24
01:06.880 --> 01:12.080
Meanwhile, I'm sending broadcast traffic for that VLAN across that trunk link.

25
01:12.080 --> 01:16.800
This is why we typically don't want to rely on this default behavior.

26
01:16.800 --> 01:22.400
This default behavior can create inefficiencies.

27
01:22.400 --> 01:27.970
We don't necessarily want to extend every VLAN because that VLAN might not

28
01:27.970 --> 01:29.400
actually be useful

29
01:29.400 --> 01:31.680
or even used at all on the other side.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:29.400 --> 01:31.680
or even used at all on the other side.

30
01:31.680 --> 01:33.640
So I want to be intentional about this.

31
01:33.640 --> 01:38.010
And so much of network configuration comes back to us wanting to be intentional

32
01:38.010 --> 01:38.280
.

33
01:38.280 --> 01:40.840
What VLANs do I want on that trunk link?

34
01:40.840 --> 01:41.840
Do I want them all?

35
01:41.840 --> 01:45.220
And even if I want all the ones that are currently configured, do I really want

36
01:45.220 --> 01:45.440
every

37
01:45.440 --> 01:48.920
future VLAN to be automatically added to that trunk link?

38
01:48.920 --> 01:51.280
And again, the answer is usually no.

39
01:51.280 --> 01:53.360
So how do we be intentional about this?

40
01:53.360 --> 01:58.160
Well, we're going to create an allowed list.

41
01:58.160 --> 02:04.120
This allowed list is going to specify which VLANs are allowed and which ones
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:58.160 --> 02:04.120
This allowed list is going to specify which VLANs are allowed and which ones

42
02:04.120 --> 02:05.000
are not.

43
02:05.000 --> 02:07.840
And this uses a pretty simple command.

44
02:07.840 --> 02:14.160
We're going to use that switch port trunk allowed command.

45
02:14.160 --> 02:19.380
This command gets used a lot in the real world as well as in CCNA and CCNP

46
02:19.380 --> 02:20.040
studies.

47
02:20.040 --> 02:25.470
And because this is a very big part of creating clean network configurations

48
02:25.470 --> 02:26.280
and clean network

49
02:26.280 --> 02:29.960
design is controlling the VLANs and where they all go.

50
02:29.960 --> 02:33.850
I want to make sure that we're limiting again the broadcasts that are getting
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
02:29.960 --> 02:33.850
I want to make sure that we're limiting again the broadcasts that are getting

51
02:33.850 --> 02:34.880
sent out.

52
02:34.880 --> 02:38.640
Want to limit the number of spanning tree protocol instances.

53
02:38.640 --> 02:40.720
Want to prevent VLANs sprawl.

54
02:40.720 --> 02:46.300
So all of these can start to get out of hand if we just put VLANs everywhere

55
02:46.300 --> 02:47.160
and allow

56
02:47.160 --> 02:49.360
them on all of the trunks.

57
02:49.360 --> 02:53.640
So switch port trunk allowed and then I'm going to specify the keyword VLAN and

58
02:53.640 --> 02:54.440
then give it

59
02:54.440 --> 02:56.000
a list of VLANs.

60
02:56.000 --> 03:02.640
So something like 1 to 10 or 13 through 15, whatever we end up putting in there
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:56.000 --> 03:02.640
So something like 1 to 10 or 13 through 15, whatever we end up putting in there

61
03:02.640 --> 03:03.320
is going

62
03:03.320 --> 03:04.960
to be allowed.

63
03:04.960 --> 03:08.890
And Cisco's really good about allowing us to configure a bunch of different

64
03:08.890 --> 03:09.880
ranges separated

65
03:09.880 --> 03:14.170
by commas that is certainly part of the syntax of the command that we're going

66
03:14.170 --> 03:14.800
to want to

67
03:14.800 --> 03:19.440
be able to play with in a lab environment when we get to our lab later.

68
03:19.440 --> 03:25.330
So now comes a tricky type of scenario because it's great that we have this

69
03:25.330 --> 03:26.680
allowed list,

70
03:26.680 --> 03:33.600
but now we might need to add or remove VLANs from the allowed list.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:26.680 --> 03:33.600
but now we might need to add or remove VLANs from the allowed list.

71
03:33.600 --> 03:39.120
And this is where we get into some pretty notorious, notorious storytelling

72
03:39.120 --> 03:40.080
about this

73
03:40.080 --> 03:41.680
scenario.

74
03:41.680 --> 03:45.480
Because I like most people who've been in the industry as long as I have can

75
03:45.480 --> 03:45.960
tell you a

76
03:45.960 --> 03:51.480
story or two about accidentally changing the VLAN list.

77
03:51.480 --> 03:52.920
What do I mean by this?

78
03:52.920 --> 03:55.160
Well, here's what I mean by it.

79
03:55.160 --> 04:01.880
The command to add or remove a VLAN is very similar to the command we just used
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:55.160 --> 04:01.880
The command to add or remove a VLAN is very similar to the command we just used

80
04:01.880 --> 04:02.320
.

81
04:02.320 --> 04:09.230
So switch port trunk allowed VLAN and then I have to use the add or remove

82
04:09.230 --> 04:11.080
keyword here.

83
04:11.080 --> 04:18.240
And then I specify the VLAN ID or VLAN IDs that I want to add or remove.

84
04:18.240 --> 04:24.400
This right here, remembering to include that command is going to be potentially

85
04:24.400 --> 04:25.280
a life-saving

86
04:25.280 --> 04:30.550
opportunity so to speak, where I remember to use it and everything went smooth
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
04:25.280 --> 04:30.550
opportunity so to speak, where I remember to use it and everything went smooth

87
04:30.550 --> 04:30.800
or it

88
04:30.800 --> 04:35.640
could potentially completely torpedo a network cut over.

89
04:35.640 --> 04:40.170
So the story that I'll tell very briefly is that I did have an engineer on my

90
04:40.170 --> 04:41.040
team who

91
04:41.040 --> 04:48.390
had a situation where he was adding a VLAN to two links that went into a switch

92
04:48.390 --> 04:48.960
that

93
04:48.960 --> 04:51.200
was located far away.

94
04:51.200 --> 04:55.650
And so he got onto this switch and happened to, of course, forget to use the

95
04:55.650 --> 04:56.520
add command.

96
04:56.520 --> 05:00.280
When you forget to use the add command, what command are you entering?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
04:56.520 --> 05:00.280
When you forget to use the add command, what command are you entering?

97
05:00.280 --> 05:05.090
You're entering this command where you're basically overriding the existing V

98
05:05.090 --> 05:05.760
LAN list.

99
05:05.760 --> 05:11.120
So instead of saying to add VLAN 10, you just say the only allowed VLAN is VLAN

100
05:11.120 --> 05:11.920
10.

101
05:11.920 --> 05:17.910
So by forgetting the add keyword and putting it on this link and then logging

102
05:17.910 --> 05:18.760
in to this

103
05:18.760 --> 05:24.720
interface and putting it on that link, the access to the switch was lost.

104
05:24.720 --> 05:28.020
And fortunately, it was only about a 30 or 40 minute drive, I think, that he

105
05:28.020 --> 05:28.680
had to drive

106
05:28.680 --> 05:29.680
out there.

107
05:29.680 --> 05:35.240
But once you eliminate the management VLAN on those two links, you're done.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
05:29.680 --> 05:35.240
But once you eliminate the management VLAN on those two links, you're done.

108
05:35.240 --> 05:37.880
You can't access that switch anymore.

109
05:37.880 --> 05:42.360
And so that is the type of stories that you'll hear around this.

110
05:42.360 --> 05:46.030
And if you've never had to worry about that yourself, then learn from the

111
05:46.030 --> 05:46.760
mistakes of

112
05:46.760 --> 05:52.840
others because this is a very common mistake that gets made and it can result

113
05:52.840 --> 05:53.680
in people

114
05:53.680 --> 05:57.370
having to get in cars and drive great distances to access a device that we

115
05:57.370 --> 05:58.560
accidentally locked

116
05:58.560 --> 06:00.200
ourselves out of.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
05:58.560 --> 06:00.200
ourselves out of.

117
06:00.200 --> 06:04.700
So when we're modifying the allowed list, make sure to remember that add a

118
06:04.700 --> 06:06.200
remove keyword.

119
06:06.200 --> 06:10.830
And hey, this is something that is a good idea to play around within the lab

120
06:10.830 --> 06:11.480
because

121
06:11.480 --> 06:15.000
it will translate over to real world configurations.

122
06:15.000 --> 06:23.630
Now we mentioned the native VLAN with 802.11 or 802.1Q, sorry, with 802.1Q, we

123
06:23.630 --> 06:24.280
get the

124
06:24.280 --> 06:27.960
concept of the native VLAN, whether we like it or not.

125
06:27.960 --> 06:33.040
And the key thing here is that it is going to be untagged.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
06:27.960 --> 06:33.040
And the key thing here is that it is going to be untagged.

126
06:33.040 --> 06:37.040
So we don't necessarily want one of our VLANs to be untagged.

127
06:37.040 --> 06:38.520
And there's good reasons for this.

128
06:38.520 --> 06:42.000
For one, security is a big concern.

129
06:42.000 --> 06:46.720
Some threat actors are able to use native VLANs for a variety of attacks.

130
06:46.720 --> 06:48.760
And the other one, as we mentioned, is quality of service.

131
06:48.760 --> 06:53.400
I can't carry my layer two tags inside an untagged frame.

132
06:53.400 --> 06:57.000
And so I don't want to necessarily use the native VLAN.

133
06:57.000 --> 07:03.450
In fact, the recommendation is to avoid using the native VLAN in real world
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
06:57.000 --> 07:03.450
In fact, the recommendation is to avoid using the native VLAN in real world

134
07:03.450 --> 07:04.680
networks.

135
07:04.680 --> 07:06.280
So what do we do here?

136
07:06.280 --> 07:09.480
Well, we have two different solutions.

137
07:09.480 --> 07:16.370
First of all, the most common one is to create a dummy VLAN and then map that

138
07:16.370 --> 07:18.040
as the native.

139
07:18.040 --> 07:23.270
So for example, I could just specify that I want the native VLAN to be VLAN

140
07:23.270 --> 07:24.680
4000 and

141
07:24.680 --> 07:28.360
then I don't actually use VLAN 4000.

142
07:28.360 --> 07:29.760
That would be the idea there.

143
07:29.760 --> 07:34.360
The second option is kind of interesting and one that we don't see too often.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
07:29.760 --> 07:34.360
The second option is kind of interesting and one that we don't see too often.

144
07:34.360 --> 07:39.320
And that is to simply tag the native VLAN.

145
07:39.320 --> 07:40.960
This is an option.

146
07:40.960 --> 07:43.120
And there is a global command to enable this.

147
07:43.120 --> 07:51.240
It is simply VLAN.1Q tag native.

148
07:51.240 --> 07:56.400
Now the downside to this, as cool as this option sounds, is it must be enabled

149
07:56.400 --> 07:56.920
on all

150
07:56.920 --> 07:59.640
switches in the layer two domain.

151
07:59.640 --> 08:02.560
Otherwise, this is going to cause a lot of problems.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

151
07:59.640 --> 08:02.560
Otherwise, this is going to cause a lot of problems.

152
08:02.560 --> 08:07.680
So I will say from my perspective, I have seen far more of option number one be

153
08:07.680 --> 08:08.040
used

154
08:08.040 --> 08:11.760
in the network because it's easier to maintain something like that.

155
08:11.760 --> 08:17.860
And it's a lot easier to maybe forget to add this native tagging command to

156
08:17.860 --> 08:18.480
every single

157
08:18.480 --> 08:20.080
switch in the environment.

158
08:20.080 --> 08:22.200
But either one of those will get the job done.

159
08:22.200 --> 08:24.240
Now, how do you change the native VLAN?

160
08:24.240 --> 08:26.280
If we want to use option one, for example.

161
08:26.280 --> 08:29.970
Well, just like over here on the left, we've got some switch port trunk

162
08:29.970 --> 08:30.960
commands and we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

162
08:29.970 --> 08:30.960
commands and we're

163
08:30.960 --> 08:40.010
going to say switch port trunk and then native VLAN and then I specify the VLAN

164
08:40.010 --> 08:41.400
ID here.

165
08:41.400 --> 08:45.750
And I just need to make sure that I place this onto both sides and that it's

166
08:45.750 --> 08:47.000
synchronized.

167
08:47.000 --> 08:50.360
Now importantly, I don't have to have it synchronized on the entire switch.

168
08:50.360 --> 08:53.640
It just needs to be synchronized between switches.

169
08:53.640 --> 09:00.140
So for example, I could have a native VLAN on this side of 10 and a native VLAN
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
08:53.640 --> 09:00.140
So for example, I could have a native VLAN on this side of 10 and a native VLAN

170
09:00.140 --> 09:01.040
of 20

171
09:01.040 --> 09:02.160
on the right.

172
09:02.160 --> 09:07.360
As long as these two switches agree or these two ports and interfaces agree on

173
09:07.360 --> 09:08.240
VLAN 10

174
09:08.240 --> 09:13.920
on the left and 20 is agreed to on the right, then we're good to go.

175
09:13.920 --> 09:17.840
Notice the switch in the middle is managing native VLANs or different native V

176
09:17.840 --> 09:18.280
LANs on

177
09:18.280 --> 09:20.480
different ports and that's perfectly fine.

178
09:20.480 --> 09:22.760
It's not a global configuration.

179
09:22.760 --> 09:25.400
This is locally significant to the interface.