WEBVTT

00:00:01.000 --> 00:00:05.000
Alright folks, now we're going to dive into our discussion on trunks.

00:00:05.000 --> 00:00:12.000
Now the great news here is that even though there's two different trunking options that exist in a multitude of iOS versions,

00:00:12.000 --> 00:00:21.000
we only need to know one nowadays because Cisco has bowed down and said that their trunking or proprietary trunking encapsulation

00:00:21.000 --> 00:00:25.000
is not as good as 802.1Q, the industry standard.

00:00:25.000 --> 00:00:31.000
So I remember a time when I used to have to learn both, be tested on both, and all that stuff, and troubleshoot both.

00:00:31.000 --> 00:00:35.000
Nowadays, you're really only worried about 802.1Q.

00:00:35.000 --> 00:00:40.000
So, why do we need trunks? Well, let's just talk about what happens when we don't have trunks.

00:00:40.000 --> 00:00:44.000
So what do we have right now? We have VLAN 10 here.

00:00:44.000 --> 00:00:47.000
We have VLAN 20 here.

00:00:47.000 --> 00:00:52.000
Oh, and also VLAN 200.

00:00:52.000 --> 00:00:57.000
So by default, folks, which VLAN is that Lincoln?

00:00:57.000 --> 00:01:07.000
By default, which VLAN is that Lincoln?

00:01:07.000 --> 00:01:11.000
VLAN 1, 2, 3, 4, 5, 6, what's the default? VLAN 1, exactly.

00:01:11.000 --> 00:01:17.000
So this is in VLAN 1. This is in VLAN 1. This is in VLAN 1. This is in VLAN 1.

00:01:17.000 --> 00:01:22.000
They're all in VLAN 1. And we can verify that right here.

00:01:22.000 --> 00:01:28.000
There's 45, 46, 47, 48. They're all in VLAN 1.

00:01:28.000 --> 00:01:36.000
So, can VLAN 10 traffic go out this interface?

00:01:36.000 --> 00:01:45.000
No, because what is our rule? Traffic from one VLAN can only go out ports that are in the exact same VLAN.

00:01:45.000 --> 00:01:49.000
So that's not going to work. Same thing with VLAN 20 and 200 here.

00:01:49.000 --> 00:01:55.000
So what we could do is we could say you're in VLAN 10, you're in VLAN 20, you're in VLAN 200.

00:01:55.000 --> 00:01:58.000
But what's the problem with that?

00:01:58.000 --> 00:02:03.000
The problem with that is that for every single VLAN we have, we are going to have to have a link.

00:02:03.000 --> 00:02:09.000
And that's just silly. That's not going to work. It's not going to scale well. It's going to be horrible.

00:02:09.000 --> 00:02:12.000
So that's why we have trunks.

00:02:12.000 --> 00:02:23.000
When we use a trunk, I can now pass traffic for multiple VLANs to cross a single physical link.

00:02:23.000 --> 00:02:29.000
So this trunk will allow me to pass traffic for VLAN 10, 20, 200, as well as whatever VLAN we have.

00:02:29.000 --> 00:02:35.000
We have VLAN 50 as well. So 10, 20, 200, VLAN 50. VLAN 50 is down here, remember?

00:02:35.000 --> 00:02:41.000
Same thing, 10, 20. So these are trunks that can pass traffic for all VLANs that we have.

00:02:41.000 --> 00:02:45.000
So that's why we want to use trunks.

00:02:45.000 --> 00:02:49.000
That's when it comes to the native VLAN. We're going to get to that. We're going to get to that.

00:02:49.000 --> 00:02:56.000
So what is a trunk? A trunk is a single physical link that can send and receive traffic for multiple VLANs.

00:02:56.000 --> 00:03:04.000
A trunk is a single physical link that normally would only be allowed to pass traffic for one VLAN,

00:03:04.000 --> 00:03:10.000
one data VLAN, one voice VLAN, and now I can pass traffic for all VLANs on it.

00:03:11.000 --> 00:03:19.000
So we're going to be focused on what? Our switch-to-switch trunk links here in this discussion.

00:03:19.000 --> 00:03:24.000
But we could do switch-to-router trunk links, and we'll see that later today.

00:03:24.000 --> 00:03:28.000
We're going to see that later today during our inter-VLAN routing discussion.

00:03:28.000 --> 00:03:38.000
In this scenario, what do we have? We have a single switch port, and we're going to have VLANs 254 here and VLANs 255.

00:03:38.000 --> 00:03:44.000
So how do I pass traffic for both those VLANs across this single physical link?

00:03:44.000 --> 00:03:53.000
Well, I'm going to have to put a trunk here, which means that my router is also going to have to support trunking as well.

00:03:53.000 --> 00:04:05.000
All right, so we'll show you how to do that later today, but there's an example of switch-to-router.

00:04:05.000 --> 00:04:17.000
What about PC or server-to-switch? Well, let's say here we had a server, and this server had VMs,

00:04:17.000 --> 00:04:31.000
and let's say this VM was for VLAN 10, and this VM here was for VLAN 20, and this VM here was for VLAN 200.

00:04:31.000 --> 00:04:37.000
Well, then how would I pass traffic for all those VLANs across a single physical link?

00:04:37.000 --> 00:04:45.000
We would need a trunk link there, so this would have to be a NIC, network interface card, that supports 802.1Q trunking, as an example.

00:04:45.000 --> 00:04:58.000
Okay, what about an access point to a switch? So let's say, for example, we have an AP here.

00:04:58.000 --> 00:05:07.000
Every single SSID you have, folks, is a different VLAN. So if you have a guest SSID, that's one VLAN, one subnet, one broadcast domain.

00:05:07.000 --> 00:05:12.000
If you have an enterprise SSID, that's one VLAN, one subnet, one broadcast domain, and so on and so forth.

00:05:12.000 --> 00:05:18.000
So for every SSID you have, you are going to have essentially a different what? Subnet VLAN broadcast domain.

00:05:18.000 --> 00:05:27.000
So therefore, we would have to have a trunk here so we can pass traffic for those different subnet-sized, VLAN-sized broadcast domains.

00:05:28.000 --> 00:05:31.000
Now, how many of you – now, that is if they're standalone access points.

00:05:31.000 --> 00:05:38.000
If you're using lightweight access points, then you'd have cap-lap tunnels, and the configuration changes in that case.

00:05:40.000 --> 00:05:45.000
What about the wireless LAN controller, for example? So let's add a wireless LAN controller down here.

00:05:45.000 --> 00:05:51.000
Well, in those lightweight access point scenarios, you'd have your cap-lap tunnel from your access point to your wireless LAN controller,

00:05:51.000 --> 00:05:55.000
and then as the traffic leaves, that could be traffic for different VLANs.

00:05:55.000 --> 00:05:58.000
So if it's traffic for different VLANs, there's going to have to be a trunk in that particular case.

00:06:00.000 --> 00:06:02.000
So all different ways that we can create trunks.

00:06:04.000 --> 00:06:11.000
So what are we going to have to do? We're going to have to configure our port as a trunk, configure this port as a trunk,

00:06:11.000 --> 00:06:15.000
and make sure all the parameters that are necessary match appropriately.

00:06:17.000 --> 00:06:22.000
And then in the end, we'll have our trunk, and we'll be able to pass traffic for multiple VLANs across it.

00:06:22.000 --> 00:06:25.000
And what's going to happen is that a tag is going to be added to our frames.

00:06:26.000 --> 00:06:30.000
A tag is going to be added to our frames to identify the VLAN that the frame belongs to.

00:06:32.000 --> 00:06:35.000
So let's take a look at this example here. We have our PC frame right now.

00:06:36.000 --> 00:06:41.000
So I have a frame coming from this PC. It's going to arrive at ASW1.

00:06:42.000 --> 00:06:49.000
Okay, pop quiz, folks. How does the switch know which VLAN that frame belongs to?

00:06:53.000 --> 00:06:59.000
We configured it. Exactly. We configured it. Switch port, access, VLAN 10.

00:07:00.000 --> 00:07:05.000
So it knows it's what? VLAN 10. It knows that. It's a configuration we put on it.

00:07:06.000 --> 00:07:11.000
There's nothing in there identifying anything about the VLAN that belongs to that VLAN.

00:07:11.000 --> 00:07:15.000
Even if there was, even if there was something in here that said, oh, VLAN 30,

00:07:16.000 --> 00:07:22.000
because our port is configured as VLAN 10, we would also have a configuration on there

00:07:23.000 --> 00:07:25.000
that would override that.

00:07:27.000 --> 00:07:28.000
So let's take a look at this example.

00:07:29.000 --> 00:07:34.000
So let's say I have a VLAN 10. I have a VLAN 10.

00:07:35.000 --> 00:07:40.000
We would also have a configuration on there that would override that.

00:07:41.000 --> 00:07:47.000
So that way there, we don't allow anybody to fraudulently use VLAN numbers they're not supposed to.

00:07:48.000 --> 00:07:51.000
So if all of a sudden we did receive a tag frame from a PC and we shouldn't be,

00:07:52.000 --> 00:07:53.000
we'll change it to VLAN 10.

00:07:55.000 --> 00:07:57.000
And that's a discussion for another day.

00:07:58.000 --> 00:08:00.000
But just to let you know that absolutely, if that is a problem,

00:08:01.000 --> 00:08:03.000
you're going to want to make sure you can stop that from happening.

00:08:04.000 --> 00:08:14.000
Now, what happens now if the switch just sends it over to this switch unmodified?

00:08:15.000 --> 00:08:16.000
Okay, so remember, this is a trunk link now.

00:08:17.000 --> 00:08:21.000
What if we just send this frame as is to DSW-1?

00:08:22.000 --> 00:08:30.000
When it arrives at DSW-1, how does DSW-1 know which VLAN the frame belongs to?

00:08:31.000 --> 00:08:34.000
It doesn't. Okay, let's be very clear about that.

00:08:35.000 --> 00:08:40.000
It does not know. Why not? Because there's nothing here.

00:08:44.000 --> 00:08:46.000
And we have this concept called the native VLAN.

00:08:47.000 --> 00:08:50.000
And by default, the native VLAN is VLAN 1, okay?

00:08:51.000 --> 00:08:52.000
By default, the native VLAN is VLAN 1,

00:08:53.000 --> 00:08:57.000
which is also the same number for our default Ethernet VLAN, remember?

00:08:57.000 --> 00:09:01.000
But the native VLAN for trunks basically says if there's no tag, you belong to that VLAN.

00:09:02.000 --> 00:09:04.000
It's essentially what it means. We'll talk more about that later.

00:09:05.000 --> 00:09:09.000
So basically, DSW-1 says you're in VLAN 1. Is that correct?

00:09:10.000 --> 00:09:13.000
No, it's not, is it? It's not correct at all in this case.

00:09:14.000 --> 00:09:19.000
So what has to happen is this switch here needs to modify that frame.

00:09:20.000 --> 00:09:21.000
It needs to modify the frame.

00:09:22.000 --> 00:09:24.000
So what is it going to do? It's going to open it up.

00:09:24.000 --> 00:09:25.000
It's going to open it up.

00:09:27.000 --> 00:09:29.000
And then what's it going to put in there? An 802.1Q tag.

00:09:35.000 --> 00:09:38.000
And then it's going to label it, 802.1Q tag.

00:09:40.000 --> 00:09:45.000
And if we have to put any class of service, quality of service values in there, we will.

00:09:46.000 --> 00:09:49.000
In this case, this is date user traffic, probably COS value of zero.

00:09:49.000 --> 00:09:50.000
And then our VLAN ID is what?

00:09:59.000 --> 00:10:00.000
Ten.

00:10:01.000 --> 00:10:03.000
Exactly. Ten.

00:10:04.000 --> 00:10:09.000
So now, as the traffic leaves, it looks like this, the frame.

00:10:12.000 --> 00:10:15.000
So when it arrives at DSW-1, DSW-1 is going to say,

00:10:16.000 --> 00:10:21.000
So when it arrives at DSW-1, DSW-1 now knows it belongs to VLAN 10.

00:10:22.000 --> 00:10:28.000
That's why we are tagging to tell the other switches which VLAN that traffic belongs to.

00:10:33.000 --> 00:10:39.000
If it wasn't for this tagging we were doing, then this switch would not know which VLAN it belongs to.

00:10:40.000 --> 00:10:43.000
And therefore, it would go from VLAN 10 over to VLAN 1.

00:10:44.000 --> 00:10:48.000
And yeah, exactly as the chat says, that would cause leakage.

00:10:49.000 --> 00:10:52.000
Leaking from one VLAN to another VLAN, which we don't want.

00:10:53.000 --> 00:10:54.000
That's why tagging is so important.

00:10:55.000 --> 00:10:56.000
And it's so important that we do it right.

00:11:01.000 --> 00:11:04.000
So the same thing would happen in reverse when traffic has to go the other way.

00:11:05.000 --> 00:11:06.000
So let's go back to here.

00:11:09.000 --> 00:11:11.000
Let's type in right now on ASW-1.

00:11:14.000 --> 00:11:18.000
Show interfaces trunk.

00:11:20.000 --> 00:11:23.000
And we'll see here that there are no trunks at all configured.

00:11:24.000 --> 00:11:26.000
In our case, if I type in do show VLAN brief,

00:11:26.000 --> 00:11:28.000
in our case, if I type in do show VLAN brief,

00:11:30.000 --> 00:11:34.000
we're going to see in our output here 45, 46, 47, 48.

00:11:38.000 --> 00:11:45.000
Those four are currently part of the default Ethernet VLAN of VLAN 1.

00:11:46.000 --> 00:11:49.000
Therefore, they only support traffic for VLAN 1.

00:11:49.000 --> 00:11:50.000
VLAN 1.

00:11:54.000 --> 00:11:55.000
Bigger terminal.

00:11:56.000 --> 00:11:57.000
I'm going to type in right now just quickly to show you.

00:11:58.000 --> 00:12:01.000
Interface gigabit 1, size 0, size 45.

00:12:03.000 --> 00:12:05.000
I'm going to type in switch port mode trunk.

00:12:06.000 --> 00:12:07.000
I just turned it into a trunk port.

00:12:08.000 --> 00:12:09.000
That easy.

00:12:11.000 --> 00:12:12.000
That easy.

00:12:14.000 --> 00:12:15.000
So now I'm a trunk port.

00:12:16.000 --> 00:12:18.000
If I type in show VLAN brief,

00:12:22.000 --> 00:12:25.000
what we're going to see is that it's no longer listed here.

00:12:26.000 --> 00:12:27.000
You see it's gone.

00:12:28.000 --> 00:12:29.000
It's gone.

00:12:30.000 --> 00:12:34.000
Trunk ports do not show up in the output of show VLAN.

00:12:37.000 --> 00:12:38.000
Nope.

00:12:39.000 --> 00:12:40.000
Why?

00:12:40.000 --> 00:12:41.000
Because on Cisco devices, if you're a trunk port,

00:12:42.000 --> 00:12:43.000
you pass traffic for all VLANs.

00:12:44.000 --> 00:12:45.000
That's what you do.

00:12:46.000 --> 00:12:47.000
That's your job.

00:12:48.000 --> 00:12:52.000
You don't belong to any single VLAN on Cisco devices.

00:12:53.000 --> 00:12:56.000
Now, other switches from other vendors, it is possible you would.

00:12:57.000 --> 00:13:00.000
You would actually have your trunk ports in a specific VLAN.

00:13:01.000 --> 00:13:02.000
And we don't do that on Cisco devices.

00:13:07.000 --> 00:13:09.000
So on Cisco devices, if you don't see the port here,

00:13:09.000 --> 00:13:10.000
it's either one, because it's a trunk,

00:13:11.000 --> 00:13:14.000
or two, because it belongs to a VLAN that doesn't exist,

00:13:15.000 --> 00:13:16.000
as we saw in our VLAN discussion.

00:13:17.000 --> 00:13:21.000
Right now, if we type in show interface gigabit one size zero size 45,

00:13:23.000 --> 00:13:24.000
not the output I'm looking for.

00:13:25.000 --> 00:13:26.000
Let's type in switch port.

00:13:29.000 --> 00:13:30.000
There we go.

00:13:31.000 --> 00:13:32.000
That's the output I'm looking for.

00:13:33.000 --> 00:13:34.000
You're going to see here that we are a trunk port.

00:13:35.000 --> 00:13:37.000
We are operating in a trunk port.

00:13:37.000 --> 00:13:40.000
We are operating as a trunk port.

00:13:42.000 --> 00:13:49.000
We are operating using 802.1Q industry standard trunking encapsulation.

00:13:50.000 --> 00:13:51.000
802.1Q.

00:13:54.000 --> 00:13:58.000
Notice that it says my access mode VLAN is VLAN one.

00:13:59.000 --> 00:14:04.000
That simply means if I am no longer a trunk port,

00:14:05.000 --> 00:14:06.000
then I will be in VLAN one.

00:14:07.000 --> 00:14:08.000
That's what that means.

00:14:09.000 --> 00:14:13.000
If you ever see a VLAN number listed here on a certification exam,

00:14:14.000 --> 00:14:16.000
it's used more as a fallback mechanism.

00:14:17.000 --> 00:14:21.000
If I am no longer a trunk, then I will be put in a certain VLAN.

00:14:25.000 --> 00:14:27.000
The key is always to look at the configuration.

00:14:28.000 --> 00:14:30.000
If the configuration shows that you are a trunk,

00:14:31.000 --> 00:14:33.000
then this number doesn't matter.

00:14:33.000 --> 00:14:36.000
If it shows that you are access ACCESS,

00:14:37.000 --> 00:14:39.000
then this number matters.

00:14:41.000 --> 00:14:42.000
Same thing with voice.

00:14:43.000 --> 00:14:44.000
Voice doesn't matter now because I am a trunk.

00:14:45.000 --> 00:14:46.000
But if I wasn't a trunk,

00:14:47.000 --> 00:14:48.000
then whatever voice VLAN was listed there would be.

00:14:49.000 --> 00:14:50.000
It'd be none in this case, which is good.

00:14:51.000 --> 00:14:52.000
It's what I would want.

00:14:53.000 --> 00:14:54.000
John, we're going to get to that later.

00:14:55.000 --> 00:14:56.000
We're going to get to that later.

00:14:57.000 --> 00:14:58.000
Native VLANs cause a lot of confusion.

00:14:59.000 --> 00:15:00.000
You'll see here it says native VLAN is one.

00:15:01.000 --> 00:15:02.000
Native VLAN is one.

00:15:03.000 --> 00:15:04.000
What does that mean?

00:15:05.000 --> 00:15:06.000
We're going to get to that.

00:15:07.000 --> 00:15:08.000
It is a very confusing thing of 802.1Q.

00:15:09.000 --> 00:15:10.000
It is actually very simple.

00:15:11.000 --> 00:15:13.000
It is actually very simple in the industry standard documentation.

00:15:14.000 --> 00:15:16.000
But the way Cisco uses it, it's complicated.

00:15:17.000 --> 00:15:18.000
It doesn't make sense.

00:15:19.000 --> 00:15:20.000
It really doesn't.

00:15:21.000 --> 00:15:22.000
But we're going to get to it.

00:15:23.000 --> 00:15:24.000
We're going to get to that.

00:15:25.000 --> 00:15:27.000
What about when you are using VLAN allowed

00:15:28.000 --> 00:15:29.000
to limit VLANs that are not native?

00:15:30.000 --> 00:15:31.000
Yeah, we're going to show you how to do that as well.

00:15:31.000 --> 00:15:32.000
We're going to absolutely show you how to do that.

00:15:37.000 --> 00:15:38.000
Okay.

00:15:39.000 --> 00:15:43.000
So none of these, this doesn't matter when we are trunks.

00:15:44.000 --> 00:15:45.000
What matters here now is this.

00:15:46.000 --> 00:15:47.000
This matters.

00:15:48.000 --> 00:15:49.000
That matters.

00:15:50.000 --> 00:15:51.000
We're going to come to that shortly.

00:15:52.000 --> 00:15:53.000
What else matters?

00:15:54.000 --> 00:15:55.000
This matters now.

00:15:56.000 --> 00:15:57.000
This matters here.

00:15:58.000 --> 00:15:59.000
This matters here with VTP.

00:15:59.000 --> 00:16:00.000
This matters.

00:16:01.000 --> 00:16:02.000
Yeah, okay.

00:16:05.000 --> 00:16:06.000
And then private VLAN information is here,

00:16:07.000 --> 00:16:08.000
which is beyond the scope of the course and certification exam.

00:16:09.000 --> 00:16:11.000
So it's important that you can read,

00:16:12.000 --> 00:16:13.000
so far, what I've shown you

00:16:14.000 --> 00:16:15.000
when we were talking about our access ports,

00:16:16.000 --> 00:16:17.000
and now also what I'm going to show you

00:16:18.000 --> 00:16:19.000
when we talk about our trunk ports.

00:16:20.000 --> 00:16:22.000
Now, before we start digging this further,

00:16:23.000 --> 00:16:25.000
I've only configured one side, one device.

00:16:26.000 --> 00:16:27.000
It shows I'm trunking.

00:16:27.000 --> 00:16:28.000
But what I want to do for a moment

00:16:29.000 --> 00:16:30.000
is I want to erase this configuration,

00:16:31.000 --> 00:16:32.000
and what we have to do is we have to talk about

00:16:33.000 --> 00:16:34.000
the multitude of different ways

00:16:35.000 --> 00:16:36.000
that we can configure an interface as a trunk

00:16:37.000 --> 00:16:38.000
on a Cisco device.

00:16:39.000 --> 00:16:40.000
Now, what I showed you here

00:16:41.000 --> 00:16:42.000
is the way you really want to do it in the real world.

00:16:43.000 --> 00:16:44.000
That is the best way to do it.

00:16:45.000 --> 00:16:46.000
It means you are a trunk.

00:16:47.000 --> 00:16:48.000
There's no if, ands, or buts about it.

00:16:49.000 --> 00:16:50.000
You are a trunk.

00:16:51.000 --> 00:16:52.000
You are in 100% control here.

00:16:53.000 --> 00:16:54.000
But what I want to point out to you

00:16:55.000 --> 00:16:56.000
is there's this thing called DTP.

00:16:57.000 --> 00:16:58.000
Dynamic Trunking Protocol.

00:16:59.000 --> 00:17:00.000
It's not a WWE move.

00:17:02.000 --> 00:17:04.000
That was the DDT by Jake the Snake Roberts,

00:17:05.000 --> 00:17:06.000
not DTP here.

00:17:07.000 --> 00:17:09.000
Dynamic Trunking Protocol, DTP.

00:17:10.000 --> 00:17:11.000
So what happens is that we have

00:17:12.000 --> 00:17:13.000
switch port mode trunk.

00:17:14.000 --> 00:17:15.000
This here says,

00:17:16.000 --> 00:17:17.000
okay, there's no negotiation going on.

00:17:18.000 --> 00:17:19.000
You are a trunk, plain and simple.

00:17:20.000 --> 00:17:21.000
But if we type in switch port right now

00:17:22.000 --> 00:17:23.000
and we type in mode,

00:17:24.000 --> 00:17:25.000
I want you to see that we have the opportunity

00:17:25.000 --> 00:17:26.000
to set it to access.

00:17:27.000 --> 00:17:28.000
More on that later.

00:17:29.000 --> 00:17:30.000
We saw that in our VLAN discussion.

00:17:31.000 --> 00:17:32.000
Trunk, which I just showed you right here.

00:17:33.000 --> 00:17:34.000
But then there's also this dynamic option.

00:17:35.000 --> 00:17:36.000
So if I type in dynamic,

00:17:37.000 --> 00:17:38.000
you'll see that there's different options,

00:17:39.000 --> 00:17:40.000
auto as well as desirable.

00:17:41.000 --> 00:17:42.000
We have to talk about these.

00:17:43.000 --> 00:17:45.000
Even though you really wouldn't need

00:17:46.000 --> 00:17:48.000
to use them in the real world.

00:17:50.000 --> 00:17:51.000
Because you could just use

00:17:52.000 --> 00:17:53.000
switch port mode trunk on your interfaces

00:17:53.000 --> 00:17:54.000
because you want them to be trunks.

00:17:55.000 --> 00:17:56.000
You don't need dynamic negotiation.

00:17:57.000 --> 00:17:59.000
So why in the world does this exist?

00:18:00.000 --> 00:18:01.000
Because way back in the day,

00:18:02.000 --> 00:18:03.000
like I'm talking way back folks,

00:18:04.000 --> 00:18:05.000
years and years and years and years ago,

00:18:06.000 --> 00:18:07.000
like over 20 years ago,

00:18:08.000 --> 00:18:09.000
maybe 30 years ago now,

00:18:10.000 --> 00:18:13.000
there was this like groundbreaking

00:18:14.000 --> 00:18:17.000
technological evolution that happened.

00:18:18.000 --> 00:18:19.000
Does anybody know what that

00:18:20.000 --> 00:18:22.000
groundbreaking technological evolution was?

00:18:23.000 --> 00:18:31.000
Plug and play.

00:18:32.000 --> 00:18:34.000
That's what it was.

00:18:35.000 --> 00:18:39.000
If your devices weren't plug and play,

00:18:40.000 --> 00:18:41.000
people didn't want them.

00:18:42.000 --> 00:18:43.000
That was true for PCs,

00:18:44.000 --> 00:18:45.000
true for many different things,

00:18:46.000 --> 00:18:48.000
but a lot of networking equipment as well.

00:18:49.000 --> 00:18:50.000
So Cisco took it upon themselves and said,

00:18:51.000 --> 00:18:52.000
hey, you know what, how can we do this?

00:18:53.000 --> 00:18:54.000
How can we help you out?

00:18:55.000 --> 00:18:56.000
So they created a protocol called

00:18:57.000 --> 00:18:59.000
dynamic trunking protocol, DTP.

00:19:00.000 --> 00:19:02.000
And we just take a moment to go back

00:19:03.000 --> 00:19:05.000
to this beautiful diagram we have here

00:19:08.000 --> 00:19:09.000
and clean it up a bit.

00:19:10.000 --> 00:19:12.000
This was at a time, folks, no joke,

00:19:13.000 --> 00:19:14.000
if you weren't aware of this,

00:19:15.000 --> 00:19:16.000
there was a time in our lives

00:19:17.000 --> 00:19:21.000
when all of this was layer two.

00:19:21.000 --> 00:19:23.000
How many of you are old enough to know

00:19:24.000 --> 00:19:26.000
of a time when all of this was layer two

00:19:27.000 --> 00:19:29.000
and layer three was out here?

00:19:30.000 --> 00:19:31.000
And you might have, for example,

00:19:32.000 --> 00:19:33.000
you might have a device somewhere

00:19:34.000 --> 00:19:36.000
like a router that could route you

00:19:37.000 --> 00:19:38.000
or do inter VLAN routing

00:19:39.000 --> 00:19:40.000
for your different subnets.

00:19:41.000 --> 00:19:42.000
Anybody old enough to know about this?

00:19:43.000 --> 00:19:44.000
Yeah.

00:19:45.000 --> 00:19:46.000
Why? Because at the time,

00:19:47.000 --> 00:19:48.000
switches were faster than routers.

00:19:48.000 --> 00:19:52.000
Switches were lightning faster than routers.

00:19:53.000 --> 00:19:56.000
And switching was superior to routing.

00:19:57.000 --> 00:19:58.000
So we only use routing

00:19:59.000 --> 00:20:00.000
when it was absolutely necessary.

00:20:01.000 --> 00:20:02.000
What did that mean?

00:20:03.000 --> 00:20:04.000
It means that every resource you wanted to access

00:20:05.000 --> 00:20:06.000
was in your subnet, was in your VLAN,

00:20:07.000 --> 00:20:08.000
was in your broadcast domain.

00:20:09.000 --> 00:20:10.000
So if I was sitting here on my PC,

00:20:11.000 --> 00:20:14.000
my server over here, my DHCP server

00:20:15.000 --> 00:20:16.000
was actually in the same subnet,

00:20:16.000 --> 00:20:17.000
VLAN broadcast domain as me.

00:20:18.000 --> 00:20:19.000
VLAN 10, VLAN 10.

00:20:20.000 --> 00:20:21.000
No joke.

00:20:22.000 --> 00:20:23.000
No joke.

00:20:24.000 --> 00:20:25.000
And nobody's old enough to know about this?

00:20:26.000 --> 00:20:27.000
Yeah.

00:20:28.000 --> 00:20:29.000
That's why when you think about a protocol like DHCP

00:20:30.000 --> 00:20:31.000
and you're like, I don't understand

00:20:32.000 --> 00:20:34.000
why the discover message is broadcasted

00:20:35.000 --> 00:20:36.000
when my DHCP servers are always centralized.

00:20:37.000 --> 00:20:38.000
It makes no sense.

00:20:39.000 --> 00:20:41.000
Well, it was designed in an environment like this

00:20:42.000 --> 00:20:43.000
when it made sense.

00:20:43.000 --> 00:20:45.000
So I send out my traffic

00:20:46.000 --> 00:20:47.000
and it's layer two switched

00:20:48.000 --> 00:20:49.000
all the way to the server.

00:20:50.000 --> 00:20:51.000
So yes, spanning tree protocol

00:20:52.000 --> 00:20:53.000
running in this entire environment, absolutely.

00:20:54.000 --> 00:20:55.000
Yeah, ugly.

00:20:56.000 --> 00:20:57.000
Ugly.

00:20:58.000 --> 00:20:59.000
But what did that mean?

00:21:00.000 --> 00:21:01.000
This had to be a trunk, this had to be a trunk,

00:21:02.000 --> 00:21:03.000
this had to be a trunk, this had to be a trunk,

00:21:04.000 --> 00:21:05.000
this, this, this.

00:21:06.000 --> 00:21:07.000
We don't do this today anymore, right?

00:21:08.000 --> 00:21:09.000
We minimize the number of trunks we have.

00:21:10.000 --> 00:21:11.000
We want like minimal trunks in our environment.

00:21:11.000 --> 00:21:12.000
Minimal spanning tree protocol.

00:21:13.000 --> 00:21:14.000
Minimal layer two,

00:21:15.000 --> 00:21:16.000
lots and lots and lots of layer three routing today.

00:21:17.000 --> 00:21:18.000
Why?

00:21:18.000 --> 00:21:19.000
Because routing is far superior to layer two nowadays.

00:21:20.000 --> 00:21:21.000
But yeah,

00:21:22.000 --> 00:21:23.000
and then you can have somebody in VLAN 20 right here.

00:21:24.000 --> 00:21:26.000
And there's their VLAN 20 server over here.

00:21:27.000 --> 00:21:28.000
So trunks,

00:21:29.000 --> 00:21:30.000
passing traffic from multiple VLANs.

00:21:31.000 --> 00:21:32.000
So DTP was invented

00:21:33.000 --> 00:21:35.000
so as soon as you plug two switches together,

00:21:36.000 --> 00:21:37.000
a trunk is automatically formed,

00:21:38.000 --> 00:21:39.000
meaning you don't have to do anything.

00:21:39.000 --> 00:21:40.000
That's right.

00:21:41.000 --> 00:21:42.000
You plug a switch into another switch,

00:21:43.000 --> 00:21:44.000
you got a trunk.

00:21:45.000 --> 00:21:46.000
That's it, that's why it was invented.

00:21:47.000 --> 00:21:48.000
Plug and play.

00:21:49.000 --> 00:21:50.000
As a network admin, right,

00:21:51.000 --> 00:21:52.000
you got a cable, you got a switch, plug it in.

00:21:53.000 --> 00:21:54.000
You got another switch, plug it in.

00:21:55.000 --> 00:21:56.000
Guess what, trunk's already configured, don't worry about it.

00:21:57.000 --> 00:21:58.000
Now, if you needed to do filtering and other things

00:21:59.000 --> 00:22:00.000
and all that stuff,

00:22:01.000 --> 00:22:02.000
then you'd still have to go and do that yourself after the fact.

00:22:03.000 --> 00:22:04.000
But the actual trunk was automatically formed for you.

00:22:09.000 --> 00:22:10.000
So Dynamic Desirable was typically

00:22:11.000 --> 00:22:13.000
what was configured on both sides by default

00:22:14.000 --> 00:22:16.000
right off of the manufacturing lot of Cisco.

00:22:17.000 --> 00:22:18.000
Dynamic Desirable.

00:22:19.000 --> 00:22:20.000
What does it say?

00:22:21.000 --> 00:22:22.000
Send and wait for DTP messages to arrive

00:22:23.000 --> 00:22:24.000
on the link

00:22:25.000 --> 00:22:26.000
and negotiate the format.

00:22:27.000 --> 00:22:28.000
So you were always, as soon as your link came up,

00:22:29.000 --> 00:22:30.000
you were sending DTP messages, sending DTP messages.

00:22:31.000 --> 00:22:32.000
Why?

00:22:32.000 --> 00:22:33.000
Trying to form a trunk with the other side automatically,

00:22:34.000 --> 00:22:35.000
that's what you were doing.

00:22:36.000 --> 00:22:37.000
And then auto

00:22:37.000 --> 00:22:39.000
is used if you don't want to send,

00:22:40.000 --> 00:22:41.000
but you still want to form a trunk.

00:22:42.000 --> 00:22:43.000
So for example, auto says wait for DTP messages to arrive

00:22:44.000 --> 00:22:45.000
to form a trunk with the other side.

00:22:46.000 --> 00:22:47.000
So what does that mean?

00:22:48.000 --> 00:22:49.000
It means if both sides are auto,

00:22:50.000 --> 00:22:51.000
you're not going to be able to form a trunk.

00:22:52.000 --> 00:22:53.000
And that is what the default is today.

00:22:54.000 --> 00:22:55.000
That is what the default is today.

00:22:56.000 --> 00:22:57.000
So if we look at ASW1 right now,

00:22:58.000 --> 00:23:00.000
we type in do show run pipe,

00:23:01.000 --> 00:23:02.000
no, no, no, no,

00:23:03.000 --> 00:23:06.000
do show interface gigabit one size zero size 45 switch port.

00:23:07.000 --> 00:23:08.000
That's what I want.

00:23:10.000 --> 00:23:12.000
You'll see that it says dynamic auto right here.

00:23:13.000 --> 00:23:15.000
Let's go over to DSW1.

00:23:16.000 --> 00:23:17.000
And on DSW1,

00:23:24.000 --> 00:23:27.000
we'll change it to we are 21.

00:23:28.000 --> 00:23:29.000
Okay, dynamic auto.

00:23:30.000 --> 00:23:32.000
So auto auto on both sides means we're both waiting today.

00:23:33.000 --> 00:23:35.000
So, but back in the day, they were both dynamic desirable.

00:23:35.000 --> 00:23:36.000
That's right.

00:23:37.000 --> 00:23:38.000
Both dynamic desirable.

00:23:39.000 --> 00:23:40.000
I still have switches here in one of my stacks

00:23:41.000 --> 00:23:43.000
that defaults to dynamic desirable.

00:23:44.000 --> 00:23:47.000
And as soon as you plug in one switch that's dynamic desirable

00:23:48.000 --> 00:23:49.000
into any other switch that supports DTP,

00:23:50.000 --> 00:23:52.000
it automatically forms a trunk no matter what.

00:23:53.000 --> 00:23:54.000
So auto auto doesn't work.

00:23:55.000 --> 00:23:57.000
And so by default, most Cisco switches today are auto.

00:23:58.000 --> 00:24:00.000
Because even Cisco says you don't really want to use this

00:24:01.000 --> 00:24:02.000
unless you absolutely want to use it.

00:24:02.000 --> 00:24:03.000
Why?

00:24:04.000 --> 00:24:05.000
Because why rely on a dynamic protocol

00:24:06.000 --> 00:24:07.000
to form a trunk for you

00:24:08.000 --> 00:24:09.000
when you can manually do it yourself?

00:24:10.000 --> 00:24:11.000
See, it made sense back in the day

00:24:12.000 --> 00:24:13.000
when you had thousands of trunks.

00:24:14.000 --> 00:24:15.000
But today, you don't have as many trunks.

00:24:16.000 --> 00:24:17.000
You have a lot less.

00:24:18.000 --> 00:24:19.000
And you can manually control those today

00:24:20.000 --> 00:24:22.000
as opposed to allowing DTP just to do it for you.

00:24:23.000 --> 00:24:24.000
So auto auto doesn't form a trunk.

00:24:25.000 --> 00:24:26.000
I want you to know that because on the exam,

00:24:27.000 --> 00:24:28.000
if you ever see a scenario

00:24:29.000 --> 00:24:30.000
where they're showing you auto on one side

00:24:30.000 --> 00:24:32.000
and the other side's also auto,

00:24:33.000 --> 00:24:35.000
and they're asking you why is a trunk not forming

00:24:36.000 --> 00:24:37.000
or solve the problem as to why the trunk's not forming,

00:24:38.000 --> 00:24:39.000
there's your problem.

00:24:40.000 --> 00:24:41.000
They're both auto, first and foremost.

00:24:42.000 --> 00:24:43.000
So you have to have the right settings on both sides.

00:24:44.000 --> 00:24:46.000
So desirable auto will work.

00:24:47.000 --> 00:24:48.000
Just change one side to desirable.

00:24:49.000 --> 00:24:50.000
The other side stays auto.

00:24:51.000 --> 00:24:52.000
It's going to work.

00:24:53.000 --> 00:24:57.000
So right now, let's type in switch port mode dynamic desirable.

00:24:57.000 --> 00:25:00.000
And we'll see here after our interface is flap

00:25:01.000 --> 00:25:04.000
that typing in the command do show interface gigabit

00:25:05.000 --> 00:25:06.000
one size zero size 45 switch port.

00:25:07.000 --> 00:25:08.000
I am now dynamic desirable.

00:25:09.000 --> 00:25:10.000
I am now a trunk.

00:25:11.000 --> 00:25:12.000
I am using 802.1Q.

00:25:13.000 --> 00:25:14.000
We are using DTP.

00:25:15.000 --> 00:25:16.000
Our native VLAN is VLAN number one.

00:25:17.000 --> 00:25:18.000
We go over to DSW1,

00:25:19.000 --> 00:25:20.000
look at the output of that command now,

00:25:21.000 --> 00:25:22.000
and you'll see that I'm still dynamic auto,

00:25:23.000 --> 00:25:24.000
but now I am a trunk.

00:25:25.000 --> 00:25:26.000
Okay, what was I before?

00:25:27.000 --> 00:25:28.000
I was dynamic auto, but I was an access port.

00:25:29.000 --> 00:25:30.000
And if you ever see access there, what did I say?

00:25:31.000 --> 00:25:32.000
I'm an access port.

00:25:33.000 --> 00:25:34.000
I'm part of VLAN one, right?

00:25:35.000 --> 00:25:36.000
Whenever you see access,

00:25:37.000 --> 00:25:38.000
then this matters and this matters.

00:25:39.000 --> 00:25:40.000
But anytime you see trunk, they don't matter anymore.

00:25:41.000 --> 00:25:42.000
So now that it says trunk,

00:25:43.000 --> 00:25:44.000
this doesn't matter.

00:25:45.000 --> 00:25:46.000
This doesn't matter, right?

00:25:47.000 --> 00:25:48.000
What matters?

00:25:49.000 --> 00:25:50.000
The fact that I negotiated 802.1Q.

00:25:51.000 --> 00:25:52.000
That's right.

00:25:52.000 --> 00:25:53.000
I negotiated it.

00:25:54.000 --> 00:25:55.000
Why?

00:25:55.000 --> 00:25:56.000
Because it supports our trunking encapsulation protocol.

00:25:57.000 --> 00:26:00.000
Cisco's proprietary trunking encapsulation protocol of ISL.

00:26:01.000 --> 00:26:02.000
It does support it.

00:26:03.000 --> 00:26:04.000
We'll talk about that momentarily.

00:26:05.000 --> 00:26:06.000
When I show you a config here,

00:26:07.000 --> 00:26:08.000
this switch won't allow me to do the configs

00:26:09.000 --> 00:26:10.000
without actually manually setting my encapsulation as well.

00:26:11.000 --> 00:26:13.000
But because the other device was doing dynamic desirable,

00:26:14.000 --> 00:26:15.000
everything could be negotiated.

00:26:16.000 --> 00:26:17.000
Negotiated trunking is on.

00:26:18.000 --> 00:26:19.000
Native VLANs one is an example.

00:26:20.000 --> 00:26:21.000
So let's just type in here now,

00:26:22.000 --> 00:26:23.000
do show interface trunk.

00:26:23.000 --> 00:26:24.000
And you'll see in this output

00:26:25.000 --> 00:26:28.000
that gig one size zero size 21 mode auto

00:26:29.000 --> 00:26:33.000
negotiated 802.1Q trunking encapsulation

00:26:34.000 --> 00:26:35.000
and the native VLAN is one.

00:26:36.000 --> 00:26:37.000
We'll go over to ASW1.

00:26:38.000 --> 00:26:40.000
We'll take a look at now show interface trunk.

00:26:41.000 --> 00:26:42.000
And it says here that we are mode desirable.

00:26:43.000 --> 00:26:45.000
802.1Q is what was used.

00:26:46.000 --> 00:26:47.000
Notice it doesn't say negotiated

00:26:48.000 --> 00:26:50.000
because this device only supports 802.1Q.

00:26:51.000 --> 00:26:52.000
It doesn't support ISL.

00:26:53.000 --> 00:26:55.000
It only supports native VLAN of one.

00:26:56.000 --> 00:26:57.000
So auto auto will not form a trunk,

00:26:58.000 --> 00:26:59.000
but desirable auto will definitely form a trunk.

00:27:00.000 --> 00:27:03.000
Therefore, desirable desirable will also form a trunk as well.

00:27:04.000 --> 00:27:06.000
So no, nothing crazy there.

00:27:07.000 --> 00:27:09.000
Okay, trunk desirable will still work.

00:27:10.000 --> 00:27:11.000
Absolutely.

00:27:12.000 --> 00:27:13.000
Now why is trunk desirable still going to work?

00:27:14.000 --> 00:27:15.000
Because what I want you to realize

00:27:16.000 --> 00:27:17.000
is that even though trunk forces the interface

00:27:18.000 --> 00:27:19.000
in the trunk mode,

00:27:20.000 --> 00:27:21.000
no matter what the other side is configured like,

00:27:21.000 --> 00:27:22.000
it still supports DTP,

00:27:23.000 --> 00:27:24.000
meaning DTP is not shut off.

00:27:25.000 --> 00:27:27.000
So if we go over to, for example, ASW1 now,

00:27:28.000 --> 00:27:30.000
and we type in switch port mode trunk instead,

00:27:31.000 --> 00:27:33.000
and we look at our output of show interfaces trunk,

00:27:34.000 --> 00:27:35.000
you'll see that says mode on.

00:27:36.000 --> 00:27:37.000
Mode on means what?

00:27:38.000 --> 00:27:40.000
Mode on means we typed in switch port mode trunk.

00:27:41.000 --> 00:27:42.000
That's what it means.

00:27:43.000 --> 00:27:45.000
If we look at the output of show interface gig

00:27:46.000 --> 00:27:47.000
one size zero size 45 switch port,

00:27:48.000 --> 00:27:49.000
you'll see the administrator mode is trunk,

00:27:49.000 --> 00:27:50.000
operational trunk.

00:27:51.000 --> 00:27:52.000
We are using 802.1Q.

00:27:54.000 --> 00:27:58.000
And notice that DTP is still on.

00:27:59.000 --> 00:28:02.000
That's why trunk works with desirable.

00:28:03.000 --> 00:28:04.000
DTP is still on.

00:28:05.000 --> 00:28:07.000
So I'm still sending and receiving DTP messages,

00:28:08.000 --> 00:28:09.000
even though we typed in switch port mode trunk.

00:28:10.000 --> 00:28:11.000
It's the default behavior.

00:28:12.000 --> 00:28:13.000
So therefore trunk works with desirable.

00:28:14.000 --> 00:28:15.000
Trunk works with auto.

00:28:16.000 --> 00:28:17.000
Trunk works with trunk.

00:28:17.000 --> 00:28:18.000
No surprise there.

00:28:19.000 --> 00:28:21.000
But trunk will not work with access.

00:28:22.000 --> 00:28:23.000
Auto will not work with access.

00:28:24.000 --> 00:28:26.000
Desirable will not work with access.

00:28:32.000 --> 00:28:33.000
It's important that you know

00:28:34.000 --> 00:28:35.000
all those combinations for the exam.

00:28:36.000 --> 00:28:38.000
Because you never know when you'll receive output,

00:28:39.000 --> 00:28:40.000
and you're trying to figure out

00:28:41.000 --> 00:28:42.000
why is the trunk not forming.

00:28:43.000 --> 00:28:44.000
So it could be this output here.

00:28:45.000 --> 00:28:46.000
So if you're looking at this output,

00:28:47.000 --> 00:28:48.000
you're looking at the administrative mode.

00:28:49.000 --> 00:28:51.000
Is the administrative mode listed on this device?

00:28:53.000 --> 00:28:54.000
Inappropriate.

00:28:55.000 --> 00:28:56.000
Administrative mode.

00:28:57.000 --> 00:28:58.000
That works with this.

00:28:59.000 --> 00:29:00.000
So does trunk,

00:29:01.000 --> 00:29:02.000
administrative mode,

00:29:03.000 --> 00:29:04.000
and auto administrative mode work?

00:29:05.000 --> 00:29:06.000
Yes they do. Absolutely.

00:29:07.000 --> 00:29:10.000
That's if and only if DTP is actually on.

00:29:12.000 --> 00:29:14.000
And in this case, it is.

00:29:18.000 --> 00:29:20.000
So in modern day networks,

00:29:21.000 --> 00:29:23.000
it is best practice to disable DTP negotiation

00:29:24.000 --> 00:29:25.000
and set everything manually exactly.

00:29:26.000 --> 00:29:27.000
And that's what I'm going to show you to do here momentarily.

00:29:28.000 --> 00:29:29.000
That's the config I'm going to provide to you

00:29:30.000 --> 00:29:31.000
for the real world.

00:29:32.000 --> 00:29:33.000
So on the exam,

00:29:34.000 --> 00:29:35.000
you might have to do that config,

00:29:36.000 --> 00:29:37.000
or if they tell you to use DTP

00:29:38.000 --> 00:29:39.000
or they tell you to use dynamic desirable on one side,

00:29:40.000 --> 00:29:41.000
then you just got to do it.

00:29:42.000 --> 00:29:43.000
Do what they tell you to do.

00:29:44.000 --> 00:29:45.000
But you've seen now how to configure DTP.

00:29:46.000 --> 00:29:48.000
Or you configure desirable, I should say.

00:29:49.000 --> 00:29:50.000
And auto is the default.

00:29:51.000 --> 00:29:53.000
And I'll show you how to configure trunk momentarily.

00:29:55.000 --> 00:29:56.000
So trunk, trunk,

00:29:57.000 --> 00:29:58.000
definitely a good way to go

00:29:59.000 --> 00:30:00.000
and not worry about dynamic desirable

00:30:01.000 --> 00:30:02.000
or auto in the real world.

00:30:03.000 --> 00:30:05.000
And then make those access ports down on ASW1.

00:30:06.000 --> 00:30:07.000
Why?

00:30:08.000 --> 00:30:09.000
Because as an access port,

00:30:10.000 --> 00:30:11.000
you're disabling DTP on the interface

00:30:12.000 --> 00:30:13.000
as an access port.

00:30:13.000 --> 00:30:14.000
So down here.

00:30:15.000 --> 00:30:16.000
Do we need DTP running there?

00:30:17.000 --> 00:30:18.000
No, we don't.

00:30:19.000 --> 00:30:20.000
Because there is no device

00:30:21.000 --> 00:30:22.000
that is out those interfaces

00:30:23.000 --> 00:30:24.000
that we're trying to form a trunk with.

00:30:25.000 --> 00:30:26.000
Now, if there was, different story.

00:30:27.000 --> 00:30:28.000
But most of the time,

00:30:29.000 --> 00:30:30.000
no, we're not trying to form a trunk with our Cisco phones.

00:30:31.000 --> 00:30:32.000
We're not trying to form a trunk with our PCs.

00:30:33.000 --> 00:30:34.000
So if it's going down to a phone,

00:30:35.000 --> 00:30:36.000
a PC, a printer, et cetera, et cetera, et cetera,

00:30:37.000 --> 00:30:38.000
and we don't need a trunk,

00:30:39.000 --> 00:30:40.000
then you might as well set the port

00:30:41.000 --> 00:30:42.000
to switch port mode access.

00:30:43.000 --> 00:30:44.000
Never, ever, ever, ever, ever

00:30:45.000 --> 00:30:46.000
allow this port to become a trunk.

00:30:47.000 --> 00:30:48.000
No matter what.

00:30:49.000 --> 00:30:50.000
Even if somebody's forcing us to.

00:30:51.000 --> 00:30:52.000
We're getting bombarded with DTP messages

00:30:53.000 --> 00:30:54.000
or we're getting bombarded with some message.

00:30:55.000 --> 00:30:56.000
No, no.

00:30:57.000 --> 00:30:58.000
Unless an administrator comes in and types in

00:30:59.000 --> 00:31:00.000
no switch port mode access

00:31:01.000 --> 00:31:02.000
or switch port mode trunk

00:31:03.000 --> 00:31:04.000
or switch port mode desirable,

00:31:05.000 --> 00:31:06.000
that's the only time we're going to get changed.

00:31:07.000 --> 00:31:08.000
We will never form a trunk at all

00:31:09.000 --> 00:31:10.000
if it's switch port mode access.

00:31:11.000 --> 00:31:12.000
Therefore, we would belong

00:31:13.000 --> 00:31:14.000
in our voice VLAN in that particular case.

00:31:15.000 --> 00:31:16.000
So let's just go ahead and do that

00:31:17.000 --> 00:31:18.000
because we saw that as part of our config earlier.

00:31:19.000 --> 00:31:20.000
So what I'll do is I'll type in interface range

00:31:21.000 --> 00:31:22.000
gigabit ethernet one size zero slash,

00:31:23.000 --> 00:31:24.000
oops,

00:31:25.000 --> 00:31:26.000
one, two, three,

00:31:27.000 --> 00:31:28.000
and then we'll type in switch port mode access.

00:31:29.000 --> 00:31:30.000
There you go.

00:31:31.000 --> 00:31:32.000
But before I do that, you know what?

00:31:33.000 --> 00:31:34.000
I want to change this again.

00:31:35.000 --> 00:31:36.000
I want to go back because I just want to show you this first.

00:31:37.000 --> 00:31:38.000
Do show interface gigabit ethernet

00:31:39.000 --> 00:31:40.000
one size zero slash one.

00:31:41.000 --> 00:31:42.000
So I erased it.

00:31:43.000 --> 00:31:44.000
And let's type in switch port.

00:31:45.000 --> 00:31:46.000
So what you're going to see here

00:31:47.000 --> 00:31:48.000
is that it says we're dynamic auto.

00:31:49.000 --> 00:31:50.000
See, that's the problem.

00:31:51.000 --> 00:31:52.000
That's what I'm trying to change.

00:31:53.000 --> 00:31:54.000
By default, these are dynamic auto.

00:31:55.000 --> 00:31:56.000
So if I do not,

00:31:57.000 --> 00:31:58.000
and then if a DTP message comes in,

00:31:59.000 --> 00:32:00.000
then I become a trunk port.

00:32:01.000 --> 00:32:02.000
So what I want to do is I want to make sure

00:32:03.000 --> 00:32:04.000
I never, ever, ever become a trunk

00:32:05.000 --> 00:32:06.000
and I shut off DTP all at the exact same time.

00:32:07.000 --> 00:32:08.000
So let's type that in.

00:32:09.000 --> 00:32:10.000
Switch port mode access.

00:32:11.000 --> 00:32:12.000
And now when we look at our VLAN,

00:32:13.000 --> 00:32:14.000
our output, you'll see it says

00:32:15.000 --> 00:32:16.000
my administrative mode is static access.

00:32:17.000 --> 00:32:18.000
So anytime you see administrative mode static access,

00:32:19.000 --> 00:32:20.000
it means this command was typed in.

00:32:21.000 --> 00:32:23.000
Therefore, since the administrative mode is static access,

00:32:24.000 --> 00:32:25.000
the operational mode is static access,

00:32:26.000 --> 00:32:27.000
which means this doesn't matter.

00:32:28.000 --> 00:32:29.000
This doesn't matter.

00:32:30.000 --> 00:32:32.000
Look, DTP is off on the access port now.

00:32:33.000 --> 00:32:35.000
Therefore, this is the VLAN I belong to for access.

00:32:36.000 --> 00:32:38.000
And this is the VLAN I belong to for voice.

00:32:39.000 --> 00:32:41.000
Perfect config for the exam.

00:32:42.000 --> 00:32:45.000
Do, show, run, interface, gigabit, one size zero slash one.

00:32:46.000 --> 00:32:47.000
There you go.

00:32:48.000 --> 00:32:49.000
All right.

00:32:50.000 --> 00:32:51.000
Port fast is there, but

00:32:55.000 --> 00:32:56.000
that is something we'll talk about later.

00:32:57.000 --> 00:32:58.000
So there you go.

00:32:59.000 --> 00:33:00.000
So far, perfect three commands

00:33:01.000 --> 00:33:02.000
that I want you to memorize for the exam.

00:33:03.000 --> 00:33:04.000
The only thing that would be different

00:33:05.000 --> 00:33:06.000
is the VLAN numbers for you.

00:33:07.000 --> 00:33:08.000
All right.

00:33:09.000 --> 00:33:10.000
Let's go back to our trunk ports now.

00:33:11.000 --> 00:33:13.000
Let's do interface range.

00:33:14.000 --> 00:33:19.000
Gigabit Ethernet, one size zero slash 45, 46, 47, 48.

00:33:20.000 --> 00:33:22.000
So we're going to configure all four of these right now.

00:33:23.000 --> 00:33:24.000
All four of these.

00:33:25.000 --> 00:33:26.000
But before we do that,

00:33:27.000 --> 00:33:29.000
I want to talk about shutting off DTP.

00:33:30.000 --> 00:33:31.000
No DTP.

00:33:32.000 --> 00:33:33.000
Basically, I want to disable this,

00:33:34.000 --> 00:33:35.000
and I want to disable this.

00:33:36.000 --> 00:33:37.000
That's what I want to do.

00:33:38.000 --> 00:33:39.000
But you don't have to do this.

00:33:39.000 --> 00:33:40.000
But if you wanted to,

00:33:41.000 --> 00:33:44.000
what you would do is you would do trunk with no negotiation.

00:33:45.000 --> 00:33:46.000
Trunk with no negotiation means

00:33:47.000 --> 00:33:49.000
that you want to shut off DTP.

00:33:51.000 --> 00:33:52.000
And we'd have to do that on both sides

00:33:53.000 --> 00:33:55.000
because once you do that to one side,

00:33:56.000 --> 00:33:58.000
you can't have the other side as dynamic desirable,

00:33:59.000 --> 00:34:00.000
and you can't have the other side as dynamic auto

00:34:01.000 --> 00:34:02.000
because once you do trunk no negotiate,

00:34:03.000 --> 00:34:06.000
the other side has to be trunk or trunk no negotiate.

00:34:06.000 --> 00:34:08.000
But it can't be dynamic desirable or dynamic auto anymore.

00:34:09.000 --> 00:34:10.000
So what we're going to do here

00:34:11.000 --> 00:34:13.000
is we're going to configure these as switch port mode trunk.

00:34:14.000 --> 00:34:15.000
Now that converts into the trunk ports.

00:34:16.000 --> 00:34:20.000
So I type in do show interface gigabit one size zero slash 45.

00:34:21.000 --> 00:34:22.000
Switch port.

00:34:25.000 --> 00:34:26.000
What you're going to see is that

00:34:27.000 --> 00:34:28.000
we are administratively mode trunk.

00:34:29.000 --> 00:34:30.000
Operationally, we're trunk.

00:34:31.000 --> 00:34:32.000
But look at this.

00:34:33.000 --> 00:34:34.000
We are

00:34:35.000 --> 00:34:36.000
still using DTP.

00:34:37.000 --> 00:34:38.000
So how do we shut off DTP?

00:34:39.000 --> 00:34:40.000
You type in switch port,

00:34:41.000 --> 00:34:42.000
no negotiate.

00:34:43.000 --> 00:34:44.000
Now that shuts off DTP.

00:34:45.000 --> 00:34:46.000
So if we look here,

00:34:47.000 --> 00:34:48.000
you'll see that DTP is now off.

00:34:49.000 --> 00:34:50.000
So I want to be super careful with this.

00:34:52.000 --> 00:34:53.000
Why? Because

00:34:54.000 --> 00:34:55.000
if you look at this here,

00:34:56.000 --> 00:34:57.000
and I asked you right now,

00:34:58.000 --> 00:34:59.000
how was DTP disabled?

00:35:01.000 --> 00:35:03.000
You can't just say

00:35:04.000 --> 00:35:05.000
that you use this command.

00:35:06.000 --> 00:35:07.000
Why is that?

00:35:08.000 --> 00:35:09.000
Scroll up.

00:35:10.000 --> 00:35:11.000
Remember what we did moments ago?

00:35:16.000 --> 00:35:18.000
Why was DTP disabled?

00:35:20.000 --> 00:35:22.000
Because you typed in switch port mode access.

00:35:23.000 --> 00:35:24.000
How do I know that?

00:35:25.000 --> 00:35:28.000
Because it says administrative mode static access.

00:35:29.000 --> 00:35:30.000
Pay attention to the details.

00:35:30.000 --> 00:35:32.000
How was DTP disabled?

00:35:33.000 --> 00:35:35.000
Well, because administrative mode is static access,

00:35:36.000 --> 00:35:38.000
that means it's because we typed in switch port mode access.

00:35:39.000 --> 00:35:40.000
Okay, let's get back to the bottom.

00:35:41.000 --> 00:35:43.000
How was DTP disabled?

00:35:44.000 --> 00:35:46.000
Well, because the administrative mode is trunk,

00:35:47.000 --> 00:35:49.000
it must mean we typed in switch port,

00:35:50.000 --> 00:35:51.000
no negotiate.

00:35:55.000 --> 00:35:56.000
There you go.

00:35:57.000 --> 00:35:58.000
Wow.

00:35:59.000 --> 00:36:00.000
Not two ways.

00:36:01.000 --> 00:36:02.000
Hang on here.

00:36:03.000 --> 00:36:04.000
Hang on.

00:36:05.000 --> 00:36:06.000
Not two ways.

00:36:07.000 --> 00:36:08.000
Think about it.

00:36:09.000 --> 00:36:10.000
One's a trunk port.

00:36:11.000 --> 00:36:12.000
One's an access port.

00:36:13.000 --> 00:36:15.000
How do you shut off DTP on an access port?

00:36:16.000 --> 00:36:17.000
Type in switch port mode access.

00:36:18.000 --> 00:36:20.000
How do you shut off DTP on an access port?

00:36:21.000 --> 00:36:22.000
Type in switch port mode access.

00:36:23.000 --> 00:36:25.000
How do you shut off DTP on an access port?

00:36:25.000 --> 00:36:26.000
Type in switch port mode access.

00:36:27.000 --> 00:36:29.000
How do you type shut off DTP on a trunk port?

00:36:30.000 --> 00:36:31.000
Switch port no negotiate.

00:36:32.000 --> 00:36:33.000
Right?

00:36:34.000 --> 00:36:35.000
It's just two different types of interfaces.

00:36:36.000 --> 00:36:38.000
Two different commands accomplish the same thing.

00:36:39.000 --> 00:36:40.000
Yeah, so yeah, okay.

00:36:41.000 --> 00:36:42.000
There's two ways then.

00:36:43.000 --> 00:36:45.000
But it's about the interface type that is more important.

00:36:48.000 --> 00:36:49.000
Is it an access port or a trunk port?

00:36:50.000 --> 00:36:51.000
That's going to make a difference.

00:36:52.000 --> 00:36:53.000
Yeah.

00:36:54.000 --> 00:36:56.000
Right, so now you can see here we've got our four ports.

00:36:57.000 --> 00:36:58.000
There's trunk ports.

00:36:59.000 --> 00:37:00.000
And because it says on,

00:37:01.000 --> 00:37:02.000
it was switch port mode trunk that we typed in.

00:37:03.000 --> 00:37:06.000
802.1Q is the only encapsulation method that's supported on this device.

00:37:08.000 --> 00:37:11.000
And notice by default we're allowing all VLANs automatically.

00:37:13.000 --> 00:37:14.000
Talk about that more later.

00:37:15.000 --> 00:37:16.000
All right, let's go to DSW-1 though.

00:37:17.000 --> 00:37:18.000
Right, because on DSW-1 right now,

00:37:19.000 --> 00:37:20.000
what we're going to do is we're going to type in

00:37:21.000 --> 00:37:22.000
interface range gigabit Ethernet.

00:37:23.000 --> 00:37:24.000
We want all of these interfaces here.

00:37:25.000 --> 00:37:26.000
Every single one of them.

00:37:27.000 --> 00:37:30.000
So that is 17, 18, 19, 20, 21, 22, 23, 24.

00:37:31.000 --> 00:37:35.000
So gigabit Ethernet 1 slash 0 slash 17 through 24.

00:37:38.000 --> 00:37:39.000
Now we're going to type in.

00:37:40.000 --> 00:37:42.000
I'm going to do it in an order that many people say,

00:37:43.000 --> 00:37:44.000
well, why don't we do it this way?

00:37:45.000 --> 00:37:46.000
Why don't we shut off DTP first?

00:37:47.000 --> 00:37:48.000
That way their negotiation is gone.

00:37:49.000 --> 00:37:50.000
So let's do that.

00:37:51.000 --> 00:37:52.000
Switch port, no negotiate.

00:37:53.000 --> 00:37:54.000
Do not do that.

00:37:55.000 --> 00:37:56.000
Why?

00:37:57.000 --> 00:38:00.000
You cannot shut off DTP if your interfaces are currently what?

00:38:01.000 --> 00:38:03.000
Auto or desirable.

00:38:04.000 --> 00:38:05.000
And we are currently running what?

00:38:06.000 --> 00:38:07.000
Auto on those interfaces.

00:38:08.000 --> 00:38:12.000
You can't shut off DTP if your interfaces are running auto or desirable.

00:38:13.000 --> 00:38:17.000
That's why this error message has shown its face.

00:38:18.000 --> 00:38:20.000
So order of operations matter here.

00:38:20.000 --> 00:38:24.000
So let's type in switch port mode trunk.

00:38:25.000 --> 00:38:28.000
Look, I can't even do that on this device.

00:38:29.000 --> 00:38:30.000
What?

00:38:31.000 --> 00:38:36.000
And the reason why is because this device supports two types of encapsulation.

00:38:37.000 --> 00:38:39.000
This device only supported 802.1Q.

00:38:40.000 --> 00:38:45.000
This device supports 802.1Q and ISL, as I mentioned before.

00:38:46.000 --> 00:38:51.000
So if we type in switch port trunk encapsulation, you'll see .1Q and ISL.

00:38:52.000 --> 00:38:56.000
So ISL is Cisco's proprietary trunking encapsulation protocol.

00:38:57.000 --> 00:38:59.000
They invented that before 802.1Q existed.

00:39:00.000 --> 00:39:04.000
And so back before VLANs and trunking became a standard,

00:39:05.000 --> 00:39:08.000
many different vendors did it on their own in different ways.

00:39:09.000 --> 00:39:12.000
Cisco created VLANs 1 through 1005, as we talked about before,

00:39:12.000 --> 00:39:16.000
and they created a trunking encapsulation protocol called ISL.

00:39:17.000 --> 00:39:23.000
ISL requires 30 bytes in order to encapsulate the data

00:39:24.000 --> 00:39:26.000
for transportation across the link,

00:39:27.000 --> 00:39:31.000
where something like 802.1Q requires how many bytes?

00:39:32.000 --> 00:39:35.000
Well, if we come back to this page here, two bytes for here,

00:39:36.000 --> 00:39:38.000
two bytes for the rest, four bytes in total.

00:39:39.000 --> 00:39:41.000
Four bytes in total.

00:39:43.000 --> 00:39:49.000
So 802.1Q only requires four bytes, whereas ISL required 30.

00:39:50.000 --> 00:39:52.000
Therefore, ISL very, very bloated,

00:39:53.000 --> 00:39:56.000
and Cisco was like, no, we don't even need to use it.

00:39:57.000 --> 00:40:02.000
So if your device supports ISL, we're probably not going to be using it.

00:40:03.000 --> 00:40:04.000
You're going to be using 802.1Q.

00:40:05.000 --> 00:40:07.000
Will ISL show up in the exam? It shouldn't.

00:40:08.000 --> 00:40:10.000
The only time I could see it showing up

00:40:11.000 --> 00:40:14.000
is if they're trying to test you on trunking encapsulation,

00:40:15.000 --> 00:40:18.000
because the encapsulation has to match on both sides,

00:40:19.000 --> 00:40:25.000
meaning that if this side is using 802.1Q,

00:40:26.000 --> 00:40:30.000
then this side also has to be using 802.1Q.

00:40:31.000 --> 00:40:35.000
If this side was using ISL, then it wouldn't work.

00:40:35.000 --> 00:40:36.000
Then it wouldn't work,

00:40:37.000 --> 00:40:39.000
because you're speaking one language, 802.1Q here,

00:40:40.000 --> 00:40:41.000
and you're speaking ISL over here.

00:40:42.000 --> 00:40:43.000
It's not going to work.

00:40:44.000 --> 00:40:45.000
So let's try that for a second.

00:40:46.000 --> 00:40:48.000
So let's do switch port trunk encapsulation ISL,

00:40:49.000 --> 00:40:53.000
switch port mode trunk, switch port no negotiate.

00:40:55.000 --> 00:41:00.000
So the thing is, is that because this side is set to 802.1Q

00:41:01.000 --> 00:41:03.000
and this side only, and then the other, yeah,

00:41:03.000 --> 00:41:05.000
they're all set right now to 802.1Q.

00:41:06.000 --> 00:41:07.000
And that's the only thing they support.

00:41:08.000 --> 00:41:09.000
We're going to see that when we type in

00:41:10.000 --> 00:41:12.000
do show interfaces trunk,

00:41:18.000 --> 00:41:23.000
it shows here that 21 and 22 are listed, doesn't it?

00:41:27.000 --> 00:41:28.000
If we go over to the other side,

00:41:33.000 --> 00:41:34.000
45, 46 are listed.

00:41:35.000 --> 00:41:37.000
The thing is, is that even though they're listed,

00:41:38.000 --> 00:41:39.000
it doesn't mean they're working.

00:41:40.000 --> 00:41:41.000
If somebody tried to communicate right now

00:41:42.000 --> 00:41:43.000
and traffic was flowing,

00:41:44.000 --> 00:41:45.000
traffic would not get across this link,

00:41:46.000 --> 00:41:49.000
because this side is encapsulating with 802.1Q,

00:41:50.000 --> 00:41:51.000
and the other side is using ISL,

00:41:52.000 --> 00:41:54.000
it has no idea how to decapsulate it.

00:41:55.000 --> 00:41:56.000
It doesn't understand it.

00:41:58.000 --> 00:41:59.000
It's like one side speaking one language,

00:42:00.000 --> 00:42:01.000
the other side speaking another language.

00:42:01.000 --> 00:42:02.000
You need a translator,

00:42:03.000 --> 00:42:04.000
but you can't translate 802.1Q to ISL.

00:42:06.000 --> 00:42:08.000
So if ISL shows up in the exam,

00:42:09.000 --> 00:42:10.000
it's because they're trying to test you on this concept,

00:42:11.000 --> 00:42:12.000
where encapsulation has to match

00:42:13.000 --> 00:42:15.000
on both ends of the link

00:42:16.000 --> 00:42:17.000
when it's all said and done.

00:42:20.000 --> 00:42:21.000
And if it doesn't match it,

00:42:22.000 --> 00:42:23.000
then it's not going to work.

00:42:24.000 --> 00:42:25.000
So let's go back and change that

00:42:26.000 --> 00:42:28.000
to switch port trunk encapsulation,

00:42:29.000 --> 00:42:31.000
802.1Q, or no, it's .1Q,

00:42:32.000 --> 00:42:33.000
that's all it's listed as, .1Q.

00:42:38.000 --> 00:42:40.000
Yeah, ISL only supports VLANs up to 1005,

00:42:41.000 --> 00:42:43.000
and that's why those restrictions are in place,

00:42:44.000 --> 00:42:45.000
as well with our normal VLANs

00:42:46.000 --> 00:42:47.000
versus our expanded range VLANs.

00:42:52.000 --> 00:42:53.000
It's all those restrictions we have,

00:42:54.000 --> 00:42:55.000
everything we talked about with our VLANs,

00:42:55.000 --> 00:42:56.000
it's all because of VTP,

00:42:59.000 --> 00:43:00.000
a Cisco proprietary protocol,

00:43:01.000 --> 00:43:03.000
ISL, Cisco proprietary protocol

00:43:04.000 --> 00:43:05.000
that were invented before,

00:43:06.000 --> 00:43:07.000
we could support 4096 VLANs.

00:43:14.000 --> 00:43:15.000
So now if I type in do show interface trunk,

00:43:17.000 --> 00:43:18.000
there, so for example,

00:43:19.000 --> 00:43:21.000
you may see on the exam output like this

00:43:22.000 --> 00:43:23.000
for one device,

00:43:23.000 --> 00:43:24.000
or you might have to type in show interface trunk,

00:43:25.000 --> 00:43:26.000
an output like this for another device,

00:43:27.000 --> 00:43:28.000
or you have to type in show interface trunk,

00:43:29.000 --> 00:43:30.000
and your whole point is to answer

00:43:31.000 --> 00:43:32.000
a multiple choice question that says,

00:43:33.000 --> 00:43:34.000
why is traffic, or why can't PC1

00:43:35.000 --> 00:43:36.000
communicate with so-and-so?

00:43:37.000 --> 00:43:38.000
Well, it could be something like this,

00:43:39.000 --> 00:43:40.000
the trunking encapsulation doesn't match

00:43:41.000 --> 00:43:42.000
between our switches.

00:43:43.000 --> 00:43:44.000
Look for the multiple choice question,

00:43:45.000 --> 00:43:46.000
if that's what it was, there it is, answer C.

00:43:47.000 --> 00:43:48.000
Change the trunking encapsulation

00:43:49.000 --> 00:43:50.000
on DSW1 to 802.1Q.

00:43:51.000 --> 00:43:52.000
But you'd have to be able to verify,

00:43:53.000 --> 00:43:54.000
are we actually using 802.1Q?

00:43:55.000 --> 00:43:56.000
Oh yeah, look, this one's 802.1Q,

00:43:57.000 --> 00:43:58.000
this one's ISL, okay,

00:43:59.000 --> 00:44:00.000
we got a trunking encapsulation mismatch.

00:44:01.000 --> 00:44:02.000
Therefore, traffic wouldn't flow,

00:44:03.000 --> 00:44:04.000
because it couldn't be encapsulated

00:44:05.000 --> 00:44:06.000
and decapsulated properly.

00:44:07.000 --> 00:44:08.000
All right, now let's go ahead

00:44:09.000 --> 00:44:10.000
and do the rest of our configurations

00:44:11.000 --> 00:44:12.000
on the other devices.

00:44:13.000 --> 00:44:14.000
So DSW1, configure terminal,

00:44:15.000 --> 00:44:16.000
interface, gigabit ethernet,

00:44:17.000 --> 00:44:18.000
or interface range.

00:44:23.000 --> 00:44:24.000
Oops.

00:44:37.000 --> 00:44:38.000
All right, and lastly, ASW2.

00:44:48.000 --> 00:44:49.000
The question earlier was,

00:44:50.000 --> 00:44:51.000
hey Raymond, is it best practice

00:44:51.000 --> 00:44:52.000
to configure your interface

00:44:53.000 --> 00:44:54.000
as a trunk and forget about DTP

00:44:55.000 --> 00:44:56.000
and shut it off?

00:44:56.000 --> 00:44:57.000
Yes, and that's what we're doing.

00:44:58.000 --> 00:44:59.000
So switch port mode trunk,

00:45:00.000 --> 00:45:01.000
switch port and then negotiate.

00:45:02.000 --> 00:45:03.000
Right now on this device also,

00:45:04.000 --> 00:45:05.000
let's not forget that this device,

00:45:06.000 --> 00:45:07.000
we have some access ports.

00:45:09.000 --> 00:45:10.000
So if we come back here,

00:45:11.000 --> 00:45:12.000
let's not forget that we've got

00:45:13.000 --> 00:45:14.000
access ports here.

00:45:15.000 --> 00:45:16.000
So what we're going to do,

00:45:17.000 --> 00:45:18.000
we're going to type in

00:45:19.000 --> 00:45:20.000
interface gigabit 1.0.1.

00:45:21.000 --> 00:45:22.000
Oh, wait a second,

00:45:23.000 --> 00:45:24.000
we never even created our VLANs here, did we?

00:45:25.000 --> 00:45:26.000
I need my VLANs.

00:45:27.000 --> 00:45:28.000
So we need VLANs 10,

00:45:29.000 --> 00:45:30.000
we need VLANs 20,

00:45:31.000 --> 00:45:32.000
we need VLANs 50,

00:45:33.000 --> 00:45:34.000
we need VLANs 200.

00:45:35.000 --> 00:45:36.000
So we've got all of those configured now.

00:45:37.000 --> 00:45:38.000
And now we can type in

00:45:39.000 --> 00:45:40.000
interface gigabit 1.0.1.

00:45:41.000 --> 00:45:42.000
And that is the interface in VLAN 20.

00:45:43.000 --> 00:45:44.000
So switch port mode access,

00:45:45.000 --> 00:45:46.000
switch port access VLAN 20,

00:45:47.000 --> 00:45:48.000
switch port voice VLAN 21.

00:45:48.000 --> 00:45:51.000
Switch port voice VLAN 200.

00:45:57.000 --> 00:45:58.000
Interface range,

00:45:59.000 --> 00:46:00.000
gigabit ethernet 1.0.2.3.

00:46:01.000 --> 00:46:02.000
Those are the interfaces in VLAN 50.

00:46:03.000 --> 00:46:04.000
So we'll type in switch port mode access,

00:46:05.000 --> 00:46:07.000
switch port access VLAN 50,

00:46:08.000 --> 00:46:11.000
and switch port voice VLAN 200.

00:46:14.000 --> 00:46:16.000
Now, if we go over to DSW1 as an example,

00:46:16.000 --> 00:46:18.000
I want to take a look at the output of our chunks right now,

00:46:19.000 --> 00:46:20.000
because I want you to see here

00:46:21.000 --> 00:46:22.000
that only VLAN 1 is showing up.

00:46:23.000 --> 00:46:24.000
You see that?

00:46:25.000 --> 00:46:26.000
Why is only VLAN 1 showing up?

00:46:27.000 --> 00:46:28.000
And the reason why is because

00:46:29.000 --> 00:46:30.000
we never configured our VLANs on our device.

00:46:31.000 --> 00:46:32.000
So if we type in do show VLAN brief,

00:46:33.000 --> 00:46:34.000
again, you'll see no VLANs.

00:46:35.000 --> 00:46:36.000
So if the VLANs aren't there,

00:46:37.000 --> 00:46:38.000
then you can't pass traffic for those VLANs.

00:46:39.000 --> 00:46:40.000
So always remember that when you're

00:46:41.000 --> 00:46:42.000
configuring, verifying, and troubleshooting VLANs,

00:46:43.000 --> 00:46:44.000
double check, is the VLAN in the database?

00:46:44.000 --> 00:46:45.000
If the VLAN is not in the database,

00:46:46.000 --> 00:46:48.000
that's your number one reason why things aren't working.

00:46:49.000 --> 00:46:50.000
The VLANs have to be there.

00:46:51.000 --> 00:46:52.000
If the VLAN is not there,

00:46:53.000 --> 00:46:54.000
your switch can't pass traffic for that VLAN,

00:46:55.000 --> 00:46:56.000
no matter what else is configured.

00:46:57.000 --> 00:46:58.000
We've got all our chunks configured and everything else,

00:46:59.000 --> 00:47:01.000
but you will only pass traffic across a chunk

00:47:02.000 --> 00:47:03.000
if it's what?

00:47:04.000 --> 00:47:05.000
In your VLAN database.

00:47:06.000 --> 00:47:08.000
You will only pass traffic in and out of port

00:47:09.000 --> 00:47:12.000
that belongs to a VLAN if that VLAN exists.

00:47:12.000 --> 00:47:13.000
So the VLAN has to exist.

00:47:20.000 --> 00:47:21.000
And you'll see that once I've done this,

00:47:22.000 --> 00:47:24.000
the VLANs are now in my database.

00:47:25.000 --> 00:47:27.000
Notice there's no ports that are associated

00:47:28.000 --> 00:47:29.000
with the VLANs on DSW1.

00:47:30.000 --> 00:47:31.000
Why is that?

00:47:32.000 --> 00:47:33.000
Because I don't have any end users,

00:47:34.000 --> 00:47:35.000
any access ports.

00:47:36.000 --> 00:47:37.000
Only access ports show up here.

00:47:38.000 --> 00:47:39.000
Ports that belong to what?

00:47:40.000 --> 00:47:41.000
A single VLAN, like VLAN10,

00:47:42.000 --> 00:47:43.000
or a port that belongs to the voice VLAN.

00:47:44.000 --> 00:47:45.000
None of those ports are there.

00:47:46.000 --> 00:47:47.000
All my ports are trunks,

00:47:48.000 --> 00:47:49.000
but the switch still has to know about the VLANs

00:47:50.000 --> 00:47:51.000
or it can't pass those VLANs on the trunks.

00:47:52.000 --> 00:47:53.000
Now if we look at our output of

00:47:54.000 --> 00:47:55.000
showing a trace trunk,

00:47:56.000 --> 00:47:58.000
we'll see that those VLANs are now listed in our output.

00:47:59.000 --> 00:48:00.000
So if you're ever looking at this output on an exam as well,

00:48:01.000 --> 00:48:02.000
or in the real world,

00:48:03.000 --> 00:48:04.000
you're like, why aren't they showing up?

00:48:05.000 --> 00:48:06.000
Why aren't they showing up?

00:48:07.000 --> 00:48:08.000
It says all the VLANs are allowed,

00:48:09.000 --> 00:48:10.000
but none of them are showing up.

00:48:10.000 --> 00:48:11.000
Nobody trained you about them.

00:48:12.000 --> 00:48:13.000
Once you train your device about them,

00:48:14.000 --> 00:48:15.000
then they show up.

00:48:17.000 --> 00:48:18.000
So we're going to do the same thing with DSW2 now.

00:48:26.000 --> 00:48:27.000
So why might a trunk not be working?

00:48:28.000 --> 00:48:29.000
Well, a trunk might not be working

00:48:30.000 --> 00:48:31.000
because the VLAN doesn't exist.

00:48:32.000 --> 00:48:33.000
You see the dependency?

00:48:34.000 --> 00:48:35.000
You see the relationship there?

00:48:36.000 --> 00:48:37.000
And why might a VLAN not be working?

00:48:38.000 --> 00:48:39.000
Because the trunk is not allowing that VLAN.

00:48:40.000 --> 00:48:41.000
So that's what we're going to talk about next.

00:48:42.000 --> 00:48:43.000
I think that's a good idea.

00:48:44.000 --> 00:48:45.000
All right, so just so we're aware folks,

00:48:46.000 --> 00:48:47.000
before we move on to the next thing

00:48:48.000 --> 00:48:49.000
I want to talk about with trunks,

00:48:50.000 --> 00:48:51.000
let's get back to some of this output

00:48:52.000 --> 00:48:53.000
and make sure we understand what we're reading.

00:48:54.000 --> 00:48:55.000
So if I type in do show interface,

00:48:56.000 --> 00:48:57.000
can you give it, Ethan,

00:48:58.000 --> 00:48:59.000
at one slash zero slash 21 right now?

00:49:00.000 --> 00:49:01.000
Switchport.

00:49:03.000 --> 00:49:04.000
So what do we have?

00:49:05.000 --> 00:49:06.000
Administrative mode means I typed in

00:49:07.000 --> 00:49:08.000
switchport mode trunk.

00:49:08.000 --> 00:49:09.000
So this is a trunk.

00:49:10.000 --> 00:49:11.000
So if you saw something like dynamic desirable

00:49:12.000 --> 00:49:13.000
or dynamic auto,

00:49:14.000 --> 00:49:15.000
and you saw trunk,

00:49:16.000 --> 00:49:18.000
then that means you successfully negotiated a trunk.

00:49:19.000 --> 00:49:20.000
But if you saw something like dynamic auto

00:49:21.000 --> 00:49:22.000
or dynamic desirable,

00:49:23.000 --> 00:49:24.000
and you saw static access,

00:49:25.000 --> 00:49:26.000
then that means no trunk has been formed.

00:49:27.000 --> 00:49:28.000
So the administrative mode means

00:49:29.000 --> 00:49:30.000
what have you configured

00:49:31.000 --> 00:49:32.000
or what is the default value in the operating system?

00:49:33.000 --> 00:49:34.000
And this is what it's actually operating it as.

00:49:35.000 --> 00:49:36.000
So the only two options for here

00:49:36.000 --> 00:49:38.000
are trunk or static access.

00:49:39.000 --> 00:49:40.000
Whereas up here,

00:49:41.000 --> 00:49:42.000
you have static access, trunk,

00:49:43.000 --> 00:49:44.000
dynamic auto, dynamic desirable.

00:49:47.000 --> 00:49:48.000
And then you've got your encapsulation.

00:49:49.000 --> 00:49:51.000
So if this said 802.1Q on this side

00:49:52.000 --> 00:49:53.000
and the other side says ISL,

00:49:54.000 --> 00:49:55.000
then you know you've got an encapsulation mismatch.

00:49:56.000 --> 00:49:57.000
They have to both be the same.

00:49:58.000 --> 00:49:59.000
So administrative trunking means

00:50:00.000 --> 00:50:01.000
this is what's configured on the device.

00:50:02.000 --> 00:50:03.000
This device only supports .1Q,

00:50:04.000 --> 00:50:05.000
so that's all you would see there.

00:50:06.000 --> 00:50:07.000
Let me rephrase that.

00:50:08.000 --> 00:50:09.000
ASW1 and ASW2 only support .1Q,

00:50:10.000 --> 00:50:12.000
so that's all you would ever see there for ASW1 and 2.

00:50:13.000 --> 00:50:14.000
But somebody like DSW1 and DSW2,

00:50:15.000 --> 00:50:16.000
they support ISL and .1Q.

00:50:17.000 --> 00:50:18.000
So by default,

00:50:19.000 --> 00:50:20.000
what you would see is negotiate there.

00:50:21.000 --> 00:50:22.000
So when it says negotiate,

00:50:23.000 --> 00:50:24.000
that means you're negotiating .1Q versus ISL.

00:50:25.000 --> 00:50:26.000
And that only works if DTP is on.

00:50:27.000 --> 00:50:28.000
If DTP is off,

00:50:29.000 --> 00:50:30.000
then you cannot negotiate your encapsulation

00:50:31.000 --> 00:50:32.000
because the negotiation of encapsulation

00:50:33.000 --> 00:50:34.000
relies on DTP as well.

00:50:34.000 --> 00:50:35.000
So if you're going to shut off DTP,

00:50:36.000 --> 00:50:37.000
then you've got to manually set your encapsulation

00:50:38.000 --> 00:50:39.000
by typing in, in this case,

00:50:40.000 --> 00:50:42.000
switchport trunk encapsulation .1Q.

00:50:43.000 --> 00:50:44.000
And then our operational mode

00:50:45.000 --> 00:50:46.000
is whatever we've configured.

00:50:47.000 --> 00:50:48.000
And then DTP is off

00:50:49.000 --> 00:50:50.000
because we typed in switchport nonegotiate.

00:50:53.000 --> 00:50:55.000
So if we look at the output now,

00:50:56.000 --> 00:50:57.000
do show interfaces trunk,

00:50:58.000 --> 00:50:59.000
what I want you to notice here

00:51:00.000 --> 00:51:01.000
is that all your ports are listed,

00:51:02.000 --> 00:51:03.000
and then those ports are listed

00:51:04.000 --> 00:51:05.000
by the mode they're running in.

00:51:06.000 --> 00:51:07.000
So on means trunk, desirable means desirable,

00:51:08.000 --> 00:51:09.000
auto means auto.

00:51:10.000 --> 00:51:11.000
The encapsulation, our native VLAN,

00:51:12.000 --> 00:51:13.000
we're going to come back to that later.

00:51:14.000 --> 00:51:15.000
But down here, notice how it says by default,

00:51:16.000 --> 00:51:20.000
every single VLAN is allowed on a port.

00:51:21.000 --> 00:51:22.000
So by default,

00:51:23.000 --> 00:51:26.000
every single VLAN is allowed on your trunk link.

00:51:29.000 --> 00:51:30.000
Now, is that what we want?

00:51:31.000 --> 00:51:33.000
Is that what we want?

00:51:35.000 --> 00:51:38.000
The answer to that is no, we don't want that.

00:51:39.000 --> 00:51:41.000
One, it could become a security issue.

00:51:42.000 --> 00:51:44.000
Two, it can become a performance issue as well.

00:51:45.000 --> 00:51:46.000
I'm going to come back to that momentarily.

00:51:47.000 --> 00:51:48.000
But what I want you to realize

00:51:49.000 --> 00:51:51.000
before we come back to that

00:51:52.000 --> 00:51:56.000
is that even though all VLANs are allowed on your trunk,

00:51:57.000 --> 00:51:58.000
take a look down here.

00:51:59.000 --> 00:52:02.000
It says VLANs allowed and active.

00:52:03.000 --> 00:52:04.000
In the management domain.

00:52:05.000 --> 00:52:06.000
What does that mean?

00:52:07.000 --> 00:52:09.000
It means that only these VLANs

00:52:10.000 --> 00:52:14.000
are allowed to use the trunks.

00:52:15.000 --> 00:52:17.000
So even though all VLANs are allowed,

00:52:18.000 --> 00:52:20.000
only the ones I know about

00:52:21.000 --> 00:52:25.000
and are active are actually allowed.

00:52:26.000 --> 00:52:28.000
So not all of them are truly allowed in the end.

00:52:29.000 --> 00:52:31.000
You have to read this from top to bottom.

00:52:32.000 --> 00:52:33.000
Which VLANs are allowed?

00:52:34.000 --> 00:52:35.000
All of them.

00:52:36.000 --> 00:52:40.000
But only the ones I know about locally

00:52:41.000 --> 00:52:42.000
in my VLAN database

00:52:43.000 --> 00:52:45.000
and are active.

00:52:46.000 --> 00:52:47.000
So if I know about them,

00:52:48.000 --> 00:52:49.000
but somebody's suspended the VLAN

00:52:50.000 --> 00:52:51.000
or shut down the VLAN,

00:52:52.000 --> 00:52:53.000
then it would not be listed here.

00:52:54.000 --> 00:52:56.000
However, that is still not the ultimate deciding factor.

00:52:57.000 --> 00:52:58.000
The ultimate deciding factor

00:52:59.000 --> 00:53:00.000
is actually Spanning Tree Protocol.

00:53:00.000 --> 00:53:01.000
Look what it says here.

00:53:02.000 --> 00:53:03.000
VLANs in the Spanning Tree forwarding state

00:53:04.000 --> 00:53:05.000
and not pruned.

00:53:06.000 --> 00:53:08.000
So even though all VLANs are allowed by default,

00:53:09.000 --> 00:53:11.000
if and only if I know about them,

00:53:12.000 --> 00:53:14.000
if and only if Spanning Tree Protocol says so

00:53:15.000 --> 00:53:16.000
and VTP says so.

00:53:19.000 --> 00:53:20.000
That's right.

00:53:21.000 --> 00:53:23.000
So why might your link

00:53:24.000 --> 00:53:25.000
not be forwarding traffic

00:53:26.000 --> 00:53:28.000
for a certain VLAN?

00:53:28.000 --> 00:53:31.000
Because Spanning Tree Protocol says no.

00:53:34.000 --> 00:53:37.000
Or VTP says no.

00:53:39.000 --> 00:53:41.000
See that relationship there?

00:53:42.000 --> 00:53:43.000
That's incredible.

00:53:44.000 --> 00:53:45.000
I'll come back to this

00:53:46.000 --> 00:53:47.000
when we have our Spanning Tree discussion tomorrow.

00:53:50.000 --> 00:53:54.000
But just because all VLANs are allowed

00:53:55.000 --> 00:53:56.000
and just because you know about it

00:53:56.000 --> 00:53:58.000
doesn't mean it's actually allowed.

00:53:59.000 --> 00:54:01.000
Because Spanning Tree Protocol is the final say.

00:54:06.000 --> 00:54:08.000
But you might want to control this manually.

00:54:09.000 --> 00:54:10.000
Now in the end,

00:54:11.000 --> 00:54:12.000
even if you control it manually,

00:54:13.000 --> 00:54:15.000
it might not have much of an effect

00:54:16.000 --> 00:54:17.000
on Spanning Tree Protocol's decision.

00:54:18.000 --> 00:54:19.000
But what you can do

00:54:20.000 --> 00:54:21.000
is basically control what's happening up here,

00:54:22.000 --> 00:54:23.000
which then has a trickle-down effect

00:54:23.000 --> 00:54:25.000
to here

00:54:26.000 --> 00:54:27.000
and a trickle-down effect into here.

00:54:28.000 --> 00:54:29.000
So if I turn around and say,

00:54:30.000 --> 00:54:31.000
you know what, I only want to allow VLAN 10 and 20

00:54:32.000 --> 00:54:33.000
on a certain link,

00:54:34.000 --> 00:54:35.000
then only VLAN 10 and 20 will be allowed on that link,

00:54:36.000 --> 00:54:37.000
which then affects this,

00:54:38.000 --> 00:54:39.000
which then affects this when it's all said and done,

00:54:40.000 --> 00:54:41.000
which then actually has an effect

00:54:42.000 --> 00:54:43.000
on Spanning Tree Protocol as well's decision-making process.

00:54:44.000 --> 00:54:46.000
So by filtering your VLANs on your trunks

00:54:47.000 --> 00:54:48.000
can actually change

00:54:49.000 --> 00:54:50.000
what Spanning Tree Protocol is doing as well.

00:54:53.000 --> 00:54:54.000
Right.

00:54:57.000 --> 00:54:58.000
Oh my gosh.

00:54:59.000 --> 00:55:00.000
All right, so let's take a look at the command,

00:55:01.000 --> 00:55:02.000
or let's take a look at why we might want to do that.

00:55:03.000 --> 00:55:04.000
So it is recommended

00:55:05.000 --> 00:55:07.000
to filter VLANs on your trunk links.

00:55:08.000 --> 00:55:09.000
Let's repeat that.

00:55:10.000 --> 00:55:11.000
It is recommended

00:55:12.000 --> 00:55:14.000
to filter VLANs on your trunk links.

00:55:18.000 --> 00:55:19.000
One, for security standpoint.

00:55:20.000 --> 00:55:21.000
Two, for performance reasons.

00:55:24.000 --> 00:55:25.000
So,

00:55:26.000 --> 00:55:27.000
let's say we have

00:55:28.000 --> 00:55:29.000
a broadcast message that leaves

00:55:30.000 --> 00:55:31.000
VLAN 10.

00:55:33.000 --> 00:55:34.000
Now let's,

00:55:35.000 --> 00:55:36.000
not leave VLAN 10,

00:55:37.000 --> 00:55:38.000
is in VLAN 10.

00:55:39.000 --> 00:55:40.000
Now what I want to do here

00:55:41.000 --> 00:55:42.000
is I want to pretend

00:55:43.000 --> 00:55:44.000
Spanning Tree Protocol

00:55:45.000 --> 00:55:46.000
is not running anywhere.

00:55:47.000 --> 00:55:48.000
So,

00:55:49.000 --> 00:55:50.000
let's say

00:55:50.000 --> 00:55:51.000
Spanning Tree Protocol

00:55:52.000 --> 00:55:53.000
is not running anywhere.

00:55:54.000 --> 00:55:55.000
Which it would never happen, okay.

00:55:56.000 --> 00:55:57.000
But let's pretend it's not.

00:55:58.000 --> 00:55:59.000
Just so that way there we don't get confused

00:56:00.000 --> 00:56:01.000
by Spanning Tree Protocol right now.

00:56:02.000 --> 00:56:03.000
I'm trying to give you a story

00:56:04.000 --> 00:56:05.000
that's going to help you understand

00:56:06.000 --> 00:56:07.000
why we want to filter.

00:56:07.000 --> 00:56:08.000
All right, so what's going to happen

00:56:09.000 --> 00:56:10.000
if we have a broadcast frame in VLAN 10?

00:56:11.000 --> 00:56:12.000
It's going to get flooded out all ports

00:56:13.000 --> 00:56:14.000
in that same VLAN

00:56:15.000 --> 00:56:16.000
except the port it came in on

00:56:17.000 --> 00:56:18.000
and all trunk ports

00:56:18.000 --> 00:56:19.000
right?

00:56:19.000 --> 00:56:20.000
So,

00:56:20.000 --> 00:56:21.000
in my case that's all my trunk ports

00:56:22.000 --> 00:56:23.000
because if you look here

00:56:23.000 --> 00:56:25.000
I'm allowing VLAN 10 on everything, right?

00:56:26.000 --> 00:56:27.000
Everything on all my devices.

00:56:28.000 --> 00:56:29.000
So that means it's going to get

00:56:30.000 --> 00:56:32.000
sent out, sent out, sent out, sent out.

00:56:32.000 --> 00:56:33.000
That's fine, right?

00:56:33.000 --> 00:56:34.000
That's fine.

00:56:34.000 --> 00:56:35.000
Don't worry about loops here.

00:56:35.000 --> 00:56:36.000
Don't worry about loops right now.

00:56:37.000 --> 00:56:38.000
Now,

00:56:38.000 --> 00:56:39.000
the question is,

00:56:39.000 --> 00:56:40.000
is when DSW-1 gets

00:56:41.000 --> 00:56:42.000
these two messages

00:56:44.000 --> 00:56:46.000
what VLAN do they belong to again?

00:56:46.000 --> 00:56:47.000
They belong to VLAN 10.

00:56:49.000 --> 00:56:50.000
Let me ask you this question.

00:56:51.000 --> 00:56:52.000
Do they need

00:56:53.000 --> 00:56:55.000
to go this way, yes or no?

00:56:56.000 --> 00:56:57.000
Do they need

00:56:57.000 --> 00:56:58.000
to go this way?

00:56:59.000 --> 00:57:01.000
Those broadcast frames.

00:57:09.000 --> 00:57:10.000
Look at the topology.

00:57:12.000 --> 00:57:15.000
If a broadcast frame is generated in VLAN 10

00:57:17.000 --> 00:57:19.000
it would have to go to everybody

00:57:19.000 --> 00:57:21.000
in VLAN 10.

00:57:22.000 --> 00:57:23.000
Correct?

00:57:23.000 --> 00:57:24.000
Correct.

00:57:25.000 --> 00:57:27.000
So to answer my question of

00:57:27.000 --> 00:57:29.000
does it need to be sent here?

00:57:30.000 --> 00:57:32.000
All you have to do is say

00:57:32.000 --> 00:57:34.000
is there anybody in VLAN 10 down here?

00:57:35.000 --> 00:57:36.000
If the answer is yes

00:57:37.000 --> 00:57:39.000
then you have to send the traffic that way.

00:57:39.000 --> 00:57:40.000
If the answer is no

00:57:41.000 --> 00:57:43.000
then you don't have to send

00:57:44.000 --> 00:57:46.000
the traffic that way.

00:57:48.000 --> 00:57:49.000
Therefore,

00:57:49.000 --> 00:57:51.000
I'm not sending VLAN 10 traffic

00:57:51.000 --> 00:57:53.000
somewhere where it doesn't need to go.

00:57:55.000 --> 00:57:56.000
One,

00:57:56.000 --> 00:57:57.000
security.

00:57:57.000 --> 00:57:58.000
Two,

00:57:58.000 --> 00:57:59.000
performance improvement.

00:57:59.000 --> 00:58:00.000
Why?

00:58:00.000 --> 00:58:01.000
Because now VLAN 10 traffic

00:58:01.000 --> 00:58:03.000
will never be on these links.

00:58:04.000 --> 00:58:05.000
Or,

00:58:05.000 --> 00:58:06.000
think about the VLAN 10 traffic

00:58:06.000 --> 00:58:07.000
that comes here.

00:58:08.000 --> 00:58:09.000
What if I did the same thing here?

00:58:10.000 --> 00:58:11.000
Therefore,

00:58:11.000 --> 00:58:12.000
it would never be sent that way

00:58:12.000 --> 00:58:13.000
either the VLAN 10 traffic

00:58:13.000 --> 00:58:15.000
because it's not needed.

00:58:15.000 --> 00:58:17.000
It's not needed.

00:58:18.000 --> 00:58:19.000
So now,

00:58:19.000 --> 00:58:21.000
I ensure that no VLAN 10 traffic

00:58:21.000 --> 00:58:22.000
comes here so therefore

00:58:22.000 --> 00:58:24.000
VLAN 10 traffic could never

00:58:24.000 --> 00:58:26.000
now consume bandwidth on those links.

00:58:26.000 --> 00:58:28.000
Never allow VLAN 10 traffic here.

00:58:28.000 --> 00:58:29.000
Again,

00:58:29.000 --> 00:58:30.000
never have the ability to consume

00:58:30.000 --> 00:58:32.000
bandwidth on those links now.

00:58:32.000 --> 00:58:33.000
So all that bandwidth is for VLAN 20

00:58:33.000 --> 00:58:35.000
and 50 and 200 instead.

00:58:35.000 --> 00:58:37.000
VLAN 10 will never interfere with that.

00:58:37.000 --> 00:58:38.000
Also,

00:58:38.000 --> 00:58:40.000
the VLAN 10 traffic never comes down here

00:58:40.000 --> 00:58:41.000
to accidentally get intercepted.

00:58:42.000 --> 00:58:43.000
When I wouldn't want it to be.

00:58:45.000 --> 00:58:46.000
So,

00:58:46.000 --> 00:58:48.000
filtering is a great way for us

00:58:48.000 --> 00:58:49.000
to improve performance

00:58:49.000 --> 00:58:51.000
as well as improve security.

00:58:51.000 --> 00:58:52.000
So over here on DSW-1,

00:58:52.000 --> 00:58:53.000
just for fun,

00:58:53.000 --> 00:58:55.000
let's think about what we could do

00:58:55.000 --> 00:58:57.000
to some of these interfaces on DSW-1.

00:58:58.000 --> 00:58:59.000
So going this way,

00:58:59.000 --> 00:59:01.000
I would want to allow what?

00:59:01.000 --> 00:59:02.000
Allow

00:59:02.000 --> 00:59:03.000
10,

00:59:03.000 --> 00:59:04.000
20,

00:59:04.000 --> 00:59:05.000
and 200.

00:59:06.000 --> 00:59:08.000
I would not want to allow 50

00:59:08.000 --> 00:59:10.000
or any other VLAN.

00:59:10.000 --> 00:59:13.000
I only need to allow the VLANs

00:59:13.000 --> 00:59:16.000
for the VLANs that live down there.

00:59:17.000 --> 00:59:18.000
So allow 10,

00:59:18.000 --> 00:59:19.000
20,

00:59:19.000 --> 00:59:20.000
and 200.

00:59:20.000 --> 00:59:21.000
Same thing here,

00:59:21.000 --> 00:59:22.000
10,

00:59:22.000 --> 00:59:23.000
20,

00:59:23.000 --> 00:59:24.000
and 200.

00:59:24.000 --> 00:59:25.000
Over here would be what?

00:59:25.000 --> 00:59:26.000
20,

00:59:26.000 --> 00:59:27.000
50,

00:59:27.000 --> 00:59:28.000
and 200.

00:59:28.000 --> 00:59:29.000
20,

00:59:29.000 --> 00:59:30.000
50,

00:59:30.000 --> 00:59:31.000
and 200.

00:59:31.000 --> 00:59:32.000
And you can do the same thing

00:59:32.000 --> 00:59:33.000
on all those other interfaces.

00:59:33.000 --> 00:59:34.000
So let me just show you the result

00:59:34.000 --> 00:59:35.000
of doing that on DSW-1.

00:59:35.000 --> 00:59:36.000
So on DSW-1,

00:59:36.000 --> 00:59:37.000
interface range,

00:59:37.000 --> 00:59:38.000
gigabit ethernet,

00:59:38.000 --> 00:59:39.000
one slash zero slash

00:59:40.000 --> 00:59:42.000
21 to 22.

00:59:48.000 --> 00:59:50.000
And we'll type in switchport,

00:59:50.000 --> 00:59:51.000
no, no.

00:59:51.000 --> 00:59:52.000
We'll type in,

00:59:53.000 --> 00:59:54.000
yes, it is.

00:59:54.000 --> 00:59:57.000
Switchport trunk allowed VLANs.

00:59:58.000 --> 01:00:00.000
So switchport trunk allowed VLANs.

01:00:00.000 --> 01:00:02.000
And then I can just list my VLANs.

01:00:02.000 --> 01:00:03.000
I can just list them.

01:00:03.000 --> 01:00:04.000
So let's go ahead and list

01:00:04.000 --> 01:00:05.000
10,

01:00:06.000 --> 01:00:07.000
20,

01:00:08.000 --> 01:00:09.000
200.

01:00:10.000 --> 01:00:11.000
Now we type in,

01:00:11.000 --> 01:00:13.000
do show interfaces trunk.

01:00:14.000 --> 01:00:15.000
We'll see in our output

01:00:15.000 --> 01:00:17.000
that it has changed,

01:00:22.000 --> 01:00:23.000
which has then changed

01:00:23.000 --> 01:00:25.000
what's going on in here,

01:00:29.000 --> 01:00:31.000
which then has probably,

01:00:31.000 --> 01:00:33.000
yes, changed what's going on down here

01:00:33.000 --> 01:00:35.000
from Spanning Tree's standpoint.

01:00:36.000 --> 01:00:37.000
Now notice,

01:00:37.000 --> 01:00:39.000
I did not include VLAN1,

01:00:39.000 --> 01:00:40.000
did I?

01:00:41.000 --> 01:00:43.000
Is that a problem?

01:00:44.000 --> 01:00:46.000
No, it's not.

01:00:46.000 --> 01:00:47.000
Absolutely not.

01:00:47.000 --> 01:00:49.000
Because the control traffic

01:00:49.000 --> 01:00:51.000
can still use VLAN1,

01:00:51.000 --> 01:00:53.000
even though it's not on the link.

01:00:53.000 --> 01:00:54.000
Always remember,

01:00:54.000 --> 01:00:55.000
when you're filtering,

01:00:55.000 --> 01:00:58.000
you're filtering the end user traffic.

01:00:58.000 --> 01:01:00.000
You're filtering the voice traffic.

01:01:00.000 --> 01:01:02.000
That's what you're doing here.

01:01:02.000 --> 01:01:04.000
You're not affecting control traffic,

01:01:04.000 --> 01:01:06.000
like Spanning Tree protocol messages

01:01:06.000 --> 01:01:07.000
or DTP messages

01:01:07.000 --> 01:01:08.000
or VTP messages

01:01:08.000 --> 01:01:09.000
or CDP messages

01:01:09.000 --> 01:01:10.000
or LLDP messages

01:01:10.000 --> 01:01:11.000
or anything like that.

01:01:11.000 --> 01:01:12.000
That's control traffic.

01:01:12.000 --> 01:01:13.000
You're not affecting that.

01:01:13.000 --> 01:01:14.000
You're just affecting what?

01:01:14.000 --> 01:01:16.000
You're just affecting user traffic.

01:01:16.000 --> 01:01:17.000
So if a user accidentally

01:01:17.000 --> 01:01:19.000
ends up in VLAN1,

01:01:19.000 --> 01:01:20.000
they're not going to be able

01:01:20.000 --> 01:01:21.000
to cross this link down.

01:01:21.000 --> 01:01:23.000
Ooh, there's that security, right?

01:01:23.000 --> 01:01:24.000
If a user accidentally

01:01:24.000 --> 01:01:25.000
ends up in VLAN1,

01:01:25.000 --> 01:01:26.000
they're not going to be allowed

01:01:26.000 --> 01:01:28.000
to use the link.

01:01:28.000 --> 01:01:30.000
Their traffic's going to stay stuck.

01:01:30.000 --> 01:01:31.000
Where?

01:01:31.000 --> 01:01:32.000
Down here.

01:01:33.000 --> 01:01:34.000
So if somebody manages

01:01:34.000 --> 01:01:36.000
to connect themselves

01:01:36.000 --> 01:01:37.000
to our switch port

01:01:37.000 --> 01:01:39.000
and end up in any VLAN

01:01:39.000 --> 01:01:41.000
other than 10, 20, or 200,

01:01:41.000 --> 01:01:42.000
they're stuck.

01:01:42.000 --> 01:01:43.000
They can't get up

01:01:43.000 --> 01:01:45.000
to the distribution layer.

01:01:45.000 --> 01:01:46.000
So again,

01:01:46.000 --> 01:01:47.000
a little bit of security as well

01:01:47.000 --> 01:01:48.000
when it comes to that.

01:01:48.000 --> 01:01:49.000
So you get both security

01:01:49.000 --> 01:01:51.000
and performance.

01:01:51.000 --> 01:01:53.000
So the command I showed you there

01:01:53.000 --> 01:01:54.000
was straightforward.

01:01:54.000 --> 01:01:56.000
It was just list the VLANs

01:01:56.000 --> 01:01:58.000
you want to allow.

01:02:00.000 --> 01:02:01.000
All right.

01:02:01.000 --> 01:02:02.000
Now let's say we wanted

01:02:02.000 --> 01:02:04.000
to modify this list.

01:02:04.000 --> 01:02:05.000
Let's say we wanted

01:02:05.000 --> 01:02:07.000
to add VLAN50 to the list.

01:02:07.000 --> 01:02:08.000
Be careful.

01:02:08.000 --> 01:02:11.000
This is not how you do it.

01:02:11.000 --> 01:02:14.000
This overwrites

01:02:14.000 --> 01:02:16.000
what was already there.

01:02:16.000 --> 01:02:18.000
See, the previous command was what?

01:02:18.000 --> 01:02:19.000
This was the previous command,

01:02:19.000 --> 01:02:21.000
and now I replaced it

01:02:21.000 --> 01:02:23.000
with that command.

01:02:23.000 --> 01:02:25.000
I just overwrote everything.

01:02:25.000 --> 01:02:27.000
So if we look at show interface trunk,

01:02:27.000 --> 01:02:29.000
you'll see I just messed everything up.

01:02:29.000 --> 01:02:33.000
I wanted to add VLAN50.

01:02:33.000 --> 01:02:34.000
So let's go back

01:02:34.000 --> 01:02:36.000
and put this command in.

01:02:36.000 --> 01:02:37.000
Exactly.

01:02:37.000 --> 01:02:40.000
We have to have the right keyword.

01:02:40.000 --> 01:02:41.000
So the right keyword for that

01:02:41.000 --> 01:02:46.000
would have been VLAN add 50.

01:02:48.000 --> 01:02:50.000
Now when you look at the output...

01:02:52.000 --> 01:02:54.000
Now when you look at the output...

01:02:54.000 --> 01:02:55.000
Excuse me.

01:02:55.000 --> 01:02:56.000
You didn't take...

01:02:56.000 --> 01:02:58.000
Oh, I forgot to put add.

01:02:58.000 --> 01:03:00.000
Did I really?

01:03:00.000 --> 01:03:02.000
Let's try that again.

01:03:03.000 --> 01:03:04.000
Add 50.

01:03:04.000 --> 01:03:06.000
There we go.

01:03:08.000 --> 01:03:09.000
All right.

01:03:09.000 --> 01:03:11.000
Now that you see what I've done there,

01:03:11.000 --> 01:03:12.000
there you go.

01:03:12.000 --> 01:03:13.000
Add 50.

01:03:13.000 --> 01:03:14.000
Be mindful of that.

01:03:14.000 --> 01:03:15.000
So I'm showing you these different options

01:03:15.000 --> 01:03:17.000
for the command

01:03:17.000 --> 01:03:19.000
just in case you need to

01:03:19.000 --> 01:03:20.000
pull this out of your back pocket

01:03:20.000 --> 01:03:23.000
on a certification exam.

01:03:23.000 --> 01:03:25.000
Because really in the real world,

01:03:25.000 --> 01:03:26.000
what would I do?

01:03:26.000 --> 01:03:27.000
I just recreate my list

01:03:27.000 --> 01:03:28.000
of VLANs I want.

01:03:28.000 --> 01:03:29.000
Why?

01:03:29.000 --> 01:03:30.000
Because I know that I'm not making a mistake.

01:03:30.000 --> 01:03:31.000
I don't have to worry about syntax

01:03:31.000 --> 01:03:32.000
and all that stuff.

01:03:32.000 --> 01:03:34.000
Here's my list of VLANs.

01:03:34.000 --> 01:03:35.000
Good enough.

01:03:35.000 --> 01:03:36.000
Double checked.

01:03:36.000 --> 01:03:37.000
Good, I'm fine.

01:03:37.000 --> 01:03:38.000
But if you want to get creative

01:03:38.000 --> 01:03:39.000
with these different keywords,

01:03:39.000 --> 01:03:40.000
you absolutely can.

01:03:40.000 --> 01:03:41.000
And I would encourage you

01:03:41.000 --> 01:03:43.000
to know them for the exam.

01:03:43.000 --> 01:03:44.000
For example,

01:03:44.000 --> 01:03:45.000
what if I said to you

01:03:45.000 --> 01:03:46.000
I wanted you to allow VLANs

01:03:46.000 --> 01:03:49.000
10, 20, and 200 only.

01:03:49.000 --> 01:03:51.000
But you had to...

01:03:52.000 --> 01:03:54.000
You had to...

01:03:54.000 --> 01:03:56.000
You couldn't use.

01:03:56.000 --> 01:03:57.000
You could just list your VLANs.

01:03:57.000 --> 01:03:58.000
Well, then you have to remove

01:03:58.000 --> 01:04:00.000
the ones that aren't there, right?

01:04:00.000 --> 01:04:01.000
For example,

01:04:01.000 --> 01:04:04.000
remove 50 to get that out of there.

01:04:04.000 --> 01:04:06.000
That's how you would get it out of there.

01:04:06.000 --> 01:04:07.000
Or you could just retype your list

01:04:07.000 --> 01:04:09.000
if you really wanted to,

01:04:09.000 --> 01:04:11.000
which is what something I would do.

01:04:11.000 --> 01:04:12.000
I copy and paste,

01:04:12.000 --> 01:04:13.000
remove what I didn't want,

01:04:13.000 --> 01:04:15.000
and so on and so forth.

01:04:15.000 --> 01:04:16.000
You can do accept,

01:04:16.000 --> 01:04:17.000
which means what?

01:04:17.000 --> 01:04:19.000
Accept means

01:04:19.000 --> 01:04:22.000
allow all these VLANs,

01:04:22.000 --> 01:04:23.000
allow every VLAN,

01:04:23.000 --> 01:04:24.000
pardon me,

01:04:24.000 --> 01:04:26.000
except the ones I've listed.

01:04:26.000 --> 01:04:27.000
So if we turn around and we say

01:04:27.000 --> 01:04:32.000
accept 10, 20, and 200,

01:04:32.000 --> 01:04:33.000
well, then you'll see

01:04:33.000 --> 01:04:35.000
what the result of that one is.

01:04:35.000 --> 01:04:38.000
Everything except for those three.

01:04:38.000 --> 01:04:40.000
So you can see how these keywords

01:04:40.000 --> 01:04:41.000
make a big difference

01:04:41.000 --> 01:04:44.000
as to what the result is.

01:04:44.000 --> 01:04:47.000
And I'd highly encourage you to know

01:04:47.000 --> 01:04:49.000
the differences on the certification exam

01:04:49.000 --> 01:04:50.000
for each of those keywords

01:04:50.000 --> 01:04:51.000
in case it shows up.

01:04:51.000 --> 01:04:53.000
So if you just do your list,

01:04:53.000 --> 01:04:55.000
it replaces whatever list you had before.

01:04:55.000 --> 01:04:56.000
If you add,

01:04:56.000 --> 01:04:57.000
if you use the keyword add,

01:04:57.000 --> 01:04:59.000
it adds to your current list.

01:04:59.000 --> 01:05:00.000
If you type in all,

01:05:00.000 --> 01:05:02.000
it goes back to the default.

01:05:02.000 --> 01:05:04.000
It just lists every single VLAN.

01:05:04.000 --> 01:05:05.000
If you do accept,

01:05:05.000 --> 01:05:06.000
it's every VLAN

01:05:06.000 --> 01:05:08.000
except the ones you've listed.

01:05:08.000 --> 01:05:09.000
If it's none,

01:05:09.000 --> 01:05:10.000
then it means no VLANs allowed

01:05:10.000 --> 01:05:11.000
on the trunk link.

01:05:11.000 --> 01:05:12.000
So that's a really great way

01:05:12.000 --> 01:05:14.000
to shut down your trunk link.

01:05:14.000 --> 01:05:16.000
If you ever are having issues

01:05:16.000 --> 01:05:17.000
and you need to shut down your trunk link

01:05:17.000 --> 01:05:18.000
to stop traffic flow,

01:05:18.000 --> 01:05:19.000
you can type in

01:05:19.000 --> 01:05:20.000
switchport trunk allowed VLAN none,

01:05:20.000 --> 01:05:22.000
and that would shut it down.

01:05:22.000 --> 01:05:23.000
You can also shut down the VLANs too

01:05:23.000 --> 01:05:24.000
on all the devices,

01:05:24.000 --> 01:05:26.000
but this might be a quick way to do that

01:05:26.000 --> 01:05:27.000
or just unplug the cable,

01:05:27.000 --> 01:05:28.000
whatever.

01:05:28.000 --> 01:05:29.000
And then remove

01:05:29.000 --> 01:05:30.000
as we saw is to remove one.

01:05:30.000 --> 01:05:31.000
So just be mindful of that.

01:05:31.000 --> 01:05:32.000
Pay attention to the scenario.

01:05:32.000 --> 01:05:34.000
Pay attention to the situation.

01:05:34.000 --> 01:05:36.000
And that'll help you get through

01:05:36.000 --> 01:05:37.000
whatever you need to get through

01:05:37.000 --> 01:05:38.000
on the certification exam.

01:05:45.000 --> 01:05:46.000
Yeah, so Casey,

01:05:46.000 --> 01:05:47.000
is there a difference between using add

01:05:47.000 --> 01:05:48.000
and just overriding the list?

01:05:48.000 --> 01:05:50.000
Again, it's a personal preference.

01:05:50.000 --> 01:05:51.000
I have a tendency to overwrite the list.

01:05:52.000 --> 01:05:53.000
I really do.

01:05:53.000 --> 01:05:55.000
But here's the thing.

01:05:55.000 --> 01:05:56.000
If you forget the add keyword,

01:05:56.000 --> 01:05:57.000
then you overwrite it,

01:05:57.000 --> 01:05:58.000
and that's the thing.

01:05:58.000 --> 01:06:00.000
So in my opinion,

01:06:00.000 --> 01:06:02.000
one's not safer than the other,

01:06:02.000 --> 01:06:03.000
in my opinion,

01:06:03.000 --> 01:06:04.000
only because if you accidentally

01:06:04.000 --> 01:06:05.000
forget the add keyword,

01:06:05.000 --> 01:06:06.000
you're overwriting it

01:06:06.000 --> 01:06:07.000
with a single VLAN

01:06:07.000 --> 01:06:08.000
or the ones you wanted to add,

01:06:08.000 --> 01:06:10.000
but you just overwrote it.

01:06:10.000 --> 01:06:12.000
So the add one can be safer

01:06:12.000 --> 01:06:13.000
if you make sure you put in

01:06:13.000 --> 01:06:15.000
the add keyword.

01:06:15.000 --> 01:06:16.000
But in the end,

01:06:16.000 --> 01:06:17.000
the result's going to be the same

01:06:17.000 --> 01:06:18.000
whether you just add something

01:06:18.000 --> 01:06:19.000
or you overwrite your whole list.

01:06:19.000 --> 01:06:20.000
It's up to you.

01:06:22.000 --> 01:06:23.000
No.

01:06:23.000 --> 01:06:24.000
None will remove everything.

01:06:24.000 --> 01:06:25.000
Yeah.

01:06:25.000 --> 01:06:27.000
So switchboard trunk allowed VLAN none.

01:06:30.000 --> 01:06:31.000
So you'll see it's none.

01:06:31.000 --> 01:06:32.000
Everything's done.

01:06:32.000 --> 01:06:33.000
Right?

01:06:33.000 --> 01:06:34.000
But again, remember,

01:06:34.000 --> 01:06:35.000
this is always about what?

01:06:35.000 --> 01:06:36.000
User traffic.

01:06:36.000 --> 01:06:37.000
So voice traffic,

01:06:37.000 --> 01:06:38.000
end user traffic,

01:06:38.000 --> 01:06:39.000
stuff like that.

01:06:39.000 --> 01:06:40.000
Control traffic's still allowed.

01:06:40.000 --> 01:06:41.000
So control traffic's still

01:06:41.000 --> 01:06:43.000
not affected by that.

01:06:43.000 --> 01:06:44.000
Right?

01:06:44.000 --> 01:06:45.000
So there's just an example, folks.

01:06:45.000 --> 01:06:46.000
I'm going to remove that, though,

01:06:46.000 --> 01:06:47.000
because I don't want it to interfere

01:06:47.000 --> 01:06:51.000
with my Spanning Tree discussion

01:06:51.000 --> 01:06:53.000
that we are going to have tomorrow.

01:06:57.000 --> 01:06:58.000
I want to make sure that I have

01:06:58.000 --> 01:06:59.000
every single VLAN listed

01:06:59.000 --> 01:07:01.000
so that way we can see

01:07:01.000 --> 01:07:03.000
Spanning Tree Protocol

01:07:03.000 --> 01:07:04.000
in full force tomorrow.

01:07:06.000 --> 01:07:08.000
But always remember that in the end,

01:07:09.000 --> 01:07:11.000
as you manipulate this list,

01:07:11.000 --> 01:07:13.000
you manipulate Spanning Tree Protocol as well.

01:07:15.000 --> 01:07:16.000
You manipulate Spanning Tree Protocol,

01:07:16.000 --> 01:07:18.000
you can also manipulate the list.

01:07:26.000 --> 01:07:27.000
All right.

01:07:28.000 --> 01:07:29.000
Lastly,

01:07:32.000 --> 01:07:34.000
we have to talk about the native VLAN.

01:07:35.000 --> 01:07:36.000
All right.

01:07:36.000 --> 01:07:37.000
So we've just looked at filtering.

01:07:37.000 --> 01:07:38.000
So I do have some slides on filtering.

01:07:38.000 --> 01:07:40.000
So just this one slide,

01:07:40.000 --> 01:07:42.000
basically we did that example

01:07:42.000 --> 01:07:44.000
and at that output there.

01:07:44.000 --> 01:07:45.000
All right.

01:07:45.000 --> 01:07:47.000
Let's talk about the native VLAN now.

01:07:47.000 --> 01:07:49.000
This is always a difficult discussion

01:07:49.000 --> 01:07:53.000
because we're dealing with something

01:07:53.000 --> 01:07:55.000
that is part of 802.1Q.

01:07:55.000 --> 01:07:57.000
Well, not really, but yes, it is.

01:07:57.000 --> 01:07:59.000
So 802.1Q is what?

01:08:00.000 --> 01:08:03.000
802.1Q is a IEEE standard.

01:08:08.000 --> 01:08:09.000
And what do you think are the odds

01:08:09.000 --> 01:08:11.000
that Cisco implemented the standard

01:08:11.000 --> 01:08:13.000
100% the way they should have?

01:08:13.000 --> 01:08:14.000
What do you think the odds are

01:08:14.000 --> 01:08:17.000
that Cisco implemented the standard 100%

01:08:17.000 --> 01:08:18.000
as they should have?

01:08:30.000 --> 01:08:33.000
Truthfully, the odds are like so low, right?

01:08:33.000 --> 01:08:35.000
They got a lot of things right,

01:08:35.000 --> 01:08:37.000
but a lot of things they adjusted

01:08:37.000 --> 01:08:39.000
for their own benefit, for their own sake.

01:08:40.000 --> 01:08:44.000
So here's the deal when it comes to VLANs

01:08:45.000 --> 01:08:49.000
on switches, according to VLAN standards.

01:08:50.000 --> 01:08:53.000
Every port, every port, no matter what,

01:08:54.000 --> 01:08:56.000
has to belong to a VLAN.

01:08:59.000 --> 01:09:00.000
That's the rule.

01:09:03.000 --> 01:09:06.000
Every port has to belong to a VLAN.

01:09:06.000 --> 01:09:09.000
Every port has to belong to a VLAN.

01:09:10.000 --> 01:09:13.000
So when you are working with 802.1Q,

01:09:16.000 --> 01:09:20.000
the standard, and potentially on other vendor switches,

01:09:24.000 --> 01:09:27.000
you actually place your port in a VLAN

01:09:32.000 --> 01:09:35.000
that you've dedicated for your trunks.

01:09:35.000 --> 01:09:39.000
So we'd create a VLAN, let's call it VLAN 333,

01:09:43.000 --> 01:09:44.000
for fun.

01:09:45.000 --> 01:09:47.000
And I put all my trunk ports in that VLAN.

01:09:47.000 --> 01:09:51.000
If I don't, then my trunk ports are in VLAN 1,

01:09:51.000 --> 01:09:53.000
which would still be acceptable,

01:09:53.000 --> 01:09:55.000
but not a best practice, okay?

01:09:55.000 --> 01:09:58.000
So your trunk ports are in VLAN 1 by default,

01:09:58.000 --> 01:10:00.000
according to the industry standard,

01:10:00.000 --> 01:10:03.000
our default Ethernet VLAN.

01:10:04.000 --> 01:10:06.000
So if you don't want it to be that,

01:10:06.000 --> 01:10:09.000
which is recommended not, you create another VLAN,

01:10:09.000 --> 01:10:10.000
use it for your trunks,

01:10:10.000 --> 01:10:14.000
you put all your trunk ports in those VLANs.

01:10:14.000 --> 01:10:16.000
And what do we call that?

01:10:16.000 --> 01:10:19.000
We call that the port VLAN ID, right?

01:10:20.000 --> 01:10:22.000
Every single one of our ports has a port VLAN ID.

01:10:22.000 --> 01:10:26.000
VLAN 10, VLAN 10, VLAN 20, VLAN 20, VLAN 50, VLAN 50.

01:10:26.000 --> 01:10:28.000
They all have port VLAN IDs.

01:10:28.000 --> 01:10:30.000
Well, so do your trunk ports.

01:10:34.000 --> 01:10:38.000
So this port belongs to VLAN 333.

01:10:40.000 --> 01:10:44.000
And so therefore, if traffic arrives

01:10:44.000 --> 01:10:48.000
that belongs to a different VLAN,

01:10:48.000 --> 01:10:50.000
so in this case, VLAN 10,

01:10:53.000 --> 01:10:56.000
what do we have to do

01:10:56.000 --> 01:10:59.000
in order to send it across a port

01:10:59.000 --> 01:11:01.000
that is part of VLAN 333?

01:11:03.000 --> 01:11:06.000
We have to tag it with what?

01:11:08.000 --> 01:11:09.000
An 802.1Q tag

01:11:11.000 --> 01:11:14.000
and put the VLAN number in that tag.

01:11:16.000 --> 01:11:19.000
So that way there, when it goes across the trunk link,

01:11:19.000 --> 01:11:21.000
when it arrives at the other side,

01:11:21.000 --> 01:11:23.000
and this port would be in 333,

01:11:23.000 --> 01:11:24.000
it comes to the other side,

01:11:24.000 --> 01:11:26.000
the same thing happens.

01:11:26.000 --> 01:11:27.000
This port would be in 333.

01:11:27.000 --> 01:11:29.000
It comes to the other side.

01:11:29.000 --> 01:11:30.000
The switch looks, says,

01:11:30.000 --> 01:11:34.000
oh, I have a frame that just came in port VLAN 333.

01:11:34.000 --> 01:11:37.000
Oh, but look, it's 802.1Q tagged.

01:11:37.000 --> 01:11:39.000
Looks at the tag and says,

01:11:39.000 --> 01:11:42.000
oh, this frame belongs to VLAN 10.

01:11:52.000 --> 01:11:54.000
Is that difficult to understand, folks?

01:11:54.000 --> 01:11:56.000
Was that difficult, yes or no?

01:11:57.000 --> 01:11:59.000
To me, that's super simple.

01:12:03.000 --> 01:12:06.000
It's basically what we talked about a while ago, right?

01:12:08.000 --> 01:12:10.000
Let's add something to this.

01:12:11.000 --> 01:12:15.000
Let's say you have a device here, a PC,

01:12:16.000 --> 01:12:20.000
that is in VLAN 333, okay?

01:12:20.000 --> 01:12:22.000
It's in VLAN 333.

01:12:22.000 --> 01:12:26.000
So if traffic arrives now from that PC to the switch,

01:12:28.000 --> 01:12:31.000
and it needs to go across the trunk link now,

01:12:32.000 --> 01:12:39.000
do we have to tag it if it's already in VLAN 333?

01:12:44.000 --> 01:12:46.000
No, right?

01:12:46.000 --> 01:12:49.000
Because if I'm already in VLAN 333,

01:12:49.000 --> 01:12:51.000
I don't have to tag it

01:12:51.000 --> 01:12:55.000
because if I send it across the link without a tag,

01:12:56.000 --> 01:12:59.000
what does the switch assume the VLAN is?

01:12:59.000 --> 01:13:05.000
333 because that's the port VLAN ID of itself,

01:13:05.000 --> 01:13:08.000
so it assumes it's part of that, which works perfect.

01:13:09.000 --> 01:13:13.000
So if you're in the same VLAN as the trunk links,

01:13:13.000 --> 01:13:15.000
which typically you wouldn't do,

01:13:15.000 --> 01:13:18.000
but if you add that, you don't tag that traffic.

01:13:19.000 --> 01:13:22.000
If you are in a different VLAN than the trunk links,

01:13:22.000 --> 01:13:24.000
then you tag the traffic.

01:13:24.000 --> 01:13:25.000
It works perfect.

01:13:25.000 --> 01:13:27.000
It's exactly what we want.

01:13:28.000 --> 01:13:31.000
But Cisco says that's not how we do it.

01:13:34.000 --> 01:13:37.000
We kind of do it that way, but we don't do it that way.

01:13:37.000 --> 01:13:40.000
For example, when we created our trunks, folks,

01:13:40.000 --> 01:13:42.000
did we put them in a VLAN?

01:13:49.000 --> 01:13:50.000
Nope.

01:13:50.000 --> 01:13:51.000
Right?

01:13:51.000 --> 01:13:52.000
Who did we configure?

01:13:52.000 --> 01:13:54.000
17, 18, 19, 20, 21, 22, 23.

01:13:54.000 --> 01:13:56.000
Look, they're not even in a VLAN.

01:13:56.000 --> 01:13:59.000
They're not even in a VLAN at all.

01:14:01.000 --> 01:14:04.000
So that goes against the IEEE standard already.

01:14:07.000 --> 01:14:08.000
What did we do?

01:14:08.000 --> 01:14:10.000
We typed in switch port mode trunk,

01:14:10.000 --> 01:14:12.000
or maybe we used dynamic desirable,

01:14:12.000 --> 01:14:14.000
or maybe we used dynamic auto, whatever, right?

01:14:14.000 --> 01:14:15.000
A trunk was formed.

01:14:15.000 --> 01:14:18.000
So which VLAN does your ports actually belong to?

01:14:18.000 --> 01:14:19.000
None.

01:14:19.000 --> 01:14:20.000
Okay.

01:14:20.000 --> 01:14:24.000
So how does it know whether it should tag the traffic or not,

01:14:24.000 --> 01:14:26.000
then, based on the native VLAN?

01:14:26.000 --> 01:14:28.000
Well, what's the native VLAN?

01:14:28.000 --> 01:14:29.000
It's a number.

01:14:29.000 --> 01:14:30.000
That means what?

01:14:30.000 --> 01:14:31.000
Native VLAN.

01:14:31.000 --> 01:14:33.000
What does that mean?

01:14:33.000 --> 01:14:35.000
It means it's a number.

01:14:35.000 --> 01:14:36.000
It's a number.

01:14:36.000 --> 01:14:37.000
It's a number.

01:14:37.000 --> 01:14:38.000
It's a number.

01:14:38.000 --> 01:14:39.000
It's a number.

01:14:39.000 --> 01:14:40.000
It's a number.

01:14:40.000 --> 01:14:41.000
It's a number.

01:14:41.000 --> 01:14:42.000
It's a number.

01:14:42.000 --> 01:14:43.000
It's a number.

01:14:43.000 --> 01:14:44.000
What does that mean?

01:14:44.000 --> 01:14:48.000
It means no tags.

01:14:48.000 --> 01:14:50.000
Untag traffic.

01:14:50.000 --> 01:14:52.000
But what does that mean?

01:14:52.000 --> 01:14:54.000
It means if you belong to the native VLAN,

01:14:54.000 --> 01:14:56.000
we won't tag you on trunks.

01:14:56.000 --> 01:14:58.000
But if you don't belong to the native VLAN,

01:14:58.000 --> 01:15:00.000
we'll tag you.

01:15:02.000 --> 01:15:05.000
So you just made up this arbitrary number?

01:15:05.000 --> 01:15:06.000
Oh, no, no.

01:15:06.000 --> 01:15:09.000
We made it number one by default.

01:15:09.000 --> 01:15:15.000
Wait, so you're telling me the default Ethernet VLAN is one

01:15:15.000 --> 01:15:19.000
and the native VLAN is also one?

01:15:19.000 --> 01:15:21.000
Yep.

01:15:21.000 --> 01:15:23.000
Can you confuse me anymore?

01:15:23.000 --> 01:15:25.000
Absolutely we can.

01:15:29.000 --> 01:15:33.000
So we type in the show interface trunk here,

01:15:33.000 --> 01:15:34.000
and what do you see?

01:15:34.000 --> 01:15:40.000
We see that the native VLAN is listed as VLAN one right here.

01:15:40.000 --> 01:15:42.000
Let's be very clear.

01:15:42.000 --> 01:15:49.000
The native VLAN is different than the default Ethernet VLAN.

01:15:49.000 --> 01:15:53.000
Because remember, the default Ethernet VLAN is VLAN one.

01:15:53.000 --> 01:15:54.000
Yes, it is.

01:15:54.000 --> 01:15:58.000
All ports are in that VLAN by default.

01:15:58.000 --> 01:16:00.000
Your trunks, before they were trunks,

01:16:00.000 --> 01:16:03.000
were part of that VLAN by default.

01:16:03.000 --> 01:16:05.000
When you type in switchboard mode trunk,

01:16:05.000 --> 01:16:08.000
essentially it says you don't belong to a VLAN anymore,

01:16:08.000 --> 01:16:13.000
but you belong to this cool thing called the native VLAN.

01:16:13.000 --> 01:16:17.000
Why didn't I just stick with the standard and go port VLAN ID?

01:16:17.000 --> 01:16:19.000
Because that's not what Cisco did.

01:16:19.000 --> 01:16:21.000
So you don't belong to a specific port.

01:16:21.000 --> 01:16:24.000
Now you belong to a native VLAN.

01:16:24.000 --> 01:16:26.000
So I want you to think going forward,

01:16:26.000 --> 01:16:29.000
to simplify this for yourself, this native VLAN,

01:16:29.000 --> 01:16:33.000
just think of it as the VLAN number of the trunk link.

01:16:33.000 --> 01:16:34.000
That's it.

01:16:34.000 --> 01:16:35.000
Just think of it that way.

01:16:35.000 --> 01:16:39.000
That's the easiest way to simplify this.

01:16:39.000 --> 01:16:46.000
That is the VLAN the trunk belongs to.

01:16:46.000 --> 01:16:49.000
Now you don't even have to create the VLAN, by the way.

01:16:49.000 --> 01:16:52.000
I could actually change my native VLAN to something else

01:16:52.000 --> 01:16:57.000
and not even create the VLAN because most of the time you're not even going to

01:16:57.000 --> 01:16:58.000
have traffic in the native VLAN,

01:16:58.000 --> 01:17:04.000
just like you would not have traffic in the trunk VLAN,

01:17:04.000 --> 01:17:07.000
like we did in our previous little example here.

01:17:07.000 --> 01:17:11.000
It doesn't make sense to have servers in the same VLAN as your trunks,

01:17:11.000 --> 01:17:13.000
unless you have no choice.

01:17:13.000 --> 01:17:14.000
So it's the same idea here.

01:17:14.000 --> 01:17:17.000
We really don't want to have end users, devices, stations, anything,

01:17:17.000 --> 01:17:20.000
services in the native VLAN.

01:17:20.000 --> 01:17:24.000
Think of the native VLAN as the VLAN the trunks belong to.

01:17:24.000 --> 01:17:29.000
So now if users are part of the native VLAN,

01:17:29.000 --> 01:17:31.000
then their traffic doesn't have to be tagged.

01:17:31.000 --> 01:17:34.000
But if users are not part of the native VLAN,

01:17:34.000 --> 01:17:36.000
then their traffic has to be tagged.

01:17:36.000 --> 01:17:39.000
So the end result is the same.

01:17:39.000 --> 01:17:41.000
The end result is the same.

01:17:41.000 --> 01:17:43.000
But it's trying to wrap your head around this concept that makes it the

01:17:43.000 --> 01:17:45.000
hardest because what is the native VLAN?

01:17:45.000 --> 01:17:49.000
It's just a virtual construct, a virtual VLAN.

01:17:49.000 --> 01:17:52.000
Give me something tangible to hang on to,

01:17:52.000 --> 01:17:55.000
like the port VLAN ID of the IEEE, that makes sense.

01:17:55.000 --> 01:17:57.000
Your port is in VLAN 33.

01:17:57.000 --> 01:17:59.000
But if you ask Cisco what port is my VLAN in,

01:17:59.000 --> 01:18:01.000
they're going to say nothing with the trunk, nothing.

01:18:01.000 --> 01:18:02.000
It doesn't belong to a VLAN.

01:18:02.000 --> 01:18:04.000
Okay, but then what's the native VLAN?

01:18:04.000 --> 01:18:06.000
Oh, it's just about tagging and untagging traffic.

01:18:06.000 --> 01:18:09.000
Okay, well, give me something concrete here that makes sense to me.

01:18:09.000 --> 01:18:11.000
Give me something that's going to help me understand this so I can get

01:18:11.000 --> 01:18:20.000
your questions right on a certification exam and build my networks properly.

01:18:20.000 --> 01:18:23.000
Daisy says, so if you change the native VLAN without creating the VLAN,

01:18:23.000 --> 01:18:26.000
therefore any traffic in the native VLAN would just get black-holed,

01:18:26.000 --> 01:18:27.000
essentially?

01:18:27.000 --> 01:18:29.000
Yeah, that's exactly what would happen.

01:18:29.000 --> 01:18:32.000
And that's not a bad thing because if anybody ends up in your native VLAN,

01:18:32.000 --> 01:18:35.000
that might be a bad thing because the recommended best practice is never,

01:18:35.000 --> 01:18:40.000
ever use your native VLAN unless you're forced to do it for some reason.

01:18:40.000 --> 01:18:44.000
And most companies will never use their native VLAN, not for nothing,

01:18:44.000 --> 01:18:46.000
for nothing, and you shouldn't.

01:18:46.000 --> 01:18:49.000
Everything should be part of a VLAN that gets tagged.

01:18:49.000 --> 01:18:51.000
And just let the native VLAN be the what?

01:18:51.000 --> 01:18:53.000
The VLAN that the trunks live in.

01:18:53.000 --> 01:18:54.000
That's it.

01:18:54.000 --> 01:18:55.000
That's it.

01:18:55.000 --> 01:18:58.000
That's the easiest way to do it, right?

01:18:58.000 --> 01:19:01.000
It's the simplest, safest, best way to do it.

01:19:01.000 --> 01:19:06.000
And so native VLAN frames are carried over the trunk untagged.

01:19:06.000 --> 01:19:11.000
So if you have native VLAN frames, that means you have devices in the native VLAN.

01:19:11.000 --> 01:19:14.000
So, for example, by default, the native VLAN we set is one.

01:19:14.000 --> 01:19:16.000
Okay, that's the native VLAN.

01:19:16.000 --> 01:19:18.000
By default is one.

01:19:18.000 --> 01:19:26.000
And so if I had a server here that was in VLAN one, then its traffic arrives.

01:19:26.000 --> 01:19:33.000
Ooh, you're in VLAN one, therefore you can go across untagged.

01:19:33.000 --> 01:19:39.000
But you would probably never,

01:19:39.000 --> 01:19:45.000
ever have a device in the native VLAN or the same VLAN as the native VLAN.

01:19:45.000 --> 01:19:49.000
So let's put it that way.

01:19:49.000 --> 01:19:51.000
So traffic here for VLAN 10 comes here.

01:19:51.000 --> 01:19:57.000
Now we got to tag it before we send it across, so it's in VLAN 10 on the other side.

01:19:57.000 --> 01:20:00.000
So traffic not in the native VLAN gets tagged.

01:20:00.000 --> 01:20:02.000
Traffic in the native VLAN gets tagged.

01:20:02.000 --> 01:20:03.000
But you don't even want to be using the native VLAN.

01:20:03.000 --> 01:20:07.000
That's best practice.

01:20:07.000 --> 01:20:09.000
You said the default is one, so know this for the exam.

01:20:09.000 --> 01:20:10.000
Know this for the exam.

01:20:10.000 --> 01:20:12.000
These are the things I want you to know.

01:20:12.000 --> 01:20:14.000
If you don't know anything else I said on the previous page, don't worry about it.

01:20:14.000 --> 01:20:18.000
You memorize this, you got all the questions right.

01:20:18.000 --> 01:20:19.000
I'm serious.

01:20:19.000 --> 01:20:24.000
You memorize this, you get all the questions right.

01:20:24.000 --> 01:20:25.000
Look at this.

01:20:25.000 --> 01:20:26.000
Native VLAN must match on both ends of the trunk.

01:20:26.000 --> 01:20:27.000
That's important.

01:20:27.000 --> 01:20:31.000
Somebody mentioned that earlier.

01:20:31.000 --> 01:20:34.000
So, for example, if this was VLAN one and this was VLAN 99,

01:20:34.000 --> 01:20:40.000
so native VLAN one, pardon me, native VLAN one and native VLAN 99,

01:20:41.000 --> 01:20:46.000
then let's say here we have a server that's in native VLAN one,

01:20:46.000 --> 01:20:51.000
or in VLAN one, which is also the native VLAN for our trunks.

01:20:51.000 --> 01:20:53.000
Then traffic arrives here.

01:20:53.000 --> 01:20:55.000
And then what happens to the traffic?

01:20:55.000 --> 01:20:56.000
Do-do-do.

01:20:56.000 --> 01:20:57.000
And untagged.

01:20:57.000 --> 01:20:58.000
Remember, it's untagged.

01:20:58.000 --> 01:20:59.000
Do-do-do-do-do.

01:20:59.000 --> 01:21:00.000
Now you're part of VLAN 99.

01:21:00.000 --> 01:21:01.000
Wait a second.

01:21:01.000 --> 01:21:03.000
You just went from VLAN one to VLAN 99.

01:21:03.000 --> 01:21:06.000
You did what is called VLAN hopping.

01:21:06.000 --> 01:21:12.000
A native VLAN mismatch will merge traffic between VLANs.

01:21:12.000 --> 01:21:14.000
So by messing up your native VLANs,

01:21:14.000 --> 01:21:18.000
you cause traffic to jump from one VLAN to another VLAN.

01:21:18.000 --> 01:21:21.000
Now cyber criminals used to take advantage of this back in the day.

01:21:21.000 --> 01:21:23.000
It used to be called a native VLAN hopping attack.

01:21:23.000 --> 01:21:25.000
But that's pretty much stopped today by our devices.

01:21:25.000 --> 01:21:28.000
Because if you ever have a native VLAN mismatch today,

01:21:28.000 --> 01:21:31.000
CDP is going to just get mad at you.

01:21:31.000 --> 01:21:34.000
LLDP, it's going to detect that there's an issue here on the trunk.

01:21:34.000 --> 01:21:37.000
So it's going to send messages saying, hey, hey, hey, this is wrong,

01:21:37.000 --> 01:21:38.000
this is wrong, this is wrong.

01:21:38.000 --> 01:21:41.000
Also, spanning tree protocol is going to lose its mind.

01:21:41.000 --> 01:21:42.000
Okay?

01:21:42.000 --> 01:21:46.000
It's going to lose its mind for both VLAN one now and VLAN 99.

01:21:46.000 --> 01:21:48.000
And it's essentially going to block those ports.

01:21:48.000 --> 01:21:50.000
So traffic won't even be allowed to flow.

01:21:50.000 --> 01:21:55.000
So by these protocols now being able to recognize this issue,

01:21:55.000 --> 01:21:56.000
and it's been around a long time.

01:21:56.000 --> 01:21:58.000
I'm not saying now like, oh, it happened yesterday.

01:21:58.000 --> 01:22:00.000
No, ages ago.

01:22:01.000 --> 01:22:05.000
These VLAN hopping attacks are less likely to occur in your environment.

01:22:05.000 --> 01:22:08.000
So if you make the mistake, your device is going to yell at you now.

01:22:08.000 --> 01:22:13.000
But for the exam, obviously all logging messages are going to be disabled,

01:22:13.000 --> 01:22:15.000
everything is not going to be shown to you, anything like that,

01:22:15.000 --> 01:22:16.000
and log messages.

01:22:16.000 --> 01:22:19.000
So if one side is configured for one and the other side is configured for some

01:22:19.000 --> 01:22:21.000
other number, you just have to know, hey,

01:22:21.000 --> 01:22:25.000
that's a native VLAN mismatch based on what Raymond told me.

01:22:25.000 --> 01:22:29.000
So if this side, for example, is one, let's go with 20.

01:22:29.000 --> 01:22:30.000
So this side is one.

01:22:30.000 --> 01:22:33.000
And then if we go over to ASW1, that would be this port here,

01:22:33.000 --> 01:22:35.000
was let's say 99.

01:22:35.000 --> 01:22:36.000
Then we have a native VLAN mismatch.

01:22:36.000 --> 01:22:38.000
So let me do that configuration for you.

01:22:38.000 --> 01:22:44.000
So interface, gigabit Ethernet, one side zero slash one.

01:22:44.000 --> 01:22:45.000
What did I do wrong?

01:22:45.000 --> 01:22:48.000
Oh.

01:22:48.000 --> 01:22:54.000
Now we'll type in switch port trunk native VLAN 99.

01:22:54.000 --> 01:22:57.000
So notice I don't have VLAN 99 on my platform.

01:22:57.000 --> 01:22:58.000
I don't have VLAN 99 on my device.

01:22:58.000 --> 01:23:00.000
We never created it.

01:23:00.000 --> 01:23:03.000
Do show VLAN brief.

01:23:03.000 --> 01:23:06.000
But I'm still using it as a native VLAN.

01:23:06.000 --> 01:23:07.000
And it didn't even create it for itself.

01:23:07.000 --> 01:23:08.000
That's okay.

01:23:08.000 --> 01:23:10.000
That's perfectly fine.

01:23:10.000 --> 01:23:13.000
It just means now that traffic for VLAN 99 can't flow across the link

01:23:13.000 --> 01:23:14.000
anyways.

01:23:14.000 --> 01:23:16.000
But if we go over to somebody like DSW1,

01:23:16.000 --> 01:23:19.000
we'll see here that it's configured for VLAN 20.

01:23:20.000 --> 01:23:33.000
And if we go to ASW1, do show interfaces trunk.

01:23:33.000 --> 01:23:34.000
Did I forget to hit enter?

01:23:34.000 --> 01:23:35.000
Did it not take it?

01:23:35.000 --> 01:23:40.000
Did I configure it on the wrong interface?

01:23:40.000 --> 01:23:42.000
What interface did I configure?

01:23:42.000 --> 01:23:43.000
One?

01:23:43.000 --> 01:23:44.000
Did I configure one?

01:23:44.000 --> 01:23:45.000
Silly me.

01:23:45.000 --> 01:23:46.000
Oh, my gosh.

01:23:46.000 --> 01:23:47.000
45.

01:23:47.000 --> 01:23:48.000
Let me try that again.

01:23:48.000 --> 01:23:52.000
Oh, my gosh.

01:23:52.000 --> 01:23:57.000
I just configured my end user interface as native VLAN.

01:23:57.000 --> 01:23:58.000
Not good.

01:23:58.000 --> 01:23:59.000
Bad Raven.

01:23:59.000 --> 01:24:01.000
Bad.

01:24:01.000 --> 01:24:02.000
Go clean up.

01:24:02.000 --> 01:24:03.000
There you go.

01:24:03.000 --> 01:24:04.000
So native VLAN 99 on this side.

01:24:04.000 --> 01:24:07.000
So, for example, for the exam, being able to look at this and say,

01:24:07.000 --> 01:24:13.000
wait, this number doesn't match this number here.

01:24:14.000 --> 01:24:17.000
Because those are the interfaces that go together.

01:24:17.000 --> 01:24:20.000
Then you absolutely want to make sure that you, you know,

01:24:20.000 --> 01:24:22.000
that would be the answer to the question if there was a problem.

01:24:22.000 --> 01:24:25.000
So we've got one here and 99 here as an example.

01:24:25.000 --> 01:24:26.000
So they've got to match.

01:24:26.000 --> 01:24:27.000
You're going to have problems.

01:24:27.000 --> 01:24:29.000
I'll see some messages.

01:24:29.000 --> 01:24:30.000
There you go.

01:24:30.000 --> 01:24:33.000
So we're starting to get CDPs starting to yell at me right now in

01:24:33.000 --> 01:24:34.000
Spanning Tree Protocol.

01:24:34.000 --> 01:24:37.000
We'll probably block some ports here momentarily for both of those VLANs.

01:24:37.000 --> 01:24:38.000
But wait a second.

01:24:38.000 --> 01:24:40.000
I'm not even allowing them.

01:24:40.000 --> 01:24:41.000
Let me see.

01:24:41.000 --> 01:24:42.000
One.

01:24:42.000 --> 01:24:44.000
That'll start blocking one.

01:24:44.000 --> 01:24:47.000
But 99 is not even allowed, so it's not going to have to worry about it

01:24:47.000 --> 01:24:51.000
because there's no Spanning Tree topology right now for VLAN 99.

01:24:51.000 --> 01:24:53.000
Yeah, so hopping is leakage.

01:24:53.000 --> 01:24:55.000
Absolutely.

01:24:55.000 --> 01:24:59.000
So is it best to use a native VLAN other than just one for chunking?

01:24:59.000 --> 01:25:00.000
Is there a security reason?

01:25:00.000 --> 01:25:01.000
So let's go to the slides,

01:25:01.000 --> 01:25:03.000
and we'll look at the very bottom one that I haven't covered yet.

01:25:03.000 --> 01:25:07.000
It says change the native VLAN to a VLAN you're not using.

01:25:07.000 --> 01:25:12.000
There you go.

01:25:12.000 --> 01:25:15.000
All right, so is it best to use the native VLAN other than one just for

01:25:15.000 --> 01:25:16.000
chunking?

01:25:16.000 --> 01:25:17.000
Absolutely.

01:25:17.000 --> 01:25:18.000
That is the recommended best practice.

01:25:18.000 --> 01:25:21.000
So one of the things you would do is you would make sure you're not using

01:25:21.000 --> 01:25:26.000
VLAN one and you are basically using a VLAN that you will not use in your

01:25:26.000 --> 01:25:27.000
environment.

01:25:27.000 --> 01:25:31.000
You set it as the native VLAN on all your chunk ports,

01:25:31.000 --> 01:25:33.000
and that adds a little bit of extra security.

01:25:33.000 --> 01:25:36.000
Definitely don't use VLAN one because cyber criminals love trying to get

01:25:36.000 --> 01:25:40.000
into that VLAN one because it's the default for everything.

01:25:40.000 --> 01:25:45.000
So the moral of the story for this is you don't want to use VLAN one for

01:25:45.000 --> 01:25:46.000
your native VLAN,

01:25:46.000 --> 01:25:50.000
but you also don't want to use VLAN one for anything else.

01:25:50.000 --> 01:25:51.000
That's right.

01:25:51.000 --> 01:25:53.000
If you took a Cisco security course,

01:25:53.000 --> 01:25:56.000
it would be don't use VLAN one for user traffic.

01:25:56.000 --> 01:25:58.000
Don't use VLAN one for voice traffic.

01:25:58.000 --> 01:26:00.000
Don't use VLAN one for your management traffic.

01:26:00.000 --> 01:26:03.000
Don't use VLAN one for anything.

01:26:04.000 --> 01:26:06.000
Get all ports off of VLAN one.

01:26:06.000 --> 01:26:08.000
Every single port off of VLAN one.

01:26:08.000 --> 01:26:10.000
That's what your recommendation is.

01:26:15.000 --> 01:26:17.000
And for the native VLAN,

01:26:17.000 --> 01:26:19.000
use a native VLAN number you're not using.

01:26:19.000 --> 01:26:21.000
Set it on all the chunk ports.

01:26:21.000 --> 01:26:22.000
Make sure they all match.

01:26:22.000 --> 01:26:24.000
Then away you go.

01:26:34.000 --> 01:26:37.000
Yeah.

01:26:37.000 --> 01:26:41.000
So hopping would be leaking from one VLAN to another VLAN.

01:26:41.000 --> 01:26:42.000
Absolutely.

01:26:42.000 --> 01:26:43.000
All right.

01:26:43.000 --> 01:26:44.000
So here, for example,

01:26:44.000 --> 01:26:45.000
I created a VLAN in this case,

01:26:45.000 --> 01:26:48.000
but as you saw in my demo,

01:26:48.000 --> 01:26:49.000
I didn't do it,

01:26:49.000 --> 01:26:50.000
but that's okay.

01:26:50.000 --> 01:26:51.000
You don't have to do it.

01:26:51.000 --> 01:26:52.000
It's still going to work for you.

01:26:52.000 --> 01:26:54.000
But if you wanted to create a VLAN 99,

01:26:54.000 --> 01:26:57.000
make sure you name it the native VLAN so you know that that's what you're

01:26:57.000 --> 01:26:58.000
using it for.

01:26:58.000 --> 01:26:59.000
And then go ahead.

01:26:59.000 --> 01:27:02.000
Now don't use 99 in the real world and don't use 999 in the real world

01:27:02.000 --> 01:27:07.000
because Cisco's documentation and Cisco Press textbooks use 99 and 999.

01:27:07.000 --> 01:27:10.000
So CyberKernel is going to try those next after one.

01:27:10.000 --> 01:27:14.000
So always go with some random number documented as your native VLAN and go

01:27:14.000 --> 01:27:16.000
with that instead.

01:27:16.000 --> 01:27:17.000
All right.

01:27:17.000 --> 01:27:19.000
And then now that we have our native VLAN configured,

01:27:19.000 --> 01:27:22.000
here is ASW1, 99 on both links.

01:27:22.000 --> 01:27:24.000
And then same thing with DSW1.

01:27:24.000 --> 01:27:26.000
You got 99 on both those links as well.

01:27:26.000 --> 01:27:28.000
So you want to make sure you're doing it on all of them.

01:27:28.000 --> 01:27:29.000
Now in this example,

01:27:29.000 --> 01:27:30.000
as you can see,

01:27:30.000 --> 01:27:33.000
I'm not doing any type of pruning or filtering down below.

01:27:33.000 --> 01:27:36.000
But what it comes down to is remember that if you are allowed,

01:27:36.000 --> 01:27:38.000
if you did create your VLAN 99,

01:27:38.000 --> 01:27:40.000
if you did create a VLAN for your native VLAN,

01:27:40.000 --> 01:27:43.000
and you're not going to have any traffic on that,

01:27:43.000 --> 01:27:45.000
which is the recommendation,

01:27:45.000 --> 01:27:49.000
so then I would filter this off with the commands we saw earlier.

01:27:49.000 --> 01:27:50.000
So, you know,

01:27:50.000 --> 01:27:53.000
switch port trunk allowed VLAN 10, 20,

01:27:53.000 --> 01:27:54.000
whatever ones you have,

01:27:54.000 --> 01:27:56.000
but don't allow 99.

01:27:56.000 --> 01:27:57.000
And if you're not using one,

01:27:57.000 --> 01:27:58.000
then don't allow one.

01:27:58.000 --> 01:28:00.000
That's another recommended best practice.

01:28:00.000 --> 01:28:02.000
So only allow the VLANs.

01:28:02.000 --> 01:28:08.000
You absolutely have to allow across those trunk links based on traffic flow.

01:28:08.000 --> 01:28:09.000
Do we have traffic in that VLAN?

01:28:09.000 --> 01:28:10.000
Yes.

01:28:10.000 --> 01:28:11.000
Then it needs to be allowed on that link.

01:28:11.000 --> 01:28:12.000
If not, take it off.

01:28:12.000 --> 01:28:13.000
It's a recommended best practice.

01:28:13.000 --> 01:28:14.000
All right.

01:28:14.000 --> 01:28:15.000
That was a lot.

01:28:15.000 --> 01:28:16.000
That was a lot for trunking.

01:28:16.000 --> 01:28:17.000
For some of you,

01:28:17.000 --> 01:28:19.000
it was a review of CCNA with a little bit more,

01:28:19.000 --> 01:28:20.000
but not much more.

01:28:20.000 --> 01:28:21.000
For some of you,

01:28:21.000 --> 01:28:23.000
it's been a while since you've dealt with trunking.

01:28:23.000 --> 01:28:25.000
So a lot of stuff to review there

01:28:25.000 --> 01:28:27.000
and make sure you're ready for the certification exam.

01:28:28.000 --> 01:28:29.000
Thank you.