trunks and dtp...

dtp causes unnecessary traffic... when you manually configure a trunk on both sides, as you should,  you will still get dtp traffic... port 1 says, i'm a trunk; port 2 says i'm a trunk too back to port 1, and port 1 says it's delightful to be a trunk and port 2 says, being a trunk is good...

turn that shit off...

never trust your trunks to create themselves...

dls1(config)#int f0/15                                                         
dls1(config-if)#sw                                                             
dls1(config-if)#sw trunk encap dot1q                                           
dls1(config-if)#sw mode trunk                                                  
dls1(config-if)#sw nonegotiate                                                 
dls1(config-if)#end                       
dls1#sh int f0/15 trunk                                                        
                                                                               
Port        Mode             Encapsulation  Status        Native vlan          
Fa0/15      on               802.1q         other         1  

                  
use nonegotiate to stop the stupid dtp traffic...

dynamic auto on both sides leads to a dtp roadblock...  this is because auto is a passive state...  two passive's will never make an active... similar in fashion to pagp and lacp...                                                                         

l2 to l3/bridging the gap...

  a vlan is a layer 2 construct, a pointer to layer 3, an association by layer 2 to layer 3...
vlan=network=subnet=broadcast domain

  a broadcast domain is the set of devices which may receive broadcasts... a layer 3 device is the defining element of the broadcast domain... a switch creates more and smaller collision domains with each additional port it places within the domain... a layer 3 device creates an additional broadcast domain with each port it introduces...  a switch floods broadcasts, multi-casts and unknown unicasts to every device in the domain... a layer 3 device recieves all broadcasts from a connected switch, and drops them (unless otherwise defined)... a layer 3 device defines the broadcast domain with that action...this layer 3 device is affectionately known as a router... vlan=network=subnet=broadcast domain


  a vlan number is the only requirement when creating a vlan. of course it's fairly useless without ports added to it, and a descriptive name would be nice also, but these are not required...

  an end-to-end vlan spans the entire switched network and should be avoided as such, a local vlan remains local (within its group) and is preferred...

  a vlan trunk can carry multiple vlans' traffic across the network

 isl encapsulates a frame for tagged transit whereas the preferred method of tagging is 802.1q, which injects a 4 byte field into the frame... 802.1q does not tag the native vlan; the native vlan is identified by the lack of a tag...

  dtp is dynamic trunking protocol.  it is a trunking negotiation mechanism...

  the native vlan is a settable parameter and is vlan1 by default... it is recommended to change the native vlan to something other than 1 after bringing the switch up... it is important to match the native vlans between switches to avoid annoying cdp messages, and sometimes derailed traffic...

does dtp ever stop...

there's this idea floating around that if nonegotiate is NOT used along with the sw mode access command, that somehow dtp will still leak through trunks or vlans, or osmosis, or something to the access port...  ok... not sure if dtp is that stealthy...


sw2950_02#sh run int fa0/19
Building configuration...

Current configuration : 58 bytes
!
interface FastEthernet0/19
 speed 100
 duplex full
end

sw2950_02#sh int fa0/19 sw
Name: Fa0/19
Switchport: Enabled
Administrative Mode: dynamic desirable
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: On

notice the administrative mode and operational mode...

sw2950_02#
1d10h: DTP-pkt:Fa0/2:  ID: 0009B752D784 ../dyntrk/dyntrk_core.c:1462
1d10h: DTP-pkt:Fa0/19:Sending packet ../dyntrk/dyntrk_process.c:1235
1d10h: DTP-pkt:Fa0/19:  TOS/TAS = ACCESS/DESIRABLE ../dyntrk/dyntrk_process.c:12
38
1d10h: DTP-pkt:Fa0/19:  TOT/TAT = 802.1Q/802.1Q ../dyntrk/dyntrk_process.c:1241
1d10h: DTP-pkt:Fa0/19:datagram_out ../dyntrk/dyntrk_process.c:1273
1d10h: DTP-pkt:Fa0/19:datagram_out encap ../dyntrk/dyntrk_process.c:1285
sw2950_02#
1d10h: DTP-pkt:Fa0/18:Sending packet ../dyntrk/dyntrk_process.c:1235
1d10h: DTP-pkt:Fa0/18:  TOS/TA

now we turn on sw mode access explicitly

sw2950_02(config)#int fa0/19
sw2950_02(config-if)#sw mode access
sw2950_02(config-if)#do sh run int fa0/19
Building configuration...

Current configuration : 82 bytes
!
interface FastEthernet0/19
 switchport mode access
 speed 100

sw2950_02(config-if)#do sh int fa0/19 sw
Name: Fa0/19
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Voice VLAN: none

sw2950_02(config-if)#
1d10h: DTP-pkt:Fa0/2:  ID: 0009B752D784 ../dyntrk/dyntrk_core.c:1462
sw2950_02(config-if)#
1d10h: DTP-pkt:Fa0/18:Sending packet ../dyntrk/dyntrk_process.c:1235
1d10h: DTP-pkt:Fa0/18:  TOS/TAS = ACCESS/DESIRABLE ../dyntrk/dyntrk_process.c:12
38
1d10h: DTP-pkt:Fa0/18:  TOT/TAT = 802.1Q/802.1Q ../dyntrk/dyntrk_process.c:1241
1d10h: DTP-pkt:Fa0/18:datagram_out ../dyntrk/dyntrk_process.c:1273
1d10h: DTP-pkt:Fa0/18:datagram_out encap ../dyntrk/dyntrk_process.c:1285
sw2950_02(config-if)#
1d10h: DTP-pkt:Fa0/2:Sending packet ../dyntrk/

no more dtp packets...

and this...

sw2950_02(config-if)#do sh dtp int fa0/19
DTP information for FastEthernet0/19:
  TOS/TAS/TNS:                              ACCESS/OFF/ACCESS
  TOT/TAT/TNT:                              NATIVE/802.1Q/NATIVE
  Neighbor address 1:                       000000000000
  Neighbor address 2:                       000000000000
  Hello timer expiration (sec/state):       never/STOPPED
  Access timer expiration (sec/state):      never/STOPPED
  Negotiation timer expiration (sec/state): never/STOPPED
  Multidrop timer expiration (sec/state):   never/STOPPED
  FSM state:                                S1:OFF
  # times multi & trunk                     0
  Enabled:                                  no
  In STP:                                   no

sw2950_02(config)#do sh run int fa0/18
Building configuration...

Current configuration : 58 bytes
!
interface FastEthernet0/18
 speed 100
 duplex full
end

sw2950_02(config)#do sh dtp int fa0/18
DTP information for FastEthernet0/18:
  TOS/TAS/TNS:                              ACCESS/DESIRABLE/ACCESS
  TOT/TAT/TNT:                              NATIVE/802.1Q/802.1Q
  Neighbor address 1:                       000000000000
  Neighbor address 2:                       000000000000
  Hello timer expiration (sec/state):       28/RUNNING
  Access timer expiration (sec/state):      never/STOPPED
  Negotiation timer expiration (sec/state): never/STOPPED
  Multidrop timer expiration (sec/state):   never/STOPPED
  FSM state:                                S2:ACCESS
  # times multi & trunk                     0
  Enabled:                                  yes

sw2950_02(config)#do sh int fa0/18 sw
Name: Fa0/18
Switchport: Enabled
Administrative Mode: dynamic desirable
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
  In STP:                                   no

dtp stops when put in access mode explicitly, so i don't know what that guy is talking about with nonegotiate

he-lans...

vlan tagging and 802.1q

802.1q introduced the concept of the native vlan. the native vlan passes untagged frames
and are recognized as belonging to it as such.  other vlans are tagged, thereby
identified, via a two byte tag identifier or TPID which always has a value of 0x8100
(802.1q tag) and another two bytes are used for Tag Control Information (TCI), bringing the total to 4
bytes.  the tci contains a 3 bit priority field (PCP, priority code point) to identify class of service
(COS) and a 12 bit VID (vlan identifier). the single bit remaining and sandwiched between
the pcp and vid is the canonical format identifier (allowing compatibility for ethernet and
token ring). this will be set to 0 for ethernet (if it is set to 1, token ring, you are
working on a network from the last century) I actually supported a token ring network in
the 90's and it was great--back then.

802.1q does not encapsulate the frame although some authors refer to it as such.  it adds
(injects) this two byte field between the source mac and ether type field.  encapsulation
of frames for vlan identification is the purview of that other thing (isl) that cisco
should finally make go away and stop mentioning in cisco press books.

DTP as well as VTP are technologies that also should go away... Are you going to trust your
trunks to discover each other... no... are you going to deploy a new switch without
configuring the proper vlans... no... of course, no... will you save bandwidth and retain
your sanity... yes

even mentioning these things, you can almost see the authors cringing;

    "On critical trunk links in a network, manually configuring the trunking mode on both    
    ends is best so that the link never can be negotiated to any other state."

when is a trunk not critical... good Lord... it's embarrassing...

dtp and native trunk mismatch...

this was an interesting exercise, and it's not pretty... below is before dynamic desirable and before changing the native vlan...

Bridge ID  Priority    20481  (priority 20480 sys-id-ext 1)

             Address     0009.b752.d780

             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

             Aging Time 300

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/1            Desg FWD 19        128.1    P2p

Fa0/2            Desg FWD 19        128.2    P2p

Fa0/3            Desg FWD 19        128.3    P2p

Fa0/4            Desg FWD 19  

now to change to dynamic desirable on both ends...

sw2950_01(config-if-range)#sw mode dyn des

sw2950_02(config-if-range)#sw mode dyn des

sw2950_02#sh int trunk

Port        Mode         Encapsulation  Status        Native vlan

Fa0/1       desirable    802.1q         trunking      1

Fa0/2       desirable    802.1q         trunking      1

sw2950_01#sh int trunk

Port        Mode         Encapsulation  Status        Native vlan

Fa0/1       desirable    802.1q         trunking      1

Fa0/2       desirable    802.1q         trunking      1

Fa0/3       desirable    802.1q         trunking      1

Fa0/4       desirable    802.1q         trunking      1

dtp packets are good...

1d23h: DTP-pkt:Fa0/2:Good DTP packet received: ../dyntrk/dyntrk_core.c:1451

1d23h: DTP-pkt:Fa0/2:  Domain: ozlan ../dyntrk/dyntrk_core.c:1454

1d23h: DTP-pkt:Fa0/2:  Status: TOS/TAS = TRUNK/DESIRABLE ../dyntrk/dyntrk_core.c

:1457

1d23h: DTP-pkt:Fa0/2:  Type: TOT/TAT = 802.1Q/802.1Q ../dyntrk/dyntrk_core.c:145

9

1d23h: DTP-pkt:Fa0/2:  ID: 0009B752D784 ../dyntrk/dyntrk_core.c:1462

1d23h: DTP-pkt:Fa0/1:Good DTP packet received: ../dyntrk/dyntrk_core.c:1451

1d23h: DTP-pkt:Fa0/1:  Domain: ozlan ../dyntrk/dyntrk_core.c:1454

1d23h: DTP-pkt:Fa0/1:  Status: TOS/TAS = TRUNK/DESIRABLE ../dyntrk/dyntrk_core.

now change the native vlan...

sw2950_02(config)#int range fa0/1 - 2

sw2950_02(config-if-range)#sw trunk native vlan 50

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/1            Desg BKN*19        128.1    P2p *PVID_Inc

Fa0/2            Desg FWD 19        128.2    P2p

Fa0/3            Desg FWD 19        128.3    P2p

Fa0/4            Desg BKN*19        128.4    P2p *PVID_Inc

dtp packets are still good

sw2950_01#

3w2d: DTP-pkt:Fa0/4:  ID: 0009B73FCE82 ../dyntrk/dyntrk_core.c:1462

sw2950_01#

3w2d: DTP-pkt:Fa0/3:Good DTP packet received: ../dyntrk/dyntrk_core.c:1451

3w2d: DTP-pkt:Fa0/3:  Domain: ozlan ../dyntrk/dyntrk_core.c:1454

3w2d: DTP-pkt:Fa0/3:  Status: TOS/TAS = TRUNK/ON ../dyntrk/dyntrk_core.c:1457

3w2d: DTP-pkt:Fa0/3:  Type: TOT/TAT = 802.1Q/802.1Q ../dyntrk/dyntrk_core.c:1459

3w2d: DTP-pkt:Fa0/3:  ID: 000F8FFE0983 ../dyntrk/dyntrk_core.c:1462

here comes the nasty vlan errors...

sw2950_01#

3w2d: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on FastEthern

et0/1 (1), with sw2950_02 FastEthernet0/1 (50).

and this doesn't look too good...  i couldn't ping and lost connectivity...

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/1            Desg BKN*19        128.1    P2p *PVID_Inc

Fa0/2            Desg BKN*19        128.2    P2p *PVID_Inc

my conclusion is that although dtp is passing good packets, doesn't matter... the trunk is no good... then i changed the native vlan back, and...

sw2950_02#

1d23h: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking FastEthernet0/1 on VLAN0001.

Port consistency restored.

1d23h: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking FastEthernet0/1 on VLAN0050.

Port consistency restored.

1d23h: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking FastEthernet0/2 on VLAN0001.

Port consistency restored.

1d23h: %SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking FastEthernet0/2 on VLAN0050.

Port consistency restored.

Interface        Role Sts Cost      Prio.Nbr Type

---------------- ---- --- --------- -------- --------------------------------

Fa0/1            Root FWD 19        128.1    P2p

Fa0/2            Altn BLK 19        128.2    P2p

so dtp still works, but the trunk is broken...