Administrator Guide

Configuration Task List
This section contains the following VLAN configuration tasks.
• Creating a Port-Based VLAN (mandatory)
• Assigning Interfaces to a VLAN (optional)
• Assigning an IP Address to a VLAN (optional)
• Enabling Null VLAN as the Default VLAN
Enabling Null VLAN as the Default VLAN
In a Carrier Ethernet for Metro Service environment, service providers who perform frequent reconfigurations for customers with
changing requirements occasionally enable multiple interfaces, each connected to a different customer, before the interfaces are fully
configured.
This presents a vulnerability because both interfaces are initially placed in the native VLAN, VLAN 1, and for that period customers are able
to access each other's networks. The system has a Null VLAN to eliminate this vulnerability. When you enable the Null VLAN, all ports are
placed into it by default, so even if you activate the physical ports of multiple customers, no traffic is allowed to traverse the links until
each port is place in another VLAN.
To enable Null VLAN, use the following command.
• Disable the default VLAN, so that all ports belong to the Null VLAN until configured as a member of another VLAN.
CONFIGURATION mode
default-vlan disable
Default: the default VLAN is enabled (no default-vlan disable).
Assigning an IP Address to a VLAN
VLANs are a Layer 2 feature. For two physical interfaces on different VLANs to communicate, you must assign an IP address to the
VLANs to route traffic between the two interfaces.
The shutdown command in INTERFACE mode does not affect Layer 2 traffic on the interface; the shutdown command only prevents
Layer 3 traffic from traversing over the interface.
NOTE:
You cannot assign an IP address to the Default VLAN (VLAN 1). To assign another VLAN ID to the Default VLAN,
use the default vlan-id vlan-id command.
You can place VLANs and other logical interfaces in Layer 3 mode to receive and send routed traffic. For more information, refer to Bulk
Configuration.
To assign an IP address, use the following command.
• Configure an IP address and mask on the interface.
INTERFACE mode
ip address ip-address mask [secondary]
• ip-address mask — Enter an address in dotted-decimal format (A.B.C.D) and the mask must be in slash format (/24).
• secondary — This is the interface’s backup IP address. You can configure up to eight secondary IP addresses.
Configuring Native VLANs
Traditionally, ports can be either untagged for membership to one VLAN or tagged for membership to multiple VLANs.
You must connect an untagged port to a VLAN-unaware station (one that does not understand VLAN tags), and you must connect a
tagged port to a VLAN-aware station (one that generates and understands VLAN tags).
Native VLAN support breaks this barrier so that you can connect a port to both VLAN-aware and VLAN-unaware stations. Such ports are
referred to as hybrid ports. Physical and port-channel interfaces may be hybrid ports.
Native VLAN is useful in deployments where a Layer 2 port can receive both tagged and untagged traffic on the same physical port. The
classic example is connecting a voice-over-IP (VOIP) phone and a PC to the same port of the switch. The VOIP phone is configured to
generate tagged packets (with VLAN = VOICE VLAN) and the attached PC generates untagged packets.
NOTE: When a hybrid port is untagged in a VLAN but it receives tagged traffic, all traffic is accepted.
Virtual LANs (VLANs) 943