Troubleshooting VLANs & Trunks

In a previous lesson I explained some of the possible interface issues that we can encounter. Once you verified that your interface(s) are configured correctly and you are still having issues, the problem might be related to VLANs & Trunks. Let’s take a look at some common issues and how to solve them.

VLAN assignment issues

Here is the topology:

host 1 switch 1 host 2

H1 is unable to ping H2. There are no issues with the hosts, the problem is related to the switch. Let’s see what happens when we try a ping:

C:Documents and SettingsH1>ping 192.168.1.2

Pinging 192.168.1.2 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.1.2:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

The two computers are unable to ping each other (what a surprise!). Let’s do a quick check if there are any interface errors:

SW1#show ip int brief
Interface           IP-Address      OK? Method Status                Protocol
FastEthernet0/1     unassigned      YES unset  up                    up      
FastEthernet0/3     unassigned      YES unset  up                    up

The interfaces are looking good, no errors here. Let’s check the VLAN assignments:

SW1#show vlan 

VLAN Name                Status    Ports
---- -------------------------------- --------- -------------------------------
1    default             active    Fa0/1, Fa0/2, Fa0/4, Fa0/5
                                   Fa0/6, Fa0/7, Fa0/8, Fa0/9
                                   Fa0/10, Fa0/11, Fa0/12,Fa0/13
                                   Fa0/14, Fa0/15, Fa0/16,Fa0/17
                                   Fa0/18, Fa0/19, Fa0/20,Fa0/21
                                   Fa0/22, Fa0/23, Fa0/24, Gi0/1
                                   Gi0/2
2    VLAN0002            active    Fa0/3

At this moment it’s a good idea to check the VLAN information. You can use the show vlan command to quickly verify to which VLAN the interfaces belong.
As you can see our interfaces are not in the same VLAN. Let’s fix this:

SW1(config)#interface fa0/3
SW1(config-if)#switchport access vlan 1

We’ll move interface Fa0/3 back to VLAN 1, both hosts are now in VLAN 1. Let’s try that ping again:

C:Documents and SettingsH1>ping 192.168.1.2

Pinging 192.168.1.2 with 32 bytes of data:

Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.1.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

This solves our problem!

Lesson learned: Make sure the interface is in the correct VLAN.

Switchport mode issues

Time for another problem, same topology:

host 1 switch 1 host 2

We verified that there are no interface errors, the interfaces are up and running:

SW1#show ip interface brief 
Interface          IP-Address      OK? Method Status               Protocol
FastEthernet0/1     unassigned      YES unset  up                    up      
FastEthernet0/3     unassigned      YES unset  up                    up

The interfaces don’t show any errors. Let’s check the VLAN assignments:

SW1#show vlan 

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/2, Fa0/4, Fa0/5, Fa0/6
                                                Fa0/7, Fa0/8, Fa0/9, Fa0/10
                                                Fa0/11, Fa0/12, Fa0/13,Fa0/14
                                                Fa0/15, Fa0/16, Fa0/17,Fa0/18
                                                Fa0/19, Fa0/20, Fa0/21,Fa0/22
                                                Fa0/23, Fa0/24, Gi0/1, Gi0/2
10   VLAN0010                         active    Fa0/1

Above you can see that FastEthernet 0/1 is in VLAN 10 but I don’t see FastEthernet 0/3 anywhere. Here are the possible causes:

  • Something is wrong with the interface. We proved this wrong because it shows up/up so it seems to be active.
  • The interface is not an access port but a trunk.

Let’s check the switchport information:

SW1#show interfaces fa0/3 switchport 
Name: Fa0/3
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 10 (VLAN0010)
Trunking Native Mode VLAN: 1 (default)

A quick look at the switchport information shows us what we need to know. We can confirm that interface fa0/3 is in trunk mode and the native VLAN is 1. This means that whenever H2 sends traffic and doesn’t use 802.1Q tagging that our traffic ends up in VLAN 1. Let’s turn this interface into access mode:

SW1(config)#interface fa0/3
SW1(config-if)#switchport mode access 
SW1(config-if)#switchport access vlan 10

We’ll turn FastEthernet 0/3 into access mode and make sure it’s in VLAN 10. Let’s verify this:

SW1#show vlan id 10

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
10   VLAN0010                         active    Fa0/1, Fa0/3

Both interfaces are now active in VLAN 10. Checking the operational mode is also a good idea:

SW1#show interfaces fa0/3 switchport | include Operational Mode 
Operational Mode: static access

It now shows up as access mode. Let’s try that ping again:

C:Documents and SettingsH1>ping 192.168.1.2

Pinging 192.168.1.2 with 32 bytes of data:

Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128
Reply from 192.168.1.2: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.1.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

Now I can send a ping from H1 to H2…problem solved!

Lesson learned: Make sure the interface is in the correct switchport mode (access or trunk mode).

VACL (VLAN Access-List) issues

Same two computers, same switch, different problem:

host 1 switch 1 host 2

This scenario is a bit more interesting though. The computers are unable to ping each other so let’s walk through our list of “possible” errors:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 660 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

507 Sign Ups in the last 30 days

satisfaction-guaranteed
100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags:


Forum Replies

  1. Hi,My concern is I am looking for the topic ‘Configuring Ethernet switch’(Telnet,console and SSH). Can you please tell me where did you discussed this topic

  2. Hi,

    Here’s an example for the console and SSH:

    Configuring Cisco router for the first time

    Here’s an example to enable telnet server on your router or switch:

    R1(config)#line vty 0 4
    R1(config-line)#transport input telnet
    R1(config-line)#password cisco123
    R1(config-line)#transport input 
    R1(config-line)#login
    

    The configuration above will only ask for the password (cisco123). It’s also possible to use usernames/passwords instead:

    R1(config)#username admin password cisco123
    
    R1(config)#line vty 0 4
    R1(config-line)#login local
    

    And you can protect it with an acce

    ... Continue reading in our forum

  3. Hello Syedwaqas.

    When troubleshooting fibre based interfaces, there are some specific items that you should check:

    First of all, all of the issues brought up by Rene in this lesson are applicable to fibre optic connections as well. Additionally, you should keep the following in mind when troubleshooting fibre based interfaces:

    1. Check the SFP or GBIC status by issuing the show inter status command. Here is an example from a production 3750 production switch that I have:
    3750_DC_1#show inter status
    Gi1/0/1   ***VOICE_SERVERS** connected    901        a-full a-
    ... Continue reading in our forum

  4. Hi Laz,
    Thanks for your explanation …
    So we have to KEEP same type for per active segment , right ??

    R1----------R2------------R3

    Suppose… Segment-1 : R1 to R2 [SFP Single Mode both end and Fiber also Single Mode ]
    And Segment-2 : R2 to R3 [Multimode SFP both end and Multimode Fiber ]

    The above is okk or not ?? Please correct me if I am wrong .Thx

    br//zaman

  5. Hello rosna

    Yes, all Cisco devices have Ethernet ports that support both half and full duplex. In order for them to function correctly however, you require the appropriate configuration on both ends.

    The following combinations of configurations will function correctly for duplex settings:

    1. Half duplex - Half duplex
    2. Full duplex - Full duplex
    3. Half duplex - Auto
    4. Full duplex - Auto

    The only configuration that will not function is:

    1. Half duplex - Full duplex

    If you have one of the first four configurations set up and it is still not working, then the problem is n

    ... Continue reading in our forum

7 more replies! Ask a question or join the discussion by visiting our Community Forum