I was asked by a colleague at work the other day, can we replace the Cisco firewalls with FortiGate firewalls for a client? As a business we are heading towards Forti, but before I said yes I wanted to know what the firewall was actually doing before I said yes. On closer inspection the firewall in question didn’t appear to be doing anything too scary, but I did notice that the LAN interface was sub-interfaced to the various internal VLANs. I didn’t know how FortiGate handled this, so I fired it up on the test bench to test FortiGate Sub Interfaces.
So I needed to create TWO sub interfaces on the FortiGate (on port3).
Creating FortiGate Sub Interfaces
Simply put, on a FortiGate if you want what a Cisco engineer would refer to as a ‘sub interface‘, then you simply add a VLAN interface to a physical interface. Like so, Network > Interfaces > {Physical Interface} > Create New > Interface.
Give the new interface a name (and alias if required) > Interface Type should be VLAN > Select the parent physical interface > Add the VLAN ID (Tag) and specify an IP address of the interface.
Just for testing I’ll allow PING, on the VLAN interface also > OK.
Repeat the procedure to add further sub interfaces (VLANs).
Remember this is just a ‘Router on a stick‘ configuration, to further allow traffic to the internet, (or between VLANs) you still need to add that traffic to the firewall policy to let the traffic through, (it is a firewall after all!)
Setting up Switches for FortiGate Sub Interfaces?
I’ve probably got this covered elsewhere on the site, but the core switch is Cisco so I just created a trunk port, and allowed ALL VLANs, (because I’m lazy, in production, you might want to lock that down a little!)
This is a subject that every time I need to create an Ether-Channel I end up checking beforehand, so it’s about time I wrote it up. We are combining two different things, an Ether-channel, (an aggregation of links) and a Trunk (the ability to carry many VLANS). If you are NOT from a Cisco background then you might want to read though the following post first to avoid confusion about the world ‘Trunk‘.
I will combine the TWO links between the switches to act at one link (Ether-Channel). An Ether-Channel can have up to eight links.
Note: I’m only concentrating on the Ether-Channel setup so VLANs/VTP and Routing are not covered.
Solution
You can use two types of Ether-Channels PAgP (Port Aggregation Protocol), but WHY when it only works on Cisco switches. LACP (Link Aggregation control Protocol) which is supported by just about everything else, so let’s stick with that! By default a ‘Trunk’ will pass ALL VLANS, you might not want that, I’ll cover filtering VLANs a bit further down.
WARNING: If you simply connect two switches with two cables you will create a LOOP, if you have STP enabled the network will recover and block one of the links, but your colleagues will shake their heads and pull a ‘frowny face’. For that reason ‘SHUT THE PORTS DOWN BEFORE YOU CABLE / CONFIGURE THEM“.
Starting on Switch1 make sure there’s is no existing Ether-Channels configured;
[box]
SW-1#show etherchannel
Channel-group listing:
----------------------
Group: 1
----------
Group state = L2
Ports: 2 Maxports = 4
Port-channels: 1 Max Port-channels = 4
Protocol: LACP
Minimum Links: 0
[/box]
Above there is already an Ether-Channel (port-channel) on the switch (group 1) so you would have to use group 2. For arguments sake we will say I don’t have one, so I can use group 1.
Note: ‘show etherchannel summary’ is also a handy command to remember!
[box]
First shut down the uplinks, Note the syntax for the 'range interfaces', may differ from device to device,
so use the TAB key.
SW-1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
SW-1(config)#interface range ethernet 0/1 - 2
SW-1(config-if-range)#shutdown
Add the ports to channel group 1, Note 'Active' denotes use LACP, (Passive also works, but one (or both) ends
should be active.)
SW-1(config-if-range)#channel-group 1 mode active
Creating a port-channel interface Port-channel 1
Create a 'trunk' with 802.1q encapsulation.
SW-1(config-if-range)#switchport trunk encapsulation dot1q
SW-1(config-if-range)#switchport mode trunk
[/box]
Then configure the other end the same, (assuming the port numbers are the same!) As mentioned above you can use LACP mode ‘passive‘ but I tend to set both ends active.
Once you have both ends configured and the cables in place, enable the interfaces with a ‘no shutdown‘ command, on both ends!
[box]
SW-1(config)#interface range ethernet 0/1 - 2
SW-1(config-if-range)#no shutdown
[/box]
Filtering VLANs on an Ether-Channel Trunk
Any further port-channel changes need to be done on the port-channel interface, so if you want to filter what’s allowed you simply use the following syntax;
[box]
SW-1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
SW-1(config)#interface Port-channel1
SW-1(config-if)#switchport trunk allowed vlan 1,10,100,200
[/box]
Note: When adding any future VLANS check the syntax, if you simply add a new one it will overwrite all the others, and things will break!
Do all Ether-Channels need to be Trunks? No! Not at all, they can be access ports (as long as they are all in the same VLAN), and they can also be routed uplinks, with an IP address at both ends, (specified in the port-channel interface).
Related Articles, References, Credits, or External Links
I was recently involved in deploying an HPe Synergy 12000 Frame. And the network connections from it were ‘a little unusual’ so I thought I’d document that here, to save anyone else the problems I had.
I was connecting to an HP/Aruba 5412 switch so my cables were all HP/Aruba (to be on the safe side).
What you can see (above) is the MPIO Cable (K2Q46A P/N 800867-001) fixed onto the left (and above boxed,) there is a QSFP (P/N 817040-B21.) Note: this can be used either as 4 x 10Gbe or 4 x 8GbFC). On the right you can see the cable ends in 4x Standard LC fibre connectors, so you will also need 4x 10GB SR SFP+ Modules (Aruba P/N J1950D) – shown bottom right.
So what does it do? (Apart from cost a fortune!) Well the QSFP connects at 40Gb and splits the traffic down into 4 x 10Gb
Cabling and Configuring MPIO QSFP
Connecting up is pretty straight forward, REMEMBER when you connect the 40GB QSFP to the Synergy it will light purple if its connected, and flash purple when it sees activity.
Connecting to the switch is also easy enough, (WARNING: All the ports need to be Trunked (HP) or Ether Channelled (Cisco,)) with LACP enabled. You don’t need to worry about configuring LACP on the Synergy, that’s handled automatically by the ‘Uplink set’.
So the back of the ‘Frame’ has two interconnect links (If you are from a switch background think of these like stacking cables). And two MPIO uplink cables.
HPe/Aruba Switch Config For MPIO
As previously stated, the switch I’m using is an Aruba 5412, with two 8 Port 1Gb/10Gb modules (J9993-A). Here’s the relevant switch config;
[box]
Firstly give the interfaces a sensible name;
!
interface A2
name "Trunk Link to Synergy VC1 Port Q1"
exit
interface A3
name "Trunk Link to Synergy VC1 Port Q1"
exit
interface A4
name "Trunk Link to Synergy VC1 Port Q1"
exit
interface A5
name "Trunk Link to Synergy VC1 Port Q1"
exit
!
interface B2
name "Trunk Link to Synergy VC2 Port Q1"
exit
interface B3
name "Trunk Link to Synergy VC2 Port Q1"
exit
interface B4
name "Trunk Link to Synergy VC2 Port Q1"
exit
interface B5
name "Trunk Link to Synergy VC2 Port Q1"
exit
!
Show any 'already configured' Trunk links with a 'show trunk' commandIn my case two existed, (Trk1 and Trk2). So I used Trk3;
!
trunk A2-A5,B2-B5 Trk3 LACP
!
Now UNTAG vlan 1 (assuming that's your default VLAN) And TAG and VLANS that need to be used in the Synergy Deployment. (Note on an HP switch simply add
the Trk3 to the existing settings like so;
!
vlan1
untagged A6-A8,B6-B8,E1-E24,F1-F24,G3-G12,H3-H12,Trk1-Trk3
!
vlan 100
tagged Trk1-Trk3
exit
vlan 101
tagged Trk1-Trk3
exit
vlan 102
tagged Trk1-Trk3
exit
vlan 103
tagged Trk1-Trk3
exit
etc.
[/box]
Cisco Switch Config For MPIO
If you have a Cisco Switch then instead of ‘Trunking’ you will be ‘Ether Channelling’ for a more detailed explanation see the following post
The process is, you add Networks, then collect Networks together in Network Sets, Then you create Logical Interconnect Groups. Part of creating a Logical Interconnect Groups, involves creating an Uplink Set, which consists of both your Networks, and the The Uplink ports.
Note: A Network Set is used by a Server Profile, (or a Server Profile Template).
Create Networks
One View > Networking > Networks > Create Network
Create Network Sets
One View > Networking > Networks Sets > Create Network Set > Give it a name > Add Networks > Create.
Create Logical Interconnect Group
One View > Networking > Logical Interconnect Group > Create Logical Interconnect Group > Give it a name > Select the correct Interconnect Bay Set (see diagram above) > Select Interconnects > Add Uplink Set.
Give the set a name > Select the Type > Add in the Networks > Add in the Uplinks > Create.
Note: You only need to add in ALL the LOGICAL interfaces i.e. Q1:1, Q1:2,Q1:3,Q1:4 for EACH Interconnect module. .
After a few minutes if you look under One View > Networking > Logical Interconnects > You will see one listed that has the name of your Logical Interconnect group (with a divide symbol on the end!) Make sure ALL the logical uplinks are connected. (If not you will see LACP errors on the switch).
Related Articles, References, Credits, or External Links
If you try and change a ports status, to make it a trunk port, you may see this error;
[box]
Petes-Switch(config-if)#switchport mode trunkCommand rejected: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode.
[/box]
Trunk Settings
I don’t know if this is a throwback to when we had ISL trunking and 802.1q, but you need to specify the encapsulation before you can specify a trunk.
[box]
Petes-Switch(config-if)#switchport mode trunk
Command rejected: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode.
Petes-Switch(config-if)#switchport trunk encapsulation dot1q
Petes-Switch(config-if)#switchport mode trunk
Petes-Switch(config-if)#
[/box]
Related Articles, References, Credits, or External Links
I know it’s not the usual site content, but PNL was born from my dislike of vendor documentation, and crappy documentation is not limited to the world of IT.
The 12v power socket in my A6 wasn’t working, this was probably because there was a 1p coin stuck in it that took a lot of fishing out, I assumed the fuse had blown, and put up with it for a while. When I finally got round to sorting it out today, I opened the ‘owners manual’, and looked for information on fuses and fuse box locations. Turns out I have three fuse box locations, one in either side of the dashboard, and one in the boot, (or trunk for our American visitors). It showed a zoomed in diagram of the fuse numbers and locations, and what each fuse was for, (which also turned out to be incorrect). What it didn’t say was where it was.
I rang the Audi Garage, no one was available, I rang another one, who was obviously doing what I had done and was Google searching it, (I could have saved him some time I’d spent an hour online). The best information I got was “it’s on the right hand side of the boot below the recess with the net over it”. This is true, but getting into it is another story.
Solution
On the right side of the boot is a recessed area with a small net over it see below, the net is held in place with a thick metal bar/rod, which will ‘pop out’ if you pull it and swing up through ninety degrees.
The two catches that hold the bar in place need to be removed, rotate them though ninety degrees anti clockwise, and you can withdraw them.
Now the base and rear of this recess are one piece that can be removed, (be careful the 12v socket shown above will come away also and is still connected, (that’s the wire you can see bottom right). The pink coloured fuse coveres will just ‘pop off’. The 20 Amp fuse, (indicated) is for the 12v power supply in the front center console (cigarette lighter). The 20 Amp fuse next to it is for the rear center console AND the boot 12V power supply.
Related Articles, References, Credits, or External Links
This little NAS box is a cheap way of adding a large amount of storage. Below I’m going to configure it as an iSCSI target, then connect my ESX5 host to it.
I’m not setting up any CHAP authentication, but I’ll show you where it’s configured, if you want to deploy yours a little more securely.
Also it’s considered good practice to separate your storage network traffic, from your actual network traffic (either physically or via VLANs). Here I’m also NOT doing that.
Solution
Initial Configuration of the TS5000
If you connect either of the NAS box’s NICs to your network they will pick up an IP address via DHCP (You will see it in your DHCP leases).
1. Connect to the NAS with a web browser, the default password is ‘password’.
2. To change the default password: Enter Easy Admin mode > Reset Password > Follow the instructions.
3. Team / Trunk The NICs: You can have each NIC with its own IP address, but I prefer to aggregate them > Network > Port Trunking > Configure port trunking.
4. Select ‘Link 1’.
5. Select All > Assign.
6. It may take a few seconds.
Configure iSCSI
7. First enable iSCSI > Drives > iSCSI > Click the switch to enable.
10. Give the volume a name, description, and specify the volume size > OK.
Note: If you wanted to configure authentication select enabled, and set accordingly.
11. Enter the numbers as requested > OK.
12. This can take a couple of minutes also.
Configure ESX For iSCSI
13. Connect to either your ESX host or vCenter > Select a host > Configuration > Networking > Add Networking > Create a new vSwitch > Add a VMkernel port group (called iSCSI or something sensible) > Assign a free NIC, and give it an IP address on the same range as the NAS box.
14. Storage Adaptors > If you do not see any, select ‘Add’ and add in a software iSCSI Adapter.
15. Right click your iSCSI Adapter > Network configuration > Bind it to the port group you created in step 13.
16. Then on either the Dynamic or the Static discovery tab, enter the IP address of the NAS box.
17. Storage > Add Storage > Disk/LUN > Select the iSCSI storage > Follow the instructions.
18. Repeat the process on your remaining ESX hosts. (Note: You will only need to create the VMFS volume(s) for the first one).
Related Articles, References, Credits, or External Links
I was lending a hand this week, while my colleague swapped out a lot of switches. I don’t usually deploy a large number of HP switches, so I was surprised when we installed a chassis switch and after patching the fiber links, the Cisco Catalyst switches all got upset and we lost three out of four ping packets.
I (wrongly) assumed that STP would be enabled, so I wandered back and pulled the second fiber link. I knew from conversations I’d had before, that HP call having multiple uplinks between the same switch, to increase throughput “Trunking”. (Note: For people like me, who think that switch trunks are links for carrying multiple VLAN traffic. In “HP Land” trunking means aggregating switch uplinks).
Solution
Note: Up to four uplinks can be aggregated into one trunk.
Option 1 Configure a Trunk via Telnet/Console Cable
1. Connect to the switch either by Telnet or via the console cable > Log in > type menu {Enter} > The Switch menu will load > Select “2. Switch Configuration…”.
2. Port/Trunk Settings.
3. Press {Enter} > Edit >Scroll to the first port you want to add to the trunk > Use the arrow keys to navigate to the “Group” column > Press {Space} > Select the first unused trunk > Arrow to the “Type” column > Change to “Trunk” > Press Enter > Save.
4. Repeat to add the additional “Links”, then configure the mirror image on the switch at the other end.
Option 2 Configure a Trunk via the Web / GUI Console
1. Log into the wen console > Interface >Port Info/Config > Select the first link you want to trunk > Change.
2. Set the Trunk Type to “Trunk” > Change the Trunk Group to the next available trunk > Save.
3. Repeat to add the additional “Links”, then configure the mirror image on the switch at the other end.
Related Articles, References, Credits, or External Links
For such a ‘baby’ switch this has a LOT of features, I had to lock down the speed and duplex settings on one of the switch ports today. The main details you will be looking for are,
Default IP address = 192.168.2.10
Default Password = blank
Solution
1. Put yourself on the same network: Windows Key+R > ncpa.cpl {enter} > Right click your network connection > Properties > Internet Protocol Version 4 (TCP/IP) > properties > Set yout IP to 192.168.2.11 and set the subnet mask to 255.255.255.0 > OK > OK.
2. Open a web browser and navigate to http://192.186.2.10 log in with a blank password.
3. To Change the Switches IP: Setup Network
4. To change Speed/Duplex Settings: Switching > Port Configuration
5. To change the password: Maintenance > Password Manager.
Related Articles, References, Credits, or External Links
When I first started in IT, I went and did my Cisco CCNA. So I learned that to connect Cisco switches and pass VLAN traffic between them, I needed to create a ‘Trunk’ to pass the VLAN traffic. Fast forward a few years, and I now work for an HP reseller. Very early on I came to realise that what HP called a ‘trunk’ was very different from what I had been taught. Below is an article I did a while ago about setting up HP Trunks.
I was in some HP/Wireless training last week and once again I was struggling with their terminology, so today I lined up a bunch of switches on the test bench and worked out the differences.
Scenario 1 Configuring Cisco Catalyst Switches with VLANs.
In ‘Ciscoland’ All ports are either in access mode or trunk mode, the access mode allows the port to communicate with the VLAN. The trunk mode carries the VLAN traffic to another switch (or device). So to replicate the diagram above, this is what you would need to do. (Note: For older switches like the 3550XL the VLAN commands are a little different see here)
[box]
Switch01>
Switch01>enable
Password: xxxxxxxx
Switch01#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch01(config)#vlan 10
Switch01(config-vlan)#name Admin
Switch01(config-vlan)#exit
Switch01(config)#vlan 20
Switch01(config-vlan)#name Data
Switch01(config-vlan)#exit
Switch01(config)#int f0/2
Switch01(config-if)#switchport mode access
Switch01(config-if)#switchport access vlan 10
Switch01(config-if)#exit
Switch01(config)#inf f0/16
Switch01(config-if)#switchport mode access
Switch01(config-if)#switchport access vlan 20
Switch01(config-if)#exit
Switch01(config)#int f0/23
Switch01(config-if)#switchport mode trunk
Switch02(config-if)#switchport trunk allowed vlan 1,10,20
Switch01(config-if)#exit
Switch01(config)#exit
Switch01#write mem
Building configuration...
[OK]
Switch01#
Switch02>
Switch02>enable
Password: xxxxxxx
Switch02#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch02(config)#vlan 10
Switch02(config-vlan)#name Admin
Switch02(config-vlan)#exit
Switch02(config)#vlan 20
Switch02(config-vlan)#name Data
Switch02(config-vlan)#exit
Switch02(config)#int f0/2
Switch02(config-if)#switchport mode access
Switch02(config-if)#switchport access vlan 10
Switch02(config-if)#exit
Switch02(config)#inf f0/15
Switch02(config-if)#switchport mode access
Switch02(config-if)#switchport access vlan 20
Switch02(config-if)#exit
Switch02(config)#int f0/1
Switch02(config-if)#switchport mode trunk
Switch02(config-if)#switchport trunk allowed vlan 1,10,20
Switch02(config-if)#exit
Switch02(config)#exit
Switch02#write mem
Building configuration...
[OK]
Switch02#[/box]
Scenario 2 Configuring HP Switches with VLANs.
With HP switches the terminology is different, here switch ports are either tagged members or untagged members of a VLAN.
What’s the difference between tagged and untagged? If a port is a tagged member it passes the VLAN information with the traffic it sends. If it is untagged it sends the VLAN traffic without adding in the VLAN tag. So you would only make a port a tagged member if the device that is plugged into it is VLAN aware, i.e. another switch, router, or machine with a VLAN aware NIC. (Note: The VLAN tag is the ID that gets inserted into the head of a network packet). So to do exactly the same as we did in scenario 1, but with HP switches, you would do the following:
BE AWARE: Any single port can only be untagged on one VLAN. Out of the box all ports are untagged on VLAN 1 (or the default VLAN), so if you untag a port into VLAN 20 (for example) it will automatically remove the ‘vlan 1 untagged’ property for that port.
Scenario 3 Setting up HP Switches with Trunked VLANs
Remember with HP a Trunk is adding together lots of links, (if you’re a Cisco head think of port-channeling). So here we create a trunk, then use that trunk to pass tagged VLAN traffic across the switches.
Scenario 4 Setup VLANs via HP Trunks and Cisco Port Channels
Now we have gone full circle, we know what all the differences are, the final part is to get them to talk to each other. So I’ll set up a two cable HP Trunk, and connect it to Cisco LACP port channel, and then finally add in the VLAN traffic.
[box]
Switch01> enable
Password:xxxxx
Switch01# configure terminal
Switch01(config)# vlan 10 name Admin
Switch01(config)# vlan 20 name Data
Switch01(config)# vlan 10
Switch01(vlan-10)# untagged 6
Switch01(vlan-10)# exit
Switch01(config)# vlan 20
Switch01(vlan-20)# untagged 16
Switch01(vlan-20)# exit
Switch01(config)# trunk 21,23 Trk1 LACP
Switch01(config)# vlan 10
Switch01(vlan-10)# tagged Trk1
Switch01(vlan-10)# exit
Switch01(config)# vlan 20
Switch01(vlan-20)# tagged Trk1
Switch01(vlan-20)# exit
Switch01(config)# write mem
Switch01(config)#
Switch02>
Switch02>enable
Password: xxxxxxx
Switch02#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch02(config)#vlan 10
Switch02(config-vlan)#name Admin
Switch02(config-vlan)#exit
Switch02(config)#vlan 20
Switch02(config-vlan)#name Data
Switch02(config-vlan)#exit
Switch02(config)#int f0/2
Switch02(config-if)#switchport mode access
Switch02(config-if)#switchport access vlan 10
Switch02(config-if)#exit
Switch02(config)# interface range fa0/23 - 24
Switch02(config-if-range)# spanning-tree portfast trunk
%Warning: portfast should only be enabled on ports connected to a single
host. Connecting hubs, concentrators, switches, bridges, etc... to this
interface when portfast is enabled, can cause temporary bridging loops.
Use with CAUTION
Switch02(config-if-range)# channel-protocol lacp
Switch02(config-if-range)# channel-group 1 mode active
Creating a port-channel interface Port-channel 1
Switch02(config-if-range)# interface port-channel 1
Switch02(config-if)# switchport mode trunk
Switch02(config-if-range)#switchport trunk allowed vlan 1,10,20
Switch02(config-if)#exit
Switch02(config)#exit
Switch02#write mem
Building configuration...
[OK]
Switch02#
[/box]
Setting up VLANs on older Cisco Switches
Here’s an example using the older vlan database commands.
[box]
Switch01>
Switch01>enable
Password:
Switch01#
Switch01#vlan database
Switch01(vlan)#vlan 10 name Admin
VLAN 10 modified:
Name: Admin
Switch01(vlan)#vlan 20 name Data
VLAN 20 modified:
Name: Data
Switch01(vlan)#exit
APPLY completed.
Exiting....
Switch01#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch01(config)#int f0/2
Switch01(config-if)#switchport mode access
Switch01(config-if)#switchport access vlan 10
Switch01(config-if)#exit
Switch01(config)#int f0/16
Switch01(config-if)#switchport mode access
Switch01(config-if)#switchport access vlan 20
Switch01(config-if)#exit
Switch01(config)#int f0/23
Switch01(config-if)#switchport mode trunk
Switch01(config-if)#switchport trunk encapsulation dot1q
Switch02(config-if-range)#switchport trunk allowed vlan 1,10,20
Switch01(config-if)#exit
Switch01(config)#exit
Switch01#write mem
Building configuration...
Switch01#[/box]
Related Articles, References, Credits, or External Links
If you don’t need different virtual machines to be in different VLANS on your vSphere/ESXi servers then you probably just connect everything together and it all works fine. I was trying to carve off some hosts into their own VLAN today, and setup a new vSwitch.
or if you prefer to work in the fat client.
Now you can see (above), I’ve presented one physical NIC to this vSwitch (vmnic1). This is patched into a Cisco 3750 Catalyst switch. I configured this switch as an ‘access port’ in VLAN 200, I made sure VLAN 200 had an IP address (an SVI address on the switch). and hit a brick wall!
No entries in the switch MAC address table, no bytes being transmitted from the VM, nothing?
Solution
I was pondering on this during my drive home, and the thought struck me, “I’ve got a ‘port group’ in VLAN 200. I had made the port on the Cisco switch an ‘access port’, so I could never add another port group with another VLAN, that’s probably why it’s not working”.
Now if I was connecting two ‘real’ switches together and wanted to do this, I would need to create a ‘trunk’ port between the two switches, and ‘allow’ VLANs across the trunk, (or allow all VLANs).
Just because you are connecting to a VMware virtual switch the process is the same, even if you only have one port group and VLAN connecting to the vSwitch! You CANT configure trunking on the virtual switch (because it does not support DTP), so you need to do everything on the Cisco Catalyst Switch.
In the example below you will need to change the port and VLAN to match your own (highlighted in red).
User Access Verification
Password:
Petes-3750>enable
Password:********
Petes-3750#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Petes-3750(config)#interface fastEthernet 1/0/2
Petes-3750(config-if)# description Connected to ESX vmnic1
Petes-3750(config-if)# switchport trunk encapsulation dot1q
Petes-3750(config-if)# switchport trunk allowed vlan 200
Petes-3750(config-if)# switchport mode trunk
Petes-3750(config-if)# switchport nonegotiate
Petes-3750(config-if)# spanning-tree portfast trunk
%Warning: portfast should only be enabled on ports connected to a single
host. Connecting hubs, concentrators, switches, bridges, etc... to this
interface when portfast is enabled, can cause temporary bridging loops.
Use with CAUTION
Petes-3750(config-if)#exit
Petes-3750(config)#exit
Petes-3750#write mem
Building configuration...
[OK]
Petes-3750#
[/box]
ESX/Cisco ‘Switchport Mode Access’
So can you do this? Yes you can, as long as you DO NOT specify the VLAN number on the vSwitch ‘port group’.
To prove it here’s another switch, connected to vmnic2, it has NO VLAN ID, and it’s connected to port FastEthernet 1/0/5 on my switch. Here is the configuration for that, (again this assumes you have VLAN 201 created with an SVI);
[box]
Petes-3750#show run Interface FastEthernet 1/0/5
Building configuration...
Current configuration : 148 bytes
!
interface FastEthernet1/0/5
description Connected to ESX vmnic2
switchport access vlan 201
switchport mode access
spanning-tree portfast
end
Petes-3750#
[/box]
Related Articles, References, Credits, or External Links
