3.1.a Troubleshoot static and dynamic 802.1q trunking protocols

What this objective tests

The objective says "troubleshoot". The exam gives you a symptom and show output. You must find the mismatch.

A trunk carries many VLANs on one link. 802.1Q adds a VLAN tag to each frame. The receiving switch reads the tag and keeps the frame in the correct VLAN.

Most trunk problems come from four places:

1. The link is not trunking.
2. The VLAN is not allowed on the trunk.
3. The native VLAN does not match.
4. Dynamic Trunking Protocol (DTP) negotiated an unexpected state.

Trunk modes and DTP

An access port belongs to one VLAN. A trunk port carries many VLANs. Frames in the native VLAN cross the trunk without a tag.

DTP negotiates the trunk state between two Cisco switches.

Two dynamic auto ports never form a trunk. Neither side starts the negotiation.

Note: Best practice is static trunks with switchport nonegotiate. DTP is a predictability and security risk.

Correct trunk configuration

SW1 and SW2 connect on GigabitEthernet1/0/1. VLANs 10 and 20 must cross the link. VLAN 999 is the unused native VLAN.

vlan 10
 name USERS
vlan 20
 name VOICE
vlan 999
 name NATIVE_UNUSED
!
interface GigabitEthernet1/0/1
 description Trunk to SW2
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,999
 switchport nonegotiate
 no shutdown

Note: Modern Catalyst switches do not offer switchport trunk encapsulation dot1q. 802.1Q is the only choice. A missing command is not a problem.

Example: access port on one side, trunk on the other

Failure: SW1 Gi1/0/1 is an access port in VLAN 10. SW2 Gi1/0/1 is a trunk with native VLAN 999.

SW1:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10

Result:

• No trunk forms. SW2 shows no trunking interface.
• Untagged frames from SW1 arrive at SW2 in the native VLAN 999, not in VLAN 10.
• VLAN 20 traffic never crosses the link.

Diagnose on SW2:

SW2# show interfaces trunk
SW2#

An empty result means no interface is trunking. Check the port mode next:

SW2# show interfaces gi1/0/1 switchport
Name: Gi1/0/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: down

Administrative mode says trunk. Operational mode says the trunk failed to form. Fix SW1:

interface GigabitEthernet1/0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,999

Example: native VLAN mismatch

Failure: SW1 uses native VLAN 999. SW2 uses native VLAN 1.

Symptom: tagged VLANs still work. Untagged traffic crosses into the wrong VLAN. Cisco Discovery Protocol (CDP) reports the mismatch:

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/0/1 (999), with SW2 GigabitEthernet1/0/1 (1).

This is silent mis-forwarding. There is no clean error. A host in VLAN 999 on SW1 can reach VLAN 1 on SW2.

Fix both ends to the same unused native VLAN:

interface GigabitEthernet1/0/1
 switchport trunk native vlan 999

Verification output

Start with show interfaces trunk:

SW1# show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi1/0/1     on               802.1q         trunking      999

Port        Vlans allowed on trunk
Gi1/0/1     10,20,999

Port        Vlans allowed and active in management domain
Gi1/0/1     10,20,999

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/1     10,20,999

Correct output shows:

• The port mode is on and the status is trunking.
• The native VLAN matches the other end.
• The VLAN you need appears in all three lists.

Check the DTP state:

SW1# show dtp interface gi1/0/1
DTP information for GigabitEthernet1/0/1:
  TOS/TAS/TNS:                              TRUNK/ON/TRUNK
  TOT/TAT/TNT:                              802.1Q/802.1Q/802.1Q
  Hello timer expiration (sec/state):       never/STOPPED
  Negotiation timer expiration (sec/state): never/STOPPED
  FSM state:                                S6:TRUNK
  Enabled:                                  no

Read this output:

• TAS: ON and TNS: TRUNK show the administrative and negotiated trunk state.
• Enabled: no means DTP frames are off. This is correct with switchport nonegotiate.

Lab: find three trunk faults

Topology:

PC1 (VLAN 10) -- SW1 Gi1/0/10
SW1 Gi1/0/1 ==== Gi1/0/1 SW2
PC2 (VLAN 10) -- SW2 Gi1/0/10

Do these steps:

1. Create VLANs 10, 20, and 999 on both switches. Put the PC ports in VLAN 10 as access ports.
2. Configure the link between SW1 and SW2 as a static trunk. Use native VLAN 999. Allow VLANs 10, 20, and 999.
3. Verify with show interfaces trunk and show vlan brief. Ping from PC1 to PC2.
4. Break the allowed list on SW2: switchport trunk allowed vlan remove 10. Predict the symptom before you test.
5. Verify the fault with show interfaces trunk. Check the allowed and forwarding lists.
6. Repair the fault with switchport trunk allowed vlan add 10. Verify the ping works again.
7. Change the native VLAN on SW2 to VLAN 1. Watch for the CDP mismatch message. Fix it.
8. Set SW1 Gi1/0/1 to switchport mode dynamic auto. Set SW2 to dynamic auto. Check show interfaces trunk. Explain why no trunk forms.
9. Restore static trunks on both sides. Verify the final state.

Exam traps

• A trunk can be up/up and still not carry the VLAN you need.
• switchport trunk allowed vlan 10 replaces the list. Use add to keep the rest.
• A native VLAN mismatch mis-forwards untagged traffic. Tagged VLANs still work.
• dynamic auto on both sides never forms a trunk.
• A VLAN must exist in the local VLAN database before the switch forwards it.

Pass check

You are ready when you can do these things:

• Read show interfaces trunk and name the mode, native VLAN, and allowed VLANs.
• Predict the result of any two DTP modes on a link.
• Explain the two symptoms of a native VLAN mismatch: the CDP error and silent mis-forwarding.
• Fix a missing allowed VLAN without replacing the allowed list.