Cisco 3.3 User Manual download pdf (Page 4)

Lab – Implementing VLAN Security

Fa0/1 on 802.1q trunking 1

Port Vlans allowed on trunk

Fa0/1 1-4094

Port Vlans allowed and active in management domain

Fa0/1 1,10,99,999

Port Vlans in spanning tree forwarding state and not pruned

Fa0/1 1,10,99,999

Step 2: Change the native VLAN for the trunk ports on S1 and S2.

Changing the native VLAN for trunk ports from VLAN 1 to another VLAN is a good practice for security.

a. What is the current native VLAN for the S1 and S2 F0/1 interfaces?

____________________________________________________________________________________

b. Configure the native VLAN on the S1 F0/1 trunk interface to Management&Native VLAN 99.

S1# config t

S1(config)# interface f0/1

S1(config-if)# switchport trunk native vlan 99

c. Wait a few seconds. You should start receiving error messages on the console session of S1. What does

the %CDP-4-NATIVE_VLAN_MISMATCH: message mean?

____________________________________________________________________________________

d. Configure the native VLAN on the S2 F0/1 trunk interface to VLAN 99.

S2(config)# interface f0/1

S2(config-if)# switchport trunk native vlan 99

e. Verify that the native VLAN is now 99 on both switches. S1 output is shown below.

S1# show interface trunk

Port Mode Encapsulation Status Native vlan

Fa0/1 on 802.1q trunking 99

Port Vlans allowed on trunk

Fa0/1 1-4094

Port Vlans allowed and active in management domain

Fa0/1 1,10,99,999

Port Vlans in spanning tree forwarding state and not pruned

Fa0/1 10,999

Step 3: Verify that traffic can successfully cross the trunk link.

a. From a command prompt on PC-A, ping the management address of S1. Were the pings successful?

Why?

____________________________________________________________________________________

1 2 3 4 5 6 7

No comments

Cisco 3.3 User Manual Page 4