Switchport nonegotiate что это
This chapter describes how to use the command-line interface (CLI) to configure Fast Ethernet, Gigabit Ethernet, and 10-Gigabit Ethernet LAN ports for Layer 2 switching in Cisco IOS Software Release 12.2SX. The configuration tasks in this chapter apply to LAN ports on switching modules and to the LAN ports on the supervisor engine and Cisco ME 6500 Series Ethernet switches.
Understanding Layer 2 Switching
Understanding Layer 2 Ethernet Switching
Layer 2 Ethernet Switching Overview
Layer 2 Ethernet ports on Cisco switches support simultaneous, parallel connections between Layer 2 Ethernet segments. Switched connections between Ethernet segments last only for the duration of the packet. New connections can be made between different segments for the next packet.
Cisco switches that support Layer 2 Ethernet ports solve congestion problems caused by high-bandwidth devices and by a large number of users by assigning each device (for example, a server) to its own 10-, 100-, or 1000-Mbps collision domain. Because each LAN port connects to a separate Ethernet collision domain, servers in a properly configured switched environment achieve full access to the bandwidth.
Because collisions cause significant congestion in Ethernet networks, an effective solution is full-duplex communication. Normally, Ethernet operates in half-duplex mode, which means that stations can either receive or transmit. In full-duplex mode, two stations can transmit and receive at the same time. When packets can flow in both directions simultaneously, the effective Ethernet bandwidth doubles.
Switching Frames Between Segments
Each Layer 2 Ethernet port can connect to a single workstation or server, or to a hub through which workstations or servers connect to the network.
On a typical Ethernet hub, all ports connect to a common backplane within the hub, and the bandwidth of the network is shared by all devices attached to the hub. If two stations establish a session that uses a significant level of bandwidth, the network performance of all other stations attached to the hub is degraded.
To reduce degradation, the switch considers each LAN port to be an individual segment. When stations connected to different LAN ports need to communicate, the switch forwards frames from one LAN port to the other at wire speed to ensure that each session receives full bandwidth.
To switch frames between LAN ports efficiently, the switch maintains an address table. When a frame enters the switch, it associates the MAC address of the sending network device with the LAN port on which it was received.
Building the Address Table
The address table is built by using the source address of the frames received. When the switch receives a frame for a destination address not listed in its address table, it floods the frame to all LAN ports of the same VLAN except the port that received the frame. When the destination station replies, the switch adds its relevant source address and port ID to the address table. The switch then forwards subsequent frames to a single LAN port without flooding to all LAN ports.
The address table can store at least 32,000 address entries without flooding any entries. The switch uses an aging mechanism, defined by a configurable aging timer, so if an address remains inactive for a specified number of seconds, it is removed from the address table.
Notification of Address Table Changes
You can configure the switch to maintain a history of dynamic additions and removals of address table entries associated with a particular LAN port. The change history can be sent as an SNMP trap notification or it can be read manually from the SNMP MIB.
Understanding VLAN Trunks
Trunking Overview
Note For information about VLANs, see Chapter 17, "Configuring VLANs."
A trunk is a point-to-point link between the switch and another networking device. Trunks carry the traffic of multiple VLANs over a single link and allow you to extend VLANs across an entire network.
Two trunking encapsulations are available on all Ethernet ports:
•Inter-Switch Link (ISL)—ISL is a Cisco-proprietary trunking encapsulation.
Note The following switching modules do not support ISL encapsulation:
· WS-X6502-10GE
· WS-X6548-GE-TX, WS-X6548V-GE-TX, WS-X6548-GE-45AF
· WS-X6148-GE-TX, WS-X6148V-GE-TX, WS-X6148-GE-45AF
•802.1Q—802.1Q is an industry-standard trunking encapsulation.
You can configure a trunk on a single Ethernet port or on an EtherChannel. For more information about EtherChannel, see Chapter 15, "Configuring EtherChannels."
Ethernet trunk ports support several trunking modes (see Table 13-2). You can specify whether the trunk uses ISL or 802.1Q encapsulation, and if the encapsulation type is autonegotiated.
Note You can configure LAN ports to negotiate the encapsulation type. You cannot configure WAN interfaces to negotiate the encapsulation type.
The Dynamic Trunking Protocol (DTP) manages trunk autonegotiation on LAN ports. DTP supports autonegotiation of both ISL and 802.1Q trunks.
To autonegotiate trunking, the LAN ports must be in the same VTP domain. Use the trunk or nonegotiate keywords to force LAN ports in different domains to trunk. For more information on VTP domains, see Chapter 16, "Configuring VTP."
Encapsulation Types
Table 13-1 lists the Ethernet trunk encapsulation types.
The trunking mode, the trunk encapsulation type, and the hardware capabilities of the two connected LAN ports determine whether a link becomes an ISL or 802.1Q trunk.
Layer 2 LAN Port Modes
Table 13-2 lists the Layer 2 LAN port modes and describes how they function on LAN ports.
Note DTP is a point-to-point protocol. However, some internetworking devices might forward DTP frames improperly. To avoid this problem, ensure that LAN ports connected to devices that do not support DTP are configured with the access keyword if you do not intend to trunk across those links. To enable trunking to a device that does not support DTP, use the nonegotiate keyword to cause the LAN port to become a trunk but not generate DTP frames.
Default Layer 2 LAN Interface Configuration
Table 13-3 shows the Layer 2 LAN port default configuration.
Layer 2 LAN Interface Configuration Guidelines and Restrictions
When configuring Layer 2 LAN ports, follow these guidelines and restrictions:
•The following switching modules do not support ISL encapsulation:
–WS-X6502-10GE
–WS-X6548-GE-TX, WS-X6548V-GE-TX, WS-X6548-GE-45AF
–WS-X6148-GE-TX, WS-X6148V-GE-TX, WS-X6148-GE-45AF
•The following configuration guidelines and restrictions apply when using 802.1Q trunks and impose some limitations on the trunking strategy for a network. Note these restrictions when using 802.1Q trunks:
–When connecting Cisco switches through an 802.1q trunk, make sure the native VLAN for an 802.1Q trunk is the same on both ends of the trunk link. If the native VLAN on one end of the trunk is different from the native VLAN on the other end, spanning tree loops might result.
–Disabling spanning tree on the native VLAN of an 802.1Q trunk without disabling spanning tree on every VLAN in the network can cause spanning tree loops. We recommend that you leave spanning tree enabled on the native VLAN of an 802.1Q trunk. If this is not possible, disable spanning tree on every VLAN in the network. Make sure your network is free of physical loops before disabling spanning tree.
–When you connect two Cisco switches through 802.1Q trunks, the switches exchange spanning tree BPDUs on each VLAN allowed on the trunks. The BPDUs on the native VLAN of the trunk are sent untagged to the reserved IEEE 802.1d spanning tree multicast MAC address (01-80-C2-00-00-00). The BPDUs on all other VLANs on the trunk are sent tagged to the reserved Cisco Shared Spanning Tree (SSTP) multicast MAC address (01-00-0c-cc-cc-cd).
–Non-Cisco 802.1Q switches maintain only a single instance of spanning tree (the Mono Spanning Tree, or MST) that defines the spanning tree topology for all VLANs. When you connect a Cisco switch to a non-Cisco switch through an 802.1Q trunk, the MST of the non-Cisco switch and the native VLAN spanning tree of the Cisco switch combine to form a single spanning tree topology known as the Common Spanning Tree (CST).
–Because Cisco switches transmit BPDUs to the SSTP multicast MAC address on VLANs other than the native VLAN of the trunk, non-Cisco switches do not recognize these frames as BPDUs and flood them on all ports in the corresponding VLAN. Other Cisco switches connected to the non-Cisco 802.1q cloud receive these flooded BPDUs. This allows Cisco switches to maintain a per-VLAN spanning tree topology across a cloud of non-Cisco 802.1Q switches. The non-Cisco 802.1Q cloud separating the Cisco switches is treated as a single broadcast segment between all switches connected to the non-Cisco 802.1q cloud through 802.1q trunks.
–Make certain that the native VLAN is the same on all of the 802.1q trunks connecting the Cisco switches to the non-Cisco 802.1q cloud.
–If you are connecting multiple Cisco switches to a non-Cisco 802.1q cloud, all of the connections must be through 802.1q trunks. You cannot connect Cisco switches to a non-Cisco 802.1q cloud through ISL trunks or through access ports. Doing so causes the switch to place the ISL trunk port or access port into the spanning tree "port inconsistent" state and no traffic will pass through the port.
Configuring LAN Interfaces for Layer 2 Switching
Note Use the default interface <ethernet | fastethernet | gigabitethernet | tengigabitethernet> slot/port command to revert an interface to its default configuration.
Configuring a LAN Port for Layer 2 Switching
To configure a LAN port for Layer 2 switching, perform this task:
After you enter the switchport command, the default mode is switchport mode dynamic desirable. If the neighboring port supports trunking and is configured to allow trunking, the link becomes a Layer 2 trunk when you enter the switchport command. By default, LAN trunk ports negotiate encapsulation. If the neighboring port supports ISL and 802.1Q encapsulation and both ports are set to negotiate the encapsulation type, the trunk uses ISL encapsulation (10-Gigabit Ethernet ports do not support ISL encapsulation).
Configuring MAC Address Table Notification
Note•Complete the steps in the «Configuring a LAN Port for Layer 2 Switching» section before performing the tasks in this section.
•To send SNMP trap notifications using this feature, you must also enable the global MAC trap flag, using the snmp-server enable mac-notification change command.
With Release 12.2(33)SXH and later releases, to configure the MAC address table notification feature, perform this task:
When configuring the notification parameters, note the following information:
•The interval value parameter can be configured from 0 seconds (immediate) to 2,147,483,647 seconds. The default is 1 second.
•The history size parameter can be configured from 0 entries to 500 entries. The default is 1 entry.
This example shows how to configure the SNMP notification of dynamic additions to the MAC address table of addresses on the Fast Ethernet ports 5/7 and 5/8. Notifications of changes will be sent no more frequently than 5 seconds, and up to 25 changes can be stored and sent in that interval:
Disabling DTP Negotiation — switchport nonegotiate
In the previous post we covered how Layer 2 interfaces on Cisco devices use DTP frames to select a trunking operational mode when their trunking administrative mode is set to dynamic auto or dynamic desirable.
An interface that is staticlly configured in access or trunk mode responds to incoming DTP frames to allow a neighboring (dynamic) interface to select the appropriate trunking operational mode for itself.
Is there a way to disable DTP negotiation on an interface?
The switchport nonegotiate command
The switchport nonegotiate command disables DTP negotiation on a Layer 2 interface. The command is available in the Interface Configuration Mode.
This command is only accepted for interfaces that are statically configured in access or trunk mode. DTP negotiation cannot be disabled on an interface that is configured in dynamic auto or dynamic desirable mode.
The following is an example of how DTP can be disabled on an interface:
| access | Set access mode characteristics of the interface |
| mode | Set trunking mode of the interface |
| nonegotiate | Device will not engage in negotiation protocol on this interface |
| trunk | Set trunking characteristics of the interface |
Switchport nonegotiate on a dynamic interface
The default trunking administrative mode on a Layer 2 interface on a Cisco device is dynamic auto. (In older firmware versions, it used to be dynamic desirable.)
Let’s see what happens when we attempt to enter the switchport nonegotiate command on an interface configured in dynamic mode.
When we try to disable DTP on a Layer 2 interface that has its trunking administrative mode to dynamic, we receive an error message stating that the command has been rejected due to a conflict between «nonegotiate» and «dynamic» status.
We cannot disable DTP on a dynamic interface because the interface must use DTP to determine its trunking operational mode. An interface must be statically configured in access or trunk mode before we can disable DTP on it.
More details on this particular error message can be found here: Command rejected: Conflict between ‘nonegotiate’ and ‘dynamic’ status
What happens when we disable DTP on an interface?
When an interface in access or trunk mode has DTP disabled on it (by using the switchport nonegotiate command), it will not participate in DTP negotiation, and will not respond to incoming DTP frames. Any DTP frames that it receives will simply be ignored.
Want to test your networking skills with hands-on configuration and troubleshooting questions? Try out the Workshops section of this website here: Workshops (Login required).
Read how to use the device simulators on this website here: Workshops — General Instructions
Dynamic Trunking Protocol (DTP) Configuration
So we’ve seen the static trunking configuration, switchport mode trunk. Now let’s look at the other methods. By default, it will either be auto or desirable, which are Dynamic Trunking Protocol methods. What does auto state mean? Let’s define the methods in the following table where you can easily spot what will be the result based on the ports’ configuration.
| switchport mode dynamic auto | switchport mode dynamic desirable | switchport mode trunk | switchport mode trunk switchport nonegotiate |
switchport mode access | |
|---|---|---|---|---|---|
| switchport mode dynamic auto | Access | Trunk | Trunk | Limited Connectivity | Access |
| switchport mode dynamic desirable | Trunk | Trunk | Trunk | Limited Connectivity | Access |
| switchport mode trunk | Trunk | Trunk | Trunk | Trunk | Limited Connectivity |
| switchport mode trunkswitchport nonegotiate | Limited Connectivity | Limited Connectivity | Trunk | Trunk | Limited Connectivity |
| switchport mode access | Access | Access | Limited Connectivity | Limited Connectivity | Access |
Auto states wait patiently for DTP messages, Dynamic Trunking Protocol messages, to arrive, asking you to form a trunk. Do not seek or try to form a trunk unless someone explicitly asks you using DTP.
Dynamic desirable states aggressively, form a trunk link. Do your best using DTP to form a trunk with the other side of that link. Trunk, we’ve seen. You are a trunk. But if I just type in switchport mode trunk, does that shut off DTP or am I still using DTP?
DTP is left on. There are only two effective ways to remove it. If you want the port to be a trunk port but not have DTP action take place, we say switchport nonegotiate. And so we can see that in the fourth column here, two separate commands, switchport mode trunk to be forceful and then nonegotiate, that means we won’t listen but we also won’t speak DTP as a language. And in some discussions that is the preferred and ideal configuration, run it forcefully as a trunk and remove any question with DTP and we see that in security courses. I’m perfectly happy with switchport mode trunk, that’s the one command that I’m going to do. I’ve no objection to switchport nonegotiate. Now the other way to turn off DTP is just to say switchport mode access and then we are certainly not expecting that port to need the DTP protocol, so we don’t run it. So there are some situations that could have some unexpected consequences based on these interactions. If you do this in the real world, avoid these unexpected consequences by just setting both sides to be the same and know the impact of setting both sides as let’s say switchport mode dynamic auto. If we do that, switchport mode dynamic auto, got it on both sides. auto, hey let’s form a trunk, right?
No, no, not at all, and the majority of the switches that I deal with on a regular basis are automatically set to dynamic auto from the manufacturer being Cisco. So what does that mean?
Well look at the output on this chart, it says switchport dynamic auto. With switchport dynamic auto, find the two headings there in our columns and our rows and then join them up, and what do you find? Access, access what? It means we’re an access port. That’s what that’s referring to. Why? Well remember, what dynamic auto does, auto says wait for DTP messages to ask you to form a trunk. So if one side is waiting and the other side is waiting, is anybody sending DTP messages? No trunk being formed. And with this being the method that’s set by default on your switches, most times when you plug switches together, you’re not going to form a trunk automatically. Older switches were usually set to dynamic desirable by default, so trunks would just form wherever they want. Plug two switches together, boom, we have our trunk, but neither one seemed to be set to dynamic auto to make sure that the trunk doesn’t form automatically. So if I can’t have dynamic auto on both sides, I need at least dynamic desirable or trunk set on the other side.
Both will tip the scales because both will ask the other side and they still run DTP. What wouldn’t happen is if you then tacked on nonegotiate because then you would have no communication to tip the scales for the auto side or even if it was desirable on the other side. Both auto and desirable would demand seeing some DTP from the other side and nonegotiate turns that off. Let’s think for a moment about limited connectivity for just a brief moment in time. What does limited connectivity even mean? Well basically, it means that the only VLAN that can communicate is the native VLAN. We would only have one VLAN be able to work and that’s still even questionable, because in that case, the native VLAN of the trunking side would have to match the access mode VLAN of the nontrunking side. So wherever you see Limited connectivity, one side is trunking, the other side is not. And so, you are going to get some pretty undesirable behavior as a result of that misconfiguration. You would never want to see that in a real-world network.
So take the time to review the different consequences based on the method you choose here to form your trunk. Majority of the time you’ll successfully form a trunk, but there are those odd situations where you’ll either stay as an access port and not form a trunk or you’ll have limited connectivity.
About the switchport mode
I am new to network Engineering. I find it is hard to distinguish and understand different switchport settings.
Why can I have a switchport set to access, auto, or dynamic? What are they used for? Are those functions only used for a host to switch connection?
What is «switchport nonnegotiate» used for?
5 Answers 5
Welcome to the field of network engineering!
DTP stands for Dynamic Trunking Protocol and is crucial to the commands below. It is also Cisco proprietary.
switchport mode access — Always forces that port to be an access port with no VLAN tagging allowed EXCEPT for the voice vlan. DTP is not used and a trunk will never be formed.
switchport nonegotiate — turns off DTP and forces the interface into a trunk.
switchport mode dynamic desirable — pro-active DTP negotiation will begin and if the other-side is set to trunk, desirable, or auto. The interface will become a trunk. Otherwise the port will become an access port.
switchport mode dynamic auto — allows the port to negotiate DTP if the other side is set to trunk or desirable. Otherwise it will become an access port.
switchport mode trunk — This interface will always be a trunk no matter what happens on the other side. It will also use DTP to negotiate a neighbouring interface that is set to dynamic desirable or dynamic auto into a trunk.
In the real world — I have never seen *dynamic auto*or dynamic desirable as generally network engineers try and make layer 2 related items (such as switchport settings) stable and static. There are also security risks associated with this.
An access role port is usually used for an single host or device. You must also specify which VLAN you would like it to be associated with, otherwise it will default to VLAN 1 in the Cisco world. eg)
interface gig0/1
switchport mode access
switchport access vlan 10
Also, if you have a VLAN for voip traffic. You can also set the voice vlan as required by adding
switchport voice vlan 20
A trunk port is generally only used when you want to interconnect two switches together in order to pass multiple VLANs between the two switches. In this example, the switches will use Dot1Q tagging and allow vlans 10, 20 & 30 to be passed between the two switches. Vlan 10 however, will be passed without tagging since it is set as the native vlan. eg)
Switch1# interface gig0/1
switchport encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30Switch2# interface gig0/1
switchport encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30
Take a look at Implement trunk and trunk protocols for more examples and to learn more about ISL or dot1q tagging along with some more command and debug information.