Usage Scenario

Devices from different vendors or in different network plans may use different values of TPID fields in VLAN tags of VLAN packets. When the TPID on the remote device is not 0x8100 and devices need to communicate, run the 8021q protocol command to change the TPID to be the same as that on the remote device. The TPID in VLAN packets received and sent by a device interface is changed to be the configured TPID so that devices can communicate.

Precautions

The 8021q protocol command can be executed on only Layer 3 Ethernet and GE interfaces.

The 8021q protocol command is valid for only tagged VLAN packets.

The TPID value specified by the 8021q protocol command must be different from TPID values of specific protocols. Otherwise, the interface cannot correctly classify protocol packets. The TPID value cannot be any of the values in the following table.

Usage Scenario

The VLAN technology is widely applied to packet switching networks because it controls broadcast domains flexibly and is easy to deploy. Generally, a Layer 3 switch usually uses a Layer 3 logical interface in each VLAN to allow user hosts in different broadcast domains to communicate. This wastes IP addresses. The VLAN aggregation function is introduced to save IP addresses while implementing communication between VLANs.

The VLAN aggregation function associates a super-VLAN with multiple sub-VLANs. A VLANIF interface can be created in the super-VLAN and be configured with an IP address. Interfaces in all the sub-VLANs use this IP address as the gateway address to communicate with interfaces in other VLANs. This reduces subnet IDs, subnet default gateway addresses, and subnet broadcast IP addresses. In a word, the VLAN aggregation function allows different broadcast domains to use the same subnet address, implements flexible addressing, and saves IP addresses.

Prerequisites

The sub-VLANs to be added to the super-VLAN have been created.

The super-VLAN has been configured using the aggregate vlan command.

Before running the access-vlan command, delete VLANIF interfaces from all the sub-VLANs.

Follow-up Procedure

Configure the sub-VLANs to implement Layer 2 communication between them.

Precautions

The super-VLAN must be different from all its sub-VLANs.

A VLAN can be added to only one super-VLAN.

If you run the access-vlan command multiple times in the same VLAN view, all the specified VLANs are added to the super-VLAN.

Usage Scenario

The VLAN technology is widely applied to packet switching networks because it controls broadcast domains flexibly and is easy to deploy. Generally, a Layer 3 switch usually uses a Layer 3 logical interface in each VLAN to allow user hosts in different broadcast domains to communicate. This wastes IP addresses. The VLAN aggregation function is introduced to save IP addresses while implementing communication between VLANs.

The VLAN aggregation function associates a super-VLAN with multiple sub-VLANs. A VLANIF interface can be created in the super-VLAN and be configured with an IP address. Interfaces in all the sub-VLANs use this IP address as the gateway address to communicate with interfaces in other VLANs. This reduces subnet IDs, subnet default gateway addresses, and subnet broadcast IP addresses. In a word, the VLAN aggregation function allows different broadcast domains to use the same subnet address, implements flexible addressing, and saves IP addresses.

Prerequisites

Before configuring a VLAN as a super-VLAN, delete all physical interfaces from the VLAN.

Precautions

VLAN 1 cannot be configured as a super-VLAN.

If a VLAN has been configured as a guest VLAN, it cannot be configured as a super-VLAN.

The super-VLAN must be different from all its sub-VLANs.

After a VLAN is configured as a super-VLAN, no physical interface can be added to the VLAN.

Usage Scenario

VLAN tag termination sub-interfaces discard broadcast packets after receiving the packets. To permit a VLAN tag termination sub-interface to forward broadcast packets, run the arp broadcast enable command on the sub-interface to enable ARP broadcast.

You can also use the arp broadcast disable command to disable ARP broadcast on a VLAN tag termination sub-interface, and run the undo arp broadcast disable command to enable ARP broadcast on a VLAN tag termination sub-interface.

Configuration Impact

Precautions

When you enable or disable ARP broadcast on a VLAN tag termination sub-interface, the routing status of the sub-interface becomes Down and then Up. This may result in route flapping on the entire network, affecting services.

After the ARP broadcast function is enabled using the arp broadcast enable command, if a service packet is sent from a termination sub-interface but does not have an ARP entry, an ARP request is copied and sent in all VLANs of the sub-interface. If a large number of VLANs are configured, the number of ARP requests to be copied and sent is large, which may bring a heavy burden on the peer devices that receive the ARP requests. Consequently, the peer devices may encounter exceptions, such as high CPU usage and broadcast suppression. The local device may also fail to immediately send ARP requests as it is busy in processing packet copying, leading to ARP learning failures. To prevent this issue, you are advised to reduce the number of VLANs configured on sub-interfaces.

Usage Scenario

Software upgrade or active/standby switchover on the router may cause frequent status changes on VLANIF interfaces. To prevent network flapping, run the damping time command on VLANIF interfaces to configure the VLAN damping function.

When all interfaces in a VLAN become Down, the router waits for a period specified by delay-time and then reports the VLAN Down event to the VLANIF interface.

Precautions

If any interface in the VLAN becomes Up within the delay time, the VLANIF interface remains Up.

You can use the display interface vlanif command to view the VLAN damping time.

If you run the damping time command multiple times in the same VLANIF interface view, only the latest configuration takes effect.

Usage Scenario

The description command is used to set the description of a VLAN, which is convenient for identifying, memorizing, and maintaining the VLAN.

The display vlan vlan-id verbose command can display the description of a specified VLAN.

Precautions

Set different descriptions for VLANs to distinguish.

If you run the description command multiple times in the same VLAN view, only the last configuration takes effect.

Usage Scenario

To manage VLANIF interfaces conveniently, use the description command to set VLANIF interface descriptions. The description of a VLANIF interface helps you identify the VLANIF interface and know its functions.

You can use the display interface vlanif command to view the description of a VLANIF interface.

Precautions

The description of a VLANIF interface should provide useful information.

Set different descriptions for VLANIF interfaces to distinguish VLANIF interfaces.

If you run the description command multiple times in the same VLANIF interface view, only the latest configuration takes effect.

After configuring dot1q termination on sub-interfaces, run the display dot1q information termination command to view the sub-interfaces where dot1q termination is configured and configuration of the dot1q sub-interfaces.

After configuring the qinq termination, you can run the display qinq information command to view the interfaces configured with qinq termination and the related configuration of qinq termination.

Usage Scenario

To monitor an interface or locate an interface fault, you can use the display interface vlanif command to view the interface status, interface configuration, and traffic statistics on the interface.

Prerequisites

The specified VLANIF interface has been created.

Precautions

If vlan-id is not specified, the display interface vlanif command displays information about all VLANIF interfaces in the system.

Usage Scenario

After configuring the MUX VLAN function, you can use the display mux-vlan command to verify the configuration. This command displays the principal VLAN ID, subordinate VLAN ID, VLAN type, and interfaces in each VLAN.

Precautions

If no MUX VLAN is configured by using the mux-vlan command, the display mux-vlan command does not display any information.

Usage Scenario

You can run the display port vlan command to view information about interfaces of the VLAN and check whether the VLAN is assigned by the command, protocols, or services. If a fault occurs on an interface, you can locate the fault based on the information about the interface and VLAN.

Prerequisite

A VLAN has been created and the Layer 2 interface has joined the VLAN.

Precautions

After VLAN aggregation is configured on a device, you can determine whether VLAN aggregation has been correctly configured by running the display sub-vlan command to check information about sub-VLANs and check which sub-VLANs are contained in a super-VLAN.

When using the display sub-vlan command, note the following issues:

• If vlan-id is not specified, information about all sub-VLANs on the device is displayed.

• If vlan-id is specified, information about a specific sub-VLAN is displayed.

Before running the display sub-vlan command, ensure that the device is configured with sub-VLANs. Otherwise, no command output is displayed.

After VLAN aggregation is configured on a device, you can determine whether VLAN aggregation has been correctly configured by running the display super-vlan command to check information about super-VLANs and check which sub-VLANs are contained in a super-VLAN.

When using the display super-vlan command, note the following issues:

• If vlan-id is not specified, information about all super-VLANs on the device is displayed.

• If vlan-id is specified, information about a specific super-VLAN is displayed.

Before running the display super-vlan command, ensure that the device is configured with super-VLANs. Otherwise, no command output is displayed.

Usage Scenario

The display vlan command displays VLAN configuration or packet statistics on interfaces in a VLAN.

Precautions

If no parameter is specified, brief information about all VLANs is displayed.

Usage Scenario

The display vlan priority command displays the 802.1p priority of a specified VLAN or 802.1p priorities of all VLANs.

Usage Scenario

You can run the display vlan-range command to view the range of VLANs that can be created on the 4GE-2S interface card.

Usage Scenario

• Communication between VLANs

  VLANs are widely used because they can separate Layer 2 packets. A physical LAN is divided into multiple logical broadcast domains. Hosts in the same VLAN can communicate with each other but the hosts of different VLANs cannot. The Layer 3 routing technology is used for communication between hosts of different VLANs in the following two methods:

  • Through the VLANIF interface on the device.

  • Through the Layer 3 Ethernet interface on the device.

    However, when a traditional Layer 3 Ethernet interface receives VLAN packets, the VLAN packets are discarded. To enable communication between hosts of different VLANs, you can create an Ethernet sub-interface on the Layer 3 Ethernet interface and enable QinQ termination on the sub-interface to remove the tag from the VLAN packet.

• Communication between a LAN and a WAN

  Most packets on a LAN have VLAN tags, but some WAN protocols such as ATM, FR, and PPP, cannot identify VLAN packets. To send a VLAN packet from LAN to WAN, the device records VLAN information in the packet, removes the VLAN tag, and forwards the packet.

Precautions

• high-pe-vid is supported by only the AR6280-S&AR6300-S&AR6280&&AR6300&AR6280K&AR6300K.

• You can specify high-pe-vid only after the termination-vid batch enable command is used to enable a sub-interface to batch terminate VLAN tags.

• The value of high-pe-vid must be greater than or equal to the value of low-pe-vid.

• When this command is executed on an Eth-Trunk sub-interface, you cannot specify high-pe-vid.

• The tag values of the user packet received by the sub-interface must be in the range of pe-vids specified in the command; otherwise, the packet is discarded.

• When you run the undo dot1q termination vid command to delete the single VLAN ID for Dot1q termination on a sub-interface, the VLAN ID must be the same as that specified in the dot1q termination vid command.

• If the dot1q termination vid command is run more than once, all configurations take effect.

Configuration Impact

After you run this command to enable batch VLAN termination on a sub-interface, the sub-interface can only connect to an L2VPN but cannot be used for Layer 3 forwarding.

Usage Scenario

After you run the dynamic-macvlan enable command on a port and 802.1X or MAC address authentication is completed, the VLAN attribute assigned by the RADIUS server is added to the packets sent to the CPU regardless of the port from which users access the network. In this manner, a MAC address-to-VLAN mapping is created and packets are not directed based on the PVID.

Precautions

• This command can be run only on Layer 2 ports of the device panel.

• The ports must be of the hybrid untagged type.

• The ports enabled with MAC address-based dynamic VLAN assignment support Layer 3 services only.

• If a port has an authentication profile applied, you need to unbind the authentication profile from the port before running the dynamic-macvlan enable command.

• For models that do not support dynamic VLANs, if the authorized VLANs are different from the VLANs configured on a port, service traffic on the port will fail to be forwarded.
• After a dynamic VLAN is configured, you must configure the authorization VLAN in the pre-authentication domain. Otherwise, the terminal cannot obtain the IP address of the dynamic VLAN.

Usage Scenario

When a device needs to communicate with devices at the network layer, you can create a logical interface based on a VLAN on the device, namely, a VLANIF interface. A VLANIF interface is a network layer interface and can be configured with an IP address. The device then users the VLANIF interface to communicate with devices at the network layer.

Prerequisites

The specified VLAN has been created using the vlan command before you create a VLANIF interface.

Follow-up Procedure

Run the ip address to assign an IP address to the VLANIF interface.

Precautions

If the specified VLANIF interface exists, the interface vlanif command displays the VLANIF interface view directly.

After a VLANIF interface is configured, the corresponding VLAN cannot be configured as a sub-VLAN or principal VLAN.

When a VLANIF interface is used as a management VLANIF interface where you can telnet to the device, the user VLAN ID cannot be the same as the management VLAN ID; otherwise, you will fail to telnet to the device.

Usage Scenario

After assigning an IP address to the super-VLAN by assigning the IP address to a VLANIF interface, you can specify the IP address range for users in the VLAN. In this manner, the ARP module filters out packets with IP addresses beyond the IP address range so that the number of ARP packets can be exactly controlled.

If the super VLAN is enabled with proxy ARP, the system directly sends an ARP Request packet from a user in the sub-VLAN to the destination sub-VLAN based on the IP address carried in the packet, which reduces broadcast traffic.

The ip pool command can be used to set an IP address pool for the sub-VLAN. In the IP address pool, a single IP address or a consecutive IP address segment can be configured, but inconsecutive IP address segments cannot be configured.

Prerequisites

After the preceding configuration is complete, run the aggregate-vlan command in the view of a VLAN to set the VLAN to the super-VLAN, and run the access-vlan command to set the VLANs that need IP address pools configured to be sub-VLANs of the super-VLAN.

Configuration Impact

After the ip pool command is run for a sub-VLAN, only ARP packets, including ARP request, ARP response, and proxy ARP, with the IP addresses in the IP address pool can be processed in the sub-VLAN.

Precautions

Before updating the IP address pool configured for a sub-VLAN, run the undo ip pool command to delete the existing one.

Usage Scenario

To use a network management system to manage multiple devices, create a VLANIF interface on each device and configure a management IP address for the VLANIF interface. You can then log in to a device and manage it using its management IP address. If a user-side interface is added to the VLAN, users connected to the interface can also log in to the device. This brings security risks to the device.

After a VLAN is configured as a management VLAN, no access interface can be added to the VLAN. An access interface is connected to users. The management VLAN forbids users connected to access interfaces to log in to the device, improving device performance.

Follow-up Procedure

Create a VLANIF interface corresponding to the VLAN and configure a management IP address on the VLANIF interface.

Precautions

VLAN 1 cannot be configured as an mVLAN.

You can run the display vlan command to view the management VLAN configuration. In the command output, the VLAN marked with a * is the management VLAN.

After a VLAN is configured as a management VLAN, only trunk and hybrid interfaces can be added to the VLAN.

Usage Scenario

MTU is short for maximum transmission unit. An MTU value determines the maximum number of bytes each time a sender can send. If the size of packets exceeds the MTU supported by a transit node or a receiver, the transit node or receiver fragments the packets or even discards them, aggravating the network transmission load. To avoid this problem, set the MTU value of the VLANIF interface.

Usage Scenario

All employees and customers of an enterprise can access servers on the enterprise network. The enterprise allows employees to communicate but expects to isolate customers from one another. To meet this requirement, the enterprise can add the servers to a VLAN, add employees to another VLAN, and add each customer to a different VLAN. This wastes VLAN IDs and increases workload on VLAN configuration.

The MUX VLAN function is introduced to solve this problem. The MUX VLAN function isolates Layer 2 traffic between interfaces in a VLAN. This function involves the following VLANs:

• Principal VLAN: allows member interfaces to communicate with each other and with interfaces in subordinate VLANs.
• Subordinate VLAN
  • Subordinate separate VLAN: allows member interfaces to communicate with only interfaces in the principal VLAN. An interface in a subordinate separate VLAN cannot communicate with interfaces in the same VLAN or other subordinate VLANs.
  • Subordinate group VLAN: allows member interfaces to communicate with interfaces in the same VLAN and interfaces in the principal VLAN. An interface in a subordinate group VLAN cannot communicate with interfaces in other subordinate VLANs.

According to features of the preceding VLANs, the enterprise can add the servers to the principal VLAN, add employees to a subordinate group VLAN, and add customers to a subordinate separate VLAN. Customers are then allowed to access the servers but isolated from one another. This saves VLAN IDs on the enterprise network and facilitates network management.

Prerequisites

The VLAN does not have a VLANIF interface.

Follow-up Procedure

Configure subordinate VLANs for the principal VLAN and enable the MUX VLAN function on interfaces.

Precautions

If a VLAN has been configured as a principal VLAN, it cannot be used to configure the VLANIF interface, Super VLAN, Sub VLAN.

If a VLAN has been configured as a principal VLAN, it cannot be configured as a subordinate VLAN of another principal VLAN.

If a device is configured with multiple VLANs for transmitting different services, you can name the VLANs in their corresponding VLAN views to facilitate service management. In this manner, you can check the deployed services of a VLAN by the VLAN name.

After VLANs are named, you can run the vlan vlan-name command in the system view to enter the view of a specific VLAN, and then check or modify the configuration of the VLAN.

Usage Scenario

All frames sent from a user device are untagged, and frames sent from a remote device may also be untagged. However, the device processes only tagged frames. Therefore, the device adds a tag to each untagged frame received by an interface. The default VLAN ID of the interface can be added to untagged frames so that these frames are forwarded in the default VLAN.

Prerequisites

The link-type of specified interfaces cannot be hybrid or trunk before you run the port command.

Precautions

A super VLAN cannot be configured as the default VLAN of interfaces.

The undo port command deletes the default VLAN of the specified interfaces only if the current VLAN is the default VLAN of these interfaces.

If you run the port command multiple times in the same VLAN view, the VLAN is configured as the default VLAN of all the specified interfaces.

You can also run the port default vlan command in the interface view to configure the default VLAN for an interface. The two commands have the same function.

Usage Scenario

All frames sent from a user device are untagged, and frames sent from a remote device may also be untagged. However, the device processes only tagged frames. Therefore, the device adds a tag to each untagged frame received by an interface. The default VLAN ID of the interface can be added to untagged frames so that these frames are forwarded in the default VLAN.

Prerequisites

Running the portswitch command in the VE interface view switches the VE interface from Layer 3 to Layer 2.

The VLAN to be configured as the default VLAN has been created.

The interface type is access. If not, run the port link-type command to change the interface type.

Precautions

• You can also run the port command in the VLAN view to configure the default VLAN of an interface. The two commands have the same function.
• A super VLAN cannot be configured as the default VLAN of interfaces.
• This command is invalid on a member interface of an Eth-Trunk.
• If you run the port default vlan command multiple times in the same interface view, only the latest configuration takes effect.
• This configuration will be deleted automatically if the default VLAN is deleted in system view.

Usage Scenario

An interface may receive untagged and tagged frames, but the device processes only tagged frames. Therefore, the device adds a tag to each untagged frame received by an interface. The default VLAN ID of the interface can be added to untagged frames so that these frames are forwarded in the default VLAN.

Prerequisites

The VLAN to be specified as the default VLAN has been created.

Running the portswitch command in the VE interface view switches the VE interface from Layer 3 to Layer 2.

Precautions

This command is invalid on a member interface of an Eth-Trunk.

The port hybrid pvid vlan command only specifies the default VLAN for an interface but does not add the interface to the default VLAN.

If you run the port hybrid pvid vlan command multiple times in the same interface view, only the latest configuration takes effect.

This configuration will be deleted automatically if the default VLAN is deleted in system view.

Usage Scenario

A hybrid interface can connect to either a user device or a router. This command adds a hybrid interface to VLANs in tagged mode so that the hybrid interface allows frames from the VLANs to pass.

After a hybrid interface is added to VLANs in tagged mode, the interface forwards frames without removing VLAN tags of frames.

Prerequisites

Running the portswitch command in the VE interface view switches the VE interface from Layer 3 to Layer 2.

If an interface is not a hybrid interface, run the port link-type hybrid command to change the interface type to hybrid.

Precautions

• This command is invalid on a member interface of an Eth-Trunk.
• A super VLAN cannot be specified in the command.
• If you run the port hybrid tagged vlan command multiple times in the same interface view, the interface is added to all the specified VLANs.

Usage Scenario

A hybrid interface can connect to either a user device or a router. When a hybrid interface is connected to a user device, it must be added to VLANs in untagged mode so that it sends untagged frames.

After a hybrid interface is added to VLANs in untagged mode, the interface removes VLAN tags of frames before sending frames.

Prerequisites

Running the portswitch command in the VE interface view switches the VE interface from Layer 3 to Layer 2.

If an interface is not a hybrid interface, run the port link-type hybrid command to change the interface type to hybrid.

Precautions

• This command is invalid on a member interface of an Eth-Trunk.
• A super VLAN cannot be specified in the command.
• If you run the port hybrid untagged vlan command multiple times in the same interface view, the interface is added to all the specified VLANs.

Usage Scenario

Prerequisites

The interface must work in Layer 2 mode. If the interface works in Layer 3 mode, run the portswitch command to switch to Layer 2 mode.

Before changing the interface type, restore the default VLAN configuration of the interface so that the interface belongs to only VLAN 1.

Follow-up Procedure

Add the interface to VLANs.

Precautions

This command is invalid on a member interface of an Eth-Trunk.

If you run the port link-type command multiple times in the same interface view, only the latest configuration takes effect.

Usage Scenario

The MUX VLAN function isolates Layer 2 traffic between interfaces in a VLAN. This function involves a MUX VLAN and several subordinate VLANs. Subordinate VLANs are classified into subordinate group VLANs and subordinate separate VLANs. Subordinate VLANs can communicate with the principal VLAN but cannot communicate with each other. Interfaces in a subordinate group VLAN can communicate with each other, and interfaces in a subordinate separate VLAN are isolated from each other.

The MUX VLAN function takes effect only after it is enabled on an interface.

Prerequisites

Precautions

• Disabling MAC address learning or limiting the number of learned MAC addresses on an interface affects the MUX VLAN function on the interface.

• The MUX VLAN and port security functions conflict on an interface. That is, the port-security enable and port mux-vlan enable commands cannot be used on the same interface.

Usage Scenario

A trunk interface can join multiple VLANs and connects to a network device. To allow all packets from one or multiple VLANs to pass through a trunk interface, the trunk interface must be added to the VLANs using the port trunk allow-pass vlan command.

Prerequisites

Running the portswitch command in the VE interface view switches the VE interface from Layer 3 to Layer 2.

The link-type of the interface is configured to trunk.

Precautions

The command cannot be used on a member interface of an Eth-Trunk.

If you run the port trunk allow-pass vlan command multiple times in the same interface view, the interface is added to all the specified VLANs.

Usage Scenario

An interface may receive untagged and tagged frames, but the device processes only tagged frames. Therefore, the device adds a tag to each untagged frame received by an interface. The default VLAN ID of the interface can be added to untagged frames so that these frames are forwarded in the default VLAN.

Prerequisites

Running the portswitch command in the VE interface view switches the VE interface from Layer 3 to Layer 2.

The VLAN to be specified as the default VLAN has been created.

Follow-up Procedure

Add the trunk interface to the default VLAN.

Precautions

The port trunk pvid vlan command only specifies the default VLAN of a trunk interface but does not add the trunk interface to the default VLAN. A trunk interface forwards frames with the default VLAN ID only after it is added to the default VLAN using the port trunk allow-pass vlan command.

If you run the port trunk pvid vlan command multiple times in the same interface view, only the latest configuration takes effect.

This configuration will be deleted automatically if the default VLAN is deleted in system view.

Usage Scenario

• Communication between VLANs

  The VLAN technology is widely used because it helps Layer 2 packets of different users to be separately transmitted. With the VLAN technology, a physical LAN is divided into multiple logical broadcast domains, that is, VLANs. In this manner, hosts in a VLAN can communicate with each other, but hosts in different VLANs cannot communicate at Layer 2. The Layer 3 routing technology is required for communication of hosts in different VLANs.

• Communication between a LAN and a WAN

  Most packets on a LAN have VLAN tags, but some WAN protocols such as ATM, FR, and PPP, cannot identify VLAN packets. To send a VLAN packet from LAN to WAN, the device records VLAN information in the packet, removes the VLAN tag, and forwards the packet.

Precautions

• The MTU of a sub-interface must be at least 4 bytes smaller than the MTU of its primary interface. Especially, the MTU of a QinQ sub-interface must be at least 8 bytes smaller than the MTU of its primary interface.
• Ethernet sub-interfaces of VDSL interfaces in PTM mode do not support QinQ commands.

Configuration Impact

After you run this command to enable batch VLAN termination on a sub-interface, the sub-interface can only connect to an L2VPN but cannot be used for Layer 3 forwarding.

Usage Scenario

This command is used when you need to collect new packet statistics in a VLAN. After this command is executed, the packet count in the VLAN becomes 0.

Precautions

Traffic statistics cannot be restored after they are cleared. Exercise caution when you use the command.

Usage Scenario

You can run the set vlan-range command to configure a range of VLANs that can be created on the 4GE-2S interface card. Only VLANs in the range can be created on the 4GE-2S interface card.

Precautions

• Before the set vlan-range command is used:
  • VLANs are delivered according to the sequence in which the VLANs were created on the 4GE-2S interface card. The system allows a maximum of 252 VLANs. Excess VLANs are not delivered.
  • If VLANs are created in a batch, VLANs are delivered in ascending order of VLAN ID. The system allows a maximum of 252 VLANs. Excess VLANs are not delivered.
  • If more than 252 VLANs are created, the set vlan-range command is recommended.
• After the set vlan-range command is used:
  • VLANs in a specified range are delivered to the 4GE-2S interface card. Ensure that the VLAN ID range is within 252. After the set vlan-range or undo set vlan-range command is executed, you must restart the 4GE-2S interface card to make the configuration take effect.
  • The 4GE-2S interface card must allow VLAN 1. You cannot use the set vlan-range command to set VLAN 1.
  • The VLAN ID range allowed on the 4GE-2S interface card is 1-252. Except for VLAN 1, the set vlan-range command allows a maximum of 251 VLANs.
  • After the VLAN ID range is set on the 4GE-2S interface card, interfaces on the 4GE-2S interface card allow only these VLANs in the range.

Usage Scenario

This command is used to configure a reserved VLAN ID on an interface board. The working mode of an interface on an interface board can be changed from Layer 2 mode to Layer 3 mode only after a reserved VLAN ID is configured.

Precautions

The reserved VLAN ID cannot conflict with a service VLAN ID. To modify or delete the reserved VLAN ID, ensure that all interfaces on the interface board in the corresponding slot work in Layer 2 mode.

Usage Scenario

When a VLANIF interface fails or is not needed, you can run the shutdown command on the VLANIF interface.

Precautions

A VLANIF interface is Up as long as an interface in the corresponding VLAN is Up.

After the VLANIF interface is shut down, the interface status changes to Down even if physical interfaces in the corresponding VLAN are Up.

After a VLANIF interface is shut down, none of the users that use the VLANIF interface address as the gateway address can communicate at Layer 3. In addition, the VLANIF interface address cannot be used in route calculation.

After a VLANIF interface is shut down, the dynamic ARP entry corresponding to the VLANIF interface starts aging in the ARP table. If the VLANIF interface address is in a static ARP entry, the ARP entry is not deleted.

Usage Scenario

All employees and customers of an enterprise can access servers on the enterprise network. The enterprise allows employees to communicate but expects to isolate customers from one another. To meet this requirement, the enterprise can add the servers to a VLAN, add employees to another VLAN, and add each customer to a different VLAN. This wastes VLAN IDs and increases workload on VLAN configuration.

The MUX VLAN function is introduced to solve this problem. The MUX VLAN function isolates Layer 2 traffic between interfaces in a VLAN. This function involves the following VLANs:

• Principal VLAN: allows member interfaces to communicate with each other and with interfaces in subordinate VLANs.
• Subordinate VLAN
  • Subordinate separate VLAN: allows member interfaces to communicate with only interfaces in the principal VLAN. An interface in a subordinate separate VLAN cannot communicate with interfaces in the same VLAN or other subordinate VLANs.
  • Subordinate group VLAN: allows member interfaces to communicate with interfaces in the same VLAN and interfaces in the principal VLAN. An interface in a subordinate group VLAN cannot communicate with interfaces in other subordinate VLANs.

According to features of the preceding VLANs, the enterprise can add the servers to the principal VLAN, add employees to a subordinate group VLAN, and add customers to a subordinate separate VLAN. Customers are then allowed to access the servers but isolated from one another. This saves VLAN IDs on the enterprise network and facilitates network management.

After interfaces using by employees are added to the subordinate group VLAN, employees can access servers of the enterprise and communicate with one another.

Prerequisites

The specified subordinate group VLANs have been created. The principal VLAN has been created.

The specified subordinate group VLANs are not super-VLANs and do not have any VLANIF interface.

Before configuring a VLAN as a subordinate group VLAN, run the undo subordinate group command to delete all its member interfaces.

Follow-up Procedure

Add interfaces to subordinate group VLANs and enable the MUX VLAN function on the interfaces.

Precautions

Subordinate VLANs must be different from the principal VLAN.

A VLAN cannot be configured as a subordinate group VLAN and a subordinate separate VLAN simultaneously.

If you run the subordinate group command multiple times in the same VLAN view, all the specified VLANs are configured as subordinate group VLANs.

A principal VLAN can be configured with a maximum of 32 subordinate group VLANs.

A subordinate group VLAN cannot be used to configure the VLANIF interface, Super-VLAN, Sub-VLAN.

Usage Scenario

All employees and customers of an enterprise can access servers on the enterprise network. The enterprise allows employees to communicate but expects to isolate customers from one another. To meet this requirement, the enterprise can add the servers to a VLAN, add employees to another VLAN, and add each customer to a different VLAN. This wastes VLAN IDs and increases workload on VLAN configuration.

The MUX VLAN function is introduced to solve this problem. The MUX VLAN function isolates Layer 2 traffic between interfaces in a VLAN. This function involves the following VLANs:

• Principal VLAN: allows member interfaces to communicate with each other and with interfaces in subordinate VLANs.
• Subordinate VLAN
  • Subordinate separate VLAN: allows member interfaces to communicate with only interfaces in the principal VLAN. An interface in a subordinate separate VLAN cannot communicate with interfaces in the same VLAN or other subordinate VLANs.
  • Subordinate group VLAN: allows member interfaces to communicate with interfaces in the same VLAN and interfaces in the principal VLAN. An interface in a subordinate group VLAN cannot communicate with interfaces in other subordinate VLANs.

According to features of the preceding VLANs, the enterprise can add the servers to the principal VLAN, add employees to a subordinate group VLAN, and add customers to a subordinate separate VLAN. Customers are then allowed to access the servers but isolated from one another. This saves VLAN IDs on the enterprise network and facilitates network management.

After interfaces using by customers are added to the subordinate separate VLAN, customers can neither communicate with each other nor access servers of the enterprise.

Prerequisites

The specified subordinate separate VLAN has been created. The principal VLAN has been created.

The specified subordinate group VLANs are not super-VLANs and do not have any VLANIF interface.

The specified subordinate separate VLANs do not have any VLANIF interface.

Before configuring a VLAN as a subordinate separate VLAN, run the undo subordinate separate command to delete all its member interfaces.

Follow-up Procedure

Add interfaces to the subordinate separate VLAN and enable the MUX VLAN function on the interfaces.

Precautions

Subordinate VLANs must be different from the principal VLAN.

A VLAN cannot be configured as a subordinate group VLAN and a subordinate separate VLAN simultaneously.

A principal VLAN can be configured with only one subordinate separate VLAN. Before configuring another VLAN as the subordinate separate VLAN, run the undo subordinate separate command to delete the previous one.

A subordinate separate VLAN cannot be used to configure the VLANIF interface, Super-VLAN, or Sub-VLAN.

Usage Scenario

To reduce broadcast domains and enhance security on a complex network, VLANs can be created on the network to isolate the devices that do not need to communicate each other. The vlan batch command creates multiple VLANs at one time, simplifying VLAN configuration.

Follow-up Procedure

Assign VLANs according to network requirements.

Precautions

VLAN 1 is the default VLAN, which cannot be deleted and does not need to be created.

The vlan command can be used to create a VLAN and enter the VLAN view. If a VLAN has been created, the VLAN view is displayed after this command is used. The vlan command multiple times creates multiple VLANs. If a VLAN has been created, using this command cannot be used to create the same VLAN or modify the configurations of the VLAN.

The vlan batch command can be used to create multiple VLANs in batches. If a VLAN has been created, using this command cannot be used to create the same VLAN or modify the configurations of the VLAN. The vlan batch commands multiple times creates VLANs in multiple batches.

Before deleting a VLAN, run the undo interface vlanif command to delete the corresponding VLANIF interface.

The maximum number of VLANs on different models.

Usage Scenario

By configuring 802.1p priorities for VLANs, you can ensure that packets from the VLAN with the highest priority are transmitted first when congestion occurs.

Prerequisites

The specified VLAN has been created.

Configuration Impact

This command changes the 802.1p priority of packets from the specified VLAN. When congestion occurs, packets from the VLAN with the highest priority are transmitted first.

Usage Scenario

After the name command is run to set a VLAN name, you can run the vlan vlan-name command in the system view to enter the corresponding VLAN view.

Assume that a device has multiple VLANs and each VLAN has a name. If you need to delete the VLAN that is used to transmit voice services but cannot remember the ID of the VLAN, you can run the undo vlan vlan-name command to delete the VLAN by inputting the VLAN name.

Prerequisites

Before running the vlan vlan-name command, ensure that the name command is run to set the VLAN name.

Precautions

When you run the undo vlan vlan-name command to delete a VLAN, services configured for the VLAN are deleted at the same time. The deleted services cannot be restored even if you recreate the VLAN. Therefore, exercise caution when running the undo vlan vlan-name command.

Usage Scenario

Downstream users of the Terminal access belong to different VLANs, packets from each VLAN need to be terminated.

You can run this command to enable a sub-interface to batch terminate VLAN tags and run the dot1q termination vid or qinq termination pe-vid ce-vid command to specify multiple VLANs for termination.

Precautions

• If VLANs for termination have been configured on a sub-interface, run the undo dot1q termination vid or undo qinq termination pe-vid ce-vid command to cancel the configuration.