NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Forbidden VLANs
Hi all Let´s assume I configure a a trunk port this way.... --snip-- interface 1/xg26 description 'SERVER3' switchport mode trunk switchport trunk native vlan 2026 switchport trunk allowed ...
I am satisfied by doing exclude. Therefor I do not want to spend more time with a private chat. Also... I think the community deserve to know. To get help in the forum is one thing. To share info is another. The second one is not fulfilled if going into a private chat.
As I have a work around with the exclude (that I think should not be needed), I am done in this thread. But I do think netgear should consider to clarify for all as it is a securrity matter.
Tnx for your time
/Peo
I had this on an interface...
(switch0.incedo.org) #show running-config interface 1/xg28
!Current Configuration:
!
interface 1/xg28
description 'FIBER IN'
switchport mode trunk
switchport trunk native vlan 999
switchport trunk allowed vlan 21,999
no lldp transmit
no lldp receive
no lldp transmit-tlv port-desc
no lldp transmit-tlv sys-name
no lldp transmit-tlv sys-desc
no lldp transmit-tlv sys-cap
no lldp transmit-mgmt
no lldp med
exit
(switch0.incedo.org) #show interfaces switchport 1/xg28
Port: 1/xg28
VLAN Membership Mode: Trunk
Access Mode VLAN: 1 (default)
General Mode PVID: 1 (default)
General Mode Ingress Filtering: Disabled
General Mode Acceptable Frame Type: Admit all
General Mode Dynamically Added VLANs:
General Mode Untagged VLANs: 1
General Mode Tagged VLANs:
General Mode Forbidden VLANs:
Trunking Mode Native VLAN: 999
Trunking Mode Native VLAN tagging: Disable
Trunking Mode VLANs Enabled: 21,999
Protected Port: False
Looks fishy... So I added...
(switch0.incedo.org) #show running-config interface 1/xg28
!Current Configuration:
!
interface 1/xg28
description 'FIBER IN'
switchport mode trunk
switchport trunk native vlan 999
switchport trunk allowed vlan 21,999
vlan participation exclude 1
no lldp transmit
no lldp receive
no lldp transmit-tlv port-desc
no lldp transmit-tlv sys-name
no lldp transmit-tlv sys-desc
no lldp transmit-tlv sys-cap
no lldp transmit-mgmt
no lldp med
exit
(switch0.incedo.org) (Interface 1/xg28)#show interfaces switchport 1/xg28
Port: 1/xg28
VLAN Membership Mode: Trunk
Access Mode VLAN: 1 (default)
General Mode PVID: 1 (default)
General Mode Ingress Filtering: Disabled
General Mode Acceptable Frame Type: Admit all
General Mode Dynamically Added VLANs:
General Mode Untagged VLANs:
General Mode Tagged VLANs:
General Mode Forbidden VLANs: 1
Trunking Mode Native VLAN: 999
Trunking Mode Native VLAN tagging: Disable
Trunking Mode VLANs Enabled: 21,999
Protected Port: False
But you mean this os not neccessary?
/Peo
I inquired the configuration you have posted to the higher tier of NETGEAR Support and just received a feedback. According to the higher tier of NETGEAR Support, you should change the PVID on the port to match either the Native VLAN or else if you want the port in a specific VLAN, then run the show command again.
Regards,
DaneA
NETGEAR Community Team
Please explain what you mean... I must be missing something.
The Native VLAN I have is 999 to tag untagged incoming internet traffic on port 28 to be able to take it out on another switch port. TV traffic already has VLAN tag 21. So no change here as it will stop working. Everything is working well.
I only talk about it seems VLAN 1 is till allowed even though it is not configured. I think it is a design flaw to even see vlan 1 when doing "show interfaces switchport 1/xg28". This as I have actively chosen what is allowed. And vlan 1 is not a part of the allowed list.
Also.. The GUI already shows PVID is 999 on switch port 28, but CLI shows 1. This is for sure not ok with this miss match.
To exclude VLAN 1 is a solution. This is what I have done. But what I mean here is that it should not be necessary here...
I inquired again your concern to the higher tier of NETGEAR Support and just got a feedback. It was suggested that you open a chat or online support ticket with NETGEAR Support here at anytime in order to further investigate if this is a possible flaw as per you have described here in the forum thread.
Regards,
DaneANETGEAR Community Team
I am satisfied by doing exclude. Therefor I do not want to spend more time with a private chat. Also... I think the community deserve to know. To get help in the forum is one thing. To share info is another. The second one is not fulfilled if going into a private chat.
As I have a work around with the exclude (that I think should not be needed), I am done in this thread. But I do think netgear should consider to clarify for all as it is a securrity matter.
Tnx for your time
/Peo
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
