Content

| 2.4 |  | Configuring VLANs and VMPS |
| 2.4.1 |  | Configuring static VLANs |

Static VLANs are ports on a switch that are manually assigned to a VLAN by using a VLAN management application or by working directly within the switch. These ports maintain their assigned VLAN configuration until an administrator changes them. Although static VLANs require manual entry changes, they are secure, easy to configure, and straightforward to monitor. This type of VLAN works well in networks where moves are controlled and managed. It is also appropriate for networks that employ robust VLAN management software to configure the ports. Static VLANs are also a consideration if it is not desirable to assume the additional overhead required when maintaining end-station MAC addresses and custom filtering tables.

The creation of a VLAN on a switch is a very straightforward and simple task. If using a Cisco IOS -based switch, get to interface configuration mode and issue the switchport command. The switchport mode command can be used to set the interface to access, dynamic or trunk.

> Switch(config-if)#switchport mode [access | dynamic | trunk]

To statically associate an interface with a VLAN, use the following commands:

> Switch(config-if)#switchport mode access
> Switch(config-if)#switchport access vlan number

Interface FastEthernet 0/3 on the switch is being set to access mode with the switchport mode command. The port is then put into VLAN 2 with the switchport access vlan command as shown using the show running-config command. The switchport mode access command is the default mode for switch interfaces and is not shown in the running-config.

Unlike the earlier 2900XL switch, the 2950 and 3550 switches have an interface range that enables a range of interfaces to be identified for a subsequent operation. For example, several ports can be assigned to a VLAN with one switchport command.

> Switch(config)#interface range fa0/1 – 6
> Switch(config-if-range)#switchport access vlan 10

This command will assign ports 1 through 6 to vlan 10 in one command sequence.

Ports on Cisco switches usually default to the DTP mode of dynamic desirable. This means that another switch connected to this port can cause trunking to occur on this interface. It is recommended that all non-trunking switch ports be configured as access ports with the command switchport mode access. This will help prevent certain man-in-the-middle attacks from occurring within the network. There are also other reasons why it is important not to have rogue switches attaching to the network in regards to Spanning-Tree Protocol (STP). These issues are discussed in the Spanning-Tree Protocol module.