Arista EOS Trunk Ports and Inter-VLAN Routing: CLI Run Book

Most Arista EOS deployments start with the same three jobs: put end devices on access ports, carry multiple VLANs between switches on trunks, and route between those VLANs with SVIs. This run book covers the full lifecycle in the order a field engineer actually configures it, with the CLI details that differ from Cisco IOS — no vlan.dat file, explicit switchport modes and bulk VLAN creation.

Before You Start: Roles, Ports and Naming

EOS is explicit about almost everything, so spend two minutes on the plan before typing. Decide which switch is the distribution pair that will hold the SVIs, which VLAN IDs map to which function, and how the ports will be named and described. Two conventions pay for themselves within a week:

• Put the device or role in the interface description (description SERVER-01 eth0, description UPLINK-SW2-Et49) so that show interfaces status is readable at a glance.
• Keep a documented range of unused VLANs, and use one of them (commonly 999) as the native VLAN on every trunk.

Check the platform baseline before configuring: show version tells you whether the ports you are about to use are 1G, 10G or 25G, and show interfaces status shows everything currently connected, including ports that are up but undocumented.

switch# show version
switch# show interfaces status
switch# show running-config section interface

Building the VLAN Database

VLANs must exist before they can be assigned to ports. Create several in one shot and verify:

switch# configure terminal
switch(config)# vlan 10,20,30,40
switch(config-vlan-10,20,30,40)# state active
switch(config-vlan-10,20,30,40)# exit
switch(config)# vlan 10
switch(config-vlan-10)# name mgmt
switch(config)# vlan 20
switch(config-vlan-20)# name servers
switch(config)# vlan 30
switch(config-vlan-30)# name storage
switch# show vlan brief
switch# show vlan id 20

Unlike IOS, EOS stores the VLAN database in the startup configuration, not in a separate vlan.dat file, so a VLAN you create is part of show running-config and survives a copy running-config startup-config as ordinary configuration. The state active line is worth understanding: a VLAN that is configured but suspended (state suspend) does not forward traffic even if ports list it, and show vlan brief will show it in the suspended column rather than the active one.

To remove VLANs, delete them from the range and confirm that no port still refers to them — a port configured for a deleted VLAN ends up with no usable VLAN assignment:

switch(config)# no vlan 40
switch# show vlan
switch# show interfaces status

Names are cosmetic on the wire (the 802.1Q tag carries only the VLAN ID), but they are stored locally and shown in show vlan, which makes troubleshooting a native-VLAN mismatch much faster when both ends use the same naming convention. Our EOS VLAN configuration procedures article shows the access/trunk split in more detail.

Access Port Configuration

EOS interfaces default to Layer 2 but the mode must be set explicitly — there is no DTP negotiation as on IOS:

switch(config)# interface Ethernet1
switch(config-if-Et1)# description SERVER-01
switch(config-if-Et1)# switchport mode access
switch(config-if-Et1)# switchport access vlan 20
switch(config-if-Et1)# spanning-tree portfast
switch(config-if-Et1)# no shutdown
switch(config-if-Et1)# exit

Verify with show interfaces Ethernet1 switchport and show mac address-table interface Ethernet1. A few EOS-specific points that trip up people arriving from IOS:

• The interface naming in the prompt is abbreviated (Et1), but you type the full name (Ethernet1) at the CLI.
• switchport mode access is required. Without it, a port takes the mode of the configuration template or defaults to access, but the explicit line makes the intent visible in show run and protects against a later template change.
• Use switchport mode access vlan 20 to combine both lines in one command if you prefer brevity.
• spanning-tree portfast is valid but EOS also offers spanning-tree portfast auto and spanning-tree portfast edge variants; show spanning-tree interface Ethernet1 detail confirms what is actually enabled.

switch# show interfaces Ethernet1 switchport
switch# show interfaces Ethernet1 status
switch# show mac address-table interface Ethernet1
switch# show spanning-tree interface Ethernet1 detail

For voice deployments, remember that the phone's untagged traffic needs a native VLAN on the access port: switchport trunk native vlan 90 plus switchport trunk allowed vlan 90,100 and switchport mode trunk is the standard EOS pattern for an IP phone with a PC behind it. An access-mode port with switchport phone vlan is a different configuration style and is not the same thing.

Trunk Ports: Pruning, Adding and the Native VLAN

Trunks carry tagged traffic for several VLANs. EOS allows all active VLANs by default, so restrict the list explicitly — this also limits the blast radius of a misbehaving downstream switch:

switch(config)# interface Ethernet49
switch(config-if-Et49)# switchport mode trunk
switch(config-if-Et49)# switchport trunk allowed vlan 10,20,30,40
switch(config-if-Et49)# switchport trunk allowed vlan add 50,60
switch(config-if-Et49)# switchport trunk allowed vlan remove 60
switch(config-if-Et49)# switchport trunk native vlan 999
switch(config-if-Et49)# no shutdown

The allowed vlan, allowed vlan add and allowed vlan remove forms are cumulative: the first line sets the list, the second adds to it, the third removes from it. Running switchport trunk allowed vlan all resets the port to carrying every active VLAN, which is convenient in a lab and a bad idea on a shared trunk. The command is applied immediately and does not bounce the link, but a VLAN that is removed from the allowed list stops forwarding on that port instantly, which will drop any host on the far side using it.

Note the security rule from the original run book: move the native VLAN to an unused ID (here 999) and keep it identical on both trunk ends. Check membership with show interfaces trunk, which clearly marks VLANs that are allowed but not yet active in the database.

switch# show interfaces trunk
switch# show interfaces Ethernet49 trunk
switch# show vlan
switch# show interfaces Ethernet49 counters

show interfaces trunk prints one block per trunk port with four columns: the allowed VLANs, the VLANs active on the port, the VLANs in STP forwarding and the VLANs in STP blocking. A VLAN that appears as allowed but not active is either suspended, missing from the VLAN database, or not yet forwarding — the first is a database problem, the second a configuration one. Trunk groups (EOS's port-channel construct) behave the same way, and the same commands accept the Port-Channel1 name. When the two ends disagree about the native VLAN, traffic on it is silently dropped or bridged into the wrong VLAN, and show interfaces trunk plus CDP/LLDP neighbour output is the fastest way to spot it — the failure signature is covered in depth in Arista EOS VLAN troubleshooting: native VLAN and trunks. If your design needs to move traffic into a different VLAN tag without changing the far end, see VLAN translation and dot1q-tunnel on EOS.

Inter-VLAN Routing with SVIs

Once VLANs span the access and distribution switches, route between them on the distribution layer using SVIs:

switch(config)# interface vlan 10
switch(config-if-Vl10)# description mgmt-gateway
switch(config-if-Vl10)# ip address 10.0.10.1/24
switch(config-if-Vl10)# no shutdown
switch(config-if-Vl10)# exit
switch(config)# interface vlan 20
switch(config-if-Vl20)# ip address 10.0.20.1/24
switch(config-if-Vl20)# no shutdown
switch(config)# ip routing
switch# show ip interface brief
switch# ping 10.0.20.10 source 10.0.10.1

ip routing must be enabled globally for SVIs to forward between VLANs. The final ping test with a source address confirms both the SVI and the downstream host path. An SVI comes up only when at least one port in that VLAN is up and forwarding, so an SVI in down state usually means no access port is active rather than a routing problem — check show vlan id 20 for the port list and show interfaces vlan 20 for the line protocol state.

switch# show interfaces vlan 20
switch# show ip interface vlan 20
switch# show ip route
switch# show ip route vrf all
switch# trace 10.0.20.10 source 10.0.10.1

EOS uses prefix notation (ip address 10.0.10.1/24) rather than mask notation, and show ip route is the IPv4 table — a similar show ipv6 route exists if you configure addresses with the ipv6 address line. If you need a DHCP relay for clients in these VLANs, add ip helper-address <server> under the SVI. For inter-VLAN designs that also need redundancy across two switches, continue with our MLAG run book or review the full EOS CLI cheat sheet here.

Routed Ports Instead of SVIs

Not every uplink needs to be a trunk. When a link connects to a router, a firewall or a carrier hand-off, a routed port avoids an SVI entirely and gives you a clean point-to-point subnet:

switch(config)# interface Ethernet51
switch(config-if-Et51)# no switchport
switch(config-if-Et51)# ip address 192.0.2.1/30
switch(config-if-Et51)# no shutdown
switch# show interfaces Ethernet51 switchport
switch# show ip interface Ethernet51

no switchport removes the port from the VLAN domain and makes it a routed interface; show interfaces switchport then reports "Switchport: Disabled". Mixing routed ports and SVIs on the same switch is normal and supported — EOS routes between them without any extra configuration once ip routing is on. The mapping between these commands and their Cisco IOS equivalents is in Cisco IOS to Arista EOS: VLAN and interface command mapping.

Verification Checklist

Run this sequence end to end after any change, and you will catch nearly every failure before a user does:

switch# show vlan brief
switch# show vlan id 20
switch# show interfaces status
switch# show interfaces Ethernet1 switchport
switch# show interfaces trunk
switch# show spanning-tree
switch# show mac address-table vlan 20
switch# show ip interface brief
switch# show ip route
switch# ping 10.0.20.10 source 10.0.10.1
switch# show running-config interfaces Ethernet1,20,49

The last one is the most under-used: show running-config interfaces <list> prints only the interfaces you name, which is far easier to review than scrolling a thousand-line configuration. Save the result when it is clean:

switch# write memory
switch# copy running-config startup-config
switch# show running-config diff

Troubleshooting Common Failures

• A host cannot reach anything and the port shows up but no MAC is learned. Wrong access VLAN, or the VLAN does not exist. Compare show vlan id <n> with the port configuration.
• Inter-VLAN traffic black-holes. Almost always a missing ip routing or an SVI that is down because the VLAN has no active port. Check show ip interface brief for administratively down SVIs.
• Only untagged traffic passes. Native VLAN mismatch between the two ends. Move both to 999 and confirm the change in show interfaces trunk.
• A VLAN works on one trunk but not another. It is missing from the allowed list on the second trunk. Diff the two show interfaces trunk outputs.
• Traffic loops and MAC flapping after adding a switch. The new switch is bridging the untagged VLAN into a second path; check for unmanaged devices and confirm that STP is enabled on the trunks (show spanning-tree interface Ethernet49 detail).
• Configuration is right but nothing forwards. Compare show running-config with show startup-config — the classic explanation is that the change was never saved and the switch reloaded.

FAQ

Does EOS create a default VLAN 1? Yes, VLAN 1 exists by default and is the default access VLAN and native VLAN. Best practice is to stop using it for user traffic and keep it only as a management fallback.

Can an interface have both an IP address and a switchport configuration? No. Assigning ip address to a switchport is rejected; you must first issue no switchport or configure an SVI instead.

Is there a DTP equivalent in EOS? No. Ports are access or trunk because you configured them that way, which removes an entire class of negotiation problems that exists on IOS access closets.

How many VLANs can an EOS switch carry? The VLAN ID range is 1-4094 and the platform supports the full 802.1Q tag space; the practical limit is the number of SVIs and MAC addresses your platform licensing supports.

Should the SVIs live on the access switch or the distribution pair? Put gates on the distribution layer, and keep the access switches as Layer 2. That is what allows an access switch to be reloaded or replaced without changing the default gateways of the hosts behind it.

原文链接：https://infrarunbook.com/article/arista-eos-vlan-trunk-configuration-access-trunk-inter-vlan-routing