Arista EOS VLAN Configuration: Procedures and CLI Commands

Arista EOS implements standard 802.1Q VLANs with one important difference from Cisco IOS: there is no separate vlan.dat database file, because the VLAN configuration lives directly in the running configuration and is persisted with write memory. This article condenses the official Arista EOS user manual chapter on virtual LANs - the concepts, the configuration procedures, and the CLI commands engineers use every day in data center leaf and spine deployments.

VLAN Basics: Numbers, Names and State

Every VLAN has a number (1-4094), an optional name and a state. VLAN 1 exists by default; all other VLANs only exist after you configure them. A VLAN in the suspended state blocks traffic on all switch ports while keeping the VLAN definition intact - useful when you want to disable a VLAN without deleting it.

The identifier space is not entirely available to the operator. EOS reserves VLANs from 1006 upward for internal use, which is where the internal VLAN allocated to every routed port comes from, and it drives the familiar rule that data VLANs should be numbered below 1006 on a default configuration. The boundary is not fixed: once you move it with vlan internal order, higher IDs become usable as ordinary data VLANs. VLAN 1 is the default VLAN, carries untagged traffic on every port in its default state, and cannot be deleted — a VLAN that does not appear in the running configuration simply does not exist on the switch.

Creating and Naming VLANs

switch(config)# vlan 10
switch(config-vlan-10)# name servers
switch(config-vlan-10)# state active
switch(config-vlan-10)# exit
switch(config)# vlan 20-30
switch(config)# no vlan 40

Use the vlan command to create VLANs and enter VLAN configuration mode; ranges and comma-separated lists are supported. no vlan removes the VLAN statements from the running configuration.

Naming is optional but pays for itself the first time someone else reads the configuration. Because EOS keeps VLANs in the running configuration rather than a separate database, a range such as vlan 20-30 produces one statement per VLAN in show running-config; a range can be collapsed only after the fact, by specifying the range and applying the same name or state to all of its members in a single command:

switch(config)# vlan 20-30
switch(config-vlans-20-30)# name lab-access
switch(config-vlans-20-30)# state active

The prompt changes to reflect that you are editing multiple VLANs at once — proof that EOS expanded the range rather than treating it as a single odd object. Deleting a VLAN that is still in use is the classic way to break an access port, so check membership before removing anything:

switch# show vlan id 30
switch(config)# no vlan 30

VLAN State: Active Versus Suspended

The state keyword is the switch's way of disabling a VLAN without destroying its definition. Suspending a VLAN stops all forwarding in it while leaving the VLAN-to-port bindings and the SVI in place, so it can be reactivated without reconfiguring anything. The operational commands distinguish the two cases clearly:

switch(config)# vlan 30
switch(config-vlan-30)# state suspend
switch(config-vlan-30)# exit
switch# show vlan
switch# show vlan 30

On a suspended VLAN, ports remain members and the SVI remains configured, but the SVI's IP interface goes down and the MAC address table for that VLAN drains. Use it during maintenance windows and for isolating a suspect VLAN without a change that has to be rolled back by hand.

Access Ports, Trunk Ports and Native VLANs

An access port carries traffic for a single VLAN - untagged frames are associated with the access VLAN and tagged frames of other VLANs are dropped. A trunk port carries multiple VLANs using 802.1Q tags. Ports are switched ports by default:

switch(config)# interface Ethernet1
switch(config-if-Et1)# switchport mode access
switch(config-if-Et1)# switchport access vlan 10
switch(config-if-Et1)# no shutdown

switch(config)# interface Ethernet5
switch(config-if-Et5)# switchport mode trunk
switch(config-if-Et5)# switchport trunk native vlan 999
switch(config-if-Et5)# switchport trunk allowed vlan 10-12
switch(config-if-Et5)# no shutdown

Always set the native VLAN to an unused VLAN ID and restrict the allowed list to what the trunk really needs - both are standard hardening steps for inter-switch links.

The two port types can be combined in a design that surprises newcomers: a port in switchport mode access with an access VLAN of 10 will still forward a frame tagged for VLAN 10, dropping tags it does not expect. If you want a port that accepts both untagged and tagged traffic, that is a trunk with a native VLAN — not an access port.

Restricting and Editing the Allowed VLAN List

On production trunks the allowed list is not a one-time setting; VLANs get added and removed as services move. EOS supports incremental edits, which is far safer than re-typing the whole list:

switch(config-if-Et5)# switchport trunk allowed vlan add 13,20-25
switch(config-if-Et5)# switchport trunk allowed vlan remove 11
switch(config-if-Et5)# switchport trunk allowed vlan all
switch(config-if-Et5)# switchport trunk allowed vlan none
switch(config-if-Et5)# switchport trunk allowed vlan except 1,999

add and remove modify the existing list in place, which avoids the outage that follows a typo in a full replacement. Two other forms are worth knowing because they appear in hardened templates: all restores the permissive default, and except permits everything but the named VLANs — a convenient way to block a management VLAN from a user-facing trunk. Whenever the allowed list is edited, confirm the result from both sides of the link, because a mismatch is silent: the VLAN simply does not pass.

VLAN Translation and Tunnelling

Where two administrative domains agree on overlapping VLAN IDs, EOS can rewrite tags on ingress rather than renumbering the whole site. VLAN translation maps one tag to another on a trunk, and 802.1Q tunnelling (switchport mode dot1q-tunnel) pushes a customer tag inside a provider tag so it travels transparently. Both are covered in our Arista EOS VLAN translation and dot1q-tunnel guide; they belong on edge ports, not on the fabric's leaf-to-spine links.

VLAN Interfaces (SVI) and Internal VLANs

To route between VLANs, create a Switched Virtual Interface (SVI) and give it an IP address; the SVI can only activate after the VLAN exists. When a port is converted to a routed (Layer 3) port, EOS allocates an internal VLAN for it - by default allocated ascending from VLAN 1006. You can steer that pool with vlan internal order so internal VLANs never collide with your data VLAN numbering plan.

switch(config)# interface Vlan10
switch(config-if-Vl10)# ip address 10.10.10.1/24
switch(config-if-Vl10)# no shutdown

switch(config)# interface Ethernet10
switch(config-if-Et10)# no switchport
switch(config-if-Et10)# ip address 10.0.0.1/31

switch(config)# vlan internal order descending 4094
switch# show vlan internal allocation

The SVI is down as long as its VLAN has no active member port. That single rule explains why an SVI with a perfectly good IP address on it refuses to pass traffic: the VLAN exists, the interface is administratively up, but no physical port is up in that VLAN, so the SVI stays down. Check show vlan for member ports before debugging the SVI itself. The internal VLAN allocation is also visible per port, which is how you confirm that a routed link did not silently consume a VLAN ID you had reserved for a service:

switch# show vlan internal allocation
switch# show interfaces Ethernet10 switchport

Private VLANs

Private VLANs (PVLANs) subdivide a single VLAN into isolated and community segments so that hosts sharing an address range cannot talk to each other. EOS implements the standard model: a primary VLAN with secondary VLANs designated isolated (no host-to-host traffic at all) or community (hosts talk within their community only), with promiscuous ports that can reach every secondary segment. In an Arista configuration the primary VLAN is declared first and the secondary VLANs are associated with it:

switch(config)# vlan 100
switch(config-vlan-100)# private-vlan primary
switch(config-vlan-100)# private-vlan association 101-102
switch(config)# vlan 101
switch(config-vlan-101)# private-vlan isolated
switch(config)# vlan 102
switch(config-vlan-102)# private-vlan community

PVLANs are a containment tool for hosting and shared-tenancy segments, not a general-purpose VLAN feature. If the goal is simply to keep two tenants apart with independent routing, separate VLANs and SVIs are easier to operate and to document.

The Default VLAN and Unused Ports

Every port on a factory-default EOS switch is a member of VLAN 1. Leaving unused ports there is a common audit finding, because a port on the default VLAN can usually reach other default-VLAN ports on the same switch. Two habits remove the issue: place unused access ports in a dedicated parking VLAN with no SVI, and shut down ports that are not expected to be patched.

switch(config)# vlan 999
switch(config-vlan-999)# name PARKING
switch(config)# interface Ethernet20-24
switch(config-if-Et20-24)# switchport mode access
switch(config-if-Et20-24)# switchport access vlan 999
switch(config-if-Et20-24)# shutdown

Because VLAN 1 cannot be deleted, the parking VLAN approach is the practical alternative to trying to disable it. Do not use VLAN 1 as either the native VLAN on trunks or the VLAN behind an SVI: it is the one VLAN whose behaviour every other device makes assumptions about.

Verifying VLAN Configuration

switch# show vlan
switch# show vlan id 10
switch# show interfaces Ethernet1 switchport
switch# show mac address-table interface Ethernet1

In MLAG deployments the VLAN itself must be configured identically on both peers; only the port-specific bridging configuration (access VLAN, mode, allowed list, native VLAN) stays on the switch where the port physically lives.

Three more commands round out the picture when a VLAN is misbehaving, and they are the ones worth reaching for instead of guessing:

switch# show interfaces Ethernet1 trunk
switch# show vlan id 10
switch# show interfaces Vlan10

show interfaces Ethernet1 trunk lists the VLANs actually passing on that trunk, which settles an allowed-list mismatch in one shot. In an MLAG pair the same VLAN must also be present on both peers for the port-channel to forward it — a VLAN configured on one side only will show up in show vlan on that side and nowhere on the other, and the symptom is intermittent loss rather than a clean failure. When the problem is specifically an untagged frame landing in the wrong VLAN, the mismatch almost always sits on the native VLAN, and the diagnostic path is covered in our Arista EOS native VLAN and trunk troubleshooting article.

Common Pitfalls

Related Reading on This Site

See the Arista EOS VLAN access/trunk/SVI runbook for a hands-on scenario, and the Arista EOS configuration cheat sheet for a broader command reference. If the fabric extends beyond a single pair of switches, the same VLAN definition also has to be mapped into the overlay, and port-channel VLAN handling is covered in our Arista EOS port-channel and LACP configuration guide.

Operator Checklist

1. Create every VLAN with a name, and keep data VLANs below the internal allocation range.
2. Set access VLANs explicitly — never rely on the default VLAN 1 for user traffic.
3. On trunks, set a dedicated native VLAN, restrict the allowed list, and verify from both ends.
4. Park unused ports in a VLAN with no SVI and shut them down.
5. Create the SVI only after the VLAN exists, and expect it to stay down until a member port comes up.
6. Write the configuration to memory — there is no vlan.dat, so an unsaved VLAN simply evaporates at the next reload.

原文链接：https://arista.com/en/um-eos/eos-virtual-lans-vlans