Arista EOS VLAN Configuration: Step-by-Step CLI Guide

Arista EOS implements standard 802.1Q VLANs, so a Cisco-trained engineer can be productive on day one — but EOS deliberately drops DTP and VTP, which means nothing negotiates itself into existence. Trunks must be configured explicitly at both ends and VLANs never propagate from a neighbouring switch. This guide walks the full VLAN lifecycle: creating VLANs, configuring access and trunk ports, adding SVIs for inter-VLAN routing, and the verification sequence that tells you which of the three layers is broken.

Creating and managing VLANs

switch# configure terminal
switch(config)# vlan 10
switch(config-vlan-10)# name mgmt
switch(config-vlan-10)# state active
switch(config-vlan-10)# exit

Create several at once with vlan 10,20,30,40. Suspend rather than delete when you want to block traffic but keep the definition: state suspend. Unlike Cisco IOS there is no separate vlan.dat — the VLAN database lives in the running configuration and persists with write memory, so an unsaved VLAN disappears on reload.

Access ports

switch(config)# interface Ethernet1
switch(config-if-Et1)# description web-server-01
switch(config-if-Et1)# switchport mode access
switch(config-if-Et1)# switchport access vlan 20
switch(config-if-Et1)# spanning-tree portfast
switch(config-if-Et1)# no shutdown

Use ranges (interface Ethernet1-8) for bulk work. For IP phones EOS supports an auxiliary voice VLAN on the same port:

switch(config)# interface Ethernet5
switch(config-if-Et5)# switchport mode access
switch(config-if-Et5)# switchport access vlan 20
switch(config-if-Et5)# switchport voice vlan 100
switch(config-if-Et5)# spanning-tree portfast

Trunk ports

switch(config)# interface Ethernet49
switch(config-if-Et49)# description Downlink-to-sw2
switch(config-if-Et49)# switchport mode trunk
switch(config-if-Et49)# switchport trunk allowed vlan 10,20,30,40
switch(config-if-Et49)# switchport trunk native vlan 999
switch(config-if-Et49)# no shutdown

Grow and shrink the list deliberately with switchport trunk allowed vlan add 50,60 and switchport trunk allowed vlan remove 60. Always set the native VLAN to an unused ID such as 999 — leaving VLAN 1 as native on a production trunk is a VLAN-hopping exposure, and EOS will happily carry it.

VLANs on port channels

switch(config)# interface Port-Channel1
switch(config-if-Po1)# switchport mode trunk
switch(config-if-Po1)# switchport trunk allowed vlan 10,20,30,40
switch(config-if-Po1)# switchport trunk native vlan 999
switch(config)# interface Ethernet49,Ethernet50
switch(config-if-Et49,Et50)# channel-group 1 mode active
switch(config-if-Et49,Et50)# no shutdown

VLAN configuration is applied to the port-channel interface only; members carry no VLAN-specific configuration of their own. Verify the bundle with show port-channel 1.

Inter-VLAN routing with SVIs

switch(config)# ip routing
switch(config)# interface Vlan10
switch(config-if-Vl10)# ip address 10.10.10.1/24
switch(config-if-Vl10)# no shutdown
switch(config)# interface Vlan20
switch(config-if-Vl20)# ip address 10.10.20.1/24
switch(config-if-Vl20)# no shutdown

Routing happens in hardware at line rate, but an SVI only comes up when at least one port in its VLAN is up and forwarding in spanning tree — so a perfectly configured SVI on an empty VLAN stays down by design. To convert an interface into a routed port, apply no switchport and give it an address directly.

Verification cheat sheet

switch# show vlan
switch# show vlan id 20
switch# show interfaces Ethernet49 trunk
switch# show interfaces Ethernet49 status
switch# show port-channel 1
switch# show ip interface brief
switch# show ip route
switch# show lldp neighbors
switch# show interfaces Ethernet49 counters

The three-command fault isolation path: show vlan proves the VLAN exists and is active; show interfaces Ethernet49 trunk proves the VLAN is in the allowed list and shows which VLAN is native; show ip interface brief proves the SVI is up/up. A VLAN that exists but shows as "not allowed" on the trunk is the number one cause of "it works on one switch but not the other", and a down/up SVI almost always means no port in that VLAN is forwarding.

Pitfalls specific to EOS

• Setting VLANs on port-channel members instead of the Port-Channel interface.
• Forgetting ip routing — the SVIs get addresses but the switch will not route between them.
• Assuming a trunk negotiates. EOS has no DTP; if the far end is mode access, no trunk forms.
• Mixing LACP (channel-group 1 mode active) with a static mode on on the peer — the bundle silently breaks.
• Building trunks with switchport trunk allowed vlan all, which destroys the diagnostic value of the trunk command.

For a fuller run book covering SVIs and native VLAN edge cases, see Arista EOS VLAN access, trunk and SVI configuration; for the link-aggregation half of the design see EOS LACP fallback and static LAG and EOS MSTP configuration.

Q-in-Q and VLAN translation

EOS supports 802.1ad Q-in-Q where you need to carry a customer's own VLAN tags across a provider network, and VLAN translation where an outer VLAN ID must be mapped to an internal ID per port. Both are relevant when a service hand-off arrives already tagged: instead of stripping the customer tag at the edge, 802.1ad lets the outer tag become the transport VLAN and the inner tag stay intact. Configuration is per-interface and should be documented explicitly, because a Q-in-Q port silently behaves like an ordinary trunk if the outer tag is not present on the frames.

Three-step VLAN troubleshooting on EOS

switch# show vlan
switch# show interfaces Ethernet49 trunk
switch# show ip interface brief
switch# show spanning-tree interface Ethernet49
switch# show mac address-table interface Ethernet49

Work down the list rather than jumping around. A VLAN missing from show vlan is a database problem — it was never created, was suspended, or was created on the other switch only. A VLAN present but absent from show interfaces Ethernet49 trunk is an allowed-list problem; the frames are dropped in hardware with no log message at all. A VLAN allowed on the trunk but a down/up SVI in show ip interface brief means no port in that VLAN is in the spanning-tree forwarding state. MACs that are not learning on the expected interface while the VLAN and trunk are both correct points at STP blocking or a Layer 2 loop-protect action rather than at VLAN configuration.

原文链接：https://www.arista.com/en/um-eos/eos-virtual-lans-vlans