Arista EOS VLAN Configuration: Step-by-Step CLI Guide

Arista EOS switches are everywhere in data centers, and VLAN configuration is the first thing you will do on any new leaf or access switch. The good news: EOS has one of the cleanest VLAN command sets in the industry - no separate switchport mode command is needed, and configuration is instantly verified with a handful of show commands. This step-by-step guide takes you from creating a VLAN all the way to inter-VLAN routing through an SVI, with every CLI command spelled out.

Before You Start: Prerequisites and Assumptions

The examples below assume an Arista 7050X or 7280R series leaf running EOS 4.29 or later, with Ethernet1 through Ethernet48 as front-panel ports. The syntax has been stable since EOS 4.15 and is identical across the 7000, 7200, 7300 and 7500 families, so the same recipe works on production hardware and on a lab vEOS instance.

Three things are worth deciding before you type anything: the VLAN IDs and names you will use, which ports are access and which are trunks, and where Layer 3 will live. If the switch is a pure Layer 2 access switch, you do not create SVIs at all - you trunk northbound to a router, firewall or MLAG pair. If it will route, you create an SVI for every VLAN that needs a gateway on this device.

EOS keeps VLANs in the running-config rather than a separate VLAN database, so there is no commit step for VLAN creation. A VLAN exists the moment you press Enter and disappears when you remove it - which also means an unsaved change can surprise you after a reload.

How the EOS VLAN Model Differs from Cisco IOS

Engineers arriving from Cisco IOS lose time on three specific differences:

• No switchport mode command. EOS infers the port mode from what you configure. switchport access vlan 10 makes the port an access port, and switchport trunk allowed vlan 10,20 makes it a trunk. Typing switchport mode trunk returns an invalid input error.
• Interface naming. EOS uses Ethernet1, Ethernet1/1 or abbreviated ranges such as Ethernet2-3, not GigabitEthernet0/1 or NX-OS style Eth1/1.
• Persistence is manual. There is no copy run start - it is write memory, and without it a reload reverts to the last saved startup-config.

Everything else feels familiar: the SVI concept, the VLAN-to-port association model, and trunking being implied by the allowed-VLAN command. EOS does not use 802.1Q encapsulation commands either, because trunking on EOS is always dot1q. There is no switchport trunk encapsulation dot1q line to add, and adding one on the platforms that accept it only adds noise.

Step 1: Create VLANs

switch# configure terminal
switch(config)# vlan 10
switch(config-vlan-10)# name Sales
switch(config-vlan-10)# exit
switch(config)# vlan 20
switch(config-vlan-20)# name Engineering
switch(config-vlan-20)# exit

EOS creates the VLAN in the VLAN database immediately. You can also create a range: vlan 30-40.

Naming VLANs is optional but cheap, and it pays for itself the first time somebody asks what VLAN 37 was supposed to be. The name appears in show vlan output next to the ID, so a well-named switch documents itself. Keep names short and free of spaces if automation will parse the output later.

Step 2: Assign an Access Port

switch(config)# interface Ethernet1
switch(config-if-Et1)# switchport access vlan 10
switch(config-if-Et1)# exit

Unlike IOS, EOS infers the port mode from the command - switchport access vlan 10 makes Ethernet1 an access port in VLAN 10. The command switchport mode is not used on EOS.

One EOS-specific trap: a port that has never been a trunk already has the right defaults, but a port converted back from trunk to access carries leftovers such as switchport trunk allowed vlan. Clean it with default interface Ethernet1 before rebuilding, because stale trunk configuration shows up confusingly in show interfaces switchport and has a habit of blocking traffic after a firmware upgrade reorders how commands apply.

Step 3: Configure a Trunk Port

switch(config)# interface Ethernet2-3
switch(config-if-Et2-3)# switchport trunk allowed vlan 10,20,30
switch(config-if-Et2-3)# exit

This turns Ethernet2-3 into trunk ports carrying VLANs 10, 20 and 30 tagged. Check the native VLAN with switchport trunk native vlan if needed (default 1).

On EOS a trunk allows all VLANs from 1 to 4094 unless you explicitly narrow the list. That is the opposite of many engineers' intuition and the single most common source of VLAN leakage between racks. Trim every trunk you build, and remember that the allowed list is a filter rather than a membership list: the VLAN must also exist on the switch, and both ends of the link must agree on the set, or traffic silently drops at the boundary with no error counter to explain it.

Step 4: Create an SVI for Inter-VLAN Routing

To route between VLANs on the switch itself, create a VLAN interface and assign an IP:

switch(config)# interface Vlan10
switch(config-if-Vl10)# ip address 10.0.10.1/24
switch(config-if-Vl10)# exit
switch(config)# interface Vlan20
switch(config-if-Vl20)# ip address 10.0.20.1/24
switch(config-if-Vl20)# exit

Enable IP routing globally with ip routing if it is not already on (it is on by default on most EOS platforms).

An SVI comes up as soon as at least one port in that VLAN is up and forwarding. That line-protocol logic is why a freshly built SVI with no active members shows as down in show ip interface brief - it is not a fault, it is EOS telling you the VLAN has no live members. Confirm the administrative state with show interfaces Vlan10.

Step 5: Save the Configuration

switch# write memory
Copy completed successfully.

Step 6: Build a Whole VLAN Range in One Pass

Building a 20-VLAN deployment one VLAN at a time wastes a morning. EOS accepts ranges on both the VLAN and interface command lines:

switch(config)# vlan 100-120
switch(config-vlan-100-120)# name Datacenter_Rack
switch(config-vlan-100-120)# exit
switch(config)# interface Ethernet10-20
switch(config-if-Et10-20)# switchport access vlan 100
switch(config-if-Et10-20)# exit

A name applied to a range sets the same name on every member, so give distinct names individually. Ranges accept comma-separated segments too, for example vlan 100-110,130-140.

Step 7: Verify MAC Learning and Data Flow

Configuration that looks right is not the same as a VLAN that works. Walk the data plane with these checks in order - each proves a different layer is healthy:

switch# show vlan
switch# show mac address-table vlan 10
switch# show interfaces Ethernet1 counters
switch# show interfaces Ethernet2 trunk

If show mac address-table vlan 10 is empty on an access port with a live host behind it, the fault is below Layer 3: check the port state, check VLAN membership, then check the host NIC. If MACs learn but ping fails, move up to the SVI.

Verification Commands

switch# show vlan
switch# show vlan id 10
switch# show interfaces switchport
switch# show interface Ethernet1 switchport
switch# show mac address-table vlan 10
switch# show ip interface brief
switch# show ip route vrf default 10.0.20.0

show vlan lists every VLAN with its ports; show interfaces switchport shows access/trunk mode and allowed VLANs for all ports in one table.

VLAN Naming and Sizing That Survives an Outage

Pick a convention before you build the network, not after. A scheme where the VLAN ID encodes the function - 10-19 for servers, 20-29 for users, 30-39 for management, 100 or above for tenants - means an on-call engineer can guess a VLAN's role from one number at 3 a.m. Document the mapping in SVI descriptions as well, for example description "Sales SVI - 10.0.10.0/24 - VLAN 10", because show ip interface brief is the first command people run and it shows descriptions.

Reserve a contiguous block for growth instead of filling every gap. Renumbering VLANs later means touching every access port, every trunk allow-list, every SVI and every upstream router - a change window nobody wants to book.

Trunk Design: Allowed Lists, Native VLAN and Pruning

A trunk carries tagged frames for the VLANs in its allowed list, plus untagged frames in the native VLAN. On EOS the native VLAN on a trunk defaults to VLAN 1, so untagged traffic lands there whether you intended it or not. The secure default is to move the native VLAN to an unused ID:

switch(config-if-Et2-3)# switchport trunk native vlan 999
switch(config-if-Et2-3)# switchport trunk allowed vlan 10,20,30

Pruning reduces broadcast domain scope. If a rack never carries the storage VLAN, its uplink should not allow it. Smaller allowed lists mean fewer unknown-unicast floods after a table flush and a smaller blast radius when somebody mis-patches a port.

Choosing Between SVI, Routed Port and VRF

Three patterns cover almost every EOS deployment:

• SVIs on a single switch - simplest to build, but the switch becomes a single point of failure and one ARP table serves every subnet.
• Routed ports with no switchport - a point-to-point Layer 3 link to a router, firewall or spine. No trunking, no VLAN semantics, and a fast-fail BGP session instead of a shared broadcast domain.
• SVIs inside a VRF with MLAG - the data-center standard. Two leafs share a virtual MAC and virtual IP through VARP, gateways survive the loss of one leaf, and each tenant gets its own routing table.

Moving a VLAN gateway into a VRF after the fact is disruptive on most platforms, so decide tenancy partitioning before the first SVI goes live.

Spanning Tree and VLAN Considerations

EOS runs MSTP or RSTP and by default maps all VLANs into one instance alongside VLAN 1. In an MLAG fabric the peer-link is treated specially and never blocked by spanning tree, because loops are prevented by MLAG's own logic. In a plain Layer 2 topology, inspect the root election with show spanning-tree and make sure the intended core switch owns the root - a randomly elected root in an access closet is a classic cause of slow convergence after a link event.

Verify that host-facing ports run in edge mode so they do not trigger topology changes, and enable BPDU guard on user-facing access ports so a mis-cabled switch cannot become the root bridge of your network.

Troubleshooting Arista VLAN Problems

switch# show vlan
switch# show interfaces switchport
switch# show interfaces Ethernet1 status
switch# show mac address-table vlan 10
switch# show ip interface brief
switch# show spanning-tree
switch# show lldp neighbors

Work the layers in order: physical link state, VLAN membership, trunk allow-list agreement on both ends, MAC learning, then Layer 3 - SVI up, correct mask, routing enabled, upstream route present. Skipping a layer costs more time than checking it. If counters grow on one side of a link and not the other, the fault is almost always in the trunk allow list or the native VLAN mismatch.

Automating VLAN Deployment with eAPI

Once the pattern is proven by hand, the same commands travel over the Arista eAPI, which exposes the CLI through HTTPS and JSON. A minimal approach renders the commands into a list and posts them to /command-api with the enable and configure revision flags; a more structured one uses the Arista Ansible collection's eos_vlan and eos_config modules. Idempotence matters: compare the intended VLAN set against show vlan before pushing, so a re-run does not flap live access ports.

If you already template device configuration with Jinja2, keep the VLAN-to-port mapping in a data file - YAML, or a NetBox export - and let the template generate both the VLAN block and the interface block. It keeps the two halves consistent, which hand-editing never does.

Common Mistakes

• Forgetting write memory - EOS config is lost on reload otherwise.
• Using switchport mode trunk (IOS habit) - not a valid EOS command.
• Creating an SVI but forgetting ip routing globally.
• Assuming a trunk allows only the VLANs it needs - EOS allows all VLANs until you trim the list.
• Leaving the native VLAN at 1 on trunks that face untrusted segments.
• Reusing the same VLAN ID with different subnets on two switches, then chasing an intermittent ping failure.

FAQ

Do I have to create a VLAN before assigning a port to it? On EOS, switchport access vlan 10 against a non-existent VLAN creates it automatically, but the port stays inactive until the VLAN exists on both ends of the path. Create VLANs explicitly for clarity.

How many VLANs can an EOS switch hold? All platforms support the full 1-4094 range. If you approach four figures, check the hardware profile with show hardware capacity.

Can I route between VLANs without SVIs? Yes - use no switchport routed ports with one link per subnet, or hand routing to an upstream device and keep the leaf purely Layer 2.

Why is my SVI down when the VLAN exists? An SVI only comes up when at least one member port in that VLAN is up. Attach a live port, or check show interfaces Vlan10 for an administrative shutdown.

Key Takeaways

EOS VLAN configuration is four commands and a save: create the VLAN, assign access ports, trim the trunk allowed list, and build SVIs where routing belongs. The differences from IOS are small but sharp - no mode command, immediate application, mandatory write memory, and all-VLANs-allowed trunks by default. Verify each layer with the show commands above, and once the pattern is proven, push it with eAPI or Ansible rather than typing it by hand.

Related: Arista EOS VLAN, trunk and port-channel guide and Cisco VLAN and inter-VLAN routing guide. For native-VLAN and trunk faults specifically, see Arista EOS VLAN troubleshooting: native VLAN and trunks.

原文链接：https://www.arista.com/en/support/toi/eos-4-24-2f/15577-vlan-configuration