Arista EOS VLAN, Trunk and Port-Channel Configuration Guide

Arista EOS is a Linux-based network operating system whose CLI feels familiar to Cisco engineers — but the differences matter where it counts: trunk-group VLAN pruning, session-based config with rollback, and JSON output for automation. This cheat sheet collects the EOS commands you reach for most often in daily operations — VLANs, trunks, port-channels, security features, routing and verification — as a quick reference for engineers managing Arista switches in data centers.

Why the EOS CLI Feels Different from Cisco IOS

EOS borrowed the Cisco look and feel on purpose, so an experienced IOS engineer can log in and be productive within minutes. Underneath that friendly syntax, three habits differ enough to cause real mistakes during a migration. First, EOS has no vlan database mode and no remove keyword for trunk VLAN lists: you either replace the entire list with one command or start from none and add ranges. Second, every configuration change can be staged inside a named session and committed or discarded as a single unit — much closer to the Junos commit model than to IOS's write-immediately behaviour. Third, virtually every show command can emit JSON, so automation talks to structured data instead of scraping human-readable text.

Those three differences explain most of the "the command is the same but the result is not" moments people hit when they move an access or leaf switch from IOS to EOS.

Basic Management Setup

switch> enable
switch# configure terminal
switch(config)# hostname switch-1
switch(config)# username admin privilege 15 secret <password>
switch(config)# ip domain-name network.arista.com
switch(config)# management ssh idle-timeout 5
switch(config)# no shutdown
switch(config)# management api http-commands protocol https
switch(config)# no shutdown

The last two lines enable eAPI, the HTTPS interface used by Ansible, Python scripts and any REST client. Note the distinctive EOS pattern: the feature is not enabled until the follow-up no shutdown is applied inside the same stanza. Management interfaces behave the same way, which is why a freshly cabled switch can answer ARP but refuse SSH until you explicitly bring the interface up.

VLANs, Access and Trunk Ports

switch(config)# vlan 10
switch(config-vlan-10)# name wireless
switch(config)# interface Ethernet1
switch(config-if-Et1)# switchport mode access
switch(config-if-Et1)# switchport access vlan 10
switch(config)# interface Ethernet1/1
switch(config-if-Et1/1)# switchport mode trunk
switch(config-if-Et1/1)# switchport trunk native vlan 999
switch(config-if-Et1/1)# switchport trunk allowed vlan 10-12

A useful EOS shortcut is creating VLANs straight from the interface prompt: typing switchport access vlan 20 on a port that references a non-existent VLAN 20 creates the VLAN automatically with a default name. That convenience is dangerous in a tightly controlled fabric, because a typo silently creates a new broadcast domain instead of failing. If you prefer strict behaviour, pre-create the VLAN range and rely on verification to catch any drift.

VLAN ranges save a lot of typing on a 48-port access switch:

switch(config)# vlan 10-12,20,30-32
switch(config)# interface Ethernet3-4
switch(config-if-Et3-4)# switchport mode access
switch(config-if-Et3-4)# switchport access vlan 30
switch(config-if-Et3-4)# no shutdown

Interface ranges in EOS accept comma-separated lists and hyphens — the same grammar as the VLAN command — and the entered prompt changes to a range prompt such as switch(config-if-Et3-4)# so you always know whether a command will land on one port or ten.

The EOS Way of Pruning Trunk VLANs

switch(config-if-Et1/1)# switchport trunk allowed vlan none
switch(config-if-Et1/1)# switchport trunk allowed vlan add 10-12

Note the EOS idiom for restricting VLANs: switchport trunk allowed vlan none followed by switchport trunk allowed vlan add 10-12 — EOS does not use the Cisco "allowed vlan remove" syntax. The two-step pattern matters because a single switchport trunk allowed vlan 10-12 command replaces the list, while add appends to it. Mixing the two is the most common cause of a service VLAN disappearing from a live uplink during a maintenance window: somebody meant to append VLAN 40 and instead replaced a 20-VLAN allowed list with one entry.

Best practice for uplinks is to set the allowed list explicitly to the VLANs the far side actually needs, and to document the list next to the interface description. It keeps unknown-unicast floods from leaking across the fabric when someone creates a new VLAN for a lab experiment.

Port-Channels and LACP

switch(config)# interface Ethernet 1-2
switch(config-if-Et1-2)# channel-group 1 mode active
switch(config)# interface port-channel 1
switch(config-if-Po1)# switchport mode trunk
switch(config-if-Po1)# switchport trunk allowed vlan 10-12

EOS supports mode active (LACP), mode passive and mode on (static). The port-channel interface must exist before or immediately after the members are added, and all Layer 2 attributes belong on the port-channel, never on the members — EOS rejects member-level VLAN changes once a port joins a channel group, which is a helpful guard rail compared with platforms that quietly accept conflicting configuration.

Two operational details are worth knowing by heart. First, the load-balancing hash is fixed per platform family but can be inspected; if a single elephant flow underuses a four-member bundle, the fix is usually the hash policy or the number of flows, not the bundle. Second, member link failures do not tear the port-channel down — as long as one member is up, the logical interface stays up, so a bundle that has silently degraded to one link keeps forwarding at one quarter bandwidth until monitoring catches it. Graph per-member utilisation, not just the port-channel interface.

switch# show port-channel 1 detailed
switch# show port-channel compatibility-parameters
switch# show lacp counters
switch# show lacp neighbor

LACP Fallback and Trunk Groups

Devices that boot slowly — hypervisors, storage arrays, PXE servers — often need a link up before they can speak LACP. EOS offers a fallback mode that keeps the bundle forwarding as a single individual link while LACP negotiation is pending:

switch(config)# interface Port-Channel1
switch(config-if-Po1)# port-channel lacp fallback static
switch(config-if-Po1)# port-channel lacp fallback timeout 30

Inside an MLAG domain the useful variant is port-channel lacp fallback individual, which lets a single-homed device keep forwarding on one member instead of waiting for the peer switch. Trunk groups solve a related problem — a port-channel that must keep a protected standby member for a device that cannot run LACP at all — and are verified with show trunk group.

Security and STP Enhancements

switch(config)# spanning-tree mode rapid-pvst
switch(config)# interface Ethernet1/1
switch(config-if-Et1/1)# spanning-tree portfast
switch(config-if-Et1/1)# spanning-tree bpduguard enable
switch(config)# ip dhcp snooping
switch(config)# ip dhcp snooping vlan 10
switch(config)# ip arp inspection
switch(config)# ip arp inspection vlan 10

Both DHCP snooping and dynamic ARP inspection are deny-by-default on untrusted ports, so enabling them without marking uplinks as trusted will black-hole every DHCP request on the switch. Trust the interfaces that face the real DHCP servers or the aggregation layer, and validate ARP contents to catch spoofed bindings:

switch(config)# interface Ethernet49
switch(config-if-Et49)# ip dhcp snooping trust
switch(config-if-Et49)# no ip arp inspection trust
switch(config)# ip arp inspection validate src-mac dst-mac ip

For host-facing edge ports, port security adds a second layer that survives even when the host is on a static address:

switch(config)# interface Ethernet1
switch(config-if-Et1)# switchport port-security
switch(config-if-Et1)# switchport port-security maximum 2
switch(config-if-Et1)# switchport port-security violation restrict

Routing Basics

switch(config)# ip route 172.16.1.0/24 172.16.2.1
switch(config)# ip route 0.0.0.0/0 172.33.1.2
switch(config)# interface Ethernet1
switch(config-if-Et1)# no switchport
switch(config-if-Et1)# ip address 192.168.1.1/24

IP routing is enabled by default on EOS, and prefixes are written in CIDR form with a slash rather than the IOS space-and-mask style. Turning a port into a routed interface is a single no switchport; turning it back restores the default VLAN 1 access state, so always re-apply the intended VLAN when reversing the change.

For a VLAN gateway, create the SVI and give it the address:

switch(config)# interface Vlan10
switch(config-if-Vl10)# ip address 10.10.10.1/24
switch(config-if-Vl10)# no shutdown

Session-Based Configuration and Rollback

Instead of committing every line as you type it, EOS lets you stage a whole change set and review the diff before it goes live:

switch# configure session uplink-maintenance
switch(config-s-uplink-maintenance)# interface Ethernet1/1
switch(config-s-if-Et1/1)# switchport trunk allowed vlan add 40
switch(config-s-if-Et1/1)# exit
switch# show session-config named uplink-maintenance diffs
switch# configure session uplink-maintenance
switch(config-s-uplink-maintenance)# commit
switch(config-s-uplink-maintenance)# abort

This workflow turns "I think that command did what I wanted" into "I read the diff and it matches the change ticket". Combined with show running-config diffs against a saved file, it gives you a lightweight audit trail without any external tooling.

Automation: JSON Output and eAPI

Every structured show command on EOS accepts the json keyword, which is the cleanest way to feed data into monitoring or a compliance script without regular expressions that break at the next software upgrade:

switch# show interfaces Ethernet1 json
switch# show vlan 10 json
switch# show version | json

The same data is available over HTTPS with eAPI, which accepts a list of commands and returns the results as JSON in one round trip — ideal for a daily configuration drift report across a hundred switches.

Verification and Troubleshooting

switch# show interfaces switchport
switch# show running-config | include hostname
switch# show interfaces Ethernet1 json   # structured output for automation
switch# show vlan
switch# show interfaces Ethernet1 status
switch# show lldp neighbors
switch# show mac address-table interface Ethernet1
switch# show spanning-tree interface Ethernet1

A fast triage order for an access-port problem: show interfaces status to confirm the link is up and at the expected speed, show interfaces switchport to confirm the mode and VLAN assignment, show mac address-table interface to confirm the host is being learned on the port you think it is, and show lldp neighbors to catch the classic case where the cable landed in the wrong patch panel port. If the host gets an address but cannot reach the gateway, verify the SVI state and the trunk allowed list end to end before blaming the optics.

Port-Channel and VLAN Pitfalls Checklist

• Replaced instead of appended: a bare switchport trunk allowed vlan 40 wipes the previous list. Always use add on a live uplink.
• Member-level L2 config: VLAN and trunk settings belong on Port-Channel, not on members; EOS rejects the change but a half-configured bundle is easy to misread.
• Native VLAN mismatch: both ends must agree, or untagged control traffic silently lands in the wrong broadcast domain.
• LACP mode mismatch: active against on, or passive against passive, never forms a bundle.
• Degraded bundle: a port-channel stays up with one member; alert on member count, not only on protocol state.
• Snooping without trust: enabling DHCP snooping without trusting the uplink breaks every host.

See Arista EOS CLI 模式指南 and Arista EOS MLAG 详解 for MLAG and CLI-mode deep dives on the same platform. For bundle-specific syntax see the Arista EOS port-channel and LACP configuration guide, and for edge-port hardening the PortFast and BPDU Guard setup notes.

原文链接：https://www.cisconetsolutions.com/arista-eos-configuration-cheat-sheet/