Arista EOS VLAN Configuration: Access, Trunk and SVI

Arista EOS implements IEEE 802.1Q VLANs across the 7050, 7060, 7170 and 7280 families, supporting up to 4094 VLAN IDs with the control plane decoupled from the data plane. This run book walks the full VLAN lifecycle on EOS: creating and naming VLANs, configuring access and trunk ports, voice VLANs, port-channel (LAG) memberships, and inter-VLAN routing through SVIs - with verification commands after every step.

VLAN Creation and Management

switch# configure terminal
switch(config)# vlan 10
switch(config-vlan-10)# name mgmt
switch(config-vlan-10)# state active
switch(config-vlan-10)# exit

Create multiple VLANs in one command with vlan 10,20,30,40, suspend a VLAN with state suspend, delete it with no vlan 40, and verify with show vlan, show vlan brief or show vlan id 10. Unlike Cisco IOS there is no separate vlan.dat file - the VLAN database lives in the running configuration and is persisted with write memory.

Access Port Configuration

switch(config)# interface Ethernet1
switch(config-if-Et1)# description web-server-01
switch(config-if-Et1)# switchport mode access
switch(config-if-Et1)# switchport access vlan 20
switch(config-if-Et1)# spanning-tree portfast
switch(config-if-Et1)# no shutdown

Use interface ranges (interface Ethernet1-8) to configure many access ports at once. For IP phones, EOS supports an auxiliary voice VLAN on the same port:

switch(config)# interface Ethernet5
switch(config-if-Et5)# switchport mode access
switch(config-if-Et5)# switchport access vlan 20
switch(config-if-Et5)# switchport voice vlan 100
switch(config-if-Et5)# spanning-tree portfast

Trunk Port Configuration

switch(config)# interface Ethernet49
switch(config-if-Et49)# switchport mode trunk
switch(config-if-Et49)# switchport trunk allowed vlan 10,20,30,40
switch(config-if-Et49)# switchport trunk native vlan 999
switch(config-if-Et49)# no shutdown

Add VLANs with switchport trunk allowed vlan add 50,60, remove them with switchport trunk allowed vlan remove 60, or allow everything with switchport trunk allowed vlan all. Security note: always set the native VLAN to an unused ID such as 999 - never leave VLAN 1 as native in production, since it is susceptible to VLAN hopping.

Trunk Between Two Arista Switches

! sw1 (distribution)
switch(config)# interface Ethernet49
switch(config-if-Et49)# description Downlink-to-sw2
switch(config-if-Et49)# switchport mode trunk
switch(config-if-Et49)# switchport trunk allowed vlan 10,20,30,40
switch(config-if-Et49)# switchport trunk native vlan 999
switch(config-if-Et49)# no shutdown

Apply the mirrored configuration on sw2 and verify adjacency with show lldp neighbors and show interfaces Ethernet49 trunk.

VLAN on Port-Channel (LAG) Interfaces

switch(config)# interface Port-Channel1
switch(config-if-Po1)# description LAG-to-sw2
switch(config-if-Po1)# switchport mode trunk
switch(config-if-Po1)# switchport trunk allowed vlan 10,20,30,40
switch(config-if-Po1)# switchport trunk native vlan 999
switch(config)# interface Ethernet49,Ethernet50
switch(config-if-Et49,Et50)# channel-group 1 mode active
switch(config-if-Et49,Et50)# no shutdown

VLAN configuration is applied to the port-channel interface only; members carry no VLAN-specific config. Verify with show port-channel 1.

Inter-VLAN Routing with SVIs

switch(config)# ip routing
switch(config)# interface Vlan10
switch(config-if-Vl10)# description SVI-mgmt
switch(config-if-Vl10)# ip address 10.10.10.1/24
switch(config-if-Vl10)# no shutdown
switch(config)# interface Vlan20
switch(config-if-Vl20)# ip address 10.10.20.1/24
switch(config-if-Vl20)# no shutdown

Routing between VLANs is performed in hardware at line rate. An SVI only comes up when at least one port in the VLAN is up and in STP forwarding state. Verify with show ip interface brief and show ip route.

Routed Ports

switch(config)# interface Ethernet50
switch(config-if-Et50)# no switchport
switch(config-if-Et50)# ip address 10.0.0.2/30
switch(config-if-Et50)# no shutdown

Revert with the switchport command. EOS does not support DTP or VTP - trunk mode must be configured explicitly on both ends.

VLAN Translation and 802.1Q Tunneling

Two adjacent features extend the VLAN model without touching the access-port logic. VLAN translation rewrites the tag of frames as they cross a port, letting you stitch two domains that reuse the same VLAN IDs. dot1q-tunnel (QinQ) pushes an outer customer VLAN tag so a whole customer tag space rides inside one service VLAN. Both are configured per port and both need matching configuration at the far end - when a translation looks one-directional, the far-end mapping is almost always the missing half (see Arista EOS VLAN Translation and dot1q-tunnel CLI).

switch(config-if-Et10)# switchport vlan translation 10 100
switch(config-if-Et10)# switchport mode dot1q-tunnel
switch(config-if-Et10)# switchport access vlan 300

Verification Cheat Sheet

show vlan
show vlan id 20
show interfaces Ethernet49 trunk
show interfaces Ethernet49 status
show port-channel 1
show port-channel 1 detailed
show ip interface brief
show ip route
show lldp neighbors           
show interfaces Ethernet49 counters

Work top to bottom when a circuit misbehaves: show vlan proves the VLAN exists and is active, show interfaces ... trunk proves the VLAN is allowed on the trunk and which is native, and show ip interface brief proves the SVI is up/up. A trunk that shows the VLAN as "not allowed" is the most frequent cause of "the VLAN works on one switch but not the other", and a down/up SVI almost always means no port in that VLAN is forwarding.

Common Mistakes on EOS VLANs

• Setting VLANs on port-channel members. On EOS, members must stay bare; only the Port-Channel interface carries VLAN config.
• Forgetting ip routing. Without it the SVIs get addresses but the switch will not route between them.
• Leaving VLAN 1 as native. Set every trunk to an unused native VLAN and keep it consistent on both ends.
• Assuming a trunk negotiates. EOS has no DTP - if the far end is mode access, the trunk will not form.
• Mixing LACP and static LAGs. channel-group 1 mode active uses LACP; pairing it with a static mode on on the peer silently breaks the bundle.

VLAN Pruning and Allowed-VLAN Hygiene

Every trunk should carry only the VLANs it genuinely needs. A trunk built with switchport trunk allowed vlan all is an invitation for one misconfigured access port to extend a broadcast domain into the wrong rack, and it makes show interfaces Ethernet49 trunk useless as a diagnostic because every VLAN looks allowed. Build trunks from an explicit list and grow them deliberately:

switch(config-if-Et49)# switchport trunk allowed vlan 10,20,30
switch(config-if-Et49)# switchport trunk allowed vlan add 40
switch(config-if-Et49)# switchport trunk allowed vlan remove 30
switch(config-if-Et49)# show interfaces Ethernet49 trunk

The verification output is the point: it prints which VLANs are allowed, which are active, and which is native. If a VLAN exists in the database but shows as not allowed on the trunk, frames for it are dropped in hardware with no log message - the single most common cause of "the VLAN works on one switch but not the other".

Voice VLAN in Depth

An auxiliary voice VLAN lets an IP phone and a PC share one wall port without exposing voice traffic to the PC. The phone tags its media as VLAN 100 and passes untagged PC traffic through to the access VLAN:

switch(config-if-Et5)# switchport mode access
switch(config-if-Et5)# switchport access vlan 20
switch(config-if-Et5)# switchport voice vlan 100
switch(config-if-Et5)# switchport voice vlan dot1p      ! tagging mode for the phone

Verify the phone landed on the voice VLAN with show interfaces Ethernet5 switchport. If the PC-visible VLAN equals the voice VLAN, the phone is not receiving its advertised configuration via LLDP-MED or CDP, so check the LLDP configuration before blaming the phone.

Private VLANs and Port Isolation

When tenants must not reach each other even inside the same VLAN, EOS offers private VLANs and switchport protected ports. A private VLAN splits one broadcast domain into a primary VLAN plus isolated and community secondary VLANs, so a compromised server cannot scan its neighbours:

switch(config)# vlan 200
switch(config-vlan-200)# private-vlan primary
switch(config)# vlan 201
switch(config-vlan-201)# private-vlan isolated
switch(config)# vlan 200
switch(config-vlan-200)# private-vlan association 201

Port isolation with switchport protected is the lighter-weight option: two protected ports on the same switch cannot talk to each other but can both reach the uplink. Use private VLANs when isolation must span switches, and protected ports when it is local.

MTU and Jumbo Frames on Trunks

Trunks that carry VXLAN, iSCSI or storage replication need a larger MTU end to end. On EOS the interface MTU is set per port and inherited by the SVI:

switch(config-if-Et49)# mtu 9214
switch(config-if-Vl10)# mtu 9214

A mismatch - one end 9214, the other 1500 - produces the worst kind of fault: pings and small flows work, large transfers stall, and nothing logs. Set the MTU on every hop a jumbo frame crosses, including the port-channel members' parent, and enable ip routing only after confirming the SVIs carry the intended MTU.

Spanning Tree Interaction

EOS runs MSTP by default and the VLAN/STP relationship trips people up in two places. First, an access port with a single host should carry spanning-tree portfast so it forwards immediately instead of waiting through listening and learning - without it, DHCP times out on first boot. Second, an SVI stays down until at least one port in that VLAN is up and forwarding, so an "up/up" trunk with a down SVI almost always means no access port in that VLAN has come up yet. Verify both with show spanning-tree vlan 20 and show ip interface brief.

Cisco IOS to EOS Command Mapping

The command syntax carries over almost one-for-one, but the absence of DTP and VTP means a trunk never negotiates itself into existence and a VLAN never propagates from a server. Both ends must be configured explicitly.

Deployment Checklist

• Native VLAN set to an unused ID on every trunk, consistent at both ends.
• Trunks carry an explicit allowed-VLAN list, not all.
• ip routing enabled before any SVI is expected to route.
• MTU matched on every jumbo-capable hop.
• Port-channel VLAN config applied only to the Port-Channel interface.
• Configuration committed with write memory - EOS has no separate vlan.dat.

Related articles: How to manage VLANs on Arista EOS, Arista EOS VLAN Translation and dot1q-tunnel CLI, Arista EOS DHCP Relay: ip helper-address Configuration Guide, and Port mirroring on Cisco, Huawei and Arista.

原文链接：https://infrarunbook.com/article/arista-eos-vlan-trunk-configuration-access-trunk-inter-vlan-routing