ArubaOS-CX Access vs Trunk: Verify with show vlan

ArubaOS-CX has one of the cleanest VLAN models once you internalise two facts: a port is either an access port (one untagged VLAN) or a trunk port (one native untagged VLAN plus an allowed tagged list), and all interfaces are Layer 3 routed by default - you must type no routing before any VLAN configuration is accepted. This article covers the exact syntax for each mode, then the verification commands that tell you what the switch is actually doing rather than what you intended.

Configuring the Two Modes

! access port: one untagged VLAN
switch(config)# interface 1/1/1
switch(config-if)# no routing
switch(config-if)# vlan access 10

! trunk port: native untagged VLAN + tagged allowed list
switch(config)# interface 1/1/2
switch(config-if)# no routing
switch(config-if)# vlan trunk native 1
switch(config-if)# vlan trunk allowed 10,20,30

! allow every VLAN now and in future (use with care)
switch(config-if)# vlan trunk allowed all

VLAN IDs accept single values, comma lists and ranges (2-8,10). One behaviour surprises people on the way back: removing the last VLAN from a trunk with no vlan trunk allowed does not shut the port - it reverts to trunking every VLAN defined on the switch, including ones you add later. To actually stop it, shut the interface.

Verification Commands

show vlan
show vlan summary
show vlan port 1/1/3
show running-config interface 1/1/3
show interface 1/1/3 brief
show mac-address-table
show lldp neighbor-info

show vlan port is the fastest way to see the truth: it lists every VLAN on that port with its mode (native-untagged for the access/native VLAN, trunk for tagged VLANs). If the expected VLAN shows as trunk when the server expects untagged, you have found the outage. On VSX pairs, most show commands accept a vsx-peer option so you can read the peer's view in the same session.

Common Misconfigurations

• Missing "no routing": the VLAN command is rejected on a routed port. Check show interface 1/1/1 for the routing state before debugging anything else.
• Native VLAN mismatch: the untagged traffic on one end lands in a different broadcast domain than the other. Align vlan trunk native on both ends, or move management traffic to a tagged VLAN.
• Allowed list asymmetry: a VLAN tagged on one end and absent from the allowed list on the other silently drops that traffic. Compare show vlan port on both switches.
• LAG members not consistent: every member of a LAG must have identical VLAN configuration; AOS-CX applies configuration to the LAG interface, so configure VLANs on the LAG, not the members.
• VSX LAG without the peer: verify with show vsx status that the peer link is up before troubleshooting the LAG itself.

A Five-Minute Layer 2 Health Check

1. show interface 1/1/x brief - link up, correct speed, no CRC growth.
2. show vlan port 1/1/x - correct mode per VLAN.
3. show mac-address-table interface 1/1/x - is the expected MAC learned on the expected VLAN?
4. show lldp neighbor-info 1/1/x - is the device on the other end the one you think it is?
5. show running-config interface 1/1/x - close the loop with the intended configuration.

Related reading: ArubaOS-CX access vs trunk port comparison, Native VLAN and untagged traffic on ArubaOS-CX trunks and HPE Aruba AOS-CX initial configuration guide.

原文链接：HPE Aruba Networking: Viewing VLAN configuration information (AOS-CX)