ArubaOS-CX Access vs Trunk Ports: VLAN Configuration Scenarios

ArubaOS-CX switches use a simple but easy-to-misread model: an interface is an access port when it carries a single untagged VLAN, and a trunk port when it carries multiple VLANs with a native VLAN plus an allowed list. This article reproduces the official ArubaOS-CX Layer-2 Bridging Guide scenario in which three switches isolate traffic for computers, servers and DHCP clients, with every command and the expected show output.

Access vs Trunk: The ArubaOS-CX Model

• Access interface — carries traffic for one VLAN only; untagged frames belong to the configured access VLAN (vlan access <ID>).
• Trunk interface — carries one or more VLANs; vlan trunk native <ID> sets the untagged VLAN and vlan trunk allowed <list> defines which VLANs may cross the trunk.
• Native VLAN tagging — add the tag keyword (vlan trunk native 6 tag) when the native VLAN must be sent tagged; untagged traffic is then dropped except BPDUs.

Two defaults matter more than the commands themselves. First, every interface on a factory-default ArubaOS-CX switch is an access port in VLAN 1, so nothing is a trunk until you explicitly configure one. Second, a VLAN does not have to exist in the VLAN database before you reference it on an interface — vlan access 100 creates VLAN 100 on the fly. That is convenient in a lab and dangerous in production, because a typo silently builds a brand-new broadcast domain instead of generating an error you would notice.

The fourth row is where the two vendors genuinely diverge. Cisco has no first-class way to send the native VLAN tagged on a standard trunk, so engineers reach for dot1q tunnel or a translation workaround. ArubaOS-CX treats the tagged native VLAN as a normal supported feature, and that is exactly why the reference scenario below uses it on the switch C uplink.

Why Trunk Ports Still Confuse Experienced Engineers

The keyword native does not mean “untagged and special”. It means “this VLAN is also present untagged on this link”. If you want an untagged VLAN on a trunk, you must designate it as the native VLAN; there is no separate syntax for “add VLAN 25 as untagged”. The corollary is just as important. A trunk whose native VLAN is left at the default of VLAN 1 carries VLAN 1 frames untagged across the link, mixing control-plane and stray traffic from every port still sitting in the default VLAN. Every example below therefore sets the native VLAN explicitly on both ends of the uplink.

The second source of confusion is the allowed list. On ArubaOS-CX the native VLAN is implicitly permitted on the trunk, so vlan trunk native 25 combined with vlan trunk allowed 4 still passes VLAN 25 traffic. Listing the native VLAN in the allowed list as well changes nothing functionally but makes the intent obvious during a config review, and that is what the scenario does.

The third is LACP. Creating interface lag 1 produces a static LAG. To negotiate with the far end you must add lacp mode active inside the LAG context. A static LAG paired with an LACP-configured partner results in one member forwarding and the rest sitting idle, which looks like a partial outage and sends people hunting for VLAN faults that do not exist.

Prerequisites and Scenario Topology

• Two or more ArubaOS-CX switches. The reference scenario uses the 4100i, 6000, 6100, 5420 and 6200 families, but the syntax is identical on 6300, 6400, 8325, 8360 and 8400.
• Cabling as intended: switch A to switch B for the computer and DHCP-client VLANs, switch A to switch C for the management and server VLANs, plus a server attached directly to switch A.
• SSH access and a maintenance window. Changing the native VLAN on a live uplink can black-hole management traffic if your management VLAN rides that same link untagged.
• A safety net: record show running-config, and consider enabling checkpoints with checkpoint auto so a single command restores the previous state.

The VLAN plan used throughout:

Scenario Configuration, Switch by Switch

Create the VLANs and a trunk LAG on switch A and B so VLANs 4 and 25 (tagged and untagged) reach switch B:

switch# config
switch(config)# vlan 4,25
switch(config)# interface lag 1
switch(config-lag-if)# no shutdown
switch(config-lag-if)# lacp mode active
switch(config-lag-if)# vlan trunk native 25
switch(config-lag-if)# vlan trunk allowed 4,25
switch(config-lag-if)# interface 1/1/1
switch(config-if)# no shutdown
switch(config-if)# lag 1
switch(config-if)# interface 1/1/2
switch(config-if)# no shutdown
switch(config-if)# lag 1

For switch C, VLANs 6 and 17 travel over LAG 3 with the native VLAN tagged:

switch(config)# vlan 6,17
switch(config)# interface lag 3
switch(config-lag-if)# no shutdown
switch(config-lag-if)# lacp mode active
switch(config-lag-if)# vlan trunk native 6 tag
switch(config-lag-if)# vlan trunk allowed 6,17
switch(config-lag-if)# interface 1/1/5
switch(config-if)# no shutdown
switch(config-if)# lag 3

Finally connect the server as a plain access port on switch A:

switch(config)# vlan 100
switch(config-vlan-100)# interface 1/2/32
switch(config-if)# no shutdown
switch(config-if)# vlan access 100

On a real deployment, add a description to each interface so the intent survives the next engineer:

switch(config-if)# description UPLINK-TO-SW-B-LAG1
switch(config-if)# no routing
switch(config-if)# exit
switch(config)# write memory

The no routing step is worth remembering: a freshly provisioned ArubaOS-CX interface may be a routed port, and a routed port ignores vlan access and vlan trunk entirely. If your VLAN commands appear to have no effect at all, check whether the port is in routing mode before you debug anything else.

Native VLAN Tagging: When to Use It and When Not To

Sending the native VLAN tagged is the correct move when both ends are switches you control and the link is a pure inter-switch transport. Choosing vlan trunk native 6 tag means every frame on the link, including management traffic, carries a tag. Untagged frames that arrive are discarded except spanning-tree BPDUs, so an accidental stray cable cannot inject traffic into the management VLAN.

Do not use a tagged native VLAN on links toward servers, hypervisors or appliances. Most NICs, operating systems and BMCs expect either a fully untagged access port or a fully tagged trunk where the OS terminates 802.1Q itself. A tagged native VLAN on an endpoint link is one of the fastest ways to produce a “link is up, nothing works” ticket.

Verification Commands

switch# show vlan
switch# show interface lag1
switch# show interface 1/2/32
switch# show running-config interface lag1
switch# show mac-address-table

On the LAG output check the VLAN Mode (native-untagged vs native-tagged), Native VLAN and Allowed VLAN List fields. Expect something like this on LAG 1:

switch# show interface lag1
Interface lag1 is up
 Admin state is up,  State information: LAG is up
 ...
 Aggregated-interfaces   : 1/1/1 1/1/2
 ...
 VLAN Mode               : native-untagged
 Native VLAN             : 25
 Allowed VLAN List       : 4,25

On the access port check VLAN Mode: access and Access VLAN: 100, then confirm the Rx and Tx counters are incrementing so you know traffic is really flowing rather than merely configured. A port that is up with a static counter proves configuration, not connectivity.

Finish by checking the forwarding database for a MAC address you know exists behind the remote switch. If show mac-address-table lists it as learned on the LAG, the trunk is carrying the VLAN end to end. If it is missing entirely, the VLAN is allowed on the near end but not the far end, or the native VLAN does not match.

Common Misconfigurations and How to Recognize Them

• Native VLAN mismatch. Symptom: CDP/LLDP warnings, intermittent connectivity, flood-like behaviour. Check the Native VLAN field on both ends. Cisco switches raise a native VLAN mismatch alarm against ArubaOS-CX because the default VLAN 1 is left native on one side only.
• VLAN missing from the allowed list. Symptom: one VLAN works, another is dead. The interface shows the VLAN as allowed but show vlan shows the uplink absent from that VLAN's interface list. Add it with vlan trunk allowed , — a bare vlan trunk allowed 9 replaces the whole list, which is a classic way to break a working trunk.
• Tagged native on one side only. Symptom: total loss of the native VLAN while all other VLANs keep working. The tag keyword must match on both ends.
• LAG member not configured. A physical port must be added to the LAG with lag 1 in its own interface context. A LAG with one member is up but provides no redundancy.
• Interface still in routing mode. VLAN configuration is silently ignored. Run show interface 1/1/1 and look at the Routing field, then apply no routing.
• VLAN created by typo. show vlan shows a VLAN ID nobody planned for. Remove it with no vlan after confirming no interface relies on it.

FAQ

Do I need to create the VLAN before using it on an interface? No. ArubaOS-CX creates it dynamically. Creating it up front is still best practice because it gives you a place to set a name and to spot typos during review.

What is the difference between vlan trunk native 25 and vlan trunk native 25 tag? The first sends VLAN 25 untagged and accepts untagged frames into VLAN 25. The second sends VLAN 25 tagged and drops untagged frames except BPDUs.

Can a trunk carry no tagged VLANs at all? Yes. Set only a native VLAN and the port behaves like a single-VLAN uplink. Check vlan trunk allowed none if you want to strip the default “all VLANs” behaviour deliberately.

Does vlan trunk allowed all include the native VLAN? Yes, plus every other VLAN, which is why an explicit list is preferred on uplinks. It prevents a newly created VLAN from silently riding a trunk it was never designed for.

How do I roll back a bad change? If you enabled checkpoints, use checkpoint rollback and select the previous checkpoint. Otherwise reverse the commands manually — the change is small and reversible — then reload if the switch becomes unreachable.

Related Reading on This Site

Brush up on ArubaOS-CX native VLAN tagging and the Aruba 8325 AOS-CX VLAN access/trunk CLI examples. Two follow-ups worth reading next: verifying an access/trunk build with show vlan and the access and trunk port hardening templates.

原文链接：https://arubanetworking.hpe.com/techdocs/AOS-CX/10.15/HTML/l2_bridging_4100i-6000-6100-5420-6200/Content/Chp_vlans/vla-sce.htm