ArubaOS-CX Access vs Trunk Ports: VLAN Scenario with LAGs

The cleanest way to understand ArubaOS-CX access and trunk ports is to build the small multi-switch scenario from the official HPE Layer-2 Bridging Guide and watch the verification output. The example uses VLANs to isolate computers, switches and a server, and it exercises every concept that trips engineers up: untagged native VLANs, tagged native VLANs, allowed lists and LAG membership. This article walks the entire configuration and explains what each command changes.

Scenario Design and VLAN Plan

• VLAN 25 — tagged and untagged traffic from computers on switch B (native on the A-B link).
• VLAN 4 — tagged traffic from computers on switch B.
• VLAN 6 — tagged and untagged traffic from computers on switch C (native on the A-C link, but explicitly tagged).
• VLAN 17 — tagged traffic from computers on switch C.
• VLAN 100 — server VLAN on a plain access port.

Switches A and B are connected over LAG 1; switches A and C over LAG 3.

Configuring Trunk VLANs on the A-B Link (LAG 1)

switch# config
switch(config)# vlan 4,25
switch(config)# interface lag 1
switch(config-lag-if)# no shutdown
switch(config-lag-if)# vlan trunk native 25
switch(config-lag-if)# vlan trunk allowed 4,25
switch(config-lag-if)# interface 1/1/1
switch(config-if)# no shutdown
switch(config-if)# lag 1
switch(config-if)# interface 1/2/1
switch(config-if)# no shutdown
switch(config-if)# lag 1

vlan trunk native 25 assigns the untagged native VLAN while vlan trunk allowed 4,25 defines the complete allowed list. If the native VLAN is missing from the allowed list, untagged frames on that trunk are dropped. Read our native VLAN and tagging deep dive for the underlying rules.

Tagging the Native VLAN on the A-C Link (LAG 3)

On the link to switch C the native VLAN must also be carried tagged, which is done by appending the tag keyword. Only packets tagged with the matching VLAN ID are then accepted; untagged packets are dropped except BPDUs, and egress packets are tagged.

switch(config)# vlan 6,17
switch(config)# interface lag 3
switch(config-lag-if)# no shutdown
switch(config-lag-if)# vlan trunk native 6 tag
switch(config-lag-if)# vlan trunk allowed 6,17
switch(config-lag-if)# interface 1/1/13
switch(config-if)# no shutdown
switch(config-if)# lag 3
switch(config-if)# interface 1/2/13
switch(config-if)# no shutdown
switch(config-if)# no routing
switch(config-if)# lag 3

Server Connection as an Access Port

End devices such as servers do not need VLAN awareness, so the port facing the server is a single-VLAN access port:

switch(config)# vlan 100
switch(config-vlan-100)# interface 1/2/32
switch(config-if)# no shutdown
switch(config-if)# vlan access 100
switch(config-if)# exit

Verification with show Commands

Confirm the VLAN-to-interface mapping first:

switch# show vlan

Output should list VLAN 4/25 on lag1, VLAN 6/17 on lag3 and VLAN 100 on 1/2/32. Then inspect the LAGs — the interesting fields are VLAN Mode, Native VLAN and Allowed VLAN List:

switch# show interface lag1
Aggregate-name lag1
VLAN Mode: native-untagged
Native VLAN: 25
Allowed VLAN List: 4,25
switch# show interface lag3
VLAN Mode: native-tagged
Native VLAN: 6
Allowed VLAN List: 6,17

VLAN Mode: native-tagged confirms the tag keyword took effect on lag3. Finally check a physical port and its counters with show interface 1/2/32 and show interface lag 1 statistics, watching the Rx/Tx counters increment to prove data is flowing. For the bigger picture of access versus trunk design, compare our ArubaOS-CX access vs trunk configuration guide and the port comparison article.

原文链接：https://arubanetworking.hpe.com/techdocs/AOS-CX/10.15/HTML/l2_bridging_4100i-6000-6100-5420-6200/Content/Chp_vlans/vla-sce.htm