Junos VLAN Configuration: Access, Trunk and IRB with Examples

2026年8月31日 LOG admin

Junos VLAN configuration on modern EX/QFX switches follows the Enhanced Layer 2 Software (ELS) style: you define the VLAN at the vlans hierarchy, assign interfaces with family ethernet-switching, and create Layer 3 gateways with IRB interfaces. This guide walks through a complete lab setup — two switches, two VLANs, access and trunk ports, and IRB routing — with every set command plus the verification commands that prove it works.

Junos VLAN Configuration Overview (ELS vs non-ELS)

Before a single command, know which syntax family your switch speaks, because this is the number one source of copy-paste failures. Juniper's older EX switches (Junos 12.x and earlier, and some platforms that never moved) use the non-ELS CLI, where you write set vlans VLAN10 vlan-id 10 but assign members with set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members VLAN10 and trunks with interface-mode trunk at the same level. Modern EX and QFX running Junos 13.2 and later use Enhanced Layer 2 Software (ELS), where the same commands exist under a restructured hierarchy and show ethernet-switching replaces show ethernet-switching's older cousins. The commands in this article are ELS, which is what you will find on anything currently supported.

You can identify the style in one command:

show version | match "JUNOS Software Release"
show configuration protocols | display set | match l2-learning

On ELS platforms the ethernet-switching family sits under the interface unit, and the commit process validates that every VLAN referenced by an interface actually exists at the vlans level — which is why defining the VLAN first is not just tidy, it is required.

Lab Topology and Assumptions

The reference lab used here is a vEX running Junos 23.1R1 and a vQFX running 21.3R3, cabled as a two-switch inter-switch link with hosts on both sides. VLAN 10 uses subnet 192.168.10.0/24 and VLAN 20 uses 192.168.20.0/24, each with two clients. The IRB interfaces act as the default gateways for each VLAN, and inter-VLAN routing happens on the switch itself — the same role as an SVI on Cisco or a VLAN interface on Huawei. The inter-switch link carries both VLANs as a trunk, so the configuration must be correct on both ends or one half of the topology will silently fail.

Throughout, replace <Interface> with the real port name (ge-0/0/1, xe-0/0/10, et-0/0/0 on a QFX uplink). The angle-bracket placeholders are from the original notes and map one-to-one onto real port names.

Basic VLAN Configuration

Define the VLAN

set vlans <VLAN Name> vlan-id <VLAN Number>
set vlans <VLAN Name> description <VLAN Description>

Concretely, for the lab:

set vlans VLAN10 vlan-id 10
set vlans VLAN10 description "Users - floor 1"
set vlans VLAN20 vlan-id 20
set vlans VLAN20 description "Users - floor 2"

Naming the VLAN with a meaningful string and setting the vlan-id explicitly is worth the two extra lines: the name is what you type in interface membership statements, and the ID is what gets tagged on the wire and what matches the IRB unit number later.

Configure an Access Port

set interfaces <Interface> unit 0 family ethernet-switching interface-mode access
set interfaces <Interface> unit 0 family ethernet-switching vlan members <VLAN Name or ID>

An interface with family ethernet-switching defaults to access mode if no interface-mode is set — adding it explicitly is clearer. In the lab:

set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members VLAN10
set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members VLAN20

An access port that receives a tagged frame for a VLAN it does not belong to will drop it; an access port that receives untagged traffic forwards it into its assigned VLAN. That is the behaviour you want for an edge port with a server or a PC on it.

Configure a Trunk Port

set interfaces <Interface> unit 0 family ethernet-switching interface-mode trunk
set interfaces <Interface> unit 0 family ethernet-switching vlan members [ <VLAN1> <VLAN2> ]

Trunk members can be added one at a time, as a range, or as a space-separated list in square brackets. All three forms below produce the same result:

set interfaces xe-0/0/10 unit 0 family ethernet-switching interface-mode trunk
set interfaces xe-0/0/10 unit 0 family ethernet-switching vlan members VLAN10
set interfaces xe-0/0/10 unit 0 family ethernet-switching vlan members VLAN20

# equivalent one-liners
set interfaces xe-0/0/10 unit 0 family ethernet-switching vlan members [ VLAN10 VLAN20 ]
set interfaces xe-0/0/10 unit 0 family ethernet-switching vlan members 10-20

The range form (10-20) is convenient on a lab switch but dangerous on a production trunk — it silently admits VLANs you have not thought about. Explicit lists are self-documenting and are what you want in a change review.

Native VLAN and Untagged Traffic on a Trunk

If the trunk must also carry untagged frames, name them explicitly rather than relying on a default:

set interfaces xe-0/0/10 native-vlan-id 1
set vlans VLAN1 vlan-id 1
set interfaces xe-0/0/10 unit 0 family ethernet-switching vlan members VLAN1

The native-vlan-id statement tells the port which VLAN to place untagged frames into. Write it down in your documentation, because a native VLAN mismatch between two switches is invisible to a plain show vlans on either end and shows up only as a connectivity failure for one host.

Configure the IRB (Layer 3) Interface

Create the IRB unit (making the unit number match the VLAN ID helps), then bind it to the VLAN with l3-interface:

set interfaces irb unit <Unit Number> family inet address <IP Address/Netmask>
set vlans <VLAN Name> l3-interface irb.<Unit Number>

In the lab this becomes:

set interfaces irb unit 10 family inet address 192.168.10.1/24
set vlans VLAN10 l3-interface irb.10
set interfaces irb unit 20 family inet address 192.168.20.1/24
set vlans VLAN20 l3-interface irb.20

The binding direction matters and it is easy to get backwards: the IP address lives on interfaces irb unit N, and the VLAN points at it with l3-interface irb.N. If you set the address but forget the l3-interface statement, the interface exists and shows the address but no traffic reaches the VLAN — the most common "my gateway does not ping" report in a Junos lab.

Verification Commands

show vlans brief
show ethernet-switching interface
show ethernet-switching interface <Interface>

show vlans brief confirms the VLAN exists and shows member interfaces; show ethernet-switching interface shows each logical interface's mode and VLAN membership. Add these for Layer 3 confirmation:

show interfaces irb terse
show interfaces irb.10 detail | match "Address|Flags"
show arp interface irb.10
show route table inet.0 | match 192.168.10.0

What "good" looks like:

user@ex1> show vlans brief
Name     Tag     Interfaces
VLAN10   10      ge-0/0/1.0, xe-0/0/10.0, irb.10
VLAN20   20      ge-0/0/2.0, xe-0/0/10.0, irb.20

user@ex1> show ethernet-switching interface ge-0/0/1.0
Interface name: ge-0/0/1.0
  Interface mode: access
  VLAN members: VLAN10

user@ex1> show interfaces irb terse
Interface   Admin Link Proto  Local        Remote
irb.10      up    up   inet   192.168.10.1/24
irb.20      up    up   inet   192.168.20.1/24

If irb.10 shows up/down, the VLAN has no active member ports — check that at least one access port in that VLAN is physically up before you go hunting in the routing table.

Full End-to-End Lab Configuration

Putting it together, a single paste-ready block for one switch:

# VLANs
set vlans VLAN10 vlan-id 10
set vlans VLAN10 description "Users - floor 1"
set vlans VLAN20 vlan-id 20
set vlans VLAN20 description "Users - floor 2"

# Access ports
set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members VLAN10
set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members VLAN20

# Trunk to the second switch
set interfaces xe-0/0/10 unit 0 description "Uplink to ex2"
set interfaces xe-0/0/10 unit 0 family ethernet-switching interface-mode trunk
set interfaces xe-0/0/10 unit 0 family ethernet-switching vlan members [ VLAN10 VLAN20 ]

# Layer 3 gateways
set interfaces irb unit 10 family inet address 192.168.10.1/24
set vlans VLAN10 l3-interface irb.10
set interfaces irb unit 20 family inet address 192.168.20.1/24
set vlans VLAN20 l3-interface irb.20

Then commit with a sanity check rather than blind acceptance:

commit check
commit and-quit

commit check validates the candidate configuration without applying it — it will catch a VLAN referenced by an interface but never defined, and an l3-interface pointing at an IRB unit that does not exist. Running it before commit costs one second and saves an outage.

Testing Inter-VLAN Routing

With both switches configured and the trunk up, host 192.168.10.10 on VLAN 10 should reach 192.168.20.10 on VLAN 20 through the switch's own routing engine. Test from the switch first, then from the host:

ping 192.168.20.1 count 3 source 192.168.10.1
show arp interface irb.20 | match 192.168.20.

If the switch can reach both gateways but hosts cannot reach each other, the fault is almost always one of: host default gateway still pointing at the old router, a trunk that carries only one VLAN, or an access port assigned to the wrong VLAN. Work the path in that order — port, then trunk, then gateway, then host.

Common Pitfalls

Undefined VLAN referenced by a port. On ELS this fails at commit check. If you see the error, define the VLAN first.
IRB address set but no l3-interface binding. Interface is up, VLAN gets no gateway, hosts have no path off-net.
Trunk only configured on one side. One direction of traffic works, the other does not — a classic asymmetric-looking fault that is actually a one-sided configuration error.
Native VLAN mismatch. Untagged frames land in different VLANs at each end; one host has connectivity, its neighbour does not.
Using a range on a production trunk. Admits every VLAN in the range, including ones that should never traverse that link.
Forgetting that family ethernet-switching replaces inet. A port cannot be both a Layer 2 switch port and a routed Layer 3 port; applying an inet address to a switch port fails or is ignored.

How This Maps to Other Vendors

The mental model transfers even though the syntax does not. On Cisco you would write vlan 10, interface Gi1/0/1, switchport mode access, switchport access vlan 10, and create an SVI with interface Vlan10 plus an IP address. Aruba CX uses vlan 10 and interface 1/1/1 with vlan access 10. Huawei uses vlan 10 and port link-type access. In every case there are exactly three objects — the VLAN, the port membership, and the Layer 3 gateway — and the Junos difference is only that the gateway is a separate irb interface that you then bind to the VLAN, rather than an interface that is implicitly named after the VLAN.

Lab Example

In the reference lab (a vEX running Junos 23.1R1 and a vQFX running 21.3R3), VLAN 10 uses subnet 192.168.10.0/24 and VLAN 20 uses 192.168.20.0/24, each with two clients. The IRB interfaces act as the default gateways for each VLAN, and inter-VLAN routing happens on the switch itself — the same role as an SVI on Cisco or a VLAN interface on Huawei. Two access ports per VLAN, one trunk between the switches, two IRB units, and the whole exercise is roughly forty lines of configuration on each switch. Once it is up, show vlans brief is the single command that tells you whether the topology is what you think it is.

Where to Take It Next

Once plain VLANs work, the natural extensions are link aggregation across the inter-switch link, and redundancy on the IRB gateways for multi-switch topologies.

set interfaces ae0 aggregated-ether-options lacp active
set interfaces ae0 unit 0 family ethernet-switching interface-mode trunk
set interfaces ae0 unit 0 family ethernet-switching vlan members [ VLAN10 VLAN20 ]

That is LACP with a trunk over the bundle — the same VLAN membership statements, moved onto ae0 instead of a physical port.