Cisco VLANs, STP & EtherChannel

Cisco IOS Layer 2 cheat sheet: VLANs, VTP, SVI interfaces, Spanning Tree (STP/RSTP), EtherChannel (LACP/PAgP), and FlexLinks. Configuration and diagnostics commands.

VLANs

VLAN Configuration

Command	Description
vlan 2	Enter VLAN 2 configuration
name sales	Assign name to VLAN
switchport mode access	Set port to access mode (one VLAN, toward end user)
switchport access vlan 2	Assign access port to VLAN 2
switchport nonegotiate	Disable DTP auto-negotiation
switchport trunk encapsulation dot1q	Set encapsulation to 802.1Q (required if ISL is supported)
switchport mode trunk	Set port to trunk mode
switchport trunk allowed vlan 2,3,4,5,99	Allow only specific VLANs on trunk
switchport trunk native vlan 99	Change native VLAN to 99
vlan dot1q tag native	Tag native VLAN frames (security hardening)

VLAN Diagnostics

Command	Description
show vlan	List all VLANs and their port assignments
show vlan id 2	Details for a specific VLAN
show int fasteth 0/1 switchport	VLAN info for a specific port
show int trunk	Trunk ports and allowed VLANs

VTP (VLAN Trunking Protocol)

VTP Configuration

Command	Description
vtp mode transparent	Disable VTP VLAN sync; store VLAN DB in config file
vtp mode server	Full VTP server mode (can create/modify/delete VLANs)
vtp mode client	Client mode — cannot modify VLANs from CLI
vtp mode off	VTP v3: completely disabled, does not forward announcements
vtp version 2	Select VTP version
vtp domain darkmaycal	Set VTP domain name
vtp password 123 [hidden\|secret]	Set VTP password
vtp primary-server	Designate as primary VTP server (v3)
show vtp status	Show VTP status and revision number
show vtp password	Show VTP domain password

SVI — Virtual Layer 3 Interfaces

Configuration is done on the switch. Enables inter-VLAN routing on L3 switches.

SVI Setup

Command	Description
ip routing	Enable routing engine on the switch
int vlan 2	Create SVI for VLAN 2
ip address 192.168.2.50 255.255.255.0	Assign IP to SVI
no shutdown	Bring up the SVI

STP / RSTP — Spanning Tree Protocol

STP Configuration

Command	Description
spanning-tree mode rapid-pvst	Switch to Rapid PVST+ (recommended)
spanning-tree vlan 1 root primary	Become root bridge for VLAN 1
spanning-tree vlan 1 root secondary	Become backup root bridge
spanning-tree vlan 1 priority 110	Set bridge priority for VLAN 1 (lower = more preferred root)
spanning-tree vlan 1 forward-time 12	Set forwarding delay (convergence time)
spanning-tree pathcost method long	Use 32-bit path cost (802.1t): cost = 20 000 000 000 / speed Kbps
spanning-tree vlan 1 cost 5	Set interface cost for STP
spanning-tree vlan 1 port-priority 50	Set port priority (affects designated port election)

STP Security Features

Command	Description
spanning-tree portfast	Skip listening/learning states (for end-host ports only)
spanning-tree portfast default	Enable PortFast on all access ports globally
spanning-tree bpduguard enable	Shut port if a BPDU is received (protects against rogue switches)
spanning-tree portfast bpdufilter default	Enable BPDU filter on all PortFast ports globally
spanning-tree bpdufilter enable	Stop sending and receiving BPDUs on interface
spanning-tree guard loop	Enable Loop Guard on interface (or use spanning-tree loopguard default)
spanning-tree guard root	Protect against unauthorized root bridge on interface
spanning-tree link-type point-to-point	Set link type for Rapid PVST+ fast convergence
spanning-tree backbonefast	Enable BackboneFast (PVST+ only)
spanning-tree uplinkfast	Enable UplinkFast for fast uplink failover (PVST+ only)
udld enable	Enable UDLD globally (fiber interfaces only)
udld port enable	Force-enable UDLD on copper interface
udld reset	Restore interfaces blocked by UDLD

STP Diagnostics

Command	Description
show spanning-tree summary	All enabled STP features (bpduguard, loopguard, etc.)
show spanning-tree [vlan 1]	STP info per VLAN (root, port roles, costs)
show spanning-tree int fa0/1 portfast	Check if PortFast is active on a port
show udld	UDLD status
debug spanning-tree events	Real-time STP event output

EtherChannel

L2 EtherChannel (LACP)

Command	Description
int range fa0/1-2	Enter range configuration for fa0/1–fa0/2
switchport mode trunk	Set ports to trunk mode
switchport nonegotiate	Disable DTP
switchport trunk allowed vlan 1,2,...	Specify allowed VLANs on the trunk
channel-group 1 mode active	Add ports to EtherChannel group 1 with LACP (active)
channel-group 1 mode auto	PAgP passive mode
channel-group 1 mode on	Static EtherChannel (no negotiation protocol)
port-channel load-balance dst-ip	Load balance by destination IP

L3 EtherChannel on Switch

Command	Description
int port-channel 1	Create port-channel interface manually
no switchport	Put port-channel in routed mode
ip address 10.0.1.1 255.255.255.0	Assign IP to port-channel
int range fa0/1, fa0/2	Select physical ports
no switchport	Set physical ports to routed mode
channel-group 1 mode active	Add physical ports to EtherChannel (LACP)

EtherChannel Diagnostics

Command	Description
show etherchannel summary	EtherChannel status and port flags
show etherchannel port-channel	Detailed EtherChannel info
show etherchannel load-balance	Current load-balancing method
show int port-channel 1	Port-channel interface status (not available in PacketTracer)

L3 EtherChannel on routers: static aggregation only (no LACP/PAgP); max 2 port-channels; max 4 ports per bundle; source+destination IP load balancing (not changeable).

STP Reference Tables

STP Versions Comparison

Version	Standard	Resources	Convergence	Per-VLAN
CST	802.1D	Low	Slow	No
PVST+	Cisco	High	Slow	Yes
RSTP	802.1W	Medium	Fast	No
Rapid PVST+	Cisco	Very high	Fast	Yes
MSTP	802.1S	Medium–high	Fast	Yes

STP Port States

State	Recv BPDU	Send BPDU	Learn MAC	Forward data	Duration
Blocking	✓	✗	✗	✗	Until loop detected
Listening	✓	✓	✗	✗	Forward Delay (15 s)
Learning	✓	✓	✓	✗	Forward Delay (15 s)
Forwarding	✓	✓	✓	✓	Until loop detected
Disabled	✗	✗	✗	✗	Admin down

STP / RSTP Path Cost by Speed

Speed	STP cost (802.1D short)	RSTP cost (802.1W long)
10 Mbps	100	2 000 000
100 Mbps	19	200 000
1 Gbps	4	20 000
2 Gbps	3	10 000
10 Gbps	2	2 000
100 Gbps	—	200

Loop Guard vs UDLD

Protection	Loop Guard	UDLD
STP software-level failure	✓	✗
Incorrect initial cabling	✗	✓
Unidirectional link	✓ (if on all alternate ports)	✓ (if on all ports)

Recommended: enable both Loop Guard and UDLD together.

DTP — Dynamic Trunking Protocol

DTP Negotiation Matrix

Local \ Remote	Dynamic auto	Dynamic desirable	Trunk	Access
Dynamic auto	Access	Trunk	Trunk	Access
Dynamic desirable	Trunk	Trunk	Trunk	Access
Trunk	Trunk	Trunk	Trunk	⚠️ misconfig
Access	Access	Access	⚠️ misconfig	Access

Default mode on Cisco switches: dynamic auto. Best practice: set mode manually (trunk / access) and disable DTP with switchport nonegotiate.

EtherChannel Reference Tables

LACP / PAgP Negotiation Modes

Protocol	Mode A \ Mode B	Active / Desirable	Passive / Auto	On
LACP	Active	✓ Trunk formed	✓ Trunk formed	—
LACP	Passive	✓ Trunk formed	✗ No trunk	—
PAgP	Desirable	✓ Trunk formed	✓ Trunk formed	—
PAgP	Auto	✓ Trunk formed	✗ No trunk	—
Static	On	—	—	✓ Trunk formed

EtherChannel Load Balancing Methods

Method	Hash based on	Supported platforms
src-ip	Source IP address	All switches
dst-ip	Destination IP address	All switches
src-dst-ip	Source + destination IP	All switches
src-mac	Source MAC address	All switches
dst-mac	Destination MAC address	All switches
src-dst-mac	Source + destination MAC	All switches
src-port	Source TCP/UDP port	Catalyst 4500, 6500
dst-port	Destination TCP/UDP port	Catalyst 4500, 6500
src-dst-port	Source + destination port	Catalyst 4500, 6500

FlexLinks

Simple active/standby failover — alternative to STP for access layer.

FlexLinks Configuration

Command	Description
int fa0/1	Enter primary interface
switchport backup interface fa0/2	Set fa0/2 as standby for fa0/1 (activates when fa0/1 goes down)
show interface switchport backup	Show FlexLinks pairs and their status

Cisco IOS Command Reference | VLANs, STP, EtherChannel