Example: Configure Automatic VLAN Administration Using GVRP
As a network expands and the number of clients and VLANs increases, VLAN administration becomes complex, and the task of efficiently configuring VLANs on multiple EX Series switches becomes increasingly difficult. To automate VLAN administration, you can enable GARP VLAN Registration Protocol (GVRP) on the network.
 |
Note: Only trunk interfaces can be enabled for GVRP. |
This example describes how to use GVRP to automate administration of VLAN membership changes within your network:
Requirements
This example uses the following hardware and software components:
- Two EX3200 access switches
- One EX4200 distribution switch
- JUNOS Release 9.0 or later for EX Series switches
Before you configure GVRP on the access switches and on the distribution switch, be sure you have:
- Performed the initial software configuration on the switches. See Connecting and Configuring an EX Series Switch (J-Web Procedure).
- Configured the VLANs on both the access switches and on the distribution switch. (Dynamic VLAN configuration is not supported.)
- Configured a trunk interface on all the switches.
Overview and Topology
When you are setting up your network, you should configure all VLANs on all switches, even though some switches are not actively participating in a VLAN. Then enable GVRP on the trunk interface of each switch. GVRP ensures that the VLAN membership information on the trunk interface is updated as the switch’s access interfaces become active or inactive in the configured VLANs.
You do not need to take an extra step of explicitly binding a VLAN to the trunk interface. When GVRP is enabled, the trunk interface advertises all the VLANs that are active (bound to access interfaces) on that switch. A GVRP-enabled trunk interface does not advertise VLANs that have been configured on the switch but that are not currently bound to an access interface. Thus, GVRP provides the benefit of reducing network overhead—by limiting the scope of broadcast, unknown unicast, and multicast (BUM) traffic to interested devices only.
This example shows a network with three VLANs: finance, sales, and lab.
Access Switch A has been configured to support all three VLANS and all three VLANS are active, bound to interfaces that are connected to personal computers:
- ge-0/0/1— Connects PC1 as member of finance vlan, VLAN ID 100
- ge-0/0/2— Connects PC2 as member of lab vlan, VLAN ID 200
- ge-0/0/3— Connects PC3 as member of sales vlan, VLAN ID 300
Access Switch B has also been configured to support three VLANS. However, currently only two VLANs are active, bound to interfaces that are connected to personal computers:
- ge-0/0/0— Connects PC4 as member of finance vlan, VLAN ID 100
- ge-0/0/1— Connects PC5 as member of lab vlan, VLAN ID 200
The Distribution Switch is also configured to support the three VLANs (finance, lab, sales). However, the Distribution Switch does not have any access interfaces that are connecting devices as members of these VLANs. The Distribution Switch has two trunk interfaces:
- xe-0/1/1— Connects Distribution Switch to Access Switch A.
- xe-0/1/0— Connects Distribution Switch to Access Switch B.
Figure 1 shows GVRP configured on two access switches and one distribution switch.
Figure 1: GVRP Configured on Two Access Switches and One Distribution Switch for Automatic VLAN Administration
Table 1: Components of the Network Topology
When VLAN access interfaces become active or inactive, GVRP ensures that the updated information is advertised on the trunk interface. Thus, the Distribution Switch does not forward traffic to inactive VLANs.
Configuring VLANs and GVRP on Access Switch A
To configure three VLANs on the switch, bind access interfaces for PC1, PC2, and PC3 to the VLANs (finance, lab, sales), and enable GVRP on the trunk interface of Access Switch A, perform these tasks:
CLI Quick Configuration
To quickly configure Access Switch A to support the three VLANs, bind interfaces for the three PCs to the appropriate VLANs, and enable GVRP on the trunk interface, copy the following commands and paste them into the switch terminal window of Switch A:
[edit]
set vlans finance
vlan-id 100 set vlans lab vlan-id 200 set vlans sales vlan-id 300 set interfaces ge-0/0/1 unit 0 family ethernet-switching
vlan members financeset interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members
labset interfaces ge-0/0/3
unit 0 family ethernet-switching vlan members salesset interfaces xe-0/1/1 unit 0 family ethernet-switching
port-mode trunk
set protocols gvrp interface xe-0/1/1.0
|
Note: As we recommend, default GVRP timers are used in this example. The default values associated with each GVRP timer are: 200 ms for the join-timer, 600 ms for the leave-timer, and 1000 cs (10000 ms) for the leaveall-timer. Modifying timers to inappropriate values may cause an imbalance in the operation of GVRP. Refer to IEEE 802.1D [2004] Clause 12 for more information. The timer values are displayed when you use the show gvrp command to verify that GVRP is enabled. For more information on the timers, see gvrp and its associated configuration statements. |
Step-by-Step Procedure
To configure Access Switch A to support the three VLANs, bind interfaces for the three PCs to the appropriate VLANs, and enable GVRP on the trunk interface, copy the following commands and paste them into the switch terminal window of Switch A:
- Configure the finance VLAN:
[edit]
user@Access-Switch-A# set vlans finance vlan-id 100 - Configure the lab VLAN:
[edit]
user@Access-Switch-A# set vlans lab vlan–id 200 - Configure the sales VLAN:
[edit]
user@Access-Switch-A# set vlans sales vlan–id 300 - Configure an Ethernet interface as a member of
the finance VLAN:
[edit]
user@Access-Switch-A# set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members finance - Configure an Ethernet interface as a member of
the lab VLAN:
[edit]
user@Access-Switch-A# set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members lab - Configure an Ethernet interface as a member of
the sales VLAN:
[edit]
user@Access-Switch-A# set interfaces ge-0/0/3 unit 0 family ethernet-switching vlan members sales - Configure a trunk interface:
user@Access-Switch-A# set interfaces xe-0/1/1 unit 0 family ethernet-switching port-mode trunk - Enable GVRP on the trunk interface:
[edit]
user@Access-Switch-A# set protocols gvrp interface xe-0/1/1.0
Results
Check the results of the configuration:
- interfaces {
-
- ge-0/0/0 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- ge-0/0/1 {
-
- unit 0 {
-
- family ethernet-switching {
-
- vlan {
- members finance;
- }
- }
- }
- }
-
- ge-0/0/2 {
-
- unit 0 {
-
- family ethernet-switching {
-
- vlan {
- members lab;
- }
- }
- }
- }
-
- ge-0/0/3 {
-
- unit 0 {
-
- family ethernet-switching {
-
- vlan {
- members sales;
- }
- }
- }
- }
-
- xe-0/1/1 {
-
- unit 0 {
-
- family ethernet-switching {
- port-mode trunk;
- }
- }
- }
-
- ge-0/1/2 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- ge-0/1/3 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
- }
-
- protocols {
-
- igmp-snooping {
- vlan all;
- }
-
- lldp {
- interface all;
- }
-
- lldp-med {
- interface all;
- }
-
- gvrp {
- interface xe-0/1/1.0;
- }
- rstp;
- }
-
- ethernet-switching-options {
-
- storm-control {
-
- interface all {
- level 50;
- }
- }
- }
-
- vlans {
-
- finance {
- vlan-id 100;
- }
-
- lab {
- vlan-id 200;
- }
-
- sales {
- vlan-id 300;
- }
Configuring VLANs and GVRP on Access Switch B
To configure three VLANs on the switch, bind access interfaces for PC4 and PC5 to the VLANs (finance and lab), and enable GVRP on the trunk interface of Access Switch Switch B, perform these tasks:
CLI Quick Configuration
To quickly configure Access Switch B to support the three VLANs, bind interfaces for the two PCs to the appropriate VLANs, and enable GVRP on the trunk interface, copy the following commands and paste them into the switch terminal window of Switch B:
[edit]
set vlans finance
vlan-id 100 set vlans lab vlan-id 200 set vlans sales vlan-id 300 set interfaces ge-0/0/0 unit 0 family ethernet-switching
vlan members financeset interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members
labset interfaces xe-0/1/0 unit 0 family ethernet-switching
port-mode trunk
set protocols gvrp interface xe-0/1/0.0 Step-by-Step Procedure
To configure Access Switch B to support the three VLANs, bind interfaces for the two PCs to the appropriate VLAN, and enable GVRP on the trunk interface, copy the following commands and paste them into the switch terminal window of Switch B:
- Configure the finance VLAN:
[edit]
user@Access-Switch-B# set vlans finance vlan-id 100 - Configure the lab VLAN:
[edit]
user@Access-Switch-B# set vlans lab vlan–id 200 - Configure the sales VLAN:
[edit]
user@Access-Switch-B# set vlans sales vlan–id 300 - Configure an Ethernet interface as a member of
the finance VLAN:
[edit]
user@Access-Switch-B# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members finance - Configure an Ethernet interface as a member of
the lab VLAN:
[edit]
user@Access-Switch-B# set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members lab - Configure a trunk interface:
user@Access-Switch-B# set interfaces xe-0/1/0 unit 0 family ethernet-switching port-mode trunk - Enable GVRP on the trunk interface:
[edit]
user@Access-Switch-B# set protocols gvrp xe-0/1/0.0
Note: As we recommend, default GVRP timers are used in this example. The default values associated with each GVRP timer are: 200 ms for the join-timer, 600 ms for the leave-timer, and 1000 cs (10000 ms) for the leaveall-timer. Modifying timers to inappropriate values may cause an imbalance in the operation of GVRP. Refer to IEEE 802.1D [2004] Clause 12 for more information. The timer values are displayed when you use the show gvrp command to verify that GVRP is enabled. For more information on the timers, see gvrp and its associated configuration statements.
Results
Check the results of the configuration:
- [edit]
user@Access-Switch-B #show
- interfaces {
-
- ge-0/0/0 {
-
- unit 0 {
-
- family ethernet-switching {
-
- vlan {
- members finance;
- }
- }
- }
- }
-
- ge-0/0/1 {
-
- unit 0 {
-
- family ethernet-switching {
-
- vlan {
- members lab;
- }
- }
- }
- }
-
- ge-0/0/2 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- ge-0/0/3 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- ge-0/1/0 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- xe-0/1/0 {
-
- unit 0 {
-
- family ethernet-switching {
- port-mode trunk;
- }
- }
- }
-
- ge-0/1/1 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- xe-0/1/1 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- ge-0/1/2 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- ge-0/1/3 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
- }
-
- protocols {
-
- igmp-snooping {
- vlan all;
- }
-
- lldp {
- interface all;
- }
-
- lldp-med {
- interface all;
- }
-
- gvrp {
- interface xe-0/1/0.0;
- }
- rstp;
- }
-
- ethernet-switching-options {
-
- storm-control {
-
- interface all {
- level 50;
- }
- }
- }
-
- vlans {
-
- finance {
- vlan-id 100;
- }
-
- lab {
- vlan-id 200;
- }
-
- sales {
- vlan-id 300;
- }
- }
Configuring VLANS and GVRP on the Distribution Switch
CLI Quick Configuration
To quickly configure the finance, lab, and sales VLANs on the Distribution Switch and to enable GVRP on the trunk interface of the Distribution Switch, copy the following commands and paste them into the switch terminal window of the Distribution Switch:
[edit]
set vlans finance
vlan-id 100 set vlans lab vlan-id 200 set vlans sales vlan-id 300 set interfaces xe-0/1/1 unit 0 family ethernet-switching
port-mode trunk
set interfaces
xe-0/1/0 unit 0 family ethernet-switching port-mode trunk set protocols
gvrp interface xe-0/1/1.0 set protocols gvrp interface xe-0/1/0.0 Step-by-Step Procedure
To configure the three VLANs on the Distribution Switch, to configure the trunk interfaces, and to enable GVRP on the trunk interface of the Distribution Switch:
- Configure the finance VLAN:
[edit]
user@Distribution-Switch# set vlans finance vlan–id 100 - Configure the lab VLAN:
[edit]
user@Distribution-Switch# set vlans lab vlan–id 200 - Configure the sales VLAN:
[edit]
user@Distribution-Switch# set vlans sales vlan–id 300 - Configure the trunk interface to Access Switch
A:
[edit]
user@Distribution-Switch# set interfaces xe-0/1/1 unit 0 family ethernet-switching port-mode trunk - Configure the trunk interface to Access Switch
B:
[edit]
user@Distribution-Switch# set interfaces xe-0/1/0 unit 0 family ethernet-switching port-mode trunk - Enable GVRP on the trunk interface for xe-0/1/1 :
[edit]
user@Distribution-Switch# set protocols gvrp interface xe-0/1/1.0
- Enable GVRP on the trunk interface for xe-0/1/0 :
[edit]
user@Distribution-Switch# set protocols gvrp interface xe-0/1/0.0
Results
Display the results of the configuration:
- [edit]
user@Distribution Switch-D #show
- interfaces {
-
- ge-0/0/0 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- ge-0/0/1 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- ge-0/0/2 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- ge-0/0/3 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- xe-0/1/0 {
-
- unit 0 {
-
- family ethernet-switching {
- port-mode trunk;
- }
- }
- }
-
- ge-0/1/1 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- xe-0/1/1 {
-
- unit 0 {
-
- family ethernet-switching {
- port-mode trunk;
- }
- }
- }
-
- ge-0/1/2 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
-
- ge-0/1/3 {
-
- unit 0 {
- family ethernet-switching;
- }
- }
- }
-
- protocols {
-
- igmp-snooping {
- vlan all;
- }
-
- lldp {
- interface all;
- }
-
- lldp-med {
- interface all;
- }
-
- gvrp {
- interface xe-0/1/0.0;
- interface xe-0/1/1.0;
- }
- rstp;
- }
-
- ethernet-switching-options {
-
- storm-control {
-
- interface all {
- level 50;
- }
- }
- }
-
- vlans {
-
- finance {
- vlan-id 100;
- }
-
- lab {
- vlan-id 300;
- }
-
- sales {
- vlan-id 300;
- }
- }
Verification
To confirm that the configuration is updating VLAN membership, perform these tasks:
- Verifying That GVRP Is Enabled on Access Switch A
- Verifying That GVRP Is Updating VLAN Membership on Switch A
- Verifying That GVRP Is Enabled on Access Switch B
- Verifying That GVRP Is Updating VLAN Membership on Switch B
- Verifying That GVRP Is Enabled on the Distribution Switch
- Verifying That GVRP Is Updating VLAN Membership on the Distribution Switch
Verifying That GVRP Is Enabled on Access Switch A
Purpose
Verify that GVRP is enabled on the switch.
Action
Show the GVRP configuration, using the show gvrp command:
user@Access-Switch-A> show gvrp Global GVRP configuration
GVRP status : Enabled
GVRP Timers (ms)
Join : 200
Leave : 600
LeaveAll : 10000
Interface Name Protocol Status
-------------- ---------------
xe-0/1/1.0 Enabled
Meaning
The results show that GVRP is enabled on the trunk interface of Switch A and that the default timers are used.
Verifying That GVRP Is Updating VLAN Membership on Switch A
Purpose
To verify that GVRP is updating VLAN membership, display the Ethernet switching interfaces and associated VLANs that are active on switch A:
Action
List Ethernet switching interfaces on the switch, using the show ethernet-switching interfaces command:
user@Access-Switch-A> show ethernet-switching
interfaces
Interface State VLAN members Blocking ge-0/0/1.0 up finance unblocked ge-0/0/2.0 up lab unblocked ge-0/0/3.0 up sales unblocked xe-0/1/1.0 up finance unblocked lab unblocked
Meaning
GVRP has automatically added finance and lab as VLAN members on the trunk interface, because they are being advertised by Access Switch B.
Verifying That GVRP Is Enabled on Access Switch B
Purpose
Verify that GVRP is enabled on the switch.
Action
Show the GVRP configuration:
user@Access-Switch-B> show gvrp Global GVRP configuration
GVRP status : Enabled
GVRP Timers (ms)
Join : 200
Leave : 600
LeaveAll : 10000
Interface Name Protocol Status
-------------- ---------------
xe-0/1/0.0 Enabled
Meaning
The results show that GVRP is enabled on the trunk interface of Switch B and that the default timers are used.
Verifying That GVRP Is Updating VLAN Membership on Switch B
Purpose
To verify that GVRP is updating VLAN membership, display the Ethernet switching interfaces and associated VLANs that are active on switch B:
Action
List Ethernet switching interfaces on the switch:
user@Access-Switch-B> show ethernet-switching
interfaces
Interface State VLAN members Blocking ge-0/0/0.0 up finance unblocked ge-0/0/1.0 up lab unblocked xe-0/1/1.0 up finance unblocked lab unblocked sales unblocked
Meaning
GVRP has automatically added finance, lab, and sales as VLAN members on the trunk interface because they are being advertised by Access Switch A.
Verifying That GVRP Is Enabled on the Distribution Switch
Purpose
Verify that GVRP is enabled on the switch.
Action
Show the GVRP configuration:
user@Distribution-Switch> show gvrp
Global GVRP configuration
GVRP status : Enabled
GVRP Timers (ms)
Join : 200
Leave : 600
LeaveAll : 10000
Interface Name Protocol Status
-------------- ---------------
xe-0/1/0.0 Enabled
xe-0/1/1.0 Enabled
Verifying That GVRP Is Updating VLAN Membership on the Distribution Switch
Purpose
To verify that GVRP is updating VLAN membership on the distribution switch, display the Ethernet switching interfaces and associated VLANs on the Distribution Switch:
Action
List the Ethernet switching interfaces on the switch:
user@Distribution-Switch> show ethernet-switching
interfaces
Interface State VLAN members Blocking xe-0/1/1.0 up finance unblocked lab unblocked sales unblocked xe-0/1/0.0 up finance unblocked lab unblocked
Meaning
The Distribution Switch has two trunk interfaces. Interface xe-0/1/1.0 connects the Distribution Switch to Access Switch A and is therefore updated to show that it is a member of all the VLANs that are active on Access Switch A. Any traffic for those VLANs will be passed on from the Distribution Switch to Access Switch A, through interface xe-0/1/1.0. Interface xe-0/1/0.0 connects the Distribution Switch to Access Switch B and is updated to show that it is a member of the two VLANs that are active on Access Switch B. Thus, the Distribution Switch sends traffic for finance and lab to both Access Switch A and Access Switch B. But the Distribution Switch sends traffic for sales only to Access Switch A.