2724 Cannot TAG a port to VLAN 1

Question

I'm trying to connect the switch to a cisco 2950 as a trunk port. But our Cisco switches management IPs are on VLAN1, so I wanted to put an IP from VLAN1 to this switch.

Problem is that if I set the trunk port on the 2724 to Admit TAG Only, I cannot get to the switch remotedly. The trunk port does not allow me to change the U to T for VLAN1.

The cisco trunk port is configured as an 802.1Q Trunk port.
I have these settings for Port 24:

PVID - 1
VLAN 1 - U
VLAN 10 - T
VLAN 20 - T
Admit TAG Only
Ingress Filtering Enable or Disable (makes no difference)

Switching to Admit ALL, works (again Ingress Filtering makes no difference either).

Also, why it makes no difference on the Ingress filtering enable or disable ?

TIA.

su_A_ve · Answer

Thanks..

From experimenting, it seems that:

a) I have to set the trunk port to PVID 1
b) I have to set the trunk port to Admit ALL

The trunk port, it's marked as U for VLAN 1, T for all other VLANS accepted. I cannot change it to T, nor remove it. Bug ? Feature ?

Dumb decision to set the management VLAN to 1... But it wasn't me, nor anyone under me...

DELL-Cuong N. · Answer

Ingress filtering is used to indicate whether the switch should accept traffic for VLAN to which the port is not a member. If filtering is on, the port will not accept traffic for VLANs to which it is not a member.

So in this case the port is a member of 10, 20 and 1. If you were to send traffic for VLAN 30 for example it would not be allowed through if you set ingress filtering on.

If you do want management traffic (VLAN 1) through then you might try this:

Leave PVID on trunk port = 1.
Setup "Frame Type" to admit all because management traffic will need to be accepted and will be tagged as VLAN=1. Note that this means any untagged traffic through the trunk port will be dumped to VLAN=1 on the 27xx.
I don't think you need to add this port to VLAN=1 explicitly. Any untagged traffic going into the port will be tagged as 1. You will need to add this port to VLAN=1 only if you know for sure management traffic are always carried on VLAN=1 in the rest of your network.
Make sure the Cisco switch is configured equivalently.

I believe this will work but experiment is the best way to confirm.

Cuong.

DELL-Cuong N. · Answer

VLAN=1 is a special VLAN designated for management. It is always VLAN=1 and you can't change it in the switch. Not a bug, just the way it works. VLAN=1 is just different from all other VLAN and its operation is different. Also another VLAN=4095 is also different. The VLAN=4095 is call the discard VLAN and if you set PVID=4095 then all untagged traffic will be discarded for example. These two VLANs are always reserved for these functions and this is standard behavior.

Cuong.

bseklecki · Answer

NO! NO! NO!

This is just wrong.

What you are saying (and what I just verified), is that VLAN1 cannot be configured as Tagged, at all, _ever_. Even when the PVID is set to Vlan1.

THIS IS JUST WRONG!

Back to CCNP Boot Camp for you guys!

When two switches share an ISL or 802.1Q trunk, *ALL VLANS EGRESS THE PORT AS/ARE TAGGED*.

THAT IS THE ESSENCE OF A TRUNK :)

Some switches that are about as trustworthy as they can be thrown, notably 3com, allow you to "Opt In" VLANSs, al la, Build a VLAN Trunk al-la-carte! This approach is fine, but your Dell switches don't do either.

The admin must have an interface that either allows you to define a Trunk based on VLAN membership, "add VLAN 1, Tagged; add vlan10 untagged", etc. ... Or take the Cisco route, "This is an Access Port in VLANX, traffic is untagged...and this is a Trunk port, all VLANs egress, all VLANs are tagged".

In either way, as VLAN1 leaves a switch port, it should *ONLY EVER BE TAGGED*.

After all; it's the private, secure, management network for your administrative interface.

These powerconnect's dont even allow you to change the management interface, much less use HTTPS/TLS/SSL to admin. So what's the point of defaulting all the ports to VLAN1 as untagged?! Security anyone?

Obviously you can reset the PVID of all the ports (manually, mind you? Efficiency ... not.) to 4095, BUT EVEN THEN, you can't go in and set VLAN membership of a port to VLAN1 / Tagged; allowing it to talk to the dozens of other vendors out there.

I just got a Cisco 2924 to talk to a PowerConnect 2724 using the highly discouraged "hybrid mode" port by setting VLAN1 as untagged, and I got a 3com to talk to it using the Opt-In config:

# Config information for VLAN Default.
config vlan "Default" tag 1 # VLAN-ID=0x1 Global Tag 1
config vlan "Default" protocol "ANY"
config vlan "Default" ipaddress 192.168.4.254 255.255.255.0
config vlan "Default" add port 6 untagged
config vlan "Default" add port 1 tagged

Anyway, It's a *BUG*, VLAN1 must be tagged as it leaves the interface. And apparently the PVID setting has no effect on VLAN1.

This is something that will probably require a firmware update. What do I need to do to get a ticket opened on this issue? My customer ID is: 47036434

Sorry If this is e-mail seems to have an aggressive overtone, but I wasted a lot of time troubleshooting a problem that stems from 1) a poor user interface 2) an arbitrary decision not to make the product easily interroperable with other vendors.

Please open an support ticket for me an e-mail me with the details. I know you get what you pay for, and these PowerConnect 2724s are a steal, but that doesn't mean they can't be interroperable.

TIA,

Brian A. Seklecki
Collaborative Fusion, Inc.
412.422.3463 x4018

su_A_ve · Answer

Any updates on this ???

Is there something set up ?

I've having a hard time configuring a linux client and it seems that I have to set the ports to be egress untagged or else they won't get a lease. Same thing with our little Link Runner (simple device to troubleshoot wiring and basic network info).

A windows client on the other hand behaves differently and obtains a lease without a problem.

WaverLH · Answer

My guess is that Dell is going to ignore this 'feature' for now and fix it on the next ver.  Stinks to be us.    To play devil's advocate here, according to the Cisco's best practices, we shouldn't be using VLAN 1 for anything anyways.  First rule of thumb is to move all clients off of VLAN 1 and shutdown all unused ports.  However, I understand that this doesn't absolve Dell of the responsibility to fix this oversight.   Still waiting for a response from you guys....  :smileysad:   WaverLH

bseklecki · Answer

Yea my solution was to migrate to a homogenous network vendor environment. Screw fighting with 3Com. I'll give you three guesses who I went with, but after the third wrong guess, the floor opens up and you drop into a pit full of Bay Networks gear. >:}

The real bug here is not that you can't tag VLAN1, it's that you cannot change the management VLAN. Also, you cannot download/backup your config file. It makes the 2724 in managed mode useless.

Cheers~
~BAS

Networking General

2724 Cannot TAG a port to VLAN 1

Was this post helpful?