The U means that the frame as sent as Ethernet II, the T means the frame is sent as 802.1q out of the port. You probably always want to use the U unless you are doing VLAN trunking on a port. You also need to go to the "VLAN Port Setting" screen and assign each port a default PVID. This will cause untagged (Ethernet II) frames to be converted to 802.1q with the PVID as the VLAN.

I've had two problems.

First, you cannot remove a port from the default VLAN. This means that if you truly want VLAN seperation, you need to move all ports into a VLAN other than 1. For example, if you have two vlans 1 and 2. Any broadcast frames being sent in VLAN 1 will also show up on VLAN 2 ports, since you cannot get rid of the untagged VLAN 1 egress, which means any frame in VLAN 1 is sent untagged on all ports! I ended up getting around this by doing 802.1q trunking to a linux box and only using VLAN 1 to manage the switch and put all other ports in VLAN's other than 1.

Then I hit my second problem, it seems that whenever I configure the PVID's to anything other than 1 on the "VLAN Port Setting" screen, after a couple of minutes the switch automagically creates tons of VLAN 0's (It doesn't make sense cause that is illegal, right?) and then the management interface breaks. All of the ports dissappear from all of the drop down menus and a lot of the "Apply Changes" buttons are gone. I can no longer use the mangement interface to do anything. The only way to fix it is to go to unmanaged mode, then back to managed (to restore default). A reboot doesn't help. Although the switch seems to still be honoring all of the configuration, it is completely useless.

I really wanted this switch to do multi-VLANS and it seems that the VLAN support is very poor. Anybody else running into problems like this?

@blue_falcon_64 ::

the previous thread is accurate in regards to the interface VLAN parameters.  You will need to assign an interface to the Egress VLAN ID as well as configure the interface PVID in order to separate the interfaces into different broadcast domains. 

@ryan_mcdowell ::

The issue you are experiencing may be a result of the PVID configuration.  While the VLAN Membership configuration will outline the Egress filters, the VLAN Port Settings will determine the Ingress filtering.  As such, any interface that is configured with a PVID of [1] will receive all broadcast traffic for VLAN ID [1], regardless of the Egress filtering configuration. 

While interfaces configured in a VLAN other than the default VLAN (ID 1) may only forward information to their respective VLAN IDs, the PVID will determine what VLAN ID the interface will receive traffic from. 

The system may only be managed via VLAN ID [1], thus removing all interfaces from the Egress and Ingress configuration for VLAN [1] will result in a loss of management to the switch.

I am unable to recreate the VLAN 0 anomaly.  I have assigned numerous interfaces to numerous VLANs and changed the PVID for each interface to correspond with the respective VLAN ID configured, however, I have not manifested any VLANs with the ID of [0].  Inter-VLAN routing with the aid of a PowerConnect 6024 seems to be no issue as well.

Is this device on a separate segment or being integrated into your existing topology?  Do the RMON statistics reflect any errors or other potential issues on the interfaces you ares testing with?  If applicable, are there excessive Non-Unicast packets being received on the interface that uplinks the device into an existing network?

s/For example, if I list a U under port 13 for VLAN 12, then any broadcast frame forwarded into the switch (somehow) will be forwarded out port 13, right?/For example, if I list a U under port 13 for VLAN 12, then any broadcast frame forwarded into the switch (somehow) as VLAN 12 will be forwarded out port 13, right?/

Problem 1:
Wait, let me make sure I understand this correctly:

The "VLAN Membership" controls egress of any 802.1q frame that matches the configured VLAN. A U means that the tag is stripped and the frame is transmitted as Ethernet II, a T means its transmitted as 802.1q.

For example, if I list a U under port 13 for VLAN 12, then any broadcast frame forwarded into the switch (somehow) will be forwarded out port 13, right?

The "VLAN Port Settings" screen controls ingress. Meaning any Ethernet II frame received on a port is tagged with whatever the configured PVID is on the port.

For example, if I list port 1 as PVID 12, then any untagged Ethernet II frame received on port 1 is converted to a 802.1q frame with VLAN 12.

The problem I think I am seeing is this:

Ports 1-8 are configured as "VLAN Membership" untagged VLAN 1. Ports 13-16 are configured as "VLAN Membership" untagged VLAN 65 and also as untagged VLAN 1 (because you cannot change this). Ports 1-8 are configured as "VLAN Port Settings" PVID 1. Ports 13-16 are configured as "VLAN Port Settings" PVID 65.

An ARP (broadcast) frame enters port 1. The frame is converted to 802.1q with a VLAN of 1. The frame is then transmitted on all ports because you cannot remove any port from the "VLAN Membership" untagged of VLAN 1.

I haven't tried it again with a sniffer because everytime I configure it the switch goes into my second problem which is a pain to fix.

Problem 2:

Here is my topology:

Internet <---> Cisco 2509 <---> Firewall <---> Dell 2716 <----> A bunch of PC's and servers

Whoops, hit submit by accident.

Problem 2:

Here is the topology

Internet <---> Cisco 2509 <----> Firewall <----> Dell 2716 <---> A bunch of PC's/servers
\
\
Cisco FastHub <----> Mail server and Webserver


I am trying to get rid of the fasthub and replace it with an isolated VLAN on the 2716 as the 2716 uses much less power which is better for the UPS I have. I am connecting to the 2716 with the following NIC's:

Hawking HGA32T 10/100/1000Mbps
Allied Telesyn AT2400T/BT 10Mbps
Netgear FA310Tx 10/100Mbps
Linksys USB200M 10/100Mbps
Linksys Ether16 10Mbps
3Com 3c509 10Mbps

Ports 1-8 are using everything except the 3Com's. Port 13-16 are using the Netgear and 3Com.

I then make the following changes on the switch.

Under "VLAN Membership" I create VLAN 65
Under "VLAN Membership" I add ports 13-16 as untagged for VLAN 65.
Under "VLAN Port Settings" I change the PVID for port 13-16 to 65.

I then wait a bit (sometimes it occurs immediately after I was testing the switch throughput with ttcp on the GE connected PC's to ensure I have them tuned properly to maximize TCP throughput), then the VLAN 0's appear under the "VLAN Membership screen" At this point, I've noticed the following: the "apply changes" button are all gone and any screen that has a "port" dropdown box, the ports are all gone.

I see no RMON errors before I make the change to VLAN 65, but once the problem occurs I cannot check for RMON errors because the dropbox for "port" on the RMON screen is empty. The only multicast I have is NTP which should be minimal. I haven't noticed an ARP storm using TCPDUMP on on of the PC's. Please note that everything seems to still forward fine, its just the switch management interface that has the issue.

One other point, the first time I noticed the switch MI had a problem is when I sent 200M down a GE port destined to a 100M port to see how the switch handled that. Since then, the problem reoccurs without abusing the switch. I also ran this test immediately after I configured the VLAN 65 for the first time and I didn't check back on the MI until I wanted to take a look at the RMON stats after the test.

I'm going to post this here, as i think it's along the same sort of questions:

1. If I want 3 isolated vlans (are there any other kind?), I have to stay away from vlan1, correct? But I still need at least one port set on vlan1 for management.  Kind of inconvenient - what is the impact of leaving one of the vlans as vlan1?

2. If I have two switches, the connect between the two has to be set as "tag egress packets" on both switches for every vlan, correct?

Thanks - Joe

Ok so I just got through working with a similar problem like whats posted here and this is how I resolved it.

 

Under Vlan> Port Settings> select a port and choose Access.  This sets the port so only one Untagged vlan can be assigned.  When you add new vlan such as 65 to this port untagged it will automatically be removed from vlan 1.  You can do this with every port.  After doing this make sure you tag the uplink ports and set them to trunk mode under port settings.  This will insure that packets leaving the switch to an upstream switch will be tagged with the correct vlan info.  You can still have Vlan 1 configured with a different management IP address if you want.  I've pasted my config so you can see how I did this.

Hope it helps

interface range ethernet all
spanning-tree disable
exit
interface range ethernet 1/g(1-2)
switchport mode trunk
exit
vlan database
vlan 40-41
exit
interface range ethernet 1/e(1-12)
switchport access vlan 40
exit
interface ethernet 1/g1
switchport trunk allowed vlan add 40
exit
interface range ethernet 1/e(13-24)
switchport access vlan 41
exit
interface range ethernet 1/g(1-2)
switchport trunk allowed vlan add 41
exit
interface vlan 40
exit
interface vlan 41
name Manuf_I-O_Panel
exit
interface vlan 1
ip address 10.14.30.64 255.255.255.0
exit
ip default-gateway 10.14.30.1
hostname R-IDFB-SW003

This last post with the "text" configuration doesn't apply here, since the 2716 can only be managed from the web interface, unfortunately.

Matthias