2.5 VLAN Configuration, Verification & Troubleshooting

Enterprise Multi-VLAN Configuration Template

To establish a baseline for enterprise switching operations and troubleshooting, consider the following end-to-end configuration template for a Junos Enhanced Layer 2 Software (ELS) switch. This template incorporates distinct corporate data, voice, guest, and native transit VLANs, configured alongside access edge ports, 802.1Q trunk uplinks, and Integrated Routing and Bridging (IRB) Layer 3 interfaces.

[edit]
# 1. Define Layer 2 VLANs
set vlans DATA-CORP vlan-id 10
set vlans VOICE-CORP vlan-id 20
set vlans GUEST-NET vlan-id 30
set vlans NATIVE-TRANSIT vlan-id 99

# 2. Bind Layer 3 IRB Interfaces to VLANs
set vlans DATA-CORP l3-interface irb.10
set vlans VOICE-CORP l3-interface irb.20
set vlans GUEST-NET l3-interface irb.30

# 3. Configure Layer 3 Gateway IP Addresses
set interfaces irb unit 10 description "Default Gateway - Corporate Data"
set interfaces irb unit 10 family inet address 10.10.10.1/24
set interfaces irb unit 20 description "Default Gateway - Corporate Voice"
set interfaces irb unit 20 family inet address 10.10.20.1/24
set interfaces irb unit 30 description "Default Gateway - Guest Wi-Fi"
set interfaces irb unit 30 family inet address 172.16.30.1/24

# 4. Configure Inter-Switch 802.1Q Trunk Uplink
set interfaces ge-0/0/0 description "Trunk Uplink to Distribution Switch"
set interfaces ge-0/0/0 native-vlan-id 99
set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode trunk
set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members [ DATA-CORP VOICE-CORP GUEST-NET NATIVE-TRANSIT ]

# 5. Configure User Edge Access Port with Voice VLAN & LLDP-MED
set interfaces ge-0/0/1 description "Workstation + IP Phone Access Port"
set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members DATA-CORP
set switch-options voip interface ge-0/0/1.0 vlan VOICE-CORP
set switch-options voip interface ge-0/0/1.0 forwarding-class expedited-forwarding
set protocols lldp interface ge-0/0/1
set protocols lldp-med interface ge-0/0/1

---

Essential Monitoring & Verification Commands

Troubleshooting Layer 2 and Layer 3 switching issues in Junos requires mastering four fundamental CLI verification commands:

1. show vlans and show vlans detail

The primary command to verify VLAN status, 802.1Q tags, and interface associations across the switch fabric:

user@EX4400> show vlans detail
VLAN: DATA-CORP, Shared VLAN ID: 0, Tag: 10, State: Active
    Active interfaces: 
        ge-0/0/0.0 (tagged)
        ge-0/0/1.0 (untagged)
    Layer 3 interface: irb.10
VLAN: GUEST-NET, Shared VLAN ID: 0, Tag: 30, State: Inactive
    Active interfaces: 
        none
    Layer 3 interface: irb.30

Operational Analysis:

• State: Active vs. Inactive: A VLAN is marked Active only when at least one assigned physical or aggregated interface is in the operational up state. Notice that GUEST-NET displays State: Inactive because no active interfaces belong to it (Active interfaces: none).
• Impact on IRB: When a VLAN transitions to Inactive, its bound IRB interface remains operationally down (Link: Down), preventing the switch from routing traffic for that subnet or responding to local pings.

2. show ethernet-switching interfaces

Displays the operational port mode, native VLAN ID, active VLAN memberships, and Spanning Tree Protocol (STP) state for every switched port on Junos ELS switches:

user@EX4400> show ethernet-switching interfaces
Interface    State  VLAN members   Tag   Tagging  Blocking
ge-0/0/0.0   up     DATA-CORP      10    tagged   Forwarding
                    VOICE-CORP     20    tagged   Forwarding
                    NATIVE-TRANSIT 99    untagged Forwarding
ge-0/0/1.0   up     DATA-CORP      10    untagged Forwarding
                    VOICE-CORP     20    tagged   Forwarding

Operational Analysis:

• Inspect the Tagging column: On trunk port ge-0/0/0.0, NATIVE-TRANSIT is listed as untagged, illustrating a trunk explicitly configured for untagged native egress; verify that behavior on the actual platform. On access port ge-0/0/1.0, DATA-CORP is untagged while VOICE-CORP is tagged.
• Inspect the Blocking column: If Spanning Tree has blocked a port to prevent a bridging loop, the state displays Discarding or Blocking, explaining why all frame transmission has halted on that link.

3. show arp

Inspects Layer 3 IPv4-to-MAC resolution on IRB routing interfaces:

user@EX4400> show arp
MAC Address       Address         Name                   Interface     Flags
aa:aa:aa:11:11:11 10.10.10.50     host-a.corp            irb.10        none
00:05:86:71:00:01 10.10.10.1      switch-gw              irb.10        permanent
incomplete        172.16.30.45    guest-tablet           irb.30        none

Operational Analysis:

• A flag of none indicates dynamically resolved ARP entries.
• An entry displaying incomplete indicates the switch issued an ARP request for the target IP address out the designated IRB interface, but received no ARP reply. This occurs when the client is powered off, firewalled against ARP, or connected to a port assigned to the wrong VLAN.

4. show ethernet-switching table

Displays the switch's Layer 2 Filtering Database (MAC address table):

user@EX4400> show ethernet-switching table
Ethernet switching table : 3 entries, 3 learned
Routing instance : default-switch
   VLAN              MAC address       Type         Age Interfaces
   DATA-CORP         aa:aa:aa:11:11:11 Learn          0 ge-0/0/1.0
   VOICE-CORP        cc:cc:cc:33:33:33 Learn         12 ge-0/0/1.0
   DATA-CORP         b8:bb:bb:22:22:22 Learn          5 ge-0/0/0.0

Operational Analysis: If a MAC rapidly alternates between ports, investigate a Layer 2 loop, host mobility, multihoming, or spoofing. MAC flapping is evidence to investigate, not proof of one cause.

---

Common Exam Traps & Troubleshooting Scenarios

Trap 1: Native VLAN Mismatch across Trunk Links

A classic enterprise misconfiguration occurs when two interconnected switches are configured with mismatched native VLAN IDs on their interconnecting trunk port:

• Switch-01: set interfaces ge-0/0/0 native-vlan-id 10
• Switch-02: set interfaces ge-0/0/0 native-vlan-id 20

Failure Mechanism: If Switch-01’s egress configuration transmits VLAN 10 frames untagged across the trunk, Switch-02 receives them untagged and immediately assigns them to its local native VLAN (VLAN 20). As a result, traffic leaks between unrelated broadcast domains, creating a major security violation.

Verification: Standard RSTP BPDUs do not carry a native-VLAN negotiation TLV. A mismatched native VLAN can misclassify untagged user traffic without RSTP reporting a PVID inconsistency. Compare native-vlan-id and allowed membership on both ends, and inspect ingress/egress tagging. Do not rely on a spanning-tree alarm to enforce VLAN consistency.

Trap 2: Trunk Pruning Drops (Missing VLAN in Allowed List)

An engineer provisions a new VLAN (e.g., VLAN 40, DEV-OPS) on both access and distribution switches, but forgets to update the trunk allowed list on the interconnecting link:

user@EX4400# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members [ DATA-CORP VOICE-CORP ]
# Missing DEV-OPS!

Diagnostic Gotcha: Frames tagged with VLAN 40 arriving at trunk port ge-0/0/0 are dropped immediately by the PFE ingress parser. However, running show interfaces ge-0/0/0 shows zero input errors, zero CRC errors, and normal link carrier! The physical port appears perfectly healthy because the frames are structurally valid Ethernet; the drop occurs purely at the Layer 2 parser level. Only running show ethernet-switching interfaces ge-0/0/0 detail will reveal that VLAN 40 is absent from the active membership list.

Trap 3: Missing l3-interface Association

An administrator configures interfaces irb unit 20 family inet address 10.10.20.1/24, but omits set vlans VOICE-CORP l3-interface irb.20 under the vlans hierarchy.

Symptom & Root Cause: Hosts in VLAN 20 cannot reach their default gateway (10.10.20.1) or any remote subnets. When viewing show interfaces terse irb.20, do not assume an operationally up IRB proves the VLAN association is correct. However, running show vlans VOICE-CORP detail reveals:

Layer 3 interface: none

Because the IRB interface is not bound to the Layer 2 broadcast domain, the switch never binds its MAC address to VLAN 20 and ignores all incoming ARP requests for 10.10.20.1.

Trap 4: Port Assigned to Wrong Access VLAN

A technician connects a new workstation to port ge-0/0/5. The client receives an IP address in the 172.16.30.0/24 range instead of the corporate 10.10.10.0/24 range, and cannot access internal databases. Running show ethernet-switching interfaces ge-0/0/5 immediately reveals VLAN members: GUEST-NET instead of DATA-CORP. The fix is a simple reassignment under family ethernet-switching vlan members.

Trap 5: Duplex and Speed Mismatches

When connecting a switch trunk or server port, an administrator hardcodes the switch port to speed 100m and link-mode full-duplex, while leaving the connecting endpoint configured for auto-negotiation.

IEEE 802.3u Rule: Under IEEE 802.3u auto-negotiation rules, if a port fails to receive auto-negotiation FLP (Fast Link Pulses) from its partner, it utilizes parallel detection. Parallel detection can reliably detect speed (100 Mbps), but standard rules mandate that duplex must fall back to half-duplex.

Symptom: One side operates at full-duplex while the other operates at half-duplex. Under light traffic, pings succeed. However, when large data transfers commence, the full-duplex end transmits while the half-duplex end is sending, triggering collisions on the half-duplex port. Running show interfaces ge-0/0/0 extensive reveals mounting Late Collisions and FCS / CRC Errors, severely degrading application performance.

---

Comprehensive Troubleshooting Reference

Output note: Command output shown here is a schematic teaching example, not a captured device session. Field names and feature support depend on platform and Junos release.