Tag/Untag VLANs from Port Perspective on HP Switch

hpiosvlan

I'm familiar with vlans and tagging, and we usually use the command line interface for our HP Layer 3 switches. I've done quite a few:

vlan 10 untagged 21

I've always wondered if this was possible to do from the perspective of the port. For example, if I have a port that needs a brand new configuration, it would be amazing to be able to do something like:

interface 21 untagged 2 tagged 3 tagged 5

and configure the port as needed in one swoop. The command above does not work (even if shorttened to interface 21 untagged 2). Is it possible to do port tagging from the perspective of the port rather than the perspective of the vlan? Even just clearing a port would be handy and from hitting ? at the command line, there appear to be no vlan options within the interface.

Thanks in advance!

Best Answer

Unfortunately, that is not possible to do on an HP switch, where all port membership is configured as part of the vlan configuration.

On the other hand, that is the standard way to do it on a Cisco switch, where a port's config includes all the vlans allowed through it.

Related Solutions

VLANs – Why Not to Use VLANs for Security

Why do people tell me not to use VLANs for security purposes?

There is real risks, if you don't fully understand the potential issues, and properly setup your network to mitigate the risk to a point that is acceptable for your environment. In many locations VLANs provide an adequate level of separation between between two VLANs.

Can someone please explain to me why the above isn't secure?

It sounds like you have taken all the basic steps needed to achieve a pretty secure setup. But I am not totally familiar with HP gear. You may have done enough for your environment.

A good article too look at would be the Cisco VLAN Security White Paper.

It includes a list of possible attacks against a VLAN-Based Network. Some of these are not possible on some switches, or can be mitigated by a proper design of the infrastructure/network. Take the time to understand them and decide if the risk is worth the effort it will take to avoid it in your environment.

Quoted from the article.

MAC Flooding Attack
802.1Q and ISL Tagging Attack
Double-Encapsulated 802.1Q/Nested VLAN Attack
ARP Attacks
Private VLAN Attack
Multicast Brute Force Attack
Spanning-Tree Attack

Cisco – vlan tagging on a cisco catalyst 3560

Once you've identified your exact requirements above:

Each VLAN needs to be created before traffic will pass:

Switch(config)# vlan [number]
Switch(config-vlan)# name [name]

For each trunk (>1 vlan) port, config as follows. Let's say 1000 is native (untagged) VLAN and 2000-2100 and 3000 are carried:

Switch(config)# int gi0/1
Switch(config-interface)# switchport mode trunk
Switch(config-interface)# switchport trunk allowed vlan 1000,2000-2100,3000
Switch(config-interface)# switchport trunk native vlan 1000

For each access (1 vlan, untagged) port, config as follows:

Switch(config)# int gi0/2
Switch(config-interface)# switchport mode access
Switch(config-interface)# switchport access vlan 1000

You can also specify and interface range: Switch(config)# int range gi0/1 - 10, gi1/1

And shorten commands if the keywords are still unique: Switch(config-interface)# sw tr na vl 1000

Best Answer

Related Solutions

VLANs – Why Not to Use VLANs for Security

Cisco – vlan tagging on a cisco catalyst 3560

Related Topic