Today I got crazy with a pair of switches dropping traffic on a 802.1q trunk. Finally, I realized the real problem was a leak in my brain, which led me to forgot how things work!
The scenario I worked on had two switches, a 3560 and a 2960, with a 802.1q (etherchannel) trunk between them; the 3560 was the gateway for the VLAN 100 while on the 2960 I only had some access ports and the management interface.
! Port-channel toward 2960, 802.1q trunk carrying VLAN 100 interface Port-channel1 description 3560-to-2960 switchport trunk encapsulation dot1q switchport trunk native vlan 100 switchport trunk allowed vlan 100 switchport mode trunk switchport nonegotiate end ! ! Native VLAN tagging vlan dot1q tag native ! ! VLAN 100 declaration vlan 100 ! ! Layer3 interface for VLAN 100 interface Vlan100 description SVI100 ip address 10.0.100.1 255.255.255.0 end
! Port-channel toward 3560, 802.1q trunk carrying VLAN 100 interface Port-channel1 description 2960-to-3560 switchport trunk native vlan 100 switchport trunk allowed vlan 200 switchport mode trunk switchport nonegotiate end ! ! VLAN 100 declaration vlan 100 ! ! Default management interface is shutdown interface Vlan1 no ip address no ip route-cache shutdown end ! ! Management interface interface Vlan100 ip address 10.0.100.2 255.255.255.0 no ip route-cache end
A ping from the 3560 toward the 2960 (where I ran a debug ip icmp) showed that ICMP echo requests was coming to the switch, replies were crafted by 2960 but they never arrived to 3560.
When I focused on the native VLANs topic, I found they were aligned on both switches: I thought that frames leaving 2960 toward 3560 were untagged (because of the switchport trunk native vlan 100 command) but on 3560 side they should be accepted thanks to the same command. Here I was wrong! I missed the vlan dot1q tag native full behaviour, which means that every untagged ingress frame is dropped, even if it matches the configured native VLAN.
In order to get this configuration to work properly, I had to ensure that every 2960 egress frame was tagged, but it seems 2960s don’t support native VLAN tagging: here I had not the vlan dot1q tag native global configuration capability, nor the switchport trunk native vlan tag interface command, so I removed the switchport trunk native vlan 100 command and everything worked.
Cisco.com: Command Lookup Tool
Cisco Support Community: cat2960 native vlan tagged on trunk discussion