When to setup VLAN1?

wweboy

Hi everyone,

Can you explain to me when you don't need to setup VLAN1? as far as I understood VLAN1 always had to be configured and it was like the default IP address of the device and without that setup its dumb to the world. I spent an hour and half setting up a simple network to test rip routing and couldn't figure out why the advertisements were not working (in packet tracer0 and now I'm watching a video on youtube that has a display like this

http://ottolab.net/ytclip.png

Why isn't VLAN1 setup? also can you explain if I'd need to be making changes on the switch? here I thought I was really grasping the stuff from the CBT Nuggets video and now I'm confused as all hell on such a simple topic.I know every device has to be configured with an ip address and that is what I thought VLAN1 essentially did.

Can someone please enlighten me?

Thank you so much everyone.

SubnetZero

Yes all ports are in VLAN 1 by default but Cisco recommends you don't use it. If you want to manage your switches create a management VLAN and assign the IP address to that SVI. For example:

vtp mode transparent
vtp domain CCNA
vtp password cisco
!!
vlan 1000
name management
exit
!
int vlan 1000
description management
ip address 192.168.100.1 255.255.255.0

That's it!

Here is from Cisco:

Source: VLAN Security White Paper* [Cisco Catalyst 6500 Series Switches] - Cisco Systems

Precautions for the Use of VLAN 1

The reason VLAN 1 became a special VLAN is that L2 devices needed to have a default VLAN to assign to their ports, including their management port(s). In addition to that, many L2 protocols such as CDP, PAgP, and VTP needed to be sent on a specific VLAN on trunk links. For all these purposes VLAN 1 was chosen.

As a consequence, VLAN 1 may sometimes end up unwisely spanning the entire network if not appropriately pruned and, if its diameter is large enough, the risk of instability can increase significantly. Besides the practice of using a potentially omnipresent VLAN for management purposes puts trusted devices to higher risk of security attacks from untrusted devices that by misconfiguration or pure accident gain access to VLAN 1 and try to exploit this unexpected security hole.

To redeem VLAN 1 from its bad reputation, a simple common-sense security principle can be used: as a generic security rule the network administrator should prune any VLAN, and in particular VLAN 1, from all the ports where that VLAN is not strictly needed.

Therefore, with regard to VLAN 1, the above rule simply translates into the recommendations to:

•Not use VLAN 1 for inband management traffic and pick a different, specially dedicated VLAN that keeps management traffic separate from user data and protocol traffic.

•Prune VLAN 1 from all the trunks and from all the access ports that don't require it (including not connected and shutdown ports).

Similarly, the above rule applied to the management VLAN reads:

•Don't configure the management VLAN on any trunk or access port that doesn't require it (including not connected and shutdown ports).

•For foolproof security, when feasible, prefer out-of-band management to inband management. (Refer to [3] for a more detailed description of a out-of-band management infrastructure.)

As a general design rule it is desirable to "prune" unnecessary traffic from particular VLANs. For example, it is often desirable to apply VLAN ACLs and/or IP filters to the traffic carried in the management VLAN to prevent all telnet connections and allow only SSH sessions. Or it may be desirable to apply QoS ACLs to rate limit the maximum amount of ping traffic allowed.

If VLANs other than VLAN 1 or the management VLAN represent a security concern, then automatic or manual pruning should be applied as well. In particular, configuring VTP in transparent or off mode and doing manual pruning of VLANs is commonly considered the most effective method to exert a more strict level of control over a VLAN-based network.