On Mon, Mar 11, 2013 at 8:49 AM, Colin Doyle <span dir="ltr"><<a href="mailto:cdoyle@verilan.com" target="_blank">cdoyle@verilan.com</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
Depends on the pruning policy. I can understand why we would
restrict certain trunks for security reasons, but it begs the
question of "what problem are we trying to solve".<br></div></blockquote><div><br></div><div>We tend to try to solve the problem of "on Thursday we will have an emergency in which we need vlan 736 to be over there ASAP". Pruning VLANs manually hurts that case. We usually just filter towards the APs.</div>
<div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="#FFFFFF" text="#000000">I added vlan 6 to that switchport to allow media vlan access for a
streambox. <br></div></blockquote><div><br></div><div>Sorry, I knew that. That shouldn't have been necessary since we should just have all VLANs on all switch links.</div><div><br></div><div>It's possible that this is my fault: if there were previously APs plugged into these ports, the templatizer would have added the appropriate AP access list, and then it doesn't know to remove them if the purpose of the port has changed. It's probably worth changing the templatizer to explicitly apply the "allow all" policy on switch<>switch links.</div>
<div><br></div><div> Bill</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="#FFFFFF" text="#000000"><br><div><div class="h5"><br>
<div>On 3/11/13 8:48 AM, Bill Fenner wrote:<br>
</div>
</div></div><blockquote type="cite"><div><div class="h5">Usually we just allow all vlans on
switch<>switch links, right? I saw a couple of edits go by
in the rancid history, like
<div><br>
</div>
<div><span style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">
interface GigabitEthernet0/4</span><br style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">
<span style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">
description SW-Boca1</span><br style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">
<span style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">
switchport trunk encapsulation dot1q</span><br style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">
<div style="color:rgb(80,0,80);font-size:13px;font-family:arial,sans-serif">-
switchport trunk allowed vlan 1,8,16,32,80,96,112<br>
</div>
<span style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">+
switchport trunk allowed vlan 1,6,8,16,32,80,96,112</span><br style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">
</div>
<div><span style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif"><br>
</span></div>
<div><span style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">but
I think it's better to just change switch<>switch links
to "switchport trunk allowed vlan all".</span></div>
<div><span style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif"><br>
</span></div>
<div><span style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">
Bill</span></div>
<div><span style="color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif"><br>
</span></div>
<br>
<fieldset></fieldset>
<br>
</div></div><pre>_______________________________________________
ietf86-tech mailing list
<a href="mailto:ietf86-tech@daedelus.com" target="_blank">ietf86-tech@daedelus.com</a>
<a href="http://www.daedelus.com/mailman/listinfo/ietf86-tech" target="_blank">http://www.daedelus.com/mailman/listinfo/ietf86-tech</a></pre>
</blockquote>
<br>
<pre cols="72">--
Colin Doyle
Senior Network Engineer
CCNA, F5 ASP/ATSP, Juniper JES
Verilan Event Services, Inc.
7327 SW Barnes Rd. #215
Portland, OR 97225
Cell: <a href="tel:503%20810-2129" value="+15038102129" target="_blank">503 810-2129</a>
<a href="mailto:cdoyle@verilan.com" target="_blank">cdoyle@verilan.com</a>
<a href="http://www.verilan.com" target="_blank">www.verilan.com</a>
This e-mail contains proprietary information and may be confidential. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this message is strictly prohibited. If you received this message in error, please delete it immediately.</pre>
</div>
<br>_______________________________________________<br>
ietf86-tech mailing list<br>
<a href="mailto:ietf86-tech@daedelus.com">ietf86-tech@daedelus.com</a><br>
<a href="http://www.daedelus.com/mailman/listinfo/ietf86-tech" target="_blank">http://www.daedelus.com/mailman/listinfo/ietf86-tech</a><br></blockquote></div><br>