VLAN

VLAN (Virtual Local Area Network) configuration enables logical network segmentation by creating isolated broadcast domains within a single NX-OS infrastructure, each identified by a numeric ID and optional descriptive name. It supports advanced features including VN segment mapping for VXLAN overlay integration, bridge mode selection, cross-connect capabilities, MAC packet classification, and fabricpath mode for data center fabric topologies. VLAN management includes administrative state control, policy enforcement, and forwarding mode configuration for both routed and bridged traffic flows. Settings from vlan configuration <id> mode, such as mac-learn disable, layer-2 multicast lookup mac and per-VLAN ip igmp snooping commands, are configured under vlan.configurations; a VLAN configuration does not create the VLAN itself. The global private VLAN FEX trunk mode and the dot1q tunnel transit VLANs are configured under system.

VLAN (Virtual Local Area Network) configuration enables logical network segmentation by creating isolated broadcast domains within a single NX-OS infrastructure, each identified by a numeric ID and optional descriptive name. It supports advanced features including VN segment mapping for VXLAN overlay integration, bridge mode selection, cross-connect capabilities, MAC packet classification, and fabricpath mode for data center fabric topologies. VLAN management includes administrative state control, policy enforcement, and forwarding mode configuration for both routed and bridged traffic flows.

Diagram

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
system	Class	system	No
vlan	Class	vlan	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
vlan	Class	vlan	No

system (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
dot1q_tunnel_transit_vlans	Class	dot1q_tunnel_transit_vlans	No
private_vlan_fex_trunk	Boolean	true, false	No

vlan (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
vlans	List	vlans	No
configurations	List	configurations	No

vlan (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
vlans	List	vlans	No

dot1q_tunnel_transit_vlans (nxos.devices.configuration.system)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No

vlans (nxos.devices.configuration.vlan)

Name	Type	Constraint	Mandatory	Default Value
id	Integer	min: 1, max: 4094	Yes
vn_segment	Integer	min: 1, max: 16777215	No
name	String		No
state_active	Boolean	true, false	No
bridge_mode	Choice	ip, mac	No
untagged	Boolean	true, false	No
policy_enforce_vlan	Boolean	true, false	No
cross_connect	Boolean	true, false	No
long_name	Boolean	true, false	No
mac_packet_classify	Boolean	true, false	No
mode	Choice	ce, fabricpath	No
vrf	String		No
private_vlan_type	Choice	primary, isolated, community	No
private_vlan_association	Class	private_vlan_association	No
isolate	Boolean	true, false	No

vlans (nxos.devices.configuration.vlan)

Name	Type	Constraint	Mandatory	Default Value
id	Integer	min: 1, max: 4094	Yes
vn_segment	Integer	min: 1, max: 16777215	No
name	String		No
state_active	Boolean	true, false	No
bridge_mode	Choice	ip, mac	No
untagged	Boolean	true, false	No
policy_enforce_vlan	Boolean	true, false	No
cross_connect	Boolean	true, false	No
long_name	Boolean	true, false	No
mac_packet_classify	Boolean	true, false	No
mode	Choice	ce, fabricpath	No
vrf	String		No

configurations (nxos.devices.configuration.vlan)

Name	Type	Constraint	Mandatory	Default Value
id	Integer	min: 1, max: 4094	Yes
mac_learn	Boolean	true, false	No
layer_2_multicast_lookup_mac	Boolean	true, false	No
igmp_snooping	Class	igmp_snooping	No

ranges (nxos.devices.configuration.system.dot1q_tunnel_transit_vlans)

Name	Type	Constraint	Mandatory	Default Value
from	Integer	min: 1, max: 4094	Yes
to	Integer	min: 1, max: 4094	Yes

private_vlan_association (nxos.devices.configuration.vlan.vlans)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No

igmp_snooping (nxos.devices.configuration.vlan.configurations)

Name	Type	Constraint	Mandatory	Default Value
enable	Boolean	true, false	No
access_group	String		No
explicit_tracking	Boolean	true, false	No
fast_leave	Boolean	true, false	No
group_timeout	Integer	min: 0, max: 65535	No
last_member_query_interval	Integer	min: 1, max: 25	No
link_local_groups_suppression	Boolean	true, false	No
proxy_general_queries_mrt	Integer	min: 0, max: 25	No
proxy_leave_use_group_address	Boolean	true, false	No
querier	IP		No
querier_timeout	Integer	min: 1, max: 65535	No
query_flood	Boolean	true, false	No
query_interval	Integer	min: 1, max: 18000	No
query_max_response_time	Integer	min: 1, max: 25	No
report_flood_all	Boolean	true, false	No
report_flood_interfaces	List	report_flood_interfaces	No
report_suppression	Boolean	true, false	No
robustness_variable	Integer	min: 1, max: 7	No
startup_query_count	Integer	min: 0, max: 10	No
startup_query_interval	Integer	min: 0, max: 18000	No
v3_report_suppression	Boolean	true, false	No
version	Choice	2, 3	No
mrouter_interfaces	List	mrouter_interfaces	No
static_groups	List	static_groups	No

report_flood_interfaces (nxos.devices.configuration.vlan.configurations.igmp_snooping)

Name	Type	Constraint	Mandatory	Default Value
interface_type	Choice	ethernet, port-channel	Yes
interface_id	Any	String or Integer[min: 0]	Yes

mrouter_interfaces (nxos.devices.configuration.vlan.configurations.igmp_snooping)

Name	Type	Constraint	Mandatory	Default Value
interface_type	Choice	ethernet, port-channel	Yes
interface_id	Any	String or Integer[min: 0]	Yes

static_groups (nxos.devices.configuration.vlan.configurations.igmp_snooping)

Name	Type	Constraint	Mandatory	Default Value
group	IP		Yes
source	IP		No
interfaces	List	interfaces	Yes

interfaces (nxos.devices.configuration.vlan.configurations.igmp_snooping.static_groups)

Name	Type	Constraint	Mandatory	Default Value
interface_type	Choice	ethernet, port-channel	Yes
interface_id	Any	String or Integer[min: 0]	Yes

Examples

Example 1: L2 VLANs with VXLAN VN segment mappings for tenant segmentation

nxos:
  devices:
    - name: LEAF1
      configuration:
        vlan:
          vlans:
            - id: 101
              name: BLUE_WEB_TIER
              vn_segment: 10101
            - id: 102
              name: BLUE_APP_TIER
              vn_segment: 10102

Example 2: L3 VLANs for VRF-to-VNI mapping (symmetric IRB)

nxos:
  devices:
    - name: LEAF1
      configuration:
        vlan:
          vlans:
            - id: 1010
              name: BLUE_L3VNI
              vn_segment: 11010
            - id: 1020
              name: GREEN_L3VNI
              vn_segment: 11020

Example 3: Private VLAN domain with primary, isolated, and community VLANs (ports are configured under switchport on Ethernet and port-channel interfaces, SVI mapping under interfaces.vlans)

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          private_vlan: true
        vlan:
          vlans:
            - id: 100
              name: PVLAN_PRIMARY
              private_vlan_type: primary
              private_vlan_association:
                ranges:
                  - from: 101
                    to: 102
            - id: 101
              name: PVLAN_ISOLATED
              private_vlan_type: isolated
            - id: 102
              name: PVLAN_COMMUNITY
              private_vlan_type: community
          configurations:
            - id: 101
              mac_learn: false
            - id: 102
              mac_learn: false

Example 4: Complete leaf VLAN configuration with both L2 and L3 VLANs

nxos:
  devices:
    - name: LEAF2
      configuration:
        vlan:
          vlans:
            # L2 VLANs - extended across VXLAN fabric
            - id: 101
              name: BLUE_WEB_TIER
              vn_segment: 10101
            - id: 102
              name: BLUE_APP_TIER
              vn_segment: 10102
            # L3 VNI transit VLANs - one per VRF for symmetric IRB
            - id: 1010
              name: BLUE_L3VNI
              vn_segment: 11010
            - id: 1020
              name: GREEN_L3VNI
              vn_segment: 11020

Example 5: VLAN with layer 2 isolation (requires NX-OS 10.6(3) or later)

nxos:
  devices:
    - name: LEAF1
      configuration:
        vlan:
          vlans:
            - id: 1030
              name: ISOLATED_HOSTS
              vn_segment: 11030
              isolate: true

Example 6: Private VLAN FEX trunk mode

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          private_vlan_fex_trunk: true

Example 7: Dot1Q tunnel transit for a VLAN range (system dot1q-tunnel transit vlan <vlan-range>)

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          dot1q_tunnel_transit_vlans:
            ranges:
              - from: 10
                to: 20

Example 8: Per-VLAN IGMP snooping with querier, timers, mrouter port and static groups

nxos:
  devices:
    - name: LEAF1
      configuration:
        route_maps:
          - name: IGMP-SNOOP-FILTER
            entries:
              - order: 10
                action: permit
        vlan:
          vlans:
            - id: 100
              name: MCAST_DATA
            - id: 200
              name: NO_SNOOPING
          configurations:
            - id: 100
              layer_2_multicast_lookup_mac: true
              igmp_snooping:
                querier: 10.1.100.1
                query_interval: 60
                query_max_response_time: 10
                robustness_variable: 3
                version: 3
                fast_leave: true
                explicit_tracking: false
                report_suppression: false
                v3_report_suppression: true
                group_timeout: 300
                proxy_general_queries_mrt: 10
                access_group: IGMP-SNOOP-FILTER
                mrouter_interfaces:
                  - interface_type: ethernet
                    interface_id: 1/10
                static_groups:
                  - group: 239.1.1.1
                    interfaces:
                      - interface_type: ethernet
                        interface_id: 1/11
                  - group: 232.1.1.1
                    source: 10.1.1.5
                    interfaces:
                      - interface_type: port-channel
                        interface_id: 10
                report_flood_interfaces:
                  - interface_type: ethernet
                    interface_id: 1/12
            - id: 200
              igmp_snooping:
                enable: false

Examples

Example 1: L2 VLANs with VXLAN VN segment mappings for tenant segmentation

nxos:
  devices:
    - name: LEAF1
      configuration:
        vlan:
          vlans:
            - id: 101
              name: BLUE_WEB_TIER
              vn_segment: 10101
            - id: 102
              name: BLUE_APP_TIER
              vn_segment: 10102

Example 2: L3 VLANs for VRF-to-VNI mapping (symmetric IRB)

nxos:
  devices:
    - name: LEAF1
      configuration:
        vlan:
          vlans:
            - id: 1010
              name: BLUE_L3VNI
              vn_segment: 11010
            - id: 1020
              name: GREEN_L3VNI
              vn_segment: 11020

Example 3: Complete leaf VLAN configuration with both L2 and L3 VLANs

nxos:
  devices:
    - name: LEAF2
      configuration:
        vlan:
          vlans:
            # L2 VLANs - extended across VXLAN fabric
            - id: 101
              name: BLUE_WEB_TIER
              vn_segment: 10101
            - id: 102
              name: BLUE_APP_TIER
              vn_segment: 10102
            # L3 VNI transit VLANs - one per VRF for symmetric IRB
            - id: 1010
              name: BLUE_L3VNI
              vn_segment: 11010
            - id: 1020
              name: GREEN_L3VNI
              vn_segment: 11020