The VLAN mode affects the way in which a module address table is used. You can select allOpen or allClosed as the VLAN mode for the switch fabric module or for any Layer 2 or Multilayer switching module. The default is allOpen. VLAN modes on a module cannot be mixed; they must be either allOpen or allClosed for a module.

3Com's use of the term "allOpen" is equivalent to the IEEE Standard 802.1Q term "Shared VLAN Learning" (SVL). The term "allClosed" is equivalent to the IEEE 802.1Q term "Independent VLAN Learning" (IVL). 3Com imposes the restriction of choosing one VLAN mode per module; more complex logic for assigning SVL and IVL to individual ports is described in the IEEE 802.1Q standard.

Important Considerations

• In general, select your VLAN mode before you define your VLANs (VLANs with an origin of static).

• As part of the configuration procedures for a router port IP interface on a Multilayer Switching Module, you must place the system in allClosed mode. After you define a router port IP interface (and the system creates the router port VLAN), you cannot change the VLAN mode until you delete the router port IP interface. Select a VLAN mode as follows:

  • allOpen - Use this less restrictive mode if you have no security issues about the forwarding of data between VLANs. The allOpen mode is the default VLAN mode for all VLANs that you create. The allOpen mode implies that the module uses a single bridge address table for all of the VLANs on the module (the default configuration). If a device is a member of two VLANs, and the VLAN mode is allOpen, the address table discards the device address and learns the new address each time that the device transmits on the other VLAN.

    On Multilayer switching modules, allOpen mode permits untagged data with a unicast MAC address to be forwarded between VLANs, if the destination MAC address is in the forwarding table. Example: Untagged data received on IP VLAN 2 with a destination of IP VLAN 3 is forwarded there.

  • allClosed - Use this restrictive mode if you are concerned about security between VLANs. Data cannot be forwarded between VLANs (although data can still be routed between VLANs). The allClosed mode implies that each VLAN that you create has its own address table. If a device is a member of two VLANs, and the VLAN mode is allClosed, the device address is retained in both address tables. Unnecessary relearning by the address table is prevented, but data cannot be forwarded between VLANs. Router port IP interfaces require allClosed mode.

• If you are using allClosed mode and STP on a Multilayer Switching Module (with multiple routes to a destination), you can also specify the mode called Ignore STP mode to disable STP blocking for a specified static VLAN. (Although each VLAN has its own address table, there is only one STP on the module.) See "Ignore STP Mode" later in this chapter for information on this mode. (To disable STP blocking on a per-port basis with allOpen or allClosed VLANs, you can use the bridging option bridge port stpState on the Administration Console). See Chapter 9 for bridging information.

• Your selection of a VLAN mode affects how you manipulate bridge port addresses. Examples:

  • If you select allClosed mode, you must specify a VLAN interface index to identify the appropriate bridge address table.

  • If you select allOpen mode (the default), only one address table exists for the entire module, so you can manipulate the bridge port addresses without specifying a VLAN interface index.

VLANs on a module are either allOpen or allClosed. You select the VLAN mode on the Administration Console by using the bridge vlan mode command. Because each mode has its own set of rules, a Switch 4007 system may contain mixed modules of different modes. The chassis may contain VLANs on some modules that are allOpen and VLANs on other modules that are allClosed.

Modifying the
VLAN Mode

To change your VLAN mode for a module:

1 .   For a Multilayer Switching Module, delete all routing interfaces (including router port IP interfaces). You cannot change the mode if you have router interfaces defined on the module.

2 .   Modify the VLAN mode to specify the new VLAN mode. When you change the mode, the module deletes all of your existing configured VLANs for the module and reverts to the default VLAN.

3 .   Reconfigure your VLANs (and, for Multilayer Switching Modules, redefine your routing interfaces).

Mode Requirements

Table 50 lists the requirements for defining VLANs in allOpen mode and allClosed mode.

Table 50 Mode Requirements for Static VLANs

Type of Static VLAN	Requirements
Port-based (Layer 2 and Multilayer Switching Modules)	For nonoverlapped port-based VLANs: Protocol type of unspecified Separate member ports (each port-based VLAN owns a different set of ports) For overlapped port-based VLANs: Protocol type of unspecified IEEE 802.1Q tagging for shared ports (the shared ports can employ a tagging mode of none in only one VLAN; shared ports in all other VLANs must use IEEE 802.1Q tagging)
Protocol-based (Multilayer Switching Modules)	For nonoverlapped protocol-based VLANs: Either the protocol type is unique per VLAN or the member ports are unique per VLAN For overlapped protocol-based VLANs (multiple VLANs of the same protocol type that share ports): IEEE 802.1Q tagging for shared ports (the shared ports can employ a tagging mode of none in only one of the same protocol type VLANs; shared ports in all other VLANs of the same protocol type must use IEEE 802.1Q tagging
Network-based (IP VLAN only on Multilayer Switching Modules)	A Layer 3 address that is unique per network-based VLAN For allOpen mode, no tagging restrictions on the shared ports For allClosed mode, IEEE 802.1Q tagging for shared ports (the shared ports can employ a tagging mode of none in only one of the network-based VLANs; shared ports in all other network-based VLANs must use IEEE 802.1Q tagging

Using allOpen Mode

Figure 13 shows an allOpen configuration between two port-based VLANs that share the same address table. In this example, although Station-A and Station-B share a common address table, they must still adhere to broadcast containment rules. If Station-A sends a tagged frame with VLAN-2 in the tag, the frame is forwarded to Station-B if the VLAN is allOpen; if the VLAN mode is allClosed, the packet is not forwarded.

Figure 13 An allOpen Mode Configuration

Using allClosed Mode

Closed VLANs maintain their own unique address tables, as shown in Figure 14. For Layer 2 modules, port-based inter-VLAN traffic can be routed through a Layer 3 module. As shown in Figure 14, traffic can only be passed if the path is routed around VLAN-1 and VLAN-2.

Figure 14 An allClosed Mode Configuration