Switch(config)# end\nSwitch# show ip interface brief | include Vlan1\nVlan1 192.168.1.10 YES manual up up\n<\/code><\/pre>\nTest reachability by pinging the upstream gateway:<\/p>\n
Switch# ping 192.168.1.1\nType escape sequence to abort.\nSending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:\n!!!!!\nSuccess rate is 100 percent (5\/5), round-trip min\/avg\/max = 1\/2\/4 ms\n<\/code><\/pre>\nFinally, write the configuration to non-volatile RAM:<\/p>\n
Switch# copy running-config startup-config\n<\/code><\/pre>\n
\n<\/span>Troubleshooting SVI Down\/Down State: Diagnosing Autostate<\/span><\/h2>\nA common frustration when configuring an SVI is issuing no shutdown<\/code> only to discover that show ip interface brief<\/code> reports the interface status as down<\/code> or up<\/code>, with line protocol down<\/code>.<\/p>\nVlan1 192.168.1.10 YES manual up down\n<\/code><\/pre>\nThis behavior is caused by Cisco’s SVI Autostate<\/strong> algorithm. Autostate prevents the switch from routing traffic into a black hole or advertising reachability for a VLAN that cannot forward frames. Use the following diagnostic procedure to identify and resolve SVI line protocol failures.<\/p>\n<\/span>The Autostate Requirements Checklist<\/span><\/h3>\nFor an SVI to transition into the up\/up<\/code> state, the switch verifies that all<\/strong> of the following conditions are met:<\/p>\n\n- VLAN Presence<\/strong>: The corresponding VLAN (e.g., VLAN 1) must exist in the local VLAN database and be active.<\/li>\n
- Administrative State<\/strong>: The SVI itself must not be configured with
shutdown<\/code>.<\/li>\n- Active Forwarding Port<\/strong>: At least one Layer 2 physical port (or Port-Channel) assigned to that VLAN must be in the
up\/up<\/code> operational state.<\/li>\n- Spanning Tree Forwarding<\/strong>: That physical port must be in an STP Forwarding<\/strong> state (not blocking, listening, or learning).<\/li>\n
- Autostate Inclusion<\/strong>: The active port must not be excluded from autostate calculations.<\/li>\n<\/ol>\n
<\/span>Diagnostic Steps<\/span><\/h3>\n1. Verify VLAN Database Status<\/h4>\n
Ensure the VLAN has not been manually suspended or disabled:<\/p>\n
Switch# show vlan id 1\n<\/code><\/pre>\nCheck that the status column reads active<\/code>.<\/p>\n2. Check Member Ports<\/h4>\n
Confirm that at least one physical port is assigned to the VLAN and physically connected:<\/p>\n
Switch# show interfaces status\n<\/code><\/pre>\nFor access ports, ensure the VLAN<\/code> column matches your SVI and the Status<\/code> column shows connected<\/code>. For 802.1Q trunk ports, verify that the VLAN is allowed and not pruned:<\/p>\nSwitch# show interfaces trunk\n<\/code><\/pre>\n3. Inspect Spanning Tree State<\/h4>\n
If a port is connected but the SVI remains down, check whether STP is preventing forwarding:<\/p>\n
Switch# show spanning-tree vlan 1\n<\/code><\/pre>\nThe interface role must be Desg<\/code> or Root<\/code>, and the status must be FWD<\/code>. If STP is stuck in BLK<\/code> (blocking) due to a loop or BPDU guard, the SVI will remain down.<\/p>\n4. Audit the Autostate Exclude Feature<\/h4>\n
Administrators sometimes configure specific monitor or analyzer ports with switchport autostate exclude<\/code>. When applied, that port’s link state is ignored by the SVI:<\/p>\nSwitch# show running-config interface GigabitEthernet 0\/1\ninterface GigabitEthernet0\/1\n switchport access vlan 1\n switchport mode access\n switchport autostate exclude\n<\/code><\/pre>\nIf this is the only active port on the VLAN, remove the exclusion with no switchport autostate exclude<\/code> under the physical interface configuration.<\/p>\n
\n<\/span>Security Hardening Guide: Migrating the Management SVI Away from VLAN 1<\/span><\/h2>\nLeaving management services attached to interface Vlan1<\/code> is a severe security liability. In enterprise architectures, Cisco security benchmarks (including DISA STIG and CIS Controls) mandate isolating management traffic on a dedicated, non-default VLAN.<\/p>\n<\/span>Why VLAN 1 Is a Security Risk<\/span><\/h3>\n\n- VLAN Hopping Vulnerability<\/strong>: Attackers can abuse double-tagged 802.1Q packets or dynamic trunk negotiation (DTP) to jump from access ports to VLAN 1, intercepting or injecting management frames.<\/li>\n
- Default Target Assumption<\/strong>: Reconnaissance scripts, worm scans, and unauthorized tools target default subnets and VLAN 1 first.<\/li>\n
- Control Plane Contention<\/strong>: Because untagged Layer 2 control protocols traverse VLAN 1, broadcast storms or loops on access ports can overwhelm the switch’s CPU, severing administrative access.<\/li>\n
- Unassigned Port Exposure<\/strong>: Any newly connected device on an unconfigured port is dropped into VLAN 1 by default, granting physical access to the management broadcast domain.<\/li>\n<\/ul>\n
<\/span>Step-by-Step Migration to a Dedicated Management VLAN<\/span><\/h3>\nIn this example, management connectivity is moved from Vlan1<\/code> to a dedicated out-of-band management VLAN (VLAN 99<\/code>).<\/p>\nStep 1: Create the Dedicated Management VLAN<\/h4>\n
Define the new management VLAN in the local database:<\/p>\n
Switch(config)# vlan 99\nSwitch(config-vlan)# name Switch_Management\nSwitch(config-vlan)# exit\n<\/code><\/pre>\nStep 2: Configure the New Management SVI<\/h4>\n
Assign the network IP parameters to the new SVI:<\/p>\n
Switch(config)# interface Vlan99\nSwitch(config-if)# description Isolated_Management_SVI\nSwitch(config-if)# ip address 10.10.99.15 255.255.255.0\nSwitch(config-if)# no shutdown\nSwitch(config-if)# exit\n<\/code><\/pre>\nStep 3: Assign Network Ports to the Management VLAN<\/h4>\n
Ensure your upstream connection (access port or trunk link) carries the new VLAN. If connecting via an 802.1Q trunk to a core distribution switch, permit VLAN 99 across the link:<\/p>\n
Switch(config)# interface GigabitEthernet 0\/24\nSwitch(config-if)# switchport trunk allowed vlan add 99\nSwitch(config-if)# exit\n<\/code><\/pre>\nStep 4: Decommission the Default SVI (VLAN 1)<\/h4>\n
Once reachability is verified over the new SVI on VLAN 99, strip the IP configuration from interface Vlan1<\/code> and shut it down:<\/p>\nSwitch(config)# interface Vlan1\nSwitch(config-if)# no ip address\nSwitch(config-if)# shutdown\nSwitch(config-if)# description UNUSED_DEFAULT_SVI\nSwitch(config-if)# exit\n<\/code><\/pre>\nStep 5: Mitigate Lingering VLAN 1 Exposure<\/h4>\n
Harden trunk links by changing the native VLAN to an unused ID and pruning VLAN 1:<\/p>\n
Switch(config)# interface GigabitEthernet 0\/24\nSwitch(config-if)# switchport trunk native vlan 999\nSwitch(config-if)# switchport trunk allowed vlan remove 1\n<\/code><\/pre>\n
\n<\/span>Architectural Comparison: SVI vs. Physical Routed Port<\/span><\/h2>\nOn modern multilayer Cisco Catalyst switches (such as the Catalyst 9200, 9300, and 9500 series), network engineers have two distinct methods for establishing Layer 3 interfaces: creating an SVI<\/strong> or converting a physical interface into a Routed Port<\/strong> using the no switchport<\/code> command.<\/p>\nThe choice between them dictates how Spanning Tree operates, how IP addressing is conserved, and where Layer 2 broadcast domains terminate.<\/p>\n
\n\n\n| Architectural Criteria<\/th>\n | Switch Virtual Interface (SVI)<\/th>\n | Physical Routed Port (no switchport<\/code>)<\/th>\n<\/tr>\n<\/thead>\n\n\nInterface Definition<\/strong><\/td>\n| Logical Layer 3 interface mapped to an internal 802.1Q VLAN.<\/td>\n | Physical Layer 3 port acting identically to an interface on a classic router.<\/td>\n<\/tr>\n | \nLayer Association<\/strong><\/td>\n| Bridges Layer 2 switching and Layer 3 routing within a VLAN.<\/td>\n | Pure Layer 3; Layer 2 switching capabilities are stripped from the port.<\/td>\n<\/tr>\n | \nSpanning Tree (STP)<\/strong><\/td>\nActive<\/strong>. Underlying ports run STP to maintain loop-free Layer 2 topology.<\/td>\nDisabled<\/strong>. STP is completely turned off on this interface; loops are handled by Layer 3 routing.<\/td>\n<\/tr>\n\nPort Mapping<\/strong><\/td>\n1-to-Many<\/strong>. Multiple access and trunk ports can belong to the same SVI.<\/td>\n1-to-1<\/strong>. The IP address belongs strictly to that single physical interface (or Port-Channel).<\/td>\n<\/tr>\n\nIP Subnet Utilization<\/strong><\/td>\n| Shared subnet across all hosts and switches participating in the VLAN.<\/td>\n | Consumes a dedicated point-to-point subnet (typically a \/30<\/code> or \/31<\/code>) per link.<\/td>\n<\/tr>\n | | | | | | | | | | |