{{ summaryHeading }}
{{ summaryValue }}

{{ summaryLine }}

Profile{{ profileLabel }} VLAN policy{{ vlanPolicyLabel }} Admin{{ admin_state === 'enable' ? 'no shutdown' : 'shutdown' }}
{{ topologyRangeLabel }} {{ topologyVlanLabel }} {{ mode === 'access' ? 'Endpoint edge' : 'Peer trunk' }}
Select the CLI family before reviewing range, trunk, DTP, or spanning-tree syntax.
Changing mode updates the visible VLAN controls, generated commands, review rows, chart, and exports.
Example: GigabitEthernet1/0/1-24. Confirm every member exists before applying the stanza.
Use a shared operational label such as User access floor 3 or Uplink trunks to distribution.
IOS profiles emit switchport nonegotiate; NX-OS and EOS record an omission warning.
{{ nonegotiate ? 'Enabled' : 'Disabled' }}
The selected state is always emitted as the final interface command.
Adds session wrapper lines without changing the interface policy.
{{ include_wrapper ? 'Enabled' : 'Disabled' }}
Leave blank to omit the command.
%
Leave blank to retain the platform default or existing value.
bytes
The neutral blank default emits no speed command.
The neutral blank default emits no duplex command.
{{ values.config_text }}

The chart renderer is unavailable. The command ledger still shows every generated line.

StepCommandAreaPurposeOperator noteCopy
{{ row.step }}{{ row.command }}{{ row.category }}{{ row.purpose }}{{ row.note }}
SeverityCheckFindingActionCopy
{{ row.level }}{{ row.check }}{{ row.detail }}{{ row.recommendation }}
VLAN Config Consistency Checker Compare switch VLAN evidence with intended trunk and native rules plus database, reserved-VLAN, and VLAN 1 policy before a change.
Interface Description Standard Checker Check network interface descriptions for endpoint evidence and policy gaps, then prioritize duplicates or length issues before cleanup and change review.
Cisco Interface Config Generator Generate Cisco interface commands for routed, access, or trunk ports with profile-aware syntax plus normalized VLAN lists and review warnings.
Static Route Commands Generator Generate reviewed static-route commands across host and network CLIs with CIDR normalization plus priority checks and rollback-ready delete output.

A switchport's link role determines which Ethernet frames it should carry. An access port normally connects one endpoint to one untagged data VLAN. A trunk carries multiple VLANs between devices or to a VLAN-aware endpoint, with an allowed list controlling which tagged networks may cross the link.

Link roleTypical peerVLAN decisionsCritical check
AccessWorkstation, printer, camera, or phoneAccess VLAN and optional voice VLANConfirm the entire selected range is host-facing.
TrunkSwitch, router, firewall, hypervisor, or access pointNative VLAN and allowed VLAN policyCompare both ends before changing the list.

The native VLAN deserves separate attention. On an IEEE 802.1Q trunk it handles untagged traffic, and both ends should use the same native VLAN and tagging policy. A mismatch can place traffic in the wrong broadcast domain and may contribute to spanning-tree problems.

Edge or PortFast behavior removes the normal spanning-tree startup delay for endpoint links. That assumption becomes dangerous on an ordinary switch-to-switch link because the port can forward before spanning tree detects a redundant path. BPDU Guard enforces the endpoint assumption by disabling a port that receives a bridge protocol data unit.

Configuration syntax also varies between IOS, older IOS dot1q profiles, NX-OS, and Arista EOS. A command accepted by one family may be absent or spelled differently on another. A generated stanza cannot inspect the current interface configuration, peer state, VLAN database, hardware limits, or software release, so it must be reviewed as a proposed change rather than pasted as a discovery mechanism.

How to Use This Tool:

Choose one syntax family and one consistent interface role before setting VLAN policy.

  1. Select the Syntax profile, choose Access or Trunk, and enter one safe Interface range. Confirm every member exists and serves the same purpose.
  2. For access ports, set the data VLAN and optional voice VLAN. Enable edge behavior and BPDU Guard only for endpoint-facing links.
  3. For trunks, set the native VLAN and choose whether the allowed list replaces, adds, removes, excludes, allows all, or allows none. Compare the choice with the current trunk and its peer.
  4. Review Paste safety review and the command ledger. Resolve reserved VLAN, edge-link, DTP, manual speed, MTU, and administrative-state warnings before copying the stanza.

Interpreting Results:

A Pass finding means an input satisfied one local rule. It does not prove the VLAN exists, the interface range is supported, the peer agrees, or the target release accepts every command.

  • Read the normalized VLAN list before the command text. Duplicates are removed, ranges are sorted and compressed, and the original order is not preserved.
  • Treat every Warning as a change-review item. The current-configuration and administrative-state checks warn by design because forwarding may change immediately.
  • Compare the final stanza with the captured running configuration and prepare exact rollback commands. The output does not merge with existing switchport settings.

Technical Details:

The command model validates one interface selector, normalizes VLAN policy, applies an access or trunk branch, and then adds optional protection and physical-interface commands. Platform selection changes interface-context and edge-port syntax; it does not query the switch.

Rule Core:

BranchRequired command sequenceConditional rules
Common baselineSelect the interface context, add an optional description, and emit switchport.IOS profiles use interface range; NX-OS and EOS use interface with the supplied selector.
AccessSet static access mode and the access VLAN.A voice VLAN is emitted when greater than zero. Edge and BPDU Guard commands follow their switches.
TrunkSet static trunk mode, native VLAN, and allowed VLAN policy.The legacy IOS profile also emits dot1q encapsulation. Edge-trunk and trunk BPDU Guard are independent choices.
DTPEmit switchport nonegotiate only for IOS and legacy IOS when requested.NX-OS and EOS produce a warning instead of that IOS command.
Advanced physical settingsOptionally emit broadcast storm control, MTU, speed, and duplex.Each produces a review warning because support and semantics vary by model and release.
Administrative finishEnd with no shutdown or shutdown.An optional configure terminal and end wrapper surrounds the stanza.

Allowed VLAN input is expanded into unique IDs, sorted numerically, and compressed back into contiguous ranges. The operation token then determines how the switch should treat that normalized set.

OperationGenerated policy meaningReview risk
ReplaceSet the allowed list to exactly the normalized VLANs.VLANs absent from the list are removed from the trunk policy.
Add or RemoveModify the current allowed list by the normalized VLANs.The effect depends on the current trunk state.
ExceptAllow every VLAN except the normalized list.This is a broad inverse policy.
AllAllow all VLANs.Trunk pruning is removed.
NoneAllow no VLANs.User traffic on the trunk can stop.
ValueAccepted range or formAdditional warning
Interface rangeOne line, at most 120 characters, using a restricted Cisco-style character set and no shell or CLI metacharactersThe estimated port count is based only on a trailing numeric range or comma-separated selectors.
VLAN IDsWhole numbers from 1 through 4094; voice VLAN may be 0 to omit itVLAN 1, IOS legacy reserved VLANs 1002 to 1005, and NX-OS internal range 3968 to 4094 are flagged.
Storm control0% through 100%Rendered with two decimal places; verify the target's threshold behavior.
MTUWhole bytes from 576 through 9216Verify every port, transceiver, and peer path.
Speed10, 100, 1000, 10000, 25000, 40000, or 100000 MbpsManual speed is always flagged for capability review.
DuplexFull, half, or omittedManual duplex is always flagged for compatibility review.

Edge mode and BPDU Guard remain separate because one setting changes spanning-tree startup behavior while the other reacts to received bridge messages. The review warns whenever edge behavior is selected and adds a separate warning when BPDU Guard is enabled without the corresponding edge selection.

Limitations:

The generated stanza cannot determine whether it is safe to replace existing commands. It does not inspect port-channel membership, routed-port state, VLAN creation, spanning-tree mode, authentication, power delivery, quality-of-service policy, transceiver support, or peer configuration.

  • Verify syntax against the exact switch model and software release.
  • Apply a range only when every member has the same intended role.
  • Capture the running stanza and use the platform's normal review, commit, save, and rollback process.

Worked Examples:

Host-facing access range

An IOS range such as GigabitEthernet1/0/1-24 with access VLAN 20, voice VLAN 120, edge behavior, and BPDU Guard produces one shared access stanza for an estimated 24 ports. The warning set still requires confirmation that every port is endpoint-facing and that both VLANs exist.

Add VLANs without replacing the trunk

For an existing trunk, choosing Add VLANs with 30-32,31,40 normalizes the set to 30-32,40 and reports the duplicate. That is materially different from Replace allowed VLAN list, which would make the same normalized set the complete policy.

References: