VLAN Membership and MAC Learning

Scenario: one VLAN, two endpoints

Host A and Host B are Linux endpoints already configured as shown. Both send untagged frames and use /24 masks. They need no default gateway to reach each other. SONiC has no IP interface on Vlan100 in this example.

Configuration: make membership explicit

Use unused VLAN IDs 100 and 200, and ports Ethernet0/Ethernet4 with no L3 address, LAG membership, or existing VLAN membership. If those assumptions fail, stop and select a clean lab allocation rather than remove unrelated configuration.

show version
show vlan config
show interfaces status
config vlan member add --help
sudo config vlan add 100
sudo config vlan member add -u 100 Ethernet0
sudo config vlan member add -u 100 Ethernet4
sudo config interface startup Ethernet0
sudo config interface startup Ethernet4

SONiC setup commands for the reserved lab. Illustrative only; not executed on a SONiC device.

-u matters: without it this baseline creates a tagged member. The endpoints here do not send VLAN tags. Port existence and correct speed/physical connectivity remain separate prerequisites.

Read further: 202505 VLAN membership CLI · 202505 command reference (pinned).

State: membership first, then learning

show vlan config
show vlan brief
show interfaces status Ethernet0
show interfaces status Ethernet4
show mac -v 100

Read-only inspection. Illustrative only; not executed on a SONiC device.

Name       VID  Member     Mode
Vlan100    100  Ethernet0  untagged
Vlan100    100  Ethernet4  untagged

Invented shortened membership output.

Membership describes which ports belong to the bridge domain. A quiet endpoint may have no learned FDB entry yet. From Host A, generate a small demand with ping -c 3 192.0.2.20; then inspect the FDB again.

Vlan  MacAddress         Port       Type
100   02:00:00:00:00:0a  Ethernet0  Dynamic
100   02:00:00:00:00:0b  Ethernet4  Dynamic

Invented FDB excerpt after traffic from both endpoints. Column layout varies.

The switch learns a frame’s source MAC on its ingress port within the VLAN. It looks up the destination MAC to select an egress action. Do not reverse those roles or assume an FDB entry proves the host is reachable now.

Read further: 202505 command reference (pinned) · Windows cross-check revision: FDB orchestration.

Forwarding evidence: follow the first exchange

1. A treats B as on-link and broadcasts an ARP request in VLAN 100. The bridge can learn A’s source MAC.
2. The broadcast reaches eligible forwarding members of VLAN 100, including Ethernet4. B’s reply supplies B’s IP-to-MAC mapping to A and lets the bridge learn B’s source MAC.
3. Subsequent known-unicast frames to B use the VLAN/MAC entry toward Ethernet4. Unknown unicast normally floods only eligible members of that VLAN, subject to platform configuration and forwarding state.

Check host neighbor state, both endpoint captures if available, a bounded ping result, and relevant counters. A hypothetical 3/3 reply result supports that tested exchange only. FDB output is a software-visible view; it is not independent verification of every ASIC table. Virtual behavior does not establish hardware throughput.

Fault and repair: B joins the wrong VLAN

sudo config vlan add 200
sudo config vlan member del 100 Ethernet4
sudo config vlan member add -u 200 Ethernet4
show vlan config
show mac -v 100
show mac -v 200

Isolated fault injection on the reserved B-facing port only. Illustrative only; not executed on a SONiC device.

A remains in VLAN 100; B’s untagged ingress now belongs to VLAN 200. Their matching IP subnet does not merge those broadcast domains. A cannot newly resolve B across this separation. B may learn in VLAN 200 when it transmits. A cached host ARP or stale FDB row can remain temporarily; neither overrides membership or proves delivery.

sudo config vlan member del 200 Ethernet4
sudo config vlan member add -u 100 Ethernet4
sudo config vlan del 200
show vlan config
show mac -v 100

Repair the exact membership change; VLAN 200 must have no other lab use. Illustrative only; not executed on a SONiC device.

Repeat the endpoint exchange and compare membership, learning, and packet results. For full teardown after repair, use the following sequence. It restores the stated absent-VLAN/admin-down switch baseline; endpoints retain their original prepared addresses. Do not automatically config save.

sudo config vlan member del 100 Ethernet0
sudo config vlan member del 100 Ethernet4
sudo config vlan del 100
sudo config interface shutdown Ethernet0
sudo config interface shutdown Ethernet4
show vlan config
show interfaces status

Teardown only after the fault has been repaired and VLAN 200 removed. Illustrative only; not executed on a SONiC device.

Compare the final switch state with the before record.

Check your understanding

Six questions, four choices each. Review the explanation after each answer, then see your score and retry.