switchport access

Sets the Layer 2 interface as access.

Syntax

switchport access { vlan vlan_id | rspan-vlan vlan_id | mac HHHH.HHHH.HHHH | mac-group mac-group-id }

no switchport access { vlan vlan_id | rspan-vlan vlan_id | mac HHHH.HHHH.HHHH | mac-group mac-group-id }

Command Default

All Layer 2 interfaces are in access mode and belong to the VLAN ID 1.

Parameters

vlan vlan_id: Sets the port VLAN (PVID) to the specified vlan_id. Range is below 4096 for 802.1Q VLANs, and from 4096 through 8191 for service or transport VFs in a Virtual Fabrics context.
rspan-vlan vlan_id: Sets a VLAN ID for RSPAN (Remote Switched Port Analyzer) traffic analysis.
mac HHHH.HHHH.HHHH: Sets a source MAC address for classifying an untagged VLAN specified by the vlan keyword.
mac-group mac-group-id: (Optional) Specifies a set of MAC addresses. The group of addresses must be established by the global mac-group command.

Modes

Interface subtype configuration mode on edge ports

Usage Guidelines

In access mode, the interface only allows untagged and priority tagged packets.

In a Virtual Fabrics context, use this command also to configure service or transport VFs on an access port. This allows multiple untagged VLANs on the port by means of SRC MAC classifiers.

Enter no switchport access vlan to set the PVID to the default VLAN 1.

Examples

To set the Layer 2 interface PVID to 100 on a specific Ethernet interface:

device# configure terminal
switch(config)# interface ethernet 1/9 
switch(conf-if-eth-1/9)# switchport access vlan 100

To set the PVID to the default VLAN 1 on a specific port-channel interface:

device# configure terminal
switch(config)# interface port-channel 44 
switch(config-Port-channel-44)# no switchport access vlan

The following examples illustrate configuration with service or transport VFs in a Virtual Fabrics context.

In global configuration mode, establish a mac-group:

device# configure terminal
switch(config)# mac-group 1
switch(config-mac-group 1)# mac 0002.0002.0002
switch(config-mac-group 1)# mac 0005.0005.0005
switch(config-mac-group 1)# mac 0008.0008.0008

In interface configuration mode, ensure that the switchport mode is set to access:

device# configure terminal
switch(config)# interface ethernet 1/1
switch(config-if-eth-1/1)# switchport mode access

Set the default access VLAN (the default is 1) to 5000 (a classified VLAN):

device# configure terminal
switch(config)# interface ethernet 1/1
switch(config-if-eth-0/1)# switchport access vlan 5000

Classify an 802.1Q VLAN by means of a source MAC address:

device# configure terminal
switch(config)# interface ethernet 1/1
switch(config-if-eth-1/1)# switchport access vlan 200 mac 0002.0002.0002

Configure a classified VLAN (> 4095) on the same interface with a MAC address. Frames that do not match the source MAC addresses of 0002.0002.0002 or 0004.0004.0004 are classified into VLAN 5000 (the access VLAN for all untagged frames that do not have MAC address classifications.

device# configure terminal
switch(config)# interface ethernet 1/1
switch(config-if-eth-1/1)# switchport access vlan 6000 mac 0004.0004.0004

The following errors occur because a MAC address can be classified to only one VLAN on the same interface.

device# configure terminal
switch(config)# interface ethernet 0/1
switch(config-if-eth-1/1)# switchport access vlan 7000 mac-group 1
switch(config-if-eth-1/1)# %Error: Mac-address/Mac-group is overlapping with another Mac-address/Mac-group configuration on the same port.
switch(config-if-eth-1/1)# switchport mode access
switch(config-if-eth-1/1)# switchport access vlan 7000 mac-group 1
switch(config-if-eth-1/1)# switchport access vlan mac 8000 0008.0008.0008
switch(config-if-eth-1/1)# %Error: Mac-address/Mac-group is overlapping with another Mac-address/Mac-group configuration on the same port.