vlan internal allocation policy ascending

If you have worked with Cisco switches for some time you may have noticed this command when viewing the configuration. Ever wonder what it actually means?

Well, I have and today I just so happened to satisfy my own curiosity by looking it up.

In short, it means that the switch will allocate VLANS for internal use starting from VLAN 1006 (because VLAN 1002-1005 are reserved for some legacy stuff that nobody dares remove even though the calendar says 2014).

This may make you go "Oh. Well, of course, that's what it means..." and think no more of it. But, if you are anything like me, you probably went "Ok. What does that mean?". What are VLANS used for "internally" on a Cisco switch?

One example that is easy to setup in the lab is this:

SW01(config)#int gi0/33
SW01(config-if)#no switchport
SW01(config-if)#ip address 192.168.1.1 255.255.255.0

We just changed a switchport on a Catalyst switch into a routed port. Another way of accomplishing this goal would be to do this:

SW01(config)#int gi0/33
SW01(config-if)#switchport access vlan 10
% Access VLAN does not exist. Creating vlan 10
SW01(config-if)#int vlan 10
SW01(config-if)#ip address 192.168.1.1 255.255.255.0

Assuming that interface gi0/33 is the only interface in VLAN 10 - this would pretty much accomplish what the no switchport command does. In fact, it is exactly what the no switchport command does and the vlan internal is the key to show it.

Let us look at the no switchport scenario and see if we can't peek a little behind the curtains.

SW01#show ip interface brief | include GigabitEthernet0/33
GigabitEthernet0/33    192.168.1.1     YES manual down                  down

So, the interface has an IP address assigned manually and it is currently in the down-down state (no cable is attached). Let us try to see some of the internal vlan usage.

SW01#sh vlan internal usage
VLAN Usage
---- --------------------
1006 GigabitEthernet0/33

This shows us that VLAN 1006 has been assigned to GigabitEthernet0/33 (per the allocation policy).

So, what this means is, that when you issue the no switchport command, the switch creates VLAN 1006 and assigns it the IP address and chains it to the physical interface.

A thing to keep in mind is that internally assigned VLANs and user created VLANs share the same database so an error message like the one below is shown if I try to manually create a VLAN that is already assigned internally.

SW01(config)#vlan 1006
SW01(config-vlan)#exit
% Failed to create VLANs 1006
VLAN(s) not available in Port Manager.
%Failed to commit extended VLAN(s) changes.
*Jun 10 08:20:11.932: %PM-4-EXT_VLAN_INUSE: VLAN 1006 currently in use by GigabitEthernet0/33
*Jun 10 08:20:11.932: %SW_VLAN-4-VLAN_CREATE_FAIL: Failed to create VLANs 1006: VLAN(s) not available in Port Manager

You can probably imagine some of the scenarios that might arise if you don't know that this is the way Catalyst switches accomplishes this - maybe you have your own tale to tell on the subject.
Here is a link to an article about one of the more likely situation you might learn of this "feature" in the IOS: http://packetpushers.net/cisco-internal-vlan-usage/

Edit (27-10-2014):
There are a few more things that the no switchport command disables.

You can mimic the no switchport a little better if you issued the following commands:

SW01(config)#no spanning-tree vlan 10
SW01(config)#no mac address-table learning vlan 10
SW01(config)#interface gi0/33
SW01(config-if)#switchport mode access
SW01(config-if)#switchport access vlan 10
SW01(config-if)#switchport nonegotiate
SW01(config-if)#no vtp
SW01(config-if)#exit
SW01(config)#interface vlan 10
SW01(config-if)#ip address 192.168.1.1 255.255.255.0

This disables spanning-tree and mac learning on the vlan, adds the port to the vlan as an access port, disables DTP negotiation and VTP on the port and finally configures an IP address on the SVI (switched virtual interface).