Multi-VLAN Configuration of Huawei Core Switches

Huawei core switches support multi-VLAN configurations using VLAN creation, port assignment, and Layer 3 inter-VLAN communication via VLANIF or sub-interfaces.VLAN Creation and Port AssignmentAccess the CLI: Connect via console, SSH, or Telnet to the switch .Create VLANs: Use the vlan batch command to create multiple VLANs at once. For example, vlan batch 10 20 30 creates VLANs 10, 20, and 30 .Assign Ports:Access Ports: Bind end devices to a VLAN using:CodeCopyinterface range GigabitEthernet 0/0/1 to 0/0/25port link-type accessport default vlan 10 This assigns VLAN 10 to the selected ports .Trunk Ports: For inter-switch links carrying multiple VLANs:CodeCopyinterface GigabitEthernet 0/0/26port link-type trunkport trunk allow-pass vlan 10 20 30 This allows VLAN-tagged traffic to traverse the trunk .VLAN Forwarding and SecurityHuawei switches support VLAN Switch and stack-vlan features to improve forwarding efficiency and security. Stack-vlan adds an outer VLAN tag to frames, while switch-vlan modifies VLAN tags between interfaces, helping prevent broadcast storms and MAC address attacks . VLANs can also be dynamically assigned using RADIUS authentication, and unused ports can be placed in a “dead” VLAN to block unauthorized access .Inter-VLAN CommunicationBy default, VLANs isolate broadcast domains, so hosts in different VLANs cannot communicate at Layer 2. To enable inter-VLAN communication:VLANIF Interfaces: Create a Layer 3 logical interface for each VLAN and assign an IP address:CodeCopyinterface Vlanif10ip address 192.168.10.1 255.255.255.0 Repeat for each VLAN. This method is simple but consumes IP addresses for each VLAN .Sub-Interfaces (Dot1q Termination): Use a single physical interface to connect multiple VLANs via sub-interfaces:CodeCopyinterface GigabitEthernet0/0/1.10encapsulation dot1q 10ip address 192.168.10.1 255.255.255.0 This is efficient for uplinks but may become a bottleneck under heavy traffic .Best PracticesAvoid using VLAN 1 for management or sensitive traffic; create custom VLANs for departments or IoT devices .Enable STP/MSTP to prevent loops and reduce convergence time.Use VLAN ACLs (vlan-filter) to enforce traffic rules and prevent unauthorized access.Implement DHCP snooping and IP source check to protect against rogue DHCP servers and spoofed requests .Audit VLANs regularly and test failover scenarios to ensure network resilience. By following these steps, Huawei core switches can efficiently handle multiple VLANs, provide secure segmentation, and enable controlled inter-VLAN communication.