Management of ProvisionAsic Based Switches

[cconsult]

Hi folks,

The Management VLAN of my Switches is not VLAN 1 (the default vlan). I have 2 zl8212 acting as router with VRRP. One does the odd vlans (it is the root for the mst instance for all odd vlans) and the other does the routing of the even vlans (spanning-tree root for this instance).
Now I get an issue with a third switch that has connections to both coreswitches. I can't reach one core, because the learned MAC address is on the blocked Port. This happens, because the management comes routed through vlan 1.
Unfortunately the Routers answers to a ping or telnet always with there IP in VLAN 1 and therefor locally routed !!

Is there way to change the "default vlan" or the "management vlan" ? (Manual says "NO") ?

If I disable the second (redundant and blocked) Uplink everything is fine (of course) !

[cenk sasmaztin]

yes it is possible change managent vlan

managemet vlan and default vlan be happen different term.

default vlan ;factory default existent vlan
managemt vlan ;for security network switch managemet vlan

you can change managemet vlan with this command
(config)# management-vlan 99
it not enable switch factory default setting this option so vlan 1 not managemt vlan only default vlan on new switch

if you want open managemet vlan feature
you must be declare managemet vlan command
(for vlan 1 or any vlan )

but as for me your config issue
please send me two core siwtch and one edge switch sh run print

[cconsult]

The "management vlan" setting disables routing to or from this VLAN as a security feature as far as I know.
So this won't help me.
I need to set the management ip address of the switch to a different vlan than "1".

[cenk sasmaztin]

if you want assign ip address on any vlan and (don't use managemet vlan commad)
you can config switch with other vlan address
but managemet pc must be connect this vlan untag port

[cenk sasmaztin]

but very unsecured method

unadvisable

management vlan must be routing and user insulating vlan

[cenk sasmaztin]

as for me your problem is not this

[Olaf Borowski]

Can't you just create a new vlan (999) for management and don't run VRRP on it? This way, you can manage each switch individually (by IP) and not bother with the VIPs.

[Kevin Richter_1]

There are multiple, related (but different) concepts regarding "management" vlans. Vlan 1 is the default vlan and, by default, the primary vlan. You cannot change the default vlan (what is the default), but you can change the primary vlan. Most "management" functions such as stacking will be attempted first in the primary vlan.

The management vlan is a security feature. As mentioned, it will prevent routing to and from the management vlan. Doesn't sound like what you want.

Start with making something other than vlan 1 the primary vlan. If no luck there, I'm with Olaf in suggesting you just don't assign an IP to vlan 1 if you don't want pings and related communcations passing in that vlan.