My situation is that my company makes a product that (currently) requires the user to set up a dozen or so VLANs on a managed switch that is dedicated to the exclusive use with our product.

Currently, the way it works is this: The user enters his system-configuration preferences into a proprietary (Qt-based) GUI that we provide, and when he's done the GUI spits out a "VLAN configuration report" indicating what VLANs need to be set up, and which Ethernet ports should be members of which VLANs. The user is then responsible for using the switch's Web interface to manually enter those settings into the switch.

This "sort of" works, but requiring the user to enter all of that data is both tedious and error-prone, so we'd like to somehow automate the process: that is, have our program connect to the managed switch directly and tell the switch what VLANs to set up and what ports to assign to them.

What is the best way to do this? Is this something that can be accomplished using SNMP? If so, where do I look to start implementing such a function? (I'm fairly experienced with basic TCP/IP programming, but I don't know where to start with SNMP.)

  • 10
    Sell the client a pre-configured managed switch with your product. Their life is easier, yours is easier and more profitable. If they don't want that they can do it themselves, and they feel OK about it because they are saving money. – TessellatingHeckler Aug 11 '11 at 23:44
  • That's a good idea for the initial configuration, but it wouldn't address the case where the customer wants to change his system to a new/different configuration (which isn't unheard of) – Jeremy Friesner Aug 12 '11 at 3:32
  • I googled you, and your company. It looks like the kind of thing that I expect this to be, requires pretty capable switching. It also looks like your clients can pay for a decent (cisco) catalyst switch, so the link I provided in my answer might be your best bet. – Tom O'Connor Aug 12 '11 at 7:33

RFC2674 might help. This would be a non-trivial implementation, but less vendor specific than other possible solutions. It defines the Q-BRIDGE-MIB which allows for changing VLANs via SNMP.


EDIT: I came back to this question to rectify a bad situation. For future readers, the idea of a system that needs 12 VLANs is highly likely to be the sign of something terribly wrong. Furthermore, the notion of automatically configuring a client's networking equipment to create those VLANs has an even higher likelihood of being the Wrong Thing.

Thanks to the sleuthing skills of Tom O'Connor, it was discovered that the product that the question's author is dealing with may have a better reason to do this than most. I emphasize the uncertainty in the situation because, regardless of scenario, I believe the overall concept still has grievous fundamental flaws. I am willing to be wrong.

Again I leave a note to future readers: if you want to do this, assume you're doing the Wrong Thing. Ask others for advice. Others who verifiably know more than you about the topic of network management and your scenario. Only programmatically create a dozen VLANs if you and several other professionals (preferably those who are not emotionally or directly professionally tied to the project) all agree that it's the best thing to do.

Having said the above, my original answer picked on the post's author and should have been less informal. For my part in the harassment I offer direct apologies to Jeremy Friesner, the ServerFault community as a whole and I accept wrongdoing. It did not render the community in a good light.

The remainder of the post is left in its ignobility for what it's worth.

My situation is that my company makes a product that (currently) requires the user to set up a dozen or so VLANs on a managed switch, before the product can be used.

Besides the fact that I just threw up in my mouth a little bit...

My question is, what is the best way to do this?

I think you've already done the best you can do. You would need to make some kind of script that can speak to the most common networking devices through their own preferred method. For example: somehow making a script that talks to Cisco devices over SSH or a serial cable and configures the VLANs and is mindful of your clients' own configurations and VLAN numbers and etc. The script would be very complex script and even so, woulds still probably need to be wizard driven to make sure that the proper options are selected. That means lots of time, lots of effort and lots of special cases to take into consideration. In my opinion, you've done your best to give the client a configuration scheme. It's up to them to handle how it's put in place.

If your product needs a dozen VLANs (Madness! SPARTA!), then your clients shouldn't have to be hand-held through making them all. In fact, I'd think they'd want to make sure that the VLANs are tailored to their own systems and not puked out with a script.

  • 6
    I would literally drive down to your office and beat you senseless if your product started messing around with my switches. Actually, it wouldn't even get that far: as soon as it asked for my switch credentials I would be reaching for my car keys... – gravyface Aug 11 '11 at 23:46
  • 6
    As soon as I saw "Now with 12 VLANS!!" on the box I'd be putting my hockey mask on and searching for a chainsaw. – Wesley Aug 11 '11 at 23:48
  • 7
    Now With 30% More VLAN's! Provides 100% of the Daily Recommended Allowance of VLAN's! Disclaimer: Product Sold by Weight Not by Volume. Product May Contain Red Dye No. 5. – joeqwerty Aug 12 '11 at 0:49
  • 4
    Geez, calm down people. Before I get killed, let me note that the switch being configured is one that is dedicated for use with our product on a private LAN... not a general IT or office switch. I guess I should have been clearer about that. – Jeremy Friesner Aug 12 '11 at 3:23
  • @Jeremy Yes, we can be a bit easy to upset here. =) By and large, what you planned on doing would be bad for 99.9% of scenarios. In your case, methinks it is the best solution you can provide. – Wesley Aug 12 '11 at 7:45

Now that I'm over my initial rage and confusion at the thought of something you'd actually pay for that creates "dozens of VLANs" and wants to automagically destroy configure my switches...

It would be much, much more prudent to just generate some documentation or a network diagram based on values submitted by the customer and the requirements of your product. That way, said customer can assess what real changes that have to be made and plan accordingly.

Creating VLANs willy-nilly in a production environment is an extremely bad thing to want to automate by a 3rd-party that does not have intimate knowledge of the environment.

Even if your code was bulletproof (and with the myriad of versions, vendors, and options, I think this an impossible task), you could completely turf somebody's network inadvertently if the user is inexperienced or perhaps underestimated a change's impact on the network.


This will vary between switches, but years ago when I was regularly configuring 10s of switches from scratch on a weekly basis, I scripted the whole thing up in Perl with Net::Telnet::Cisco. In modern day, I'd probably go with something like Net::SSH::Perl.

Anything you'd end up typing on the console, you can script.


Assuming you're using a Cisco Catalyst switch (which, frankly, you should be).. Then there's two options I can think of.

1) Use Net::Telnet::Cisco to tell the switch to dump the config to a tftp server, grab it from there, parse it with something (augeas springs to mind), then squirt a fresh copy back with tftp.

2) This document seems to do what you want. "Add a VLAN to a Cisco Catalyst Switch With SNMP"

I'm not saying it's a good idea, but it is certainly possible

If I were challenged with doing something similar with a web-based switch, you'd probably find me with Fiddler2 looking at the HTTP requests, then doing something dirty with Python's httplib.

  • Having written a nice wrapper in Python to submit commands via HTTP to Cisco switches, that's a pretty good way to go. The worst part about it is parsing the absolute garbage HTML that the switch pukes out. Naturally, BeautifulSoup helps. – MikeyB Aug 12 '11 at 14:31

There is a way to do this, but it really depends on the type of switch. If it's a Cisco device, you should be able to create a default template config and just let them paste it into it. Otherwise, you could do it via SNMP, but the OIDs could change from vendor to vendor.

Without knowing the model of the switch that's being used, it's really hard to answer properly.


I can't imagine what your product is that requires a dozen different VLANs or how that's physically cabled, but it seems to me that this screams for the use of some sort of VLAN tagging, such as 802.1Q.


If you sell the switches and you sell the product, you could stick with one vendor (say cisco) and write something in expect or as Jeff and others suggested .

But again, VLANs are dangerous and I hope the client's network is indeed studied prior to the deployment.

  • 1
    VLANs are dangerous? {citation-needed} – Zoredache Aug 15 '11 at 23:33
  • Sorry, it sounded vague and was something I should not have mentioned in specific, but just giving up a note, as the VLANs are to be configured by the client and the service provider and the client seem to work individually [chances of human errors]. Just a few cases that I had experienced in the past. – Gaumire Nov 2 '11 at 5:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.