I have two devices not managed by myself (let's call them A and B) that should be directly connected, but due to cabling reasons they have to go over at least 2 switches used by my internal network.


I've tried with a dedicated VLAN (access on ports where A and B are connected) but it failed, because I've discovered later that devices don't use "standard" access traffic but tagged traffic on VLAN ID 9 and 10.

I could solve it simply adding VLAN 9 and 10 to the switches and two trunk ports for A and B, problem is that VLAN ID 10 it's already used by my internal network and devices A and B should be connected point-to-point.

Is there anything else that I could do in order to prevent changing all my internal network on another VLAN ID?


  • 2
    Reconfigure the devices or use Q-in-Q tunnels. – Tommiie Dec 2 '18 at 10:39
  • I cannot reconfigure devices A and B because they are not under my control but managed by an external supplier that has 9 and 10 as default and doesn't want to change them. I'll look into Q in Q – Gabriele-V Dec 2 '18 at 12:57
  • I've searched for Q-in-Q and seems that could do the trick, but it's supported only on datacenter routers/switches, I have just two "simple" 2960X – Gabriele-V Dec 2 '18 at 13:14
  • Is there used anything else then 9T,10T ? What is untagget / native VLAN ? In case just these two VLANs are in use would it be possible to communicate to use VLAN 10 as native (untagged) and just tagged VLAN 9 on device A and B? In that case you can "transport" VLAN 9 and for native (untagged) trafffic use any free VLAN ID in your structure. – Kamil J Dec 2 '18 at 19:16
  • On devices side, they use only VLAN 9 and 10 without untagged traffic. On my switch side, I have others 5/6 VLAN used, trunk native VLAN it's the default so VLAN 1. They want to keep everything as is without modify anything because A and B should be directly connected, moreover they don't support transport over customer switches, but there shouldn't be any problem, a part of this ID conflict.. – Gabriele-V Dec 2 '18 at 20:11

I am not sure about the licence / image you have on the switch and if it would be available on your device but in general for the cases like this there is "native" function for VLAN translation.

Let's take example for port gigabitEthernet 1/0/19 and to translate VLAN 10 to VLAN 15:

Router(config)# interface gigabitEthernet 1/0/19
Router(config-if)# switchport vlan mapping enable
Router(config-if)# switchport vlan mapping 10 15
Router(config-if)# end

to disable (one of the following based on the use case):

Router(config-if)# no switchport vlan mapping 10 15
Router(config-if)# no switchport vlan mapping all

to check

Router# show interface gigabitEthernet 1/0/19 vlan mapping

In case you have 2 spare devices supporting VLANs you can do "hardware translation". To setup TRUNK with allowed VLANs 9,10 on the port facing the device. Set some other port to ACCESS mode with VLAN 10 and some other port to ACCESS with any VLAN which is not conflicting the rest of the network (let say 15). Use some short patch cable to interconnect these two ports in access mode. Then you can set the TRUNK port connected to the rest of the infrastructure with allowed VLAN 9,15 (explicitly not allowed 10 otherwise you would mix it up;-) ). Then you need the same setup on the other side to "restore" device's VLAN 10.

Device A                  Spare switch                  other network device
9T,10T |------------------| 9T,10T    |                  |
       |                  |           |                  |
       |                  |    9T,15T | ---------------- | 9T,15T
       |                  |           |                  |
       |               ---| 10        |                  |
       |       (patch) |  |           |                  |
       |               ---| 15        |                  |
       |                  |           |                  |

In case you will go this way please take care of STP (Spanning tree protocol) - e.g. you can enable bpdu filter to eliminate all spanning tree communication on the port

Router(config-if)# spanning-tree bpdufilter enable

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.