Cisco NX-OS VLAN & Switchport Config

Cisco NX-OSBeginner

VLAN database, SVI interfaces, trunk and access switchport configuration for Cisco Nexus switches.

What is it?

NX-OS VLAN configuration is similar to IOS with key differences. NX-OS requires 'feature interface-vlan' to create SVI interfaces. NX-OS uses HSRP (Hot Standby Router Protocol) version 2 for gateway redundancy — in a vPC pair, both switches run HSRP but only one is active per VLAN. For VXLAN EVPN deployments, VLANs are mapped to VNIs using 'vn-segment' commands. NX-OS also supports 'spanning-tree port type edge' instead of IOS 'spanning-tree portfast' for fast port convergence.

✓ When to use

·Segmenting server traffic in data center environments (servers, storage, management VLANs)
·Defining VLAN-to-VNI mappings in VXLAN EVPN fabrics
·Configuring SVIs with HSRP for redundant default gateways on vPC leaf pairs
·Any standard Layer 2 segmentation requirement on Nexus switches

✗ When NOT to use

·For VXLAN EVPN tenants — use the bgp-evpn template which handles VNI-to-VLAN mapping and VRF configuration
·When you have more than ~4000 VLANs — use VXLAN VNIs for scale beyond the 4094 VLAN limit

How it compares

vs Cisco IOS VLANsNX-OS requires 'feature interface-vlan' before creating SVIs. NX-OS uses 'spanning-tree port type edge' instead of 'spanning-tree portfast'. HSRP config syntax is slightly different but functionally the same.

vs VXLAN EVPN L2VNITraditional VLANs are L2-only and limited to a single L2 domain. VXLAN VNIs extend the same L2 segment across any IP network. In a VXLAN fabric, VLANs still exist locally but are mapped to VNIs for fabric-wide distribution.

Prerequisites

→'feature interface-vlan' must be enabled before SVIs can be created
→'feature hsrp' must be enabled if using HSRP for gateway redundancy
→For vPC deployments, HSRP virtual IPs must match on both vPC peers
→VLANs used for VXLAN must also have 'vn-segment' mappings (see bgp-evpn template)

Config Generator

Hostname *

VLANs

Trunk Interfaces

Access Ports

Verification commands

show vlan brief

List all VLANs and their status

Expected: All configured VLANs should show 'active'. VLANs show as 'act/lshut' if suspended.

show interface vlan <id>

Verify SVI status and IP address

Expected: Interface should be up/up. Line protocol up only when a port in the VLAN is active.

show hsrp brief

Show HSRP state for all SVIs

Expected: One switch should show 'Active', the other 'Standby'. Active hold the virtual IP and responds to ARP.

show interface trunk

Show trunk interfaces and which VLANs are active on each trunk

Expected: VLANs should appear in the 'VLANs in STP Forwarding' column for them to carry traffic.

Debug commands

show spanning-tree vlan <id>

Show spanning tree topology for a specific VLAN

Common mistakes & fixes

⚡ SVI interface is up but line protocol is down

Cause: No active ports assigned to that VLAN, or VLAN is not in the VLAN database

Fix: Verify 'show vlan id <id>' shows the VLAN as active. Connect at least one active port to the VLAN.

⚡ HSRP stuck in INIT or both switches active

Cause: HSRP packets being blocked (VLAN not on trunk), or virtual IP mismatch between vPC peers

Fix: Verify HSRP hello packets reach the peer: check trunk allows the VLAN. Verify virtual IP matches on both switches.