Skip to content

fix: cisco vlan mask patching logic#483

Open
azryve wants to merge 5 commits intomainfrom
fix/cisco-trunk-vlanmask-patching
Open

fix: cisco vlan mask patching logic#483
azryve wants to merge 5 commits intomainfrom
fix/cisco-trunk-vlanmask-patching

Conversation

@azryve
Copy link
Contributor

@azryve azryve commented Feb 2, 2026

This MR fixes custom logic swtrunk() for switchport trunk allowed command.
Added vlandb tests just to make sure that changes does not affect other configuration block.

Current patching logic of swtrunk() seems to be actually broken.
By default on cisco ios when you enable switchport mode trunk all vlan ids are permitted.
AFAIK it has always been the case.

On setting mask on iface in a default state swtrunk() logic issues switchport trunk allowed vlan add ... which is ignored by the device. Again because all vlans are allowed by default.

On removal it issues an invalid no switchport trunk allowed vlan remove ... which instead removes entire allowed vlans config. Because it gets interpreted as no switchport trunk allowed vlan.

So summary of changes in cisco/vlandb.py:

  • refactored tenary if ... else - the code is complicated enought as is.
  • fix "no switchport trunk allowed vlan remove" - its a direct cmd.
  • issue "switchport trunk allowed vlan none" if no old mask existed - by default all vlans are allowed.
  • issue "no switchport trunk allowed vlan" if no new mask added - this returns state to a default.

allowed vlan testcases were validated on:

  • ios xe 17.12.06
  • ios 15.0(2)SE11

PS: I am still not sure if we need this add/remove complexity but I spent too much time on this already and too afraid to touch it at this point.

@azryve azryve marked this pull request as ready for review February 2, 2026 12:25
@azryve azryve force-pushed the fix/cisco-trunk-vlanmask-patching branch from b6641c7 to 52dd429 Compare February 3, 2026 09:47
@azryve azryve requested a review from Tishka17 February 4, 2026 12:24
@azryve azryve force-pushed the fix/cisco-trunk-vlanmask-patching branch 3 times, most recently from 3ed90de to a136687 Compare February 4, 2026 19:05
@azryve azryve force-pushed the fix/cisco-trunk-vlanmask-patching branch 2 times, most recently from 7f15679 to 48a9d3b Compare February 5, 2026 10:05
Stuff in swtrunk() does not seem to be reqired at all.
By default vlan mask is "allowed all".
When you run "allowed vlan 10,20,30" it replaces current mask.
This is exactly a behaviour that default patching assumes.
After playing around with config I finally realised the reason for custom logic.
There are cases when allowed vlans are splitted in a following manner:

switchport trunk allowed vlan 10,20,30,40,50,60,70,80,90,100,110,120,130,140
switchport trunk allowed vlan add 150,160,170

This in turn requires a custom logic. So I reverted swtrunk() back.
Still the old beheviour is obviously broken so I spent a day checking behaviour with minimal changes.

Summary of changes in cisco/vlandb.py:

- refactored tenary if ... else - the code is complicated enought as is
- fix "no" from "switchport trunk allowed vlan remove" - its a direct cmd
- issue "switchport trunk allowed vlan none" if no old mask existed - by default all vlans are allowed
- issue "no switchport trunk allowed vlan" if no new mask added - this returns state to a default
@azryve azryve force-pushed the fix/cisco-trunk-vlanmask-patching branch from 48a9d3b to 8ed6732 Compare February 5, 2026 10:11
@azryve azryve requested review from anteron1992 and grigory51 and removed request for Tishka17 February 5, 2026 11:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant