| 场景 | VLAN 裁剪、变更审计、安全收敛 |
|---|---|
| 适用 | 全部交换机 |
| 命令族 | port trunk allow-pass vlan / switchport trunk allowed vlan / port trunk permit vlan |
华为 VRP
华为 VRP
[Huawei-GigabitEthernet0/0/24] port trunk allow-pass vlan 10 20 30
[Huawei-GigabitEthernet0/0/24] port trunk allow-pass vlan 40 ! 追加（默认追加）
[Huawei-GigabitEthernet0/0/24] undo port trunk allow-pass vlan 30 ! 移除单个
! 全量重置：先 undo 再重新配思科 IOS
思科 IOS
SW-CORE-01(config-if)# switchport trunk allowed vlan 10,20,30 ! 覆盖设置
SW-CORE-01(config-if)# switchport trunk allowed vlan add 40 ! 追加
SW-CORE-01(config-if)# switchport trunk allowed vlan remove 30 ! 移除
SW-CORE-01# show interfaces trunkH3C Comware
H3C Comware
[H3C-GigabitEthernet1/0/24] port trunk permit vlan 10 20 30
[H3C-GigabitEthernet1/0/24] port trunk permit vlan 40 ! 追加
[H3C-GigabitEthernet1/0/24] undo port trunk permit vlan 30
! 全量重置：undo port trunk permit vlan all 后重配思科有 add/remove 关键字做增删（allowed vlan 直接写是覆盖，极易误清全部）；华为/H3C 的 allow-pass/permit 是追加语义，重置需先 undo。变更前后用 show interfaces trunk / display port vlan 对账。