InterVLAN Routing

In this lesson we are going to take a look at routing between VLANs. When we want communication between different VLANs we’ll need a device that can do routing. We could use an external router but it’s also possible to use a multilayer switch (aka layer 3 switches).

Let’s look at the different options!

Router on a Stick

router on a stick configuration example

SW1 has two VLANs so we have two different subnets. If we want communication between these VLANs we’ll have to use a device that can do routing. In this example we’ll use a router for the job. R1 will need access to both VLANs so we’ll create a 802.1Q trunk between SW1 and R1. Here’s how to configure this:

SW1(config)#interface fa0/3
SW1(config-if)#switchport trunk encapsulation dot1q 
SW1(config-if)#switchport mode trunk 
SW1(config-if)#switchport trunk allowed vlan 10,20

This is how we configure SW1. Make interface fa0/3 a trunk port and for security measures I made sure that only VLAN 10 and 20 are allowed.

R1(config)#interface fa0/0.10
R1(config-subif)#encapsulation dot1Q 10
R1(config-subif)#ip address 192.168.10.254 255.255.255.0
R1(config)#interface fa0/0.20
R1(config-subif)#encapsulation dot1Q 20
R1(config-subif)#ip address 192.168.20.254 255.255.255.0

Create two sub-interfaces on the router and tell it to which VLAN they belong. Don’t forget to add an IP address for each VLAN.

R1#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C    192.168.10.0/24 is directly connected, FastEthernet0/0.10
C    192.168.20.0/24 is directly connected, FastEthernet0/0.20

The router will be able to route because these two networks are directly connected.

C:\Documents and Settings\H1>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 192.168.10.1
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.10.254
C:\Documents and Settings\H2>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 192.168.20.1
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.20.254

Don’t forget to set your IP address and gateway on the computers.

Let’s try a ping:

C:\Documents and Settings\H1>ping 192.168.20.1

Pinging 192.168.20.1 with 32 bytes of data:

Reply from 192.168.20.1: bytes=32 time<1ms TTL=128
Reply from 192.168.20.1: bytes=32 time<1ms TTL=128
Reply from 192.168.20.1: bytes=32 time<1ms TTL=128
Reply from 192.168.20.1: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.1.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

That’s how you do it. So why would you want to use a solution like this? It’s cheap! You don’t need a multilayer switch for your routing. Any layer 2 switch will do.

The Cisco Catalyst 2960 is a layer 2 switch; the cheapest multilayer switch is the Cisco Catalyst 3560. Compare the price on those two and you’ll see what I’m talking about.

Some of the disadvantages of this solution is that your router is a single point of failure and that traffic flows up and down on the same link which might cause congestion.

Configurations

Want to take a look for yourself? Here you will find the configuration of each device.

R1

hostname R1
!
interface fastEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.254 255.255.255.0
!
interface fastEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.254 255.255.255.0
!
end

SW1

hostname SW1
!
interface fastEthernet0/1
 switchport mode access 
 switchport access vlan 10
!
interface fastEthernet0/2
 switchport mode access 
 switchport access vlan 20
!
interface fastEthernet0/3
 switchport trunk encapsulation dot1q 
 switchport mode trunk 
 switchport trunk allowed vlan 10,20
end


So what other solutions do we have?

SVI (Switch Virtual Interface)

switch virtual interface example

This is the picture of a multilayer switch. This switch has routing capabilities! I can configure something called a SVI (Switch Virtual Interface) for each VLAN and put an IP address on it. This IP address can be used for computers as their default gateway. Here’s how to configure it:

SW1(config)#ip routing
SW1(config)#interface vlan 10
SW1(config-if)#no shutdown
SW1(config-if)#ip address 192.168.10.254 255.255.255.0
SW1(config)#interface vlan 20
SW1(config-if)#no shutdown
SW1(config-if)#ip address 192.168.20.254 255.255.255.0

Start by enabling routing using the ip routing command. If you forget this your switch won’t build a routing table! Next step is to create a SVI for VLAN 10 and 20 and configure IP addresses on them. This configuration might look familiar if you worked with layer 2 switches before. On a layer 2 switch like the Cisco Catalyst 2950/2960 we also have a SVI but you can only use it for remote management.

Once you create a SVI and type no shutdown it will normally be “up” since it’s only a virtual interface, there are however a number of requirements or it will show up as “down”:

  • The VLAN has to exist in the VLAN database and it should be active.
  • At least one access or trunk port should use this VLAN actively and it should be in spanning-tree forwarding mode.

Simply said: the VLAN has to be active somehow or your SVI will go down.

svi interface up

I have two computers in VLAN 10 and created a SVI for VLAN 10.

SW1#show ip interface brief vlan 10
Interface              IP-Address      OK? Method Status                Protocol
Vlan10                 192.168.10.254  YES manual up         up

You’ll see that the status says up/up so that’s good.

svi interface still up

If I shutdown one interface nothing will change, my SVI will still show up/up because interface fa0/2 is still active.

svi interface down

SW1#show ip interface brief vlan 10
Interface              IP-Address      OK? Method Status                Protocol
Vlan10                 192.168.10.254  YES manual up         down

Once I shut both interfaces we don’t have anything active anymore in VLAN 10. As a result the SVI will go to up/down.

Now if I want I can exclude an interface from the SVI state. Imagine I want to make sure that whatever happens to interface fa0/2 doesn’t influence the SVI state:

SW1(config)#interface fa0/2
SW1(config-if)#switchport autostate exclude

I can use the switchport autostate exclude command. This means it won’t influence the state of the SVI interface anymore. Fa0/1 is the only interface that can now influence the SVI state, as soon as it goes down you’ll see that SVI state go down as well, even though fa0/2 is still up and running.

Enough about the SVI, there’s another method we can use our multilayer switch for routing. By default all interfaces on a switch are switchports (layer 2) but we can change them to routed ports (layer 3). A routed port is the exact same interface as what we use on a router.

Configurations

Want to take a look for yourself? Here you will find the configuration of SW1.

SW1

hostname SW1
!
ip routing
!
interface vlan 10
ip address 192.168.10.254 255.255.255.0
!
interface vlan 20
ip address 192.168.20.254 255.255.255.0
!
interface FastEthernet0/2
switchport autostate exclude
!
end


Enough about SVI, there’s another method we can use for routing on multilayer switches.
We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 655 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

535 Sign Ups in the last 30 days

satisfaction-guaranteed
100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Forum Replies

  1. Rene,

    I have a Cisco SG300-28 PoE+ switch and am having an old age moment in setting up VLans. Would you know the answer to or be able to assist with the following:

    My network has:

    1 router, which also handles DHCP duties with one range currently specified 192.168.1.x/24
    1 switch
    1 WAP
    and about 40 nodes

    I want to create multiple VLANS on the Cisco SG300 switch.

    Vlan10 - Mgmnt
    Vlan20 - Children
    Vlan30 - AV
    Vlan40 - Automation
    Vlan50 - VoIP
    Vlan60 - Guest

    What are the steps necessary after creating the Vlans in this scenario to make things work?

    WAP is on port 1

    ... Continue reading in our forum

  2. Hello Dinh.

    I had a production network where I wanted to implement exactly what you describe. The solution I used was access lists as you mentioned. It is probably the fastest and most immediate solution. However, there are a couple of other solutions that may be more flexible as well. These are described below:

    VLAN access list - This is just an access list but it filters based on VLAN rather than IP. It is a layer 2 solution. An example configuration can be seen below:

    interface Vlan1
    no ip address
    shutdown
    !
    interface Vlan2
    description VLan connected t
    ... Continue reading in our forum

  3. Hello Brian

    Please allow me to step in and participate, as this is an issue that I had trouble in visualising and understanding. I hope I can be of some help. For the most part, you’ve got it, maybe I can make things a little bit clearer for you.

    ... Continue reading in our forum

  4. Hello Arindom

    There are two fundamental differences between your config and mine. Your config is what is called a “router on a stick” where the routing takes place in the router itself. This means that any traffic from VLAN 10 to VLAN 20 for example will go to the router, be routed from the Fe0/0.10 interface to the Fe0/0.20 interface, be sent back to the switch and to the appropriate device on VLAN 20.

    My config involves interVLAN routing, which is routing from one VLAN to another within the Layer 3 switch itself. In this case, routing takes place from one

    ... Continue reading in our forum

  5. Hi Nityanand,
    this “L3” written over the line means that both link end-points on switches are routed ports. We can add one more link interconnecting switches, make both of its end-points routed ports. Bundle links together, add IP on each end-point of port-channel and then run OSPF over it. It is no problem, should look like this.

    //cdn-forum.networklessons.com/uploads/default/original/2X/6/6c03ec646e325fc129b469d8c9d9523622802d73.png

    Create virtual port-channel interface, make it routed port-channel and add IP on it.

    SW2(config)# interface port-channel 23
    SW2(
    ... Continue reading in our forum

80 more replies! Ask a question or join the discussion by visiting our Community Forum