Open navigation menu
Close suggestions
Search
Search
en
Change Language
Upload
Sign in
Sign in
Download free for days
0 ratings
0% found this document useful (0 votes)
47 views
Firewall Design
d
Uploaded by
mohammed suhel
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content,
claim it here
.
Available Formats
Download as PDF or read online on Scribd
Download now
Download
Save Firewall Design For Later
Download
Save
Save Firewall Design For Later
0%
0% found this document useful, undefined
0%
, undefined
Embed
Share
Print
Report
0 ratings
0% found this document useful (0 votes)
47 views
Firewall Design
d
Uploaded by
mohammed suhel
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content,
claim it here
.
Available Formats
Download as PDF or read online on Scribd
Download now
Download
Save Firewall Design For Later
Carousel Previous
Carousel Next
Save
Save Firewall Design For Later
0%
0% found this document useful, undefined
0%
, undefined
Embed
Share
Print
Report
Download now
Download
You are on page 1
/ 43
Search
Fullscreen
Practical ® Networking Routing Between VLANs We wrote an article which covers Virtual Local Area Networks (VLANs) as a concept, and another article on configuring VLANs fon Cisco switches, The remaining subject to cover is the different options that exist for routing between VLANS. This is also sometimes called inter-vian routing, or occasionally Router on a Stick (Roa) Why do we need Routing Between VLANs? 'As we learned in 3 prior article, VLANS create a losical separation between Switch ports. Essentially, each VLAN behaves like @ separate physical switch. To illustrate this, below are two topology pictures of the same environment — one Physical and one Logical psunapeaiedhetnrengnatitalonaouin teen! usThe Physical topology depicts a switch and four hosts in two different VLANs ~ Host A and Host B are in VLAN 20 and Host C and Host D are in VLAN 30. The logical topology reflects how the physical topology operates — the two VLANs essentially create ‘two separate physical switches. Prysical Logical Despite all four hosts being connected to the same physical switch, the logical topology makes it clear that the hosts in VLAN 20 are unable to speak with the hosts in VLAN 30, Notice since there is nothing connecting the two “Virtual” switches, there is no way for Host A to speak to Host C. Since Host A and Host C are in different VLANs, itis also implied that they are in different Networks. Each VLAN will typically correspond to its own IP Network. In this diagram, VLAN 20 contains the 1@.0.28.0/24 network, and VLAN 30 contains the 10.0.30.0/24 network, ‘The purpose of a Switch is to facilitate communication within networks. This works great for Host A trying to speak to Host 8, However, if Host Ais trying to speak to Host C, we will need to use another device one whose purpose is to facilitate communication between networks. osunpeacieshetnrengattanlonaouin etcen aan! aIf you've read the Packet Traveling series, then you know that the device which facilitates communication between networks is a Router. ‘A router will perform the routing function necessary for two hosts an different networks to speak to one another. In the same way. a Router is what we will need in order for hosts in diferent VLANs to communicate with one another. ‘There are three options available in order to enable routing between the VLANS: + Router with a Separate Physical Interface in each VLAN + Router with a Sub-Interface in each VLAN + Utilizing a Layer 3 Switch The remainder of this article will explore these three options and their configuration Router with Separate Physical Interfaces The simplest way to enable routing between the two VLANs to simply connect an additional port from each VLAN into a Router, osunpeacieshetnrengattanlonaouin etcen aan! usThe Router doesn't know that it has two connections to the same switch — nar does it need te. The Router operates like normal ‘when routing packets between two networks. infact, the process of a packet moving from Host A to Hest D in this topology will work exactly as it does in this video. The only difference is since there is only one physical switch, there will only be one MAC address table ~ each entry includes the mapping of switchport to MAC address, as well as the VLAN ID number that port belongs to. ch switch port in this diagram is configured as an Access port, we can use the range command to configure multiple ports as swaten(configyy interface range eth2/@ - 2 Suiten{config-ié-rangeye sudtehport mode access Sisten(config-iforangeys sudtenport secess vian 20 swsten{contta)a interface range etho/0 2 Of course, before assigning the switchport to a VLAN, itis @ good idea to create the VLAN in the VLAN Database. The Router interfaces also use a standard configuration — configuring an IP address and enabling the interface: iouter(config)# interface eth@/2 Router(config-14)f 1p eddress.10.0,20.1 255.255.255.0 Router(config-i#)# ne shutdown Router(config)# interface ethe/s Router config-ts)s ip eddress 10.0,30.1 255.255.255.0 Router(config-if)s ne shutdonn Below you will find various show commands for the Router and the Switch, these can be used to understand and validate how the environment is functioning, Router Show Commands psunmaeaiedhetrengnatitalonatouin teen! aeshownn pinto | iproute ap eip neighbor outer Show Punning- contig intertace echernete/2 Ip address 1600-28-2 255.255.255.0 interface Ethernete/3 ip adaress 16.0. 38-2 255.255.255.0 ‘Switch Show Commands shownn —mactable vlan brief | eap neighbor Snitch show running- contig in 20 ian 20 interface eenernet2/9 Sltehport mode access interface Ethennet2/2 ‘Siicehport secess. Vian 28 Suitehport mode access nterface ethernet2/2 Seahpee ceS fan 28 interface Feheenet3/9 Switchport secess vian 38 Sultehport mode access Anterface Ethernet3/3 osunmapeactedhetnrengattanlonaouir etcen aan!‘sultchport access vian 38 Stitchport mode access Anterface ethernet3/2 Suitchport mode access Router with Sub-Interfaces The previously described method is functional, but scales poorly. If there were five VLANs on the switch, then we would need five switchports and five router ports to enable routing between all five VLANs Instead, there exists a way for multiple VLANs to terminate on a single router interface, That method is to create a Subelnterface. ‘A Sub-Interface allows 2 single Physical interface to be split up into multiple virtual sub-interfaces, each of which terminate their own VLAN, ‘Sub-interfaces to a Router are similar to what Trunk ports are toa ‘Switch — one link carrying trafic for multiple VLANs. Hence, each router Sub-interface must also add a VLAN tag t all traffic leaving erty said interface. The logical operation of the Sub-interface topology works exactly as the separate physical interface topology in the section before it. The ‘only difference is with Sub-interfaces, only one Router interface is required to terminate all VLANs. ov ke psunmapeciedhetnrengatitalonaouin teense! onKeep in mind, however, that the drawback with all VLANs terminating on a single Router interface is an increased risk of congestion on the link. ‘The Sub-interface feature is sometimes referred to as Router on a Stick or One-armed Router. This is in reference to the single router terminating the traffic from each VLAN. ‘The Switch's port facing the router is configured as a standard Trunk: Interface etn/a Ie)f sultehport trunk encapsulation dott [Skiten{config-if)s switehport mode trunk The Router's configuration of Sub- interfaces is farty straight forward, Fist, we enable the physical interface: outer(confiaja interfoce etha/a Router(config-1¢)# no. shutdown: Next, we create and configure the first Sub- interface: outer{ config) interface etha/3.20 Router(config-sub!f)# encapsulation dotae 20 outer (config-subis}® Sp addness 10.0, 20-1 255.255.255.0 ‘Apart from using the Sub-interface distinguisher (eth1/1.20} and using the encapsulation datiq
command, the rest of the interface configuration is exactly the same as any other regular physical interface, Similarly, we will also configure the Sub-interface for VLAN 30: Fovke-(cmna Interface tae | 1 outen(contig-subifjn fp address 0.023001 255.255.255.0 osunmapeaciehetnrengrattanlonaouir eteen aan!A point of clarity regarding the Sub-interface syntax. The number after the physical interface (fa0/3.20 and fa0/3.30) simply serves the purpose of spitting up the physical interfaces into Sub interfaces. The number specified in the encapsulation dota lan iit command is what actually specifies what VLAN IDi the traffic belongs to, “These two values do not have to match, but often they do for the purpose of technician sanity. Below you will find various show commands for the Router and the Switch. These can be used to understand and validate how ‘the environment is functioning, Router Sub-Interface Show Commands shownn —ipintorie | iproute ap ep neighbor outer show running- config Inkertace esherneti/1 nouip address Anerface Ethernest/1.20 fneapsulation detig 20. Interface ethernett/1.30 foneapauiation aotig SDiaaaress 30 ‘Switch Trunk Show Commands osunpeacieshetnrengattanlonaouin etcen aan!shown mactable vianbiefintrunk_ cd Seiten Show runndng- contig ian 20 interface etherneta/1 nitehport trunk encapsulation dottq Suitchport mode trunk interface Eehemet2/2 Switchport secess vian 20 Sltehport mode access interface Ethernet2/2 Ghicehport secess. Vian 28 eitehpert access vian 30 Suitehport moce access Antertace ¢hernes3/2 ‘Sidcehport secess Vian 38 Layer 3 Switch “The last option for routing between VLANs does not involve a router at all. Nor does it involve using a traditional switch. Instead, a diferent device entirely can be used. This device is known as a Layer 3 Switch (or sometimes also as a Multilayer switch). But exactly what is Layer 3 switch? osunpeacieshetnrengattanlonaouin etcen aan!A Layer 3 Switch is different from a traditional Layer 2 Switch in that it has the functionality for routing between VLANs intrinsically. In fact, when considering how a L3 Switch operates, you can safely imagine that a Layer 3 Switch is a traditional ‘switch with a buitt in Router. With regard to VLANs the Multilayer switch is configured mostly the same way as a regular L2 switch mettiiayersniten(configye vien 20 Imuittlayersudeen(contigavian)# ane RED Inultilayersuiteh{contigys vian 30 Imuteslayersuiten(config-vian)e mane OLUE pucpreetent net cae lmuitstayersuiten(conttgy# in Imuteilayersudzentcont Imutehlayersuiten (contig race range eth3/@ - 2 Then, for each VLAN that you want the Multilayer switch to route for, you have the option of configuring an IP address within ‘what is known as an SVI, or a Switched Virtual Interface ‘An SVI serves as the L3 termination point for each VLAN ~ aka, the way in or out of each VLAN. Another way of looking ati is that the SVI serves as the interface on the built-in Router of the Multilayer switch, allowing traffic from one VLAN to reach the built-in Router and be routed to another VLAN as necessary. The configuration for an SVI involves two parts. First, enabling IP Routing; and Second, applying an IP address to the VLAN. To enable IP Routing, use the following command: fuetiayerssttan(contigye ip routing psunmapeciedhetnrengatitalonaouin teense! seisRouting only needs to be enabled once. Some L3 switches come with it enabled by default. Applying the command while its already enabled will nat cause any harm, so i in doubt as to whether its already enabled or not, simply applying it again is sae. To apply an IP address to the VLANs, configure the SVI as follows: [nateitayersaivcn(contigye interface vlan 2 Inuitslayersuiven(contig-f)8 ip address 10. Inuitilayersndten(contig-if}® no shutdown lnurtsiayersuiten(conttgy4 interface vian 30 Inuitslayersuiventcontig-if}s ip address’ 10-0,30.2. 255.255.2550 Inultilayersudventcontig-it38 no. snutdoun The two configurations above will enable routing between VLAN 20 and VLAN 30. The hosts in each VLAN can use the IP addresses 19.0.20.1 and 10.0.30.1 as their default gateway (respectively. ‘When Host A sends a packet to Host B, the packet will be switched within the same VLAN —no L3 processing will occur. When Host A sends a packet to Host C, the packet will be sent to the SVI to be routed to the other VLAN ~ all regular L3 processing will occur: the TTL will be decremented and the L2 header will be rewritten Multilayer Switch Configuration psunmapeaicdhetrengnatitaalenaouin teense! wachown macadcresssable | vanbief WoleilayerSuiteh® show running- config ip’ routing ‘Sp sadess 10.1 255.255.255.0 Hp sedress 16 10.1 255.255.255.0 proute arp pint viet iat iTayerSuitche show ip route (odes: '” decal, €'= connected, Gatewsy of last resort is not set 9,9,0/8 Sa worsany stinetted, 4 sutnets, 2 masks /24'is directly connected, Vianie Ieiecze.1/38 13 directly comected, viange 1010:30.0/24 $3 directly comected, Vian30 to0:30:1/52 35 directly comected, Vian3e Note: both sets of tabs and configuration above are fram the same device. For the sake of erganization, one set of tabs refer to the L3 functions and the other refers to the L2 functions. osunpeacieshetnrengattanlonaouin etcen aan! saissummary This article discussed the three different options for Routing between VLANs. In each case, the hosts in communication behave exactly the same. In fact, the hosts have no visibility into how and what they are connected to. Each strategy above has its own benefits and Limitations. Hopefully at this point you have a good idea of the options available to enable communication between hosts on different VLANS. Related Posts: ane ae —— \cona/) es — Son Tags: asco WANS 47 Arte Ratng oto: osinpractedhetarengattanlonaouin etcen an! ss© Suvserve © Join the discussion 2» eo 92 COMMENTS Jacob © Syearsag0 rice post - thanks for these nuggets! wet Reply Hector (© Sysorsa50 | really liked the detailed diagrams, the contig examples and of course, the clear explanation. An excellent source for beginners in networking, Kudos! we 3 Reply EdHarmoush (eed) 2 Reply to Hecior @ Syeareage Hi Hector, glad you tked the article Thanks forthe kind words. ie 0 Repiy osunpeaciehetnrengattanalonaouir etcen an! asJose Carlos (© 5 years 290 Hill'm from Portugal. Congrats for the way you teaching. Very well explained and easily o understand, Thanks! 0% Reply Dhiraj © years 2g0 Can single host access multiple vlan using layer 2 switch without router ? > Reply Ed Harmoush (eed) Reply to Dhira @ ayens age Hi Dhica. No, it can not. Recall that a single L2 switch with two VLANS is essentially like tvo physical, “switches that are not connected together — frames from one can not reach the other Ifyou need to wrap your head around it further. would recommend this artic. neo Repty Prom Karat 2 Resiyto EdHarmaush © 3 veer 290 Iecan inthe scenario of virtualization, Imagine the host isa hypervisor andit has a virtual swith, in that case, the switch port on physical switch, that connects your virtual switch to physical switch needs tobe configured as a vunk port 0% Reply osunpeaciehetnrengattanlonsouin eteen aan! sssEd Harmoush (@ed) 2 Reply to Prem Karat © 3 years ago “The hypervisor here isnot acting like a host. It may be a physical server, but you are connecting into the virtual swite, ‘The virtual hosts within the hypervisor ae stil subject tothe same rules as any other hosts regarding VLANs: The wSwitch wil not let ta virtual hosts in efferent VLANs speak t each ther without something performing routing between the two VLANS ea Reply Jon Pinkley 1 Replyte Dies © 2yeue age The answer Ed provided is true as tong asthe host has only a single interface and is connected to an access port fora single vlan. However, itis possible to have a host with multiple physical interfaces, each connecting to access ports on ‘two vlans. Or if connected toa trunk port i the hosts vlan-aware it can connect to multiple ians on its ‘sub-interfaces onthe trunk port Here's an example using a Raspberry i with the the vian package loaded. hitpsiiwwwsbprojects netbrojectsraspberrypivlan php > Repiy Eo Harmoush (tea) 2 Repiyto Jon Pikley © 2 yest 290 ‘There are always exceptions»). Yes. single host with two NIC's can have each NIC in a separate VLAN, And of course ifthe hosts VLAN aware, you can configute a host's single interface asa trunk and therefore become members of multiple VLANS using VLAN tagging eo Reply osunpeacieshetnrengattanlonaouin etcen aan! seusRicardo Luiz © year 390 Excellent post. The best! Thank you eo Reply Ed Harmoush (Ged) 2 Reply to Ricardo Luis @ 2 year ag0 You're welcome! i 0S Reply Asi Samson © yeas 290 Well expained, however, usta few questions since | am stuck in this same scenarfo, My question is How do | route between two different networks, | created subinterfaces in both routers and | can ping from network 10.0.0.0 to network 192.168.0.2 interface fa0/0 but | cannot ping the interface (which have subinterfaces) directly connected to the other LAN whichis interface fa0/1 | used router rip, please help what am I missing in the configurations. Thank you Asi > Reply Ed Harmoush (Ged) 2 Reply to Asi Samson @ A years age HAs, osunmapeaciehetrengattanlonaouin etcen ar! mastis hard to know without sesing the configuration and topology. But! think your routers don't know of each ‘other's networks. This article can explain the details, but try comparing the show ip route of each router land ensure they know about each other's networks. ‘Beyond that, this is probably not the best place to ack for specifi configuration troubleshooting Try pasting ‘on Redalt's CCNA or Networking forums, 0S Reply ANWAR © yeas 290 0000000 > Reply ANULJAIN © year 390 [really Uked very nice > Reply LafRay Red © year 390 “Thank you kindly. Your method has assisted with really understanding this Vian communication environment. | appreciate you a whole tot. we 0% Reply Vishat © years 350 osunpeacieshetnrengattanlonaouin etcen aan! usReally nice explanation. | was having some trouble understanding the SVI part. Could you share an example with MAC addresses of the ports and SVis and show how the L2 header changes? wet Reply Ed Harmoush (eed) 2 Reply to Vishal © 4 yeerea50 Hi Vishal, absolutely Host has the IP address 10.0:20.11 and Host C has the IP address 10.0.30.32, These IP address willbe the ‘Source and Destination inthe L3 header, Remember L3 is responsible for enc to end delivery therefore this header wil nat change. To understand the L2 header, well have to take a look atthe Multilayer Switeh ourput From the show ara command (the afp tab) we learn the four MAC addresses that will e used in the process Host has a MAC address of 050.7966 6800, and Host Chas @ MAC address of 0050,7966.6803. And, ‘The MAC address of SVI20 is aabb.ccB0.0200, and the MAC address of SVI 30 ls aabb.ccB0.0200 (tis common fr all SVs ona L3 switch to share the same MAC adres), ‘That said, when the packet is just leaving Host A the L2 source will be 0050:7966.6800, and the L2 destination will be aabb.ce80.0200, When the packet i ust leaving SVI 30, the L2 source will be ‘sabb.ccB0.0200, and the L2 destination wil be 0050 796.6803, {Lawl accomplish the hop to hop delivery to move the packet through the entire path Hope this helps 2 Reply Vishal 2 Rei AHarmaush © 4 yess apo Thanks Ea 9% Reply osunmpeaciehetrengattanlonaouin etcen ar! saisting © 4 years 290 ‘thank you for explanation, nave a question on the SVI | could do the SVI connection as per ur explanation. however, when trunk it with second layer three switch, ‘then | couldnt ping each other from another layer three switch, why could this happen? thank you Reply What does it mean eth2/1, ethOV1 ? 0 Reply Ed Harmoush (Ged) Reply to Siar © 4 years ae Those are simply the names ofthe physical interface ports on the Switch, OS Reply Alberto © 4 years 290 In Layer 3 Switch ‘Add "ip routing" for enable the option of routing, this is important for test the communication ofthe VLANS. eo Reply osunpeacieshetnrengattanlonaouin etcen aan! aav 2 Reply to Alberto © A years go Didr't see your comment until attr Ihit post. & OS Reply Ed Harmoush (eed) 2 Reply to Alberto © 3 years a0 "ve updated the article with a rote about enabling IP Routing, Thanks for pointing this out! oS Reply 0 © A yeorea90 Ifthe switch supports it, you can also simply enable ip routing hetps:lwwwecsco.comileniusisuppertidocs/ian-switehinglinter-vian-routing/41860-howto-L3- intervlanrouting html eo Reply EdHarmoush (wea) * Reply to T) © Bye ‘ve updated the article with a rote about enabting IP Routing, Thanks for pointing this out =), iO Repiy Mark © years 290 osunpeacieshetnrengattanlonaouin etcen aan! a‘Thanks. | understand the routing of vans well veo Reply anita (© 3 ysorea50 wow. Great article. | have werked 4 years in networking domain and configured VLANs too. But never Understood the concept. Ths is an eyeopener for me. Thanks alot for writing such a lovely article @ 0% Reply manorma (© 3years 290 Very clear and detailed explanation © eo Reply sijo © 3 years 290 ‘thank you so00000 much we 0% Reply Yohan Tejerta Carbajat © Syst a90 Hi,1'm from Uruguay, very clear, detailed articles, it help me a let, congrats I eo Reply osunpeacieshetnrengattanlonaouin etcen aan!Jana Uramova (© 3 years a90 Perfect, just one suggestion: It would be perfect to add also “show cdp neigh detail to your article, because it would be very explanatory to see the output on switch {in the ist scenario ~ router with sub-interfaces), how are IP addresses visible in the output. Also ifL3 switch would have one access switch connected to it. it would be perfect to see “sh edp neigh detail’ on this access switch, how are IP addresses visible in the output. If someone know the answer, please post it) “There is another problem to discussion, what with the native vlan, and when, why and where to change configuration for that (router ~ switch, L3switch ~ L2swite ° Reply Ed Harmoush (eed) 2 Reply to lana Uramove © 3 yeu age HiJana, good point about show cép neighbor detail . Hopefully after reading tis article though, you can build these topologies yoursein GNS3Y/VIRL and find the output youself =). [As forthe Native VLAN, it wouldn't necessarily tis into which ofthe three methods fr routing between VLANs you choose. The concept of the Native VLAN was discussed hee, 0S Reply Peter © Sys ape Higa, | must sayyou have done brilliant work but | think there is @ small error upper image logical and physical has twaalternate © wo Reply osunmapeacieshetnrengattanlonaouin eteen an! auosunpeacieshetnrengattanlonaouin etcen aan! Ed Harmoush (Ged) 2 Reply to Peter @ 3 years a0 Hi Peter. m not sure m following, thin they are labeled correctly, Are you seeing something else? oY Reply Gary (© 3 ysores50 Good informative post We have a problem with a 2nd switch we have added to the network. Core switch i L3 and the additional one Js L3 too. We cannot get this 2ndinew switch to route from its vian20 across to vlan20 on the other switch. We have port going from vlan! to viant on the switches. tried tagging the ports in lan20 but that doesnt work How can we route the new switch vian20 across tothe other switch vlan20? Thanks ° Reply Ed Harmoush (ted) Reply to Gory @ 3year a90 Hi Gary. Glad you liked he past Your question is very specific though, unfortunately this isn't the right ‘medium fr that type of question. | woule recommend the Network Engineering Stack Exchange or the "Networking Sub Reddit. i 0S Reply Rohan © Syste a90 Hi Please tell me do i need to enable jp routing emd in L3 switch to enable routing between vian 208 Vian 30?> Reply EdHarmoush (Gea) Reply to Rohan © 3 years 90 Hi Rohan, Yes, you do need to enable ip routing. | have updated the artcte with anote discussing it. Thanks for pointing this ou oS Reply Pavan Gu © Sys 390 Please update the HSRP topic with troubleshooting methods. 0% Reply CodeTron © Sys 290 One of the simplest description of how connecting VLANS for beginners ‘Thank you eo Reply van © Zea 290 ‘Very nice explanation in general. But | got some specific questions. The first is why do we need a VLAN fietd in the entry of MAC table when VLAN has been set up in the switch? Ist only useful for blocking traffic when, broadcasting within 2 domain? The second is, given a layer 3 switch scenario, iftwo hosts in the same VLAN osunpeacieshetnrengattanlonaouin etcen aan!domain, ke A and 8, would like to communicate with each other, only the MAC table will be used for ‘forwarding, ight? Although they go through a TCP/IP stack. Thanks :) > Reply Ed Harmoush (eed) 2 Reply to ar @ Deas ag9 > why do we need a VLAN feldn the entry of MAC table when VLAN has been set up inthe switch? Consider it as a separate MAC address table foreach VLAN. The MAC addresses in VLAN 10 are nat "known" tothe users in VLAN 20 fet) > iftwo hosts in the same VLAN domain, tke A and B, would like to cammunicate with each other, only the MAC table will be used for forwarding ight? Yes, correct =). They will operate exactly like the host in this article hitpsswww practialnetworking.netiseriesipacket-tavelinghhostto-host! bntpssdwww practiealnetworking.netiseriespacket-travelinghhostto-hostthrough-a-switeh! 0 Reply Wan a Reptyto EdHarmoush © 2 veer 290 ‘Thanks for your reply:) |am stl a Uitte bit confused about the frst question. Since users in diff VLANS, Live in dif IP subnets, they shouldbe able to judge that they are in iff domains before sending packets. Hence in my point of view, the VLAN field seems useless inthis scenaro. And the only scenario in which this field would be useful should be preventing broadcast packets from leaking, 9% Reply Ed Hermoush (@ea) 2 Rely 29 van © Zea 290 osunpeaciehetnrengattanlonsouin eteen aan! aus‘A host can not always be trusted todo the right thing. Look atthe output of "show mac-address table" inthe thie example, Host has the MAC address 0959. 7965.6800 and isin VLAN 20, Host Dis in VLAN 30 and has the MAC address (2050. 7966.6803 . Being that these hosts are indtferent VLANS, we de NOT want them to speak drectly to each other (without going through a Router, which may have security policies applied Ir Host A were to craft a malicious packet witha destination MAC address of €050.7966..6803 , clespite the switch having this MAC address in t's MAC Table, since the entry belongs ta VLAN 30, the switch will not forward it to Host D. It wil instead act asf the switch aid nat have a ‘matching entry inthe MAC table and simply flood the frame out all ports in VLAN 20, 0% Rely Ivan 2 Reply =AHormoush @ 2yeas a0 ‘An excellent counterexample. Thanks alot. 0 Reoly van © 2ysore390 | nave ever seen the configuration fie of a layer 3 switch in which some interfaces are also configured to be sub-interfaces. Does it mean that a layer 3 switch can bein a mixed mode with sub-interface and SVI in use? Thanks =) wo Reply Rajesh © Dyer 399 osunpeacieshetnrengattanlonaouin etcen aan! amaHig, Great explanation, thanks. Have a quick question, For routing, hosts need to configure the SVI as default gateway, or we have to enable routing protocol on SVI and hosts. Would enabling proxy arp remove the need {for turning on routing protocol or configuring default gateway on hosts? Host A needs to talk to Host C, it sends out a arp request for host C's IP address, can the layer 3 switch jump in and proxy for host C?, Thanks, Rajesh veo Reply Mohamed Maubasher © 2yeare950 | just want to say Thank you very much for such efforts, The grahics and method is amazing, please keep the {00d work. © Reply ogjitha (© 2s 290 can | get explanation of encapsulation and decapsulation for HTTP or FTP request eo Reply Ed Harmoush (Ged) Reply to poojth: © 2yees age Hello, The Encapsulation process is described inthis article: tps: practicalnetwarking netiseriesfpacket-travelinglosi-model/encap-decap osunmapeaciehetrengattanlonaouin etcen ar! ana‘That tink shows the tee application Layers as simply creating a generic “DATA payload. Each application populates that payload dliferently. | dont have @ write up about FTP, but | dd write about the inner workings (of HTTP inthis answer on the Network Engineering Stack Exchange: https: Jnetworkengineering stackexchange.comla/1 3464/3675 Hope it helps. OS Reply vidath © 2ysore 390 “Thank you so much, this really helped mel! eo Reply EgHarmoush (eed) * 2 Replyto vidath © 2yeer290 Hi Vidath, You're welcomel m glad this helped! i 0S Reply Marco © 2yea 290 Hill am an aeronautical engineer trying to acquire a solid background in networking as well. This is Undoubtedly the best explanation of communication among hosts belonging to different VLANs that | have seen so far. Many thanks? 0 Reply EdHarmoush (Ged) osunmapeaciehetrengattanlonaouin etcen ar! aaaReply to Marco 2years ago Hi Marco, thank you forthe kind words +) ™m so happy you enjoyed the content Prasad PK © 2yeore350 In scenario 1> where configured router on stick with 2 vians on switch switch connected with 1 host on each vlan, Switch vlan 10 host 10.10,10.10 = Host A, Switch vlan 20 - host 20.20.20.20 = Host B "Default gateway not configured on both hosts In Scenario 2> below is connectivity with 2 Switches instead 1 switch Host A (Vlan10} - Switch 1 ~ Router~ Switch 2— host 8 (Vian 20} "The default gateway is not configured on switches Question below for both topologies What will happen when Host A sends packets (Broadcast) packet who is 20,20.20.20 Will router Interfacefinterfaces receive that packet if yes what will be details of that packet and frame. will it reply with proxy-arp and connectivity will work? eo Reply Ed Harmoush (Ged) 2 Reply to Prasad PK @ 2yeurs age In both cases, the Router may respond to the ARP request (le, do Proxy ARP). But Proxy ARP shouldnt be depended on for routing ‘Azo, remember, Hast A wouldn't send a Broadcast for 2020.20.20 unless t though the IP 20:20.20.20 was Init own netwark. This series will explain how hosts communicate with one another through Routers and osunmapeaciehetrengattanlonaouin etcen ar! na‘Switches: hutpsilwww practicalnetwarkingnetiseriesbacket-travelingpackettraveling! 0S Reply Saeed Rehman (© 2years 290 | am Uiterally blown away how smooth your content flows. It's really easy to follow and I'm so glad Ive found your website. | am learning CCNA from zero understanding or experience. Slowly going through the CCNA 200 -301 book and was struggling with understanding Router on a stick and SV\s. I've now understood that they are are two separate options which can be used, but most importantly | get what the SVIs are used for “Thank you so so much for setting this website and providing this content. 0 Reply Eg Harmoush (eed) 1 Reply te Ssced Rehman © 2ye Hey Saved, thanks forthe kind wore 1m so happy you found my articles beneficial If you're studying for CCNA, | puta ist of all my CCNA related articles here: etpsulwwrmpractcalnetworkingnetindexkenal Hope ithetps! OS Reply Mark Symms © iyearage Ed, thanks so much for this. | am currently designing my home network around a refurbished Cisco Catalyst 3750. | want to set up several VLANs but only need communication between a small subset of that. |am osunpeacieshetnrengattanlonaouin etcen aan! saaplanning on several SSIDs running to isolate the wireless devices even further {I hate Wifi. Anyway, how do | isolate the communications between VLANs without it bleeding over to other VLANS? Granted | am very new at this managed switch game, ° Reply Redwyvren87 © tye ge Ed, solid article and used it to great effect to build afew VLANs at home for a lab setting. Quick question on the topic, i the original purpose of VLANS is to provide a logical separation between networks (or subnets), why would you want to perform routing between the VLANs? | can't find any good real world examples af a network that has multiple VLANs with routing in between them, ° Reply Ed Harmoush (eed) 2 Reply to Recdeyens? 1 year ago riginaty, applying securty policies (ike ACI) could anly dane an Reuters. Meaning ifyou wanted t iter ‘rac between two PCs, you had to force that trafic to go through a Router. This allows you to logically ‘separate PC's but allow some or limited communication between them Ifyou want zero communication ‘between them, then you don't need to enable Routing between ther. Soto summarize + if you intend for two PC's to nave full communication, aut them in the same VLAN + Ifyou want twa PC's to have no communication, put them in diferent VLANs. * Ifyou want two PC's to have limited communication, put ther in different VLAN, but enable Routing ‘between VLANS and fiter traffic as necessary on the Router Hope it helps. io Reply osunmapeaciehetnrengattanlonaouir eteen ar! aaSisira Kumara © tysorage Hi Ed Harmoush, First of all | want to say my special thanks for your article. Itis clearly described how to build different VLANS in a Cisco switch it sel. Using Cisco packet tracer | practically did iit went well for Multilayer ‘Switches, Layer 3 Switches. I wonder that How I solve this problem in Below layer 3 Switches till example Cisco 2900 series or 2800 series or 1800 series switches. Your solution will be highly appreciated. Thank you in advance. Looking forward to hear from you soon. /Sisira wo Reply Giuliano © i yearego ‘Thank you very much for the detailed explanation, ihad a lot of doubts about vians and svi, and with this post ‘you made them clear to me. Really thank you so much <3 ° Reply Vish © year age awesome past! Thanks, The layer 3 switch routing answered a question Ive had for ages. Love the diagrams AND the switehfouter configs as well. makes it REALLY clear Reply ‘Spoorthi © year age | really loved it. need not to look for any other 100's of sites! Its all in one best and complete book!.| would say @ Bible for me!. Thank you very much!. Appreciate your knowledge and wisdom! osunpeacieshetnrengattanlonaouin etcen aan! sais\ Reply EdHarmoush (Ged) 1 Reply to Spoorth) @ 13 mone age You're welcome, Spoorthi =}. OS Reply ssamir fadtallah © tysorage Hi, ‘Thanks for this topic. | always gets confused but when i read is straight forward and clear. just one question if you enable ip routingo on (3 switch you enable all vians communication but is there any command to route just like 2 vlan from 5 vlans actually? 0 Reply Ed Harmoush (Ged) 2 Replys smifelallah © 4 months age ‘You's have to both enable and Create SVisto tll the L3 switch to route between VLANs, Soin your example, if you only want two VLANS ta Route, youd only create those two SVs. The remaining three VLANs would Just act as regular L2 VLANs. oS Reply Jenny © ti montesse Impressive article Ed, Awesome explanatory skills! In your example regarding router's sub-interfaces, just one question to shed light osunpeacieshetnrengattanlonaouin etcen aan! utawas this the Mac address : aabb 00,0211 of router’s physical port, cor switchport’s virtual port (ie switch's trunk port); “To be precise if the Mac address aabb
You might also like
ASTM D5882-16 Standard Test Method for Low Strain Impact Integrity Testing of Deep Foundations (Withdrawn 2025)
PDF
No ratings yet
ASTM D5882-16 Standard Test Method for Low Strain Impact Integrity Testing of Deep Foundations (Withdrawn 2025)
6 pages
ISO-TC 71 - N182 - 27th TC 71 Plenary - Meeting Document
PDF
No ratings yet
ISO-TC 71 - N182 - 27th TC 71 Plenary - Meeting Document
40 pages
Ready-Mixed White and Yellow Traffic Paints: Standard Specification For
PDF
No ratings yet
Ready-Mixed White and Yellow Traffic Paints: Standard Specification For
3 pages
Lecture 8 Two Way Slab-1
PDF
No ratings yet
Lecture 8 Two Way Slab-1
93 pages
Astm
PDF
No ratings yet
Astm
6 pages
Calculation Report Fire Wall
PDF
No ratings yet
Calculation Report Fire Wall
5 pages
TEK - 01-01E ASTM Specifications For Concrete Masonry Units (7-2007)
PDF
No ratings yet
TEK - 01-01E ASTM Specifications For Concrete Masonry Units (7-2007)
4 pages
Astm C31 C31M 23
PDF
No ratings yet
Astm C31 C31M 23
4 pages
Astm C90 22
PDF
No ratings yet
Astm C90 22
4 pages
ASTM C1240-15Microsilica Specification 硅灰
PDF
No ratings yet
ASTM C1240-15Microsilica Specification 硅灰
7 pages
ASTM D6926 - 2016 - Preparation of Asphalt Mixture Specimens Using Marshall Apparatus
PDF
No ratings yet
ASTM D6926 - 2016 - Preparation of Asphalt Mixture Specimens Using Marshall Apparatus
7 pages
KV of Bitumen
PDF
No ratings yet
KV of Bitumen
10 pages
ASTM D3689-2007 (2013) E1 Tensile
PDF
No ratings yet
ASTM D3689-2007 (2013) E1 Tensile
13 pages
C140C140M 16 PDF
PDF
No ratings yet
C140C140M 16 PDF
24 pages
Series 3 Oil-Fired Natural Draft Water Boiler: This Manual Includes: Installation Start-Up Boiler Parts
PDF
No ratings yet
Series 3 Oil-Fired Natural Draft Water Boiler: This Manual Includes: Installation Start-Up Boiler Parts
32 pages
Thermomass AC320
PDF
No ratings yet
Thermomass AC320
11 pages
Mastertop CTZ Seamless Cement Based Terrazzo System
PDF
No ratings yet
Mastertop CTZ Seamless Cement Based Terrazzo System
12 pages
DIN 1045-4 - 2001-07 - Eng
PDF
No ratings yet
DIN 1045-4 - 2001-07 - Eng
7 pages
Cicpa - C&mcig1w922
PDF
No ratings yet
Cicpa - C&mcig1w922
782 pages
High-Strength Steel Bolts, Classes 10.9 and 10.9.3, For Structural Steel Joints (Metric)
PDF
No ratings yet
High-Strength Steel Bolts, Classes 10.9 and 10.9.3, For Structural Steel Joints (Metric)
6 pages
Steel Welded Wire Reinforcement, Deformed, For Concrete
PDF
100% (1)
Steel Welded Wire Reinforcement, Deformed, For Concrete
6 pages
Astm c825-2019 预制混凝土格栅
PDF
100% (1)
Astm c825-2019 预制混凝土格栅
4 pages
Astm A497
PDF
No ratings yet
Astm A497
10 pages
E1309
PDF
No ratings yet
E1309
15 pages
Astm C1363 19 - GHB
PDF
No ratings yet
Astm C1363 19 - GHB
45 pages
Final PDF of Standard Specification
PDF
No ratings yet
Final PDF of Standard Specification
180 pages
4.2 Technical Product Manual - Pipe - Brochure - EN
PDF
No ratings yet
4.2 Technical Product Manual - Pipe - Brochure - EN
23 pages
ATT MasTec Stamped SA Capitan NM 85ft AFS1700
PDF
100% (1)
ATT MasTec Stamped SA Capitan NM 85ft AFS1700
41 pages
BS EN ISO 24346-2012
PDF
No ratings yet
BS EN ISO 24346-2012
16 pages
Astm C 936 - Compress
PDF
No ratings yet
Astm C 936 - Compress
3 pages
C90 23 4 05 Standard Specification For Loadbearing Concrete Masonry
PDF
No ratings yet
C90 23 4 05 Standard Specification For Loadbearing Concrete Masonry
5 pages
FLATE Slab Design
PDF
100% (1)
FLATE Slab Design
16 pages
Distribution Restriction Statement
PDF
No ratings yet
Distribution Restriction Statement
9 pages
Precast Concrete Water and Wastewater Structures: Standard Specification For
PDF
No ratings yet
Precast Concrete Water and Wastewater Structures: Standard Specification For
6 pages
Astm A184 - A184m-01 STD Specs For Welded Deformed Steel Bar
PDF
No ratings yet
Astm A184 - A184m-01 STD Specs For Welded Deformed Steel Bar
4 pages
Design of Highways and Streets (2024)
PDF
No ratings yet
Design of Highways and Streets (2024)
129 pages
Two Way Slab Systems
PDF
No ratings yet
Two Way Slab Systems
264 pages
214-Astm A 392 1996 Zinc Coated Steel Chain Link Fence Fabric PDF
PDF
No ratings yet
214-Astm A 392 1996 Zinc Coated Steel Chain Link Fence Fabric PDF
4 pages
ASTM-C597-22
PDF
No ratings yet
ASTM-C597-22
4 pages
Aashto T322-11
PDF
No ratings yet
Aashto T322-11
11 pages
318M-19 Errata
PDF
No ratings yet
318M-19 Errata
15 pages
Astm A47 A47m (1999)
PDF
No ratings yet
Astm A47 A47m (1999)
5 pages
Precast Landing Slab - Connection TSS
PDF
No ratings yet
Precast Landing Slab - Connection TSS
8 pages
Standard Test Methods For Sampling and T
PDF
No ratings yet
Standard Test Methods For Sampling and T
10 pages
Astm A36 2005
PDF
No ratings yet
Astm A36 2005
6 pages
TMS 302 Sound Standard Public Comment Version 2018-08-07
PDF
No ratings yet
TMS 302 Sound Standard Public Comment Version 2018-08-07
19 pages
Recycled Aggregate
PDF
No ratings yet
Recycled Aggregate
10 pages
Temperature of Freshly Mixed Hydraulic-Cement Concrete
PDF
No ratings yet
Temperature of Freshly Mixed Hydraulic-Cement Concrete
3 pages
D6103D6103M 33316
PDF
No ratings yet
D6103D6103M 33316
4 pages
Astm D4956 01
PDF
No ratings yet
Astm D4956 01
4 pages
SS002-Suspended-Ceiling Rev 0
PDF
No ratings yet
SS002-Suspended-Ceiling Rev 0
22 pages
Astm E997-15
PDF
No ratings yet
Astm E997-15
11 pages
Aashto T0047 PDF
PDF
No ratings yet
Aashto T0047 PDF
2 pages
Precast Concrete Gravity Grease Interceptor Tanks: Standard Specification For
PDF
100% (1)
Precast Concrete Gravity Grease Interceptor Tanks: Standard Specification For
5 pages
JVA INT Catalogue 2020
PDF
No ratings yet
JVA INT Catalogue 2020
25 pages
Gabion Code ASTM A974-94
PDF
No ratings yet
Gabion Code ASTM A974-94
7 pages
AAC Thermal
PDF
No ratings yet
AAC Thermal
14 pages
Materials For Bridge Deck Waterproofing Membrane Systems
PDF
No ratings yet
Materials For Bridge Deck Waterproofing Membrane Systems
2 pages
Polyethylene Terephthalate Uses Properties and Degradation - Naomi A.. Barber
PDF
No ratings yet
Polyethylene Terephthalate Uses Properties and Degradation - Naomi A.. Barber
211 pages
Routing Between VLANs & Layer 3 Switches - Practical Networking
PDF
No ratings yet
Routing Between VLANs & Layer 3 Switches - Practical Networking
41 pages