static routing through vlan

[bolybay]

Hi all 

I have question related to static routing on l3 switches

in this photo, static routing is configured through VLAN ...

i know that we can configure static routing through next-hop IP or exit interface but if we use VLAN how will the traffic leave the switch

I mean from which interface will the traffic leave to the next hop

[bolybay]

interface GigabitEthernet1/0/1
description printer
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 249
switchport mode trunk
switchport nonegotiate
flowcontrol receive on
spanning-tree portfast
!
interface GigabitEthernet1/0/2
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/3
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/4
description Monitoring-PC-under-LCDs
switchport access vlan 249
switchport mode access
!
interface GigabitEthernet1/0/5
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/6
switchport access vlan 249
flowcontrol receive on
spanning-tree portfast
!
interface GigabitEthernet1/0/7
switchport access vlan 249
spanning-tree portfast
!
interface GigabitEthernet1/0/8
switchport access vlan 249
switchport mode access
!
interface GigabitEthernet1/0/9
switchport access vlan 249
switchport mode access
!
interface GigabitEthernet1/0/10
switchport trunk encapsulation dot1q
switchport mode trunk
spanning-tree portfast
!
interface GigabitEthernet1/0/11
switchport access vlan 249
switchport mode access
!
interface GigabitEthernet1/0/12
switchport access vlan 249
switchport mode access
spanning-tree portfast
!
interface GigabitEthernet1/0/13
description mo-abobasha-office
switchport access vlan 249
switchport mode access
!
interface GigabitEthernet1/0/14
switchport access vlan 249
switchport mode access
!
interface GigabitEthernet1/0/15
description test
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 249
switchport mode trunk
!
interface GigabitEthernet1/0/16
switchport access vlan 249
spanning-tree portfast
!
interface GigabitEthernet1/0/17
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/18
switchport access vlan 249
spanning-tree portfast
!
interface GigabitEthernet1/0/19
switchport access vlan 249
spanning-tree portfast
!
interface GigabitEthernet1/0/20
description PC
switchport access vlan 249
spanning-tree portfast
!
interface GigabitEthernet1/0/21
description Hussiny-Office
switchport access vlan 249
switchport mode access
!
interface GigabitEthernet1/0/22
description AP-OT
switchport trunk encapsulation dot1q
switchport trunk native vlan 249
switchport mode trunk
load-interval 30
!
interface GigabitEthernet1/0/23
switchport access vlan 249
switchport mode access
!
interface GigabitEthernet1/0/24
description ECC-Uplink
switchport access vlan 249
switchport trunk encapsulation dot1q
switchport mode access
!
interface Vlan1
ip address 10.10.10.1 255.255.255.0
!
interface Vlan33
ip address 10.10.33.50 255.255.255.0
!
interface Vlan50
no ip address
!
interface Vlan61
ip address 10.61.10.61 255.255.255.0
!
interface Vlan246
no ip address
!
interface Vlan249
ip address 192.168.1.1 255.255.255.0 secondary
ip address 172.16.1.1 255.255.255.0 secondary
ip address 192.168.2.1 255.255.255.0 secondary
ip address 192.168.130.200 255.255.255.0 secondary
ip address 192.168.110.245 255.255.255.0 secondary
ip address 10.9.99.10 255.255.255.0 secondary
ip address 10.0.249.23 255.255.255.0
!
interface Vlan400
ip address 40.50.60.123 255.255.255.0
!
interface Vlan564
ip address 5.5.5.253 255.255.255.0

[MHM Cisco World]

I do this small LAB and see the MAC change in each SW, 
in SW0 there is VLAN 10 and VLAN 20
in SW1 there is VLAN 10 and VLAN 30
static route in each SW toward VLAN 10
there is trunk between two SW

connect between the two client done with 
SW0 receive the traffic from PC0 in VLAN 20 and use the static route and see that the VLAN30 is reachable via VLAN 10
the SW0 only bridge the frame and change the MAC address of source and destination.
this how the SW handle the traffic.
for VLAN 249
why there is many secondary IP?
if I am right you add secondary IP for each VLAN in other SW?
you need only one IP.

[bolybay]

can i see the config for static route of vlan 30 and vlan 20 via vlan 10 ?

[MHM Cisco World]

[bolybay]

ok i have tested it and it's worked well 

now I'm asking what's the difference between IP route 30.0.0.0 255.255.255.0 VLAN10

and ip route 30.0.0.0 255.255.255.0 10.0.0.2  ?

I tried the two commands and in the two cases, it's worked! 

[MHM Cisco World]

same no different I think. 
but I will make double check.

[MHM Cisco World]

interest Q
lab soon 

[Joseph W. Doherty]

"I mean from which interface will the traffic leave to the next hop"

Generally the "best" interface to the next hop.  SVI, as an interface, no difference beyond actual physical interface will deal with L2, too.  I.e. logically, SVI will be used for L3 egress, but L2 port, for that SVI, will depend on typical VLAN port selection.  (NB: Consider the switch's port was configured as "routed" and connected to another switch hosting the VLAN.  Basically the same for L3 port selection, although the routed port would always be the same as physical L2 port.)

". . . we can configure static routing through next-hop IP or exit interface . . ."

If I remember correctly, it's not "or" but "and/or".

If I'm understanding your config correctly, you have a (typical/usual) default route that routes to another gateway on the VLAN 249.

What's curious is the static route statement that routes 10.0.249.0/24 to VLAN 249's SVI whose primary network is 10.0.249.0/24.

On this router, this router will already know it has a connected network for 10.0.249.0/24 without the need for a static route statement.

The only reason I could see doing this might be if elsewhere in the config, static routes were being redistributed into a IGP, while all the interface networks weren't being directly included in an IGP or not redistributing connected networks.  I.e. a method to just pass along 10.0.249.0/24 to other routers.  But then the default route static should also be redistributed negating the need to also redistribute 10.0.249.0/24, I believe.(?)  Of course, guess you could also further control network prefix redistribution using route maps.

Seeing the rest of this router's config might be useful to try to further determine if there's a real purpose for this static route statement.

Laugh - of course, another possible reason for something like this, is who ever did it, doesn't fully understand how to configure routing.  It wouldn't be the first time I've "wondered" why something was being done like it was to finally discover the person who set it up didn't know what they were doing.

[Richard Burts]

First let me agree with Joseph that the static route for 10.0.249.0 seems redundant. That subnet is already known and will be in the routing table as a connected subnet. And the static route specifies the vlan 249 interface as the way to get to the subnet and vlan 249 is the locally connected interface.

Then let me address what I believe is a misunderstanding in the original post. It starts by correctly describing config options for a static route:

"i know that we can configure static routing through next-hop IP or exit interface"

But then it asks "but if we use VLAN how will the traffic leave the switch" which suggests that the original poster believes that vlan 249 is something different from the exit interface. In fact vlan 249 is the exit interface.

The original post than asks another question "I mean from which interface will the traffic leave to the next hop". For the static default route the next hop is 10.0.249.1 and traffic will leave using interface vlan 249. For the other static route (the redundant one) traffic will leave using interface vlan 249.

[bolybay]

thanks for your reply

I'm wondering .. VLAN 249 is a virtual not physical interface (port) so how the traffic will go throw something virtual !

[bolybay]

Thank you, Mr. Joseph, for your reply.

Actually, after I posted this topic, I reviewed the configs and realized that there was no need for the static route of 10.0.249.0/24 and I deleted it. As you said, the traffic will be routed by default to the gateway router 10.0.249.1, which will already know this network as it's directly connected

But now I have another question if you don't mind. I don't know when I should use VLAN and when I should use exit int or next hop.

As an example,

ip route 1.1.1.0 255.255.255.0 vlan1

IP route 1.1.1.0 255.255.255.0 next hop IP / exit interface

I wish you could understand me.

[Richard Burts]

You ask a very good question and the answer depends on a very subtle difference in the way that the static routes operate." I don't know when I should use VLAN and when I should use exit int or next hop."

These 2 static routes look sort of the same and some have suggested that there is not much difference. But the subtle difference between them is quite important.

ip route 1.1.1.0 255.255.255.0 vlan1

IP route 1.1.1.0 255.255.255.0 next hop IP / exit interface

The difference between them is in the way that the device (either router or switch) makes its forwarding decision. The version of static route that specifies the next hop is generally more efficient (less work for the device) than the version that specifies only the outbound interface. The difference is that if the static route specifies the next hop then a single arp is sufficient to forward traffic to various destination addresses. If the static route specifies only the outbound interface then the assumption is that all of the destination addresses are locally connected through that interface. And in that case the device must arp for EVERY remote address to which it will forward traffic. The first factor to consider is that operating this way works only if the next hop supports proxy arp. If the next hop does not support proxy arp (and there are many organizations that regard proxy arp as a security risk and do not support it) then no traffic would be forwarded. Other factors to consider are that doing arp for every remote destination will result in a much larger arp table. So it requires more memory to store the arp table, requires more bandwidth to send the increased number of arp requests and responses, and requires more CPU resources to maintain the larger arp table.

So in general it is better to use static routes with next hop addresses (or perhaps static routes with both next hop address and outbound interface) than it is to use static routes with only an outbound interface.

[Joseph W. Doherty]

"But now I have another question if you don't mind. I don't know when I should use VLAN and when I should use exit int or next hop."

@Richard Burts' recent reply post, to your question, I believe, is well answered in his post.

As an aside, it's not uncommon that those that use exit interface for traffic handling egress Internet traffic will fill all its available RAM (often a very bad thing) with a huge ARP tables because there are often so many different destination IP addresses.

Also BTW, recall it's possible to use both an exit interface and next hop address in static route.  I believe that's done to insure only a specific egress interface is to be used to reach the next hop.

[Richard Burts]

In reading through the discussion there is another question that I would address "VLAN 249 is a virtual not physical interface (port) so how the traffic will go throw something virtual !" Yes interface vlan 249 is a virtual interface. Traffic going out would go out one of the physical layer 2 ports that belongs to vlan 249.