same VLANs on router's different interfaces

[s.souroutis]

Here is my problem. 1 router, 3 switches.

ROUTER fa1/0 -- SWITCH1

ROUTER fa1/1 -- SWITCH2

ROUTER fa2/0 -- SWITCH3

ROUTER

| | |

| | |

| | |

| | |

| | |

SWITCH1 SWITCH2 SWITCH3

Every switch has 4 vlans configured. VLAN1, VLAN10, VLAN20 and VLAN30.

How can I configure the router to route between those VLANs?

I mean, if I use subinterfaces, I can configure interface fa1/0 ok.

interface fastethernet 1/0.1

encapsulation dot1Q 10

ip address 10.1.1.1 255.255.255.0

!

interface fastethernet 1/0.2

encapsulation dot1Q 20

ip address 20.1.1.1 255.255.255.0

!

interface fastethernet 1/0.3

encapsulation dot1Q 30

ip address 30.1.1.1 255.255.255.0

!

Then I go for interface fa1/1:

interface fastethernet 1/1.1

encapsulation dot1Q 10

ip address 10.1.1.2 255.255.255.0

% 10.1.1.0 overlaps with FastEthernet1/0.1

I thought about bridging, but is this the right way to do it?

Thank you for your help

[Kevin Dorrell]

Indeed, what you need here is bridging. Routing normally connects one VLAN to another; it is not used to join disconnected segments of the same VLAN - that is the job of a bridge.

If never done this before in this topology, but I guess you are going to have to make a trunk to each switch. On each trunk, make a subinterface to connect to each VLAN on that trunk, like you have been doing so far, but dont give it an IP address. Then take all the subinterfaces for VLAN 20, and make them part of bridge-group 20, say. Then define bridging irb, and start defining one bvi interface to represent each vlan, e.g. int bvi 20. The single IP address for each VLAN goes on the BVI interface for that VLAN. The router is then used to route between the bvi interfaces.

But why don't you use a distribution switch to connect together all the trunks from your access switches. that way they could share a VLAN database. Then you put the router on a stick to route between them? Just an idea.

If you have a 2600 series, you could do this all in one box by using an NM-16ESW switch installed in the router to gather your trunks.

Kevin Dorrell

Luxembourg

[Kevin Dorrell]

bridge irb

:

interface fastethernet 1/0.1

encapsulation dot1Q 10

bridge-group 10

no ip address

!

interface fastethernet 1/0.2

encapsulation dot1Q 20

bridge-group 20

no ip address

!

interface fastethernet 1/0.3

encapsulation dot1Q 30

bridge-group 20

no ip address

!

:

interface fastethernet 1/1.1

encapsulation dot1Q 10

bridge-group 10

no ip address

!

interface fastethernet 1/1.2

encapsulation dot1Q 20

bridge-group 20

no ip address

!

interface fastethernet 1/1.3

encapsulation dot1Q 30

bridge-group 30

no ip address

!

:

interface fastethernet 2/0.1

encapsulation dot1Q 10

bridge-group 10

no ip address

!

interface fastethernet 2/0.2

encapsulation dot1Q 20

bridge-group 20

no ip address

!

interface fastethernet 2/0.3

encapsulation dot1Q 30

bridge-group 30

no ip address

!

interface bvi 10

ip address 10.1.1.1 255.255.255.0

!

interface bvi 20

ip address 20.1.1.1 255.255.255.0

!

interface bvi 30

ip address 30.1.1.1 255.255.255.0

!

!

bridge 10 protocol ieee

bridge 10 route ip

!

bridge 20 protocol ieee

bridge 20 route ip

!

bridge 30 protocol ieee

bridge 30 route ip

!

[s.souroutis]

Hi Kevin.

Thank you for your time.

Bridging was one of the solutions I thought, but I'm not a fan of bridge. I prefer routing.

This leads us to the solution of the switch you mensioned which I think is best, and undoubted the one I would use. The problem is that I don't know for sure my client's equipment. All the feedback I had so far, told me of a router (or two) and 3 switches, so I started to think of solutions with these devices.

In case of the 2600 router and the 16port ethernet module, I can use interface vlan 10 command ??? Is this allowed? If yes then it's really easy. :)

So, in conclusion, assuming we have 1 router and 3 switches, bridge is my only solution???

Thanks

[Kevin Dorrell]

"In case of the 2600 router and the 16port ethernet module, I can use interface vlan 10 command ??? "

Yes, absolutely. In fact, you must; that is what connects the switched VLAN to the routing engine.

"assuming we have 1 router and 3 switches, bridge is my only solution???"

Again true, but a disclaimer here: I have never tried the configuration I gave you for real.

The disadvantage of the bridging solution is that VTP will not work to the router interfaces, so you have to configure VLANs on all interfaces and switches by hand.

The advantage of using a central switch is that VTP propagates the VLAN database throughout the switched network; you only have to configure the new VLAN on one switch. Oh yes ... and VTP does work OK with the NM-16ESW.

P.S. If you find the information useful, please do not forget to "Rate this post". Thanks in advance.

Kevin Dorrell

Luxembourg

[s.souroutis]

Thank you for your help.

I'll see what equipment my client has, and if it is 1 router and 3 switches, I'll try your configuration. I think it sould work. Do you want a feedback if it worked or not?

Thanks again Kevin.

[Kevin Dorrell]

Feedback - yes please. That's the main reason I do this forum, to gain experience from real life situations.

Thanks in advance.

Kevin Dorrell

Luxembourg

[rbradfield]

I have followed this one.

I take it the router is the only L3 device,and you want to run trunks to the router interfaces for redundancy.

Do you have trunks running between the switches? I assume you do, then I would just run each link in access mode with a different vlan on each link to the router

just a thought!

Richard.

[s.souroutis]

Hi Richard

I'm not sure I understand what you mean.

I have three switches. 2 of them are connected with 2 gigabitethernet (channel-group) to each-other for redundancy.

In order to be fully redundant, they should both be connected to the router. Correct?

The 3rd switch should also be connected somehow.

The switches do not support L3 routing, so all of them should be connected to the router.

Also each of them should have the VLANs configured and no VTP used. Who would be VTP master?

I need 3 VLANs. If I connect the switches to the router through access ports, I would need 9 ethernet ports and 9 different VLANs. Right?

Is this what you said?

Thank you for your help

[dnewell24]

If you do connect all your switches redundantly using the bridge configuration on the router, make sure the router is the STP root. You can do that by lowering the priority.

Router(config)# bridge (bridge-group-number) priority (number)

Router(config)# bridge 10 priority 1

Or else you could have only one link being used for access to your layer 3 device.

[Kevin Dorrell]

I've just read about a cheaper solution for you, but still with the core/distribution switch we talked about. If you have a 1751, 2600 or 3600 series router, there is a WIC-4ESW, which is a 4-port switch card on a WIC module. Apparently the ports will do 802.1Q trunking.

The only drawback is that it will do VTP, but transparent mode only. That is, you would define the VLANs on one of your access switches, and they would propagate to the other switches, but not to the WIC-4ESW - you would have to define the new VLAN there by hand. Don't know if they plan to support other VTP modes on that WIC in the future.

Kevin Dorrell

Luxembourg

[jmmgrodrigues]

Hi,

Let's view this scenario. In my case I need to implement a similar solution, but with NAT in every BVI.

I have this commands "ip nat inside source list 100 interface BVI7 overload" and "access-list 100 permit ip any any". If I add "ip nat inside source list 100 interface BVI9 overload" the first one disappears...

Can you help, please?

Thanks in advance!

[Cristian Matei]

Hi,

   Because source is the same "ip nat inside source list 100" for both NAT statements, it will always override it; there is no workaround for this, other than creating another list like ACL 200, and use another NAT statements; however, you need to ensure the router matches each NAT statement that you want, for the traffic you want:

access-list 100 permit 192.168.10.0 0.0.0.255

access-list 200 permit 192.168.10.0 0.0.0.255

!

ip nat inside source list 100 interface BVI7 overload

ip nat inside source list 200 interface BVI9 overload

Regards,

Cristian Matei.

[jmmgrodrigues]

Hi, Thanks for quick reply! I'll give feedback ASAP.

[Richard Burts]

I agree with @Cristian Matei that the overlapping use of the same access list on both interfaces creates a problem. Unfortunately I do not believe that his suggested solution goes far enough to solve the issue

access-list 100 permit 192.168.10.0 0.0.0.255

access-list 200 permit 192.168.10.0 0.0.0.255

There are 2 access lists but they both use exactly the same logic and I believe that the result will not really solve the issue. When configuring address translation where traffic may be outgoing on 2 interfaces the better solution is to configure address translation using route maps. In this approach the route map can match on the access list and also match on the outbound interface. So one route map is for BVI7 and another route map is for BVI9. They could each have an individual access list but it would work just as well if both route maps used the same access list.

Another note is that configuring address translation this way it would be preferable to use a standard access list rather than an extended access list.