Cat6500: InterVlan Routing

[new_networker]

hi,

I would like to know how do the Cisco network devices as well as FWSM communicate with different VLANs defined on Cat6500 24/48 port switch. Is SVI required for every VLAN defined on Cat6500 switch ?

For e.g. if an ASA is connected to VLAN2 (192.168.1.x subnet) on Cat6500 switch and would like to initiate connection to FWSM which is connected to VLAN3 (192.168.2.x subnet).

Rgds.

[Jon Marshall]

This is quite a large question. If we forget about the FWSM for the moment.

"Is SVI required for every VLAN defined on Cat6500 switch"

Not necessarily, it depends. If you want to be able to route to that vlan and from that vlan then yes you will need an SVI for that vlan. If you don't create an SVI you cannot route for this vlan on the MSFC.

So why create just a vlan without an SVI on the MSFC ? Well there are a number of reasons but this is where the FWSM comes in. If you want to firewall a vlan that exists on the 6500 then you cannot have an SVI on the MSFC otherwise it will never be firewalled. So you need to create the interface for that vlan on the FWSM module and not the MSFC.

Does this makes sense ?

Jon

[new_networker]

1) SVI for every VLAN (except FWSM)

Does it mean that a SVI will have to defined per VLAN i.e. two SVI's will be required to support in & out traffic between two VLANs.

2) FWSM

In other words is it right to say that FWSM will do the routing, hence doesn't require MSFC configuration.

[Jon Marshall]

1) One SVI will route traffic for that vlan both in & out.

2) In effect yes. Any vlan that you allocate to the FWSM will have a L3 interface on the FWSM and not an SVI on the MSFC and the FWSM will pass traffic between these vlans.

Note that one vlan is needed to connect the MSFC to the FWSM and so both the MSFC and the FWSM will have a L3 interface for this vlan.

Jon

[new_networker]

1) For more clarity,

If SVI is configured only on VLAN1 and not VLAN2, would VLAN1 be able to successfully route the traffic to VLAN2. Or, is SVI required for VLAN2 (the receiving VLAN) as well.

Thanks.

[Jon Marshall · Accepted solution]

You would need an SVI for both vlans to route traffic between those vlans. So yes an SVI is required for both vlan 1 and 2 in your example.

Jon