Configuring C3560X as a Layer 3

[julito4589]

Hi,

Currently my network has a Cisco 3825 performing all the vlan routing work. I have a Cisco 3560X behind it that could be configured as a full layer 3 switch, thus removing the need for the Cisco 3825 altogether or at least optimizing the functions of the 3560X.

The C3825 has a mix of subinterfaces off one of the gb interfaces and FastEthernet interfaces configured with a total of 9 vlans. My initial plan is to configure the 3560X to deal with the vlans that are configured in the subinterfaces. Therefore, I'd basically need to move those subnets and vlan configurations to the 3560X. The vlans that are tied to the FastEthernet interfaces would remain in the C3825 (until eventually moved). Will the switch support this configuration? In other words, even if it's configured to act as a full Layer 3 switch, will it be able to send the traffic to the C3825 for those vlans that it doesn't have layer 3 configurations for?

[Jon Marshall]

even if it's configured to act as a full Layer 3 switch, will it be able to send the traffic to the C3825 for those vlans that it doesn't have layer 3 configurations for?

Yes as long as it has routes for the subnets on the router and the router has routes for the subnets on the switch.

You can use static routes or depending in your switch feature set run a routing protocol.

Jon

[julito4589]

The only factor that would prevent me from configuring ALL the vlans on the switch is changing some of the wiring so that whatever is connected to the FastEthernet interfaces gets connected to the 3560X switch. As long as the vlans are configured correctly and the trunks configurations allow only the appropriate vlans, do you foresee any issues with moving all vlans to the switch?

Note that a couple of those vlans are for web services. There are access lists configured in the C3825, which keep that traffic isolated and which will need to be also transferred to the switch.

[Jon Marshall]

 As long as the vlans are configured correctly and the trunks configurations allow only the appropriate vlans, do you foresee any issues with moving all vlans to the switch?

Do you mean trunks to other switches ie. not the router because if all vlans are routed on the L3 switch you don't need a trunk to the router.

Or are you talking about still routing some vlans on the router ?

No I don't see any issues as that is what L3 switches are used for.

Jon

[julito4589]

Do you mean trunks to other switches...

Yes. Trunks to other switches. I will also potentially have trunks for servers connected to the 3560X that have to allow more than one vlan

[Jon Marshall]

Okay, then there should be no problem.

As for the trunks to the servers see your other post.

Jon

[julito4589]

Part of the info that I didn't include in my initial post (mainly to keep things simple) is that there's a Barracuda webfilter 410 between the 3825 and 3560X. Whoever implemented this, thought it was a good idea to have a device with an interface that maxes at 50Mbps right in the middle of the core of the network. Because of this, I can't move all the VLANs to the 3560X at once. I want to move some of the vlans that have lighter traffic and let the 3825 handle a couple of the vlans that deal with external web traffic and that can potential have higher traffic rates. I'm including a partial diagram of the layout I'm considering.

Questions:
1.  If I move three vlans to the 3560X, how do I have to modify the interface or routing table configuration in the 3825 so it forwards the traffic for those vlans to the 3560X  

2. These are the configs (in general) that I plan to implement in the 3560X

2.1 Enable routing on 3560
ip routing

2.2 Configure vlans IPs in 3560
interface vlan6
ip address [vlan ip] [vlan mask]
no shut

Repeat for every vlan

2.3 Configure interface to 3825
int g0/48
no switchport
ip address [switch ip] [switch mask]
no shut

2.4 Configure default route for 3560
ip route 0.0.0.0 0.0.0.0 [router ip]

I'm assuming that the static route that outline above will be enough to allow the 3560X to forward the traffic for the VLANs that it is not managing. Do I have to configure this static route to be tied to the interface that is connected to the router? I believe this is a global command, but this scenario may consider it otherwise.

As you can see in the diagram, there's a Cisco 2960X that is connected to the 3560X and that the web servers are connected to. This is to facilitate traffic between the VLANs and the WEB VLAN. With the 3560X doing the intervlan routing, the traffic to the WEB VLAN will go to the 3825. This may or may not be a desired result. So is there a way to direct traffic from VLANs 10, 20, and 30 to go through the trunk to the 2960X?
At some point the Barracuda web filter will be out of the picture. At that point all the VLANs will be routed in the 3560X

[Jon Marshall]

One other thing.

You mentioned acls on the router.

If these acls are just normal acls applied to a L3 interface then it should not be a problem.

If they are reflexive acls then I doubt the L3 switch will support them.

Jon

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

As Jon has already described, you should be able to do what you desire.

Keep in mind, with a trunk between the router and switch, you have different options for exchanging L2 and L3 traffic.  For example, the router and switch can use HSRP to share a gateway on the same VLAN.  I.e. you don't have to actually move subnets and VLANs, you also have the option to share them between the two devices.  Also moving or sharing can be per VLAN, all don't have to be configured the same way.