Make Loopback interfaces on Switches reachable/pingable

[CiscoBrownBelt]

I know that I would need to create static routes or use a routing protocol to make loopback interfaces pingable but what about if I create loopbacks on switches?

[Francesco Molino]

Hi

If the loopback is created on your layer 3 switch which has svi default gateways for your user vlans, then you will be able to reach it.
If svi for users are on a distribution switch and you create loopbacks on access switch, you won't be able to reach them without routing (dynamic or static)

[CiscoBrownBelt]

Ok thanks!

Ok so if you reference the topology of my other post (or one I uploaded for you convenience),

I will create loopbacks on both access switches (access switch has SVIs for all subnets needed for users/servers, and the DG for these switches points to the Inside/Internal Routers) -  there is no real distribution switch being used.

Router, and all other devices will have loopbacks as well. I would rather not use dynamic routing so I would simply create static route pointing to each loopback (e.g. on Access switch create ip route 10.1.1.1 255.255.255.0 for interface loopback 10 on Router?

Also, I would like to name all loopbacks the same (e.g. loopback 10) on each device for easy memory but use different IPs would this be a best practice?

[CiscoBrownBelt]

Also in regards to my static routes, based on my topology I have to configure an actual host IP for each device instead of lets say 10.1.1.0 255.255.255.0 (DG) correct?

Also, if I have to use some other IP on the device that has the loopback I am trying to reach (let's say SVI 10 10.1.1.5) does this kinda defeat the purpose of the loopbacks if I am using them for management reachability since they never go down - SVI 10 could go down.

[Francesco Molino]

Not sure I get your point here. You can assign /32 subnet mask to your loopback but sometimes you can also want to assign /24 if you use them on another interface with IP unnumbered Loopback xx. This depends on your requirements but quite often it's /32 subnet mask.
Now, you can have a SVI using IP in same subnet as loopback, the device will say overlap ip address. For example, if you have your svi using 10.10.10.1/24, you can't assign 10.10.10.254/32 to your loopback.

[CiscoBrownBelt]

Not sure I get your point here.

Not sure which statement you were referring to but I configure static route for a device loop back as 

let's say 10.10.10.10 255.255.255.255  instead of 10.10.10.0 255.255.255.0.

 You can assign /32 subnet mask to your loopback but sometimes you can also want to assign /24 if you use them on another interface with IP unnumbered Loopback xx. This depends on your requirements but quite often it's /32 subnet mask.

The loopback is not going on an actual interface just configuring globally correct? Can you give me an example sorry I am a bit confused.

Now, you can have a SVI using IP in same subnet as loopback, the device will say overlap ip address. For example, if you have your svi using 10.10.10.1/24, you can't assign 10.10.10.254/32 to your loopback.

Right overlap got it.

[Francesco Molino]

Ok for your new loopback setup as /32.

unnumbered example: There are different usage but one of them would be SSL VPN on IOS routers. You want to assign a pool to your vpn clients on a subnet that's not directly connected (subnet not attached to a physical interface), then you would need to create a loopback and call it into your SSL config. In that specific case, if you have multiple users you want them to be able to pick up an IP and get able to access network.
Config example:

crypto ssl authorization policy authz-policy
mtu 1400
netmask 255.255.255.0
include-local-lan
pool SSLPOOL
dns 172.16.1.1
def-domain test.lab
route set access-list sslvpn-tunnel-acl
!
ip local pool SSLPOOL 10.255.255.10 10.255.255.50
!
interface Loopback111
ip address 10.255.255.1 255.255.255.128