Management VLAN Switch Layer 2 Questions

[matias.huartamendia]

Hello,

I have questions that are quite simple to answer for most of you.

1) Why an L2 switch has an IP address if it's layer 2? Is it because it's considered a managed L2 switch?

2) Is that IP fixed depending on the manufacturer? Is it assigned to a specific port?

3) Can it be changed? Can it be assigned by DHCP?

4) Is it assigned to VLAN1 by default?

5) Can the switch be managed from any interface in the switch? even if they belong to different vlans/subnets?

6) Can the VLAN be changed?

Appreciate the response.

[David Ruess]

Hello,

Most of your questions can be answered with "yes, it can all be changed". No IP address is defined or assigned by default. When you log into a switch there is no configuration.

A L2 switch is referenced as such becasue thats its primary function in traffic forwarding. It uses L2 (MAC addresses) to get frames to where they need to go. 

The IP address is usually assigned to a MGMT VLAN that you create (or can be VLAN 1). This is used for connectivity and logging into the device remotely. As long as it has access to the network through upstream devices then thats how you would mange the device.

An IP is also used for things like Ping, SNMP, NTP, Logging, Etc. Its also a way of identifying the device.

Hope that helps

-David

[matias.huartamendia]

@David Ruess thanks for answering.

So no IP address by default, no management vlan by default?

Do I have to connect to a specific port to configure it?

So its not managed via web by default?

[David Ruess]

A new switch has no configuration on it except VLAN 1 which all ports are in by default. You can make any VLAN your management VLAN and you can connect any port you want and configure it to meet your needs.

[liviu.gheorghe]

Hello @matias.huartamendia ,

Correct, there is no IP address configured by default and all interfaces are in VLAN 1 which can be considered the default management VLAN.

Initial configuration of the switch is done by using the console port and a terminal emulation software - Putty for example. Once you configured a management IP address for the switch, a username and password, the enable secret password, you can access the switch remotely using the telnet protocol or the web interface.

Hope this helps.

[matias.huartamendia]

@liviu.gheorghe thank you for that.

Lets say I configure the IP to be 10.8.9.254 and VLAN 9, will I be able to connect to that IP only on VLAN 9 access port interfaces, or any other VLAN in other switches if routing is configured appropriately?

Would that mean the management vlan is 9 now, and it has to have a subnet and default gateway to be routable?

[liviu.gheorghe]

---

@matias.huartamendia wrote:

Lets say I configure the IP to be 10.8.9.254 and VLAN 9, will I be able to connect to that IP only on VLAN 9 access port interfaces, or any other VLAN in other switches if routing is configured appropriately?

If routing is configured appropriately in your network, you can connect to IP 10.8.9.254 from anywhere in your network.

Would that mean the management vlan is 9 now, and it has to have a subnet and default gateway to be routable?

---

Correct. Your new management plan 9 has to have a subnet and gateway. Also routing must be configured on the gateway (router) in order to enable reachability between this subnet and the rest of the network.

[matias.huartamendia]

@liviu.gheorghe ok great thanks for the response. And if I configured the port to be VLAN9 and I do not configure VLAN 9 in other switches, I can restrict management of the switch via this port ONLY, right? I can still define a gateway to get out tthe internet for example.

[liviu.gheorghe · Accepted solution]

Assigning a port in a vlan makes the hosts connected to that port part of that vlan. If you configure the routing in your network to distribute the subnet assigned to that vlan, then other hosts from different subnets will be able to reach it.

The proper way to restrict access to a device is to configure an access list. Management is done using protocols like telnet or ssh for command line usage or http/https for GUI.

You can define an access list on the switch and specify what IP addresses are allowed to access it. An example of such a configuration:

ip access-list standard ACL_VTY
permit 192.168.9.0 0.0.0.255

line vty 0 14
access-class ACL_VTY in
transport input ssh telnet

ip http access-class ipv4 ACL_VTY

The example defines an access-list named ACL_VTY that permits only IP's from subnet 192.168.9.0/24 to access the switch via telnet, ssh, http or https.

Hope this helps.

[matias.huartamendia]

@liviu.gheorghe thanks ffor that.

I understand that's the approrpiate way, although I was trying to evacuate the doubt if my procedure would work as well, which I think it does. Correct me if I am wrong

[liviu.gheorghe]

It would work only if your vlan 9 subnet is not known to the rest of the network.

[MHM Cisco World]

SW1(pure L2SW)(VLAN9 mgmt vlan)-SW2(transit)-SW3(L3 capability for inter-vlan)
SW1 have VLAN 9 and it SVI
SW3 have VLAN 9 and it SVI 
SW2 since it only l2 transit need VLAN9 no IP

do I need GW ? since it pure L2SW it need GW point to SVI of VLAN 9 in SW3 

do I need other VLAN and it SVI in pure L2SW ? No need, this VLAN 9 SVI IP is ok for mgmt like ping (check the status of SW) telnet (telnet need IP in device even if it Pure L2SW)

How I make my network more secure ? put all mgmt VLAN in VRF this make L3 layer totally separate

MHM 

[MHM Cisco World]

This pure l2 SW' and you config vlan 9 as mgmt vlan then you need 

1-L3 device (l3 sw or router) connect to this l2 sw via trunk or access port and  these port allow vlan 9

2- ip default gateway toward vlan 9 of l3 device 

This make l2 SW connect to any IP outside subnet of vlan 9.

If you config multi vlan SVI ip in l2 SW 

Same as above except 

1- port connect to l3 device must allow all vlan that have IP

2- l3 device must config with IP for vlan config in l2 SW (and have IP).

That all 

MHM

[Joseph W. Doherty]

Just another presentation of the information already within other posters' replies.

"1) Why an L2 switch has an IP address if it's layer 2?"

Same reason as any other IP host, i.e. so it can be reached on an IP network.

"Is it because it's considered a managed L2 switch?"

Yes and no.  A managed switch often can have an IP address but it doesn't need to.  Further, in theory (in practice?), a L2 switch might have an IP address to allow retrieval of stats, and not permit any "management".

Keep in the mind, the IP address supporting a host of some kind, doesn't require it be a specific kind of device, such as a switch and conversely a switch might not provide support for an IP address.

"2) Is that IP fixed depending on the manufacturer? Is it assigned to a specific port?"

Fixed, very, very likely not.  Ditto re: assigned to a specific port.

"3) Can it be changed? Can it be assigned by DHCP?"

Changeable?  Usually.  DSCP?  Possible, but not commonly.

"4) Is it assigned to VLAN1 by default?"

Presume VLAN capable switch?  Likely, yes.

"5) Can the switch be managed from any interface in the switch? even if they belong to different vlans/subnets?"

Any interface?  Depends on configuration.  Different VLANs/subnets?  Depends on configuration of switch and network.

"6) Can the VLAN be changed?"

Usually.