cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
870
Views
1
Helpful
8
Replies

non-routable protocol between two vlans

Ruhtra
Level 1
Level 1

Short history first.  Inherited this mess.  Have a vlan that had PC's and PLC's that used two seperate IP address ranges (call them 10. and 192.).  To implement new firewall rules they were split up into two respective vlans.  The downside is there is a small number of devices that can longer talk to each other across the two vlans using non-routable protocols (s7comm and cotp).  Doable, but undesirable, we can readdress and change many of them, but this is a LARGE network, several hundred each.  It would take a long time.  Is there a way to bridge or forward these two protocols that are mac-based between the two vlans?  They aren't broadcast, so helper-address is not the answer.

8 Replies 8

Reza Sharifi
Hall of Fame
Hall of Fame

If they are all connected to Cisco switches and the default gateway for both vlans are on the same switch, most Cisco switches route between vlans (on the same switch) without a need for any routing protocol. 

HTH 

 

The two protocols only talk layer 2.

Joseph W. Doherty
Hall of Fame
Hall of Fame

"Is there a way to bridge or forward these two protocols that are mac-based between the two vlans?"

Maybe.

I believe I understand exactly what you want to accomplish, unsure whether it's actually doable.

Much would depend on the bridging device's capabilities.

BTW, if possible rather than the bridging device filtering via MACs, might filtering by protocol be better?  Answer might also be influenced by number of hosts.

Another possible approach might define a VLAN for these hosts.  Implicitly it solves the L2 issue but leaves full L3 control to/from that VLAN.

Also, if you try the new VLAN approach, remember rather than moving all these special hosts to it, it might be easier to move the non special hosts to it.

The new network is setup as a VSS 9606 pair, supporting 80+ L2 9300 switch stacks.  About 10 vrf's, and 50 different vlans.  Using VTP, all the switch-stacks are clients, so any changes made to the vlans on the 9606 will propagate.  It gets complicated since the field devices can send data to PC's, servers, etc, via L3 protocols, but talk between each other using L2 protocols, and that can't be changed.  The easiest would be to allow the L2 traffic between the two specific vlans.  But if I have to ask the engineers to re-IP their equipment, then that's what I will do.

There are several (easy) ways to bridge VLANs, but doing so, you're negating the primary purpose of VLANs.  This is where the filtering issues comes into play, whether filtering by MACs and/or some L2 protocols.  I.e. ideally, I presume, you only want the special L2 protocols to be able to communicate, directly, using L2 across VLANs.

I don't recall whether any Cisco equipment supports it, but I recall some vendors do support protocol based VLANs.  For any that might, don't recall whether protocol could be purely L2.  (NB: just did a quick search, protocol based VLANs support varies, per vendor, and Cisco does support protocol based VLANs on some of their SMB devices [other Cisco devices too?].)

The second issue, which I didn't get into, is whether these L2 protocols will operate totally independent of L3, which I'm guessing they do.  Otherwise, they hosts will consider themselves on different networks and these specially L2 protocols may fail to operate correctly, if when you span/join their VLANs if they have IPs in different networks.

In summary, I still think this is a "maybe", again much depending on what your special L2 apps need and what your network can support.

Assuming there is one or more ways to do this, I'm sure you would want to compare the "cost" to do them, versus some of your other options, which for many reasons, you hope not need to pursue.

Your need is unusual enough, I think it unlikely anyone will pop up with, did exactly that too, just last week, doing this xxx.

BTW, this is the kind of project I often was asked to investigate, and so can say, it often requires a good bit of research, often some lab work (to confirm or correct possible implementations) and final analysis of best approach, which might lead you back to where you began.

These two were previously one vlan, and they were separated with the network upgrade based on IP address.  The engineers managed their own IP addresses for this big fat vlan.  It was assumed (and asked many different ways) that they were grouped by logical IP address range and separating them would not be an issue.  If you're wondering it's all automation equipment, like Siemens, Rockwell, etc.  I think we are going to push the engineers to modify their IP addresses to better align with logical groupings of devices that actually need to talk to each other.  Thanks to all responses.

Ruhtra
Level 1
Level 1

I should have mentioned, I am only worried about those two protocols, S7COMM and COTP.

mlund
Level 7
Level 7

I would suggest to have a look at cisco:s IRB (Integrated Routing and Bridging) feature, and see if that could solve your issue.

In short, it can make 2 interfaces to a bridge-group, where traffic is bridged between the interfaces, while traffic outside will be routed.

Review Cisco Networking for a $25 gift card