PC on Static IP change from one VLAN to another

[Cherubim Ramirez]

Hi All,

I just would like to check if this is correct. To demonstrate below is the topology:

There are two VLANs, two PCs (PC1 and PC3) are getting their IP addresses from the Core Switch. PC2 is in static IP address. Gateways are configured for each PC. Everything works. However if PC2, still in static IP, is plugged in to a port configured as VLAN 20, all pings fail. Destination Unreachable and RTOs are shown. The switch do knows where each PC is located based on show mac address-table. The only difference is the VLAN number for PC2 has changed from VLAN 10 to 20.

Any switching concept I am missing here? 

[Reza Sharifi]

Hi,

When you switch the PC from vlan 10 to 20, make sure the PC is configured to pick IP from the DHCP server and not static.

HTH

[Cherubim Ramirez]

Yes, this is noted. I do DHCP as much as possible for all VLANs. It's just that this scenario came up and it made me curious. Based on my testing it does not work but I would like to know the concept behind it.

[pwwiddicombe · Accepted solution]

They WILL fail, as you have not got the correct gateway or network defined on the PC.  If you had 2 PC's set up with similar static info and you plugged BOTH into VLAN 20, they would see each other, but nothing else (as they have a "common misconfiguration").

This is why we want to use DHCP for typical (mobile) devices.

[Cherubim Ramirez]

Hi,

This might be silly to ask, does it mean that the VLAN column in show mac address-table is still important? Based on what I have learned from a Cisco class, only the destination mac address and port where it was learned are being checked. Does the switch do the following:

Check destination MAC -> VLAN (correct gateway) -> forward to port where it was learned?

Is there any cisco docu that I can read more about this? I have been searching since yesterday but still cannot found anything.

[pwwiddicombe]

I don't know if there's a way to "trick" the system, but there are 2 concepts here:

1.  VLANs are SUPPOSED to isolate LAN segments for various reasons (security, broadcast control, etc.).

2.  Your misconfigured workstation would be trying to LOCATE destination IP addresses and failing to get an ARP back.    Based on the mask, the workstation would recognize it's a different subnet, and look for it's configured gateway; and even the ARP to the gateway would fail; so you'd get nowhere.

As a potential third problem; assuming the destination did miraculously get the packet through some tricky finangling, the destination would then attempt to return the packet to the destination network; and that IP address isn't correctly ON the right network.

[Cherubim Ramirez]

Thanks Sir!