Using Interfaces as L2 access ports on L3 Catalyst

[fbeye]

Hello

I was trying to figure out if I would be able to dedicate/separate 10 Interfaces from my Catalyst 3750G so I wouldn’t have to buy another L2 Switch just to expand the Ethernet connections from my home router. 
I did not want to specify any IP Addresses but simply use 10 interfaces as extensions from the existing router. Would this be a simple;

vlan 10

Home Lan

interface range GigabitEthernet 10 - 20

switchport mode access

switchport access vlan 10

Or is that not how it would work. Also, would that allow the devices that connected to Interfaces 10-20 to communicate as well as grab their own IP from the main Router they are connecting to?

[TJ-20933766 · Accepted solution]

You are spot on. So long as you don't define an IP address on interface VLAN 10, your L3 switch will not route traffic.

Devices connecting to any of those ports will be able to get an IP address from the router so long as the router is also connected to one of the 10 ports.

[Joseph W. Doherty]

Tyson is correct, as long as your router is also connected to one of the VLAN 10 ports, you'll get the desired results (because the 3750G is also a L2 switch too).

However, you an assign an IP to that VLAN (10), but that might only cause issues if your hosts gateway IP isn't the router's IP on the interface connected to a VLAN 10 port.

Also BTW, by default, all the 3750G ports should be in VLAN 1, so in theory, unless you need multiple VLANs, all you need to do, to use the 3750G as an L2 switch, is just connect hosts and your router to any port (again, if running its default port setup).

[balaji.bandi]

depends on model of the switch, if you have more than 24 port model, you can simply create new VLAN Seperate from exiting network, and assign new IP range for that VLAN, you can also write ACL if you like to not to interact each other of you looking some security.

[fbeye]

It is a WS-C3750G-24TS-S1U.

Why does a L3 with more than 24 matter in this instance? Also in my scenario I want my home router be he hosting the DHCP Server and the assigned 10 interfaces I speak up to simply be an extension of the home router for more inputs, no routing on the L3. 
I am interested in what you say about inter vlan communication. By default I assume 2 vlans will not communicate but that raises a question on a situation where Interface GigabitEthernet 4 10.0.1.115 talks to GigabitEthernet 5 10.0.2.115 and there is no ACL but they communicate. I do have “ip routing” enabled and an IP Route for those 2 interfaces and so how are they communicating without an ACL?

[TJ-20933766]

A layer 3 switch has to have an IP address configured on the VLAN interfaces to route between VLANs. If you create a new VLAN without a VLAN interface or you just don't apply an IP address to the VLAN interface, that VLAN will be on it's own and traffic will not be routed between it and the rest of your VLANs.

-If GigabitEthernet4 & GigabitEthernet5 are on different VLANs and one of those VLANs does not have an IP address on the VLAN interface, they will not route between them.

-If both interfaces are on the same VLAN then these two computers could communicate so long as they were on the same subnet (although they would hear broadcast traffic from each other regardless).

-If both interfaces are in different VLANs and both of those VLANs have VLAN interfaces with IP addresses (and "ip routing" is enabled), the Layer 3 switch will route traffic between the two VLANs and only then would you require an ACL to limit or block all traffic between the two.

Does this help (or make sense lol)?

[fbeye]

It is very helpful. It makes sense actually. Thank you 

[Joseph W. Doherty]

"If both interfaces are on the same VLAN then these two computers could communicate so long as they were on the same subnet (although they would hear broadcast traffic from each other regardless)."

BTW, if hosts do not have a gateway IP defined, they can also communicate across subnets within the same VLAN.  (W/o a gateway, the host will ARP for all destination IPs.)

Also BTW, Tyson is correct about global broadcasts, but if the broadcast is a subnet broadcast, it's a bit more complicated.  I believe a switch will physically forward a subnet broadcast to all (excluding received) ports on the VLAN, but the hosts should filter out a subnet broadcast that's not directed to their network address (much as they would also do for unicast or multicast they have no interest in - although switches work to suppress non-desired unicast and multicast [if IGMP snooping supported]).