VLAN Information across L3 network

[ahmedaburaihan]

Hi Everyone! I need to clarify myself about VLANS. I have a topology like below. 

My question is that, does the vlan information from HostA travel across the L3 network and reach the otherside to HostC? 

Because I tried this topology and the hosts are communicating with each other, although they are in the same vlans.

Can someone tell me, how the traffic is going from PC1 to PC3 in other side of the network with all infos like VLAN info.  

[rais]

VLAN info isn't [usually] carried by layer-3 devices such as routers. 

The diagram seems to be an interconnect of two similar but different companies/networks that happen to use the same VLAN IDs for their HR/IT networks. Subnets are different.  Between switch ports gi0/0, there aren't any VLANs - just IP.

HTH.

[Giuseppe Larosa]

Hello @ahmedaburaihan ,

in your network scenario all VLANs are locally defined and because there is a router on the path between the two sites and the router uses two different L3 subnets 10.1.1.0/24 and 20.1.1.0/24 the router acts as a boundary for all L2 info.

Also to be noted the devices in each site should either be in the same VLAN or if they are in different VLANs they should have IP addresses in different IP subnets terminated on subinterfaces of the routers R1 and R2.

So PC1 to talk to PC3 uses L3 IP and sends packets to PC3 IP address 172.16.1.2 with source IP 192.168.1.2. R1, R3, R2 route the packets and VLAN info is not propagated.

Hope to help

Giuseppe

[Richard Burts]

Giuseppe is spot on in his response. R1, R2, and R3 are connected by routed links (different IP subnet on each connection). And vlan information is not sent over the routed links. 

The diagram shows a vlan 10 connected to R1 and a vlan 10 connected to R2. But they are not the same vlan. There are 2 separate vlans which happen to have the same name, but they are NOT the same vlan.

[ahmedaburaihan]

Yes, but in my case PC1 which is in VLAN 10 is not communicating to it's default Gateway which is R1. Also is it possible that PC1 should also communicate with PC3 of same VLANs without using Router on a Stick or SVI. Because during a packet capture I saw that Trunk link of Switch1 was carrying VLAN Information towards the default Gateway. Hope I get my answer, thanks alot. 

[Richard Burts]

There are several things to address about this:

- there are several significant mismatches in what you have set up. PC1 and PC2 appear to be in the same IP subnet but in different vlans. That is an architectural or configuration error. If PC1 and PC2 are truly in the same subnet then they need to be in the same vlan.

- PC1 not communicating with its default gateway. We do not know how R1 is configured, but logically f1/0 would be configured with vlan subinterfaces, one for vlan 10 and one for vlan 20. Which one of those is 192.168.1.0? Based on your description of the behavior vlan 20 has that subnet. What does the subinterface for vlan 10 have? When PC1 attempts to communicate with its gateway it will send an arp request for its gateway. The arp request arrives at the router in vlan 10 and there is not anything in vlan 10 that would respond to the arp request. 

- It would be expected behavior that a traffic capture of traffic going from PC1 toward its default gateway would carry vlan information. The frame is being carried on a trunk and needs the vlan information for the trunk to function correctly.

- You need to decide on some architectural issues: if there are truly 4 vlans then there need to be 4 subnets. If there are only 2 subnets then there need to be 2 vlans.

[ahmedaburaihan]

Why could it be architectural error if it's a need of the network let suppose. PC1 and PC2 have IPs from the same subnet because they are connected to the same Switch. Why should they be in different Subnets??? 

Also, they are in different VLANs because it is also the need of the company let's assume. Because a user from IT department is sitting in the same place where HR department is located and they are connected to the same Switch. Is it possible that they could have different Subnets by being connected to the same Switch??? 

[Giuseppe Larosa]

Hello @ahmedaburaihan ,

>> Is it possible that they could have different Subnets by being connected to the same Switch??? 

Yes , it is not only possible it is the way inter VLAN routing usually work.

@Richard Burts has provided you clear explanations of your issues.

One L2 VLAN can be mapped to multiple IP subnets using the ip address x.y.z.k  255.255.w.0 secondary feature but one IPv4 subnet cannot be mapped to multiple VLANs like in your network diagram without special configuration of vlan bridging.

In your case as explained your LAN switch has a trunk port to the router so it carries frames with VLAN tag 802.1Q . In order to make PC1 able to talk with R1 you need the following:

on R1

interface fas1/0

desc main physical interface

no ip address

int fas1/0.10

enc dot1q 10

ip address 192.168.1.1 255.255.255.0

int fas1/0.20

enc dot1q 20

ip addres 192.168.2.1 255.255.255.0

This is the way to make R1 able to process tagged frames. frames with tag VLAN=10 will be processed by subif int fas1/0.10 and frames with tag VLAN=20 will be processed by subif fas1/0.20.

The key command is encapsulation dtot1q X that informs the subinterface of what frames it should process. Also frames sent by the router will be tagged.

Make these changes on both sites and you will solve all IP connectivty issues.

Hope to help

Giuseppe

[ahmedaburaihan]

@Giuseppe Larosa Thanks for the clarification. the thing you mentioned is known as Router on a Stick. As shown in the figure below: 

I wished but something else, which is not possible as you say so. 

My comment is, would it not be better with a single IP subnet (192.168.1.0/24) to have 2 different VLANs (VLAN 10, VLAN  20)???
Also, it would have been a better solution if the VLANs information would travel to R1 from Sw1 and then enter to another side of Router (separate IP subnet) and carry the same VLANs info, communicate with other PCs in same VLANs.???

Hope you understood my consideration. 

[Giuseppe Larosa]

Hello @ahmedaburaihan ,

as I have explained before usually we have a one to one mapping between a VLAN and an IP subnet.

You could think of using Private VLANs where you have one primary VLAN used for the router port and secondary VLANs. However, this is an advanced concept with its own caveats.

>> My comment is, would it not be better with a single IP subnet (192.168.1.0/24) to have 2 different VLANs (VLAN 10, VLAN 20)???

This is not normally possible unless inter vlan bridiging or using Private VLANs but both are not recommended.

VLANs have local meaning, having the VLAN info carried between sites would require a L2 802.1Q trunk between sites but you have a router on the path and the links are L3 links so no VLAN info can be propagated and what I would like to point out it is not important to have this info.

From remote site point of view you just need to know the local site IP subnets using routing on routers R1, R3, R2.  The details of the mapping of an IP subnet to VLAN 10 or to VLAN 30 are not useful they are not needed for communication

Hope to help

Giuseppe

[ahmedaburaihan]

@Richard Burts thank you for the clarification. It was a test case in order to simulate and know the behavior. The purpose was to know whether it is possible to connect two different networks and within these different networks, the VLAN infos should travel, secondly to see if different VLANS exist in the same network and a PC belonging to VLAN10 from a subnet (192.168.1.0) could communicate to another PC belonging to (VLAN10) in different Network (lets say 10.1.1.0). 

[Richard Burts · Accepted solution]

You are welcome. I am not clear what you mean when you say "The purpose was to know whether it is possible to connect two different networks and within these different networks, the VLAN infos should travel". What I can say is that vlan information is used when a switch used as layer 2 switch is making forwarding decisions within a vlan and that vlan information is part of the ethernet frame when sent over a trunk. vlan information does not travel when forwarding traffic from one layer 3 domain/subnet to another layer 3 domain/subnet.

You also say "secondly to see if different VLANS exist in the same network". I believe you are asking if network 192.168.1.0/24 can have both vlan 10 and vlan 20. The answer to this is no this will not work. The fundamental problem with this is that if you did configure that then a PC in vlan 10 would want to communicate with another PC in the same subnet but in vlan 20. The vlan 10 PC would send an arp request for the vlan 20 PC. The arp request would be forwarded to all vlan 10 ports but not to vlan 20 ports. So the PCs would not be able to communicate.

You say one other thing " a PC belonging to VLAN10 from a subnet (192.168.1.0) could communicate to another PC belonging to (VLAN10) in different Network (lets say 10.1.1.0)." This is quite different from the other points and the answer to this is that yes you could have a single vlan and have 2 different IP subnets/networks.

Your questions are about the relationship of layer 2 boundaries (vlans) and layer 3 boundaries (networks/subnets). We tend to think that the relationship is one to one (one vlan has one network/subnet and one network/subnet is in one vlan). But one to many relationship is possible if you think of one vlan having multiple networks/subnets. But one network in multiple vlans does not work.

Another way to look at it is that vlan information  is used in making layer 2 forwarding decisions and the vlan information travels with the frame in that layer 2 domain but vlan information does not travel with the frame when making a layer 3 forwarding decision.

[ahmedaburaihan]

@Richard Burts 

@Giuseppe Larosa 

Thanks guys for helping. Its now very much clear. 

[Richard Burts]

You are welcome. I am glad that our suggestions have been helpful and that now it is more clear. Thank you for marking this question as solved. This will help other participants in the community to identify discussions which have helpful information. This community is an excellent place to ask questions and to learn about networking. I hope to see you continue to be active in the community.

[Joseph W. Doherty]

The others have already explained VLANs do not transit L3 links (without, unmentioned, L2 tunneling of some kind).

What I find interesting in your diagram, you appear to have one /24 subnet on each side of the diagram, hosting two hosts in that side of the network but in two VLANs.(?)