Vlan trunk protocol vs IP protocol

[rabbdavid]

I got a doubt about trunking protocol on switches which puts in communication different vlan, and a L3 device with its  gateway IP protocol <span;>which puts in communication different networks.

1st. Question
First of all even if maybe is a silly question I need you to confirm to me if 2 smaller subnets (/25 i.g.) derived from a bigger network (/24 I.g.), can be considered as 2 different networks.

2nd Question
if i have 1 router only and many switches connected to it one after the other,  is it possible to get more than 2 subnets?

3rd Question

I know trunk link works at L2 whilst IP protocol is working at L3, but vlan and subnet are associated, so if I send a packet from a source ip address of a subnet to a destination ip address of a different subnet, and i have not configured trunk link, can the packet arrive the same?

If arrives, what's the pro to have a trunk link?

4th Question
If it's the opposite scenario, I mean I have configured trunk link but I have not any subnets (I want to work at L2 only), so I have more vlan which house many end devices, can the frame arrive from an end device to another both in case they belong to the same vla, and in case they belong to different vlan?

[rabbdavid]

I am going to look into it.

Obviously it works but I have some questions:

1. on router interface g0/2 you created the subinterface but without giving any ip address, why? what does this type of configuration accomplish?

2. at the same time the other side of that link (g0/2 router - g0/1 switch if am not saying wrong), is not conifgured with trunk, why?

3. on SW2 you put int f0/4 in VLAN5 and configured int f0/8 as access port but not associating to any VLAN, why?

[Joseph W. Doherty]

Only changes I recall making were:

switch0:

interface FastEthernet0/6
switchport access vlan 6
switchport mode access

interface FastEthernet0/7
switchport access vlan 5
switchport mode access

interface GigabitEthernet0/1
switchport mode trunk

switch1:

interface FastEthernet0/6
switchport access vlan 6
switchport mode access

interface FastEthernet0/7
switchport access vlan 5
switchport mode access

[rabbdavid]

Ok thanks Joseph,  they must be my old pieces of configuration some which make no sense, some other - router configuration splitting the interface - left incomplete because I had come to conclusion that I could not set the same ip on both the subinterfaces of the two main router interfaces. And trunk I did not want to use on router link. Anyhow, thanks.

Regarding associating different subnet to same VLAN on different switches,  I am curious how to do for not creating problem even if it is highly not recommended. 

Thanks

[Joseph W. Doherty]

"Regarding associating different subnet to same VLAN on different switches,  I am curious how to do for not creating problem even if it is highly not recommended."

You're struggling with VLANs across switches.

Again, if I have two switches, with no L2 interconnection, each having a VLAN 5, there are TWO VLANs, TWO L2 domains, each identified as number 5 on their local switch.

If I have switches, with a L2 interconnection, one having VLAN 5, and the other having VLAN 6, but the L2 interconnection is connecting them, I have but ONE L2 domain.  (Cisco's CDP, though, if active, will generate messages you have a VLAN mismatch, which is true, for the VLAN ID, i.e. 5 connected to 6, but there's really just one VLAN, L2 domain.

Where the VLAN ID become very important, is on trunks.  Then frames are tagged with the VLAN ID.  This to allow "matching" L2 domains between switches.

If I have VLANs 4 and 5 on one switch, and VLANs 5 and 6 on the other, and interconnect them with a trunk, which tags the frames with VLAN IDs, the two switches will assume, the two VLANs 5, on the two switches, should be treated as one L2 domain (VLAN 5).

Even with a Cisco trunk, in the prior paragraph, I could disallow frames with VLAN 5 to use the trunk.  If I do that, I had two separate L2 VLAN 5 domains, one per switch.

L2 domains boil down to frames that are allowed to flow between nodes within the L2 domain.

Again, think about non-VLAN capable switches.  How do you share frames between multiple switches?  You need a link between switches.  Same is true with VLAN capable switches, but as you can have multiple VLANs, per switches, either you need a link for every VLAN you want to interconnect or some way to share a link.  The latter is a Cisco trunk, which keeps frames on the shared link logically separate by tagging the frames with a VLAN ID.

BTW, how does a switch keep VLANs segregated on a switch?  There no standard for that, it's up to the switch vendor.

[rabbdavid]

Even with a Cisco trunk, in the prior paragraph, I could disallow frames with VLAN 5 to use the trunk. If I do that, I had two separate L2 VLAN 5 domains, one per switch.

how can you manage to do that?

And what is the pro? 

Same VLAN ID on different switches but configured as 2 different L2 domains is just confusing.. I can't see any advantages in doing so.

BTW, how does a switch keep VLANs segregated on a switch? There no standard for that, it's up to the switch vendor.

really don't know how to do this.. and honestly I never thought about it.

[Joseph W. Doherty]

---

@rabbdavid wrote:

Even with a Cisco trunk, in the prior paragraph, I could disallow frames with VLAN 5 to use the trunk. If I do that, I had two separate L2 VLAN 5 domains, one per switch.

how can you manage to do that?

SWITCH#1(config-if)#switchport trunk allowed vlan ?
  WORD    VLAN IDs of the allowed VLANs when this port is in trunking mode
  add     add VLANs to the current list
  all     all VLANs
  except  all VLANs except the following
  none    no VLANs

And what is the pro? 

Usually used to keep traffic off a VLAN trunk that isn't used by other switches on the other side of the trunk.  I.e. saves bandwidth; provides a tad more security.

Same VLAN ID on different switches but configured as 2 different L2 domains is just confusing.. I can't see any advantages in doing so.

Indeed, often not done except in the cases of multiple L3 splits hosting VLANs for the same purpose.

For example, might have within a building or campus multiple (large chassis) L3 switches, each with a set of VLANs used for the same purpose.  For example, VLANs 10, 20, 30 and 40 might be each a PC data VLAN while VLANs 11, 21, 31 and 41 might be companion voice VLANs for VoIP phones.  However, as the switches are L3, these VLANs likely not L2 extended into the same L2 domain.

For example, years ago, at one site, we had a couple of 6513s, supporting eleven 96 FE ports line cards for users.  Each user port supported a data and voice VLAN.  As a general rule, we generally didn't exceed a /24 for user subnets, but with over a thousand ports, that was 4 data VLANs and 4 voice VLANs.  Again, as these 6513s were L3, no reason to have VLANs span the switches, but rather than assign another set of same purpose VLANs on each chassis, VLAN numbers were used for same purposes and same port allocations on each chassis switch. Made it as bit easier to maintain.

Often you would see similar situations with switches separated by L3 based on floor, building, campus.  I.e. Same VLAN numbering, for same usage standard, but each identically numbered VLAN was its own L2 domain.

Of course, if you do want to have the same L2 domain span multiple switches, you would generally use the same VLAN number, and, on Cisco switches, by default, if you don't you'll get CDP mismatch VLAN messages.

The only time a VLAN number is really important is when using trunk links, as switches assume VLAN numbers, for the same L2 domain, should be identical.

Laugh, recently been involved in another discussion how to merge two different VLAN numbers, on different switches.  Posed as an interview question, can it be done, and how would it be done.

[rabbdavid]

Ok as you implicitly said in your message above, same VLAN ID on different switches is certainly possibile but only because they work as separate L2 domains, they are not interconnected. VLAN5 on a switch has not been extended on other switches, they are 2 separated VLAN5, just same VLAN ID.

 ....can we say that is like have different subnets in a certain way?

I can see the praticatal side for this, naming vlan 10-20-30-40 and 125-215-758 etc.

I'll go have a look on the other discussion 

[Joseph W. Doherty]

I suspect you're still struggling with VLANs, conceptionally.  If so, . . .

Consider you have a singe non-VLAN capable switch.  How many IP networks can you have on it?

A: As many as IP supports.

Consider you have a second non-VLAN capable switch.  It too can have multiple IP networks, but can these two switches host the same IP network?  As I didn't mention any switch to switch connectivity, yes they can, because each switch is isolated from the other.

Next, though, we directly interconnect these two switches.  What does this cause?  Logically, the two switches become one switch (one L2 domain).  Just as switch hosts did not know what port other hosts are connected to, once you interconnect the two switches, hosts do not know what switch another host is connect to.  This means what were isolated IP networks, now become one network.

For example, with the two separate switches, I could have a host with IP 192.168.1.5/24 on both switches.  Cannot, though, have that IP shared by two hosts on the same switch.

When we interconnect the switches, we cannot have two hosts with the same IP.

Next consider those two same switches, but rather than having a direct interconnection, each is connected to a router.

Can you still have many IP networks on each switch?  Yes you can.

Can you have the same network, on both those switches, e.g. 192.168.1.0/24?  No you cannot, because otherwise the router wouldn't know which switch has host 192.168.1.5/24.

Or consider, you have a non-VLAN capable 24 port switch.  You replace it with a non-VLAN capable 48 port switch.  What's changed?  You have twice as many ports.

Further consider, you have you have a non-VLAN capable 24 port switch.  You add another non-VLAN capable 24 port switch, and directly interconnect the two switches.  How does that differ from using a 48 port switch?  It doesn't.

Do you understand all the above?  If not, asked further questions and/or experiment in Packet Tracer (without defining any VLANs).

If you understand the forgoing, VLANs allow to split/merge/combine ports across switches, much a you might do with physical switches.

For example, if we have a 48 port VLAN capable switch, we can define two VLANs, each using 24 ports, which effectively provides us two 24 port non-VLAN capable switches.  Since VLANs are assigned per port, we can be very flexible in port usage.

Before there were VLAN capable switches, I might have a need to provide one L2 segment 30 ports and another L2 segment 10 ports.  This might have required using a 48 port switch, or two cascaded 24 port switches, or cascaded one 24 port switch with one 12 or 8 port switch, or etc.  Similar issue for providing the 10 ports.

With VLAN capable switches, I just allocate whatever number of ports, per VLAN, that are required from one or multiple cascaded VLAN switches.

The "rules" using non-VLAN capable switch or VLANs, are the same.  As both provide a L2 broadcast domain.

The extra part to VLAN capable switches, as they can have multiple VLANs, direct logical interconnections can be done physically by using VLAN tagged frames.

[rabbdavid]

Hi Joseph,

I have a doubt on this part:

Next, though, we directly interconnect these two switches.  What does this cause?  Logically, the two switches become one switch (one L2 domain).  Just as switch hosts did not know what port other hosts are connected to, once you interconnect the two switches, hosts do not know what switch another host is connect to.  This means what were isolated IP networks, now become one network.

if we have for example 3 hosts on a switch belonging to different networks, and 5 hosts on the other switch belonging to a different networks as well; how many L2 domains do we have considering we have non-capable VLAN switches and are not interconnected? 8 because I have 8 networks, or 2 becasue I have 2 non-capable VLAN switches?

If answer is 8, considering all networks adresses are different among each other so that I'll not have IP overlapping issue in case of switches interconnection, when I interconnect the two switches, why does the L2 domains turn into 1 only, and why will we get 1 network IP only?

[Joseph W. Doherty]

When you join the two switches the 2 L2 domains become one L2 domain but you retain all 8 IP networks.

Consider if you keep the two switches separate, can you relocate one host PC to the other switch?  Could you place all 8 on one switch?  If so, how does that differ from connecting the two switches?  (It doesn't.)

[Joseph W. Doherty]

BTW, I also suspect you're struggling a bit with the difference between the L2 domain and the L3 IP domain.

Both assume they have direct inter host/node/device access within their domain.  I.e. one host/node/device can communicate with any other host/node/device with their domain.

Again, consider a single non-VLAN capable Ethernet switch.  Regardless of the number of ports it provides, any connected device should be able to send/receive L2 frames to any other connected device.

If you have two such switches, with no inter switch connectivity, hosts/nodes/devices cannot intercommunicate.  But, the moment you connect those two switches, the behavior changes to match a single switch with the total number of ports.

The L2 boundary is determined by where frames can flow between hosts/nodes/devices.

BTW, addresses need to be unique per domain.  On one switch, you cannot have two hosts/nodes/devices with the same MAC, but you can on two non-connected switches.  Again, the moment you connect the two switches, you cannot have a MAC conflict.

VLANs just provide logical L2 domains.  If I define two VLANs on one switch, hosts/nodes/devices are L2 isolated, between the VLANs, just as when we have two physical non-connected switches.  If I move a particular host/node/device from one VLAN to another, its MAC cannot conflict with other hosts/nodes/devices on that VLAN.

Again, a VLAN is but a logical equivalent of non-VLAN capable switches.  All the same rules apply.

A L3 IP domain, in many ways, has the same "rules" as a L2 domain.  Each IP host/node/device assumes it can reach any other IP host/node/device in the same L3 domain.  An IP need to be unique within the same L3 domain.

Consider two separate businesses, without any external connectivity.  Can each use 192.168.1.0/24 as a network?  The answer is yes.  What happens if you interconnect the two networks?  You'll have a duplicate network usage, which isn't allowed.

L3 runs on top of L2 and with IP, each L3 network requires a common L2 domain.  Multiple IP networks can use the same L2 domain, but, again, you cannot have a single L3 network on different L2 domains.

Most often you'll see just a single L3 network on a single L2 domain, but that's not a requirement.

Also, commonly, you'll see some L3 networks used as a transit for other L3 networks, but those transit networks are not hosted on the transit L3 network.

Multiple L2 domains are often interconnected by L3.  At the L2 level, they are totally isolated, again like non-interconnected switches, but they are part of single L3 domain.

When you have:

L2-switch<>L2-switch, that only supports extending the L2 domain, might be physical (e.g. switches) or logical (VLANs)

L2-switch<>Router<>L2-switch, that generally is one L3 domain, with multiple L2 domains

In theory, the whole world could run on one single L2 domain using 48 bit MACs and "flat" addressing.  In practice, this isn't practical on network hardware, since the creation of 48 bit MACs and the foreseeable future.  Often to scale up you need hierarchal addressing which is what IP provides.

[rabbdavid]

Thanks, all above is clear

L3 runs on top of L2 and with IP, each L3 network requires a common L2 domain.  Multiple IP networks can use the same L2 domain, but, again, you cannot have a single L3 network on different L2 domains.

however here I have some doubt when you say you can't have a single L3 network on different L2 domains.

If L2 domains here means VLANs, in the other discussion we said the opposite: you can have L3 network on more L2 domains/VLANs by a trunk link connecting two VLANs f we avoid spanning tree, or by access link connecting two VLANs.

Also, commonly, you'll see some L3 networks used as a transit for other L3 networks, but those transit networks are not hosted on the transit L3 network. I don't understand that statement and I don't know transit networks.

Multiple L2 domains are often interconnected by L3.  At the L2 level, they are totally isolated, again like non-interconnected switches, but they are part of single L3 domain. 

One confirmation: if I have 2 PCs connected each other by a router, setting them two on different networks, the PCs themselves form two single L2 domains even if I don't use any swtiches, correct?

When you have:

L2-switch<>L2-switch, that only supports extending the L2 domain, might be physical (e.g. switches) or logical (VLANs)

This means I can connect two L2 domains on single switches, by using a physcal cable (joining the two domains to one)

or by creating an only VLAN on both switches (all ports of both switches in access).

or, when you say "extending might be logical" you mean creating a common VLAN span between switches (so, just some ports of SW1 and some of SW2 put under same VLAN)?

L2-switch<>Router<>L2-switch, that generally is one L3 domain, with multiple L2 domains

In theory, the whole world could run on one single L2 domain using 48 bit MACs and "flat" addressing.  In practice, this isn't practical on network hardware, since the creation of 48 bit MACs and the foreseeable future. 

Actually I can't see the bad implications of using 48 bit MACs, and flat addressing.

By the way, flat addressing means one only big L3 network, so I need no router for hosts communicating each other, right?

Often to scale up you need hierarchal addressing which is what IP provides.

[Joseph W. Doherty]

however here I have some doubt when you say you can't have a single L3 network on different L2 domains.

Correct for the same L3 domain.  (BTW for L3 network, I mean something like #.#.#.#/#.)

If L2 domains here means VLANs, in the other discussion we said the opposite: you can have L3 network on more L2 domains/VLANs by a trunk link connecting two VLANs f we avoid spanning tree, or by access link connecting two VLANs.

In that discussion, we're joining VLANs on two different switches, but the VLANs are numbered differently on the two switches.  In theory, joining two separate L2 domains is joining two separate L2 domains, but in that discussion, things unique to Cisco, that are VLAN number aware, cause issues.  What that discussion is dealing with, is something you, hopefully, will never encounter in a production network.

Also, commonly, you'll see some L3 networks used as a transit for other L3 networks, but those transit networks are not hosted on the transit L3 network. I don't understand that statement and I don't know transit networks.

Typical example would be a point-to-point /30 link, but transit just means a network that other networks use to pass traffic back and forth.  E.g. /24<>/30<>/24  the /30 is a transit for the two /24s because its neither a source or destination for those two /24s packet exchanges.  Also, the transit could also be other than a /30 and/or be a source or destination for the two /24 networks, but those networks need to transit it to reach each other.

One confirmation: if I have 2 PCs connected each other by a router, setting them two on different networks, the PCs themselves form two single L2 domains even if I don't use any swtiches, correct?

Correct.

This means I can connect two L2 domains on single switches, by using a physcal cable (joining the two domains to one)

or by creating an only VLAN on both switches (all ports of both switches in access).

or, when you say "extending might be logical" you mean creating a common VLAN span between switches (so, just some ports of SW1 and some of SW2 put under same VLAN)?

Correct.

Actually I can't see the bad implications of using 48 bit MACs, and flat addressing.

Laugh, very, very common thinking of those new to networking.

By the way, flat addressing means one only big L3 network, so I need no router for hosts communicating each other, right?

Correct, but start to really ponder how to make it actually work.

As there's up to 281,474,976,710,656 addresses, how does each device find any other?

If you were using switches, potentially each switch table could have up to 281,474,976,710,656 entries, multiplied by how many bytes for possible egress ports.  How does the switch learn which port is the correct egress toward every one of those MACs?

[rabbdavid]

Actually I can't see the bad implications of using 48 bit MACs, and flat addressing.

Laugh, very, very common thinking of those new to networking.

By the way, flat addressing means one only big L3 network, so I need no router for hosts communicating each other, right?

Correct, but start to really ponder how to make it actually work.

As there's up to 281,474,976,710,656 addresses, how does each device find any other?

If you were using switches, potentially each switch table could have up to 281,474,976,710,656 entries, multiplied by how many bytes for possible egress ports.  How does the switch learn which port is the correct egress toward every one of those MACs?

Flat addressing which are with no router and no switches dividing lan networks in vlan, is really impossible to manage, isn't it?

[Joseph W. Doherty]

Flat addressing which are with no router and no switches dividing lan networks in vlan, is really impossible to manage, isn't it?

Usually all fail due to scalability issues.  Also, VLANs aren't needed, but they are a great convenience, the usage of different ports on the same switch for different L2 domains.  Before VLANs, separation of L2 domains often got very much involved with how many ports a switch provides, and when there was growth, often replacing one switch with a larger switch or adding an additional switch.  You also often ended up needing more physical switches, as they couldn't share their ports for different L2 domains.  More switches also meant more switches to maintain, configure, manage, etc.

Another problem of flat addressing, how do you provide best paths?  At L2, everything is just there.  With L3 routing, a topology is created.