joealbergo wrote:
The VTP Domain traffic is at layer 2 on the switches -
So VTP traffic is not sent across.
The layer 3 Router will allow data between the VLAN's because it will re-route the data back to the VLAN's going through the Router's Sub Ethernet Interfaces.
Switches - sending traffic from one VLAN to OTHER VLAN's (with different ID's) must use a Router.
A Router will receive the traffic from VLAN 30 with the desination to VLAN 20 -
The Router will re-tag the data and send it back with the destination tag of VLAN 20.
The proper switch and VLAN receives that then?
I hope I am still with you - but speak on brother, speak on wise one.
Joe
Not sure about the "wise one"
Some examples will help with this but first a few key points.
1) a vlan is a L2 concept only. To forward packets within the same vlan mac-addresses are used as the destination address.
2) 99% of the time there is a 1-1 relationship between a L2 vlan and a L3 IP subnet.
3) To send data from one vlan to another vlan you do indeed need a L3 device, either a router or a L3 switch.
vlans 5/6 -> sw1 -> L2 trunk -> R1 -> routed link -> R2 -> L2 trunk -> sw2 -> vlans 7/8
in the above R1 and R2 are using 802.1q subinterfaces on their LAN interfaces. The link between R1 & R2 is a simple routed link. sw1 & sw2 are L2 switches.
vlan 5 = 192.168.5.0/24
vlan 7 = 192.168.6.0/24
H1 = 192.168.5.10
H2 = 192.168.6.10
H1 sends a packet to H2
1) H1 knows it is on network 192.168.5.0 because it knows it's address and it knows it subnet mask.
2) H1 compares H2's IP address with it's own subnet mask and works out that H2 is on the 192.168.6.0 network. Because the networks do not match H1 needs to send the packet to it's default-gateway which is the subinterface for vlan 5 on R1.
3) Assuming H1 has the mac-address of R1's vlan 5 subinterface it sends the frame out of it's NIC.
4) sw1 receives the packet on a port allocated to vlan 5, sees the destination IP is for R1 vlan 5 subinterface, also sees that is via a trunk so adds an 802.1q tag identifying this frame to be in vlan 5 and sends it to R1.
5) R1 receives the frame, strips the tag, lookups the destination IP, realises it has to send it to R2.
6) Assuming R1 has R2's L2 address it sends it to R2.
7) R2 does a lookup on the destination IP, sees it is on a directly connected subinterface, adds a vlan tag and sends it to sw2.
8) sw2 strips the tag and sends it to H2.
Note that vlan tags were only relevant between the L2 switch and the LAN interfaces of the routers. When the packet was routed between R1 & R2 there was no vlan tag and in fact there was no real concept of a vlan. The reason i specified R2's L2 address in point 6) above was that the routed link could be across ethernet in which case it would be a mac-address but it could also be frame-relay using DLCIs, ATM using VPI/VCIs etc..
Next example is a setup you are far more likely to see in production networks -
vlans 5/6 -> sw1 -> L2 trunk -> sw2 -> routed link -> R1 -> routed link -> R2 -> routed link -> sw3 -> L2 trunk -> sw4 -> vlans 7/8
sw1 and sw4 are still L2 only switches.
sw2 and sw3 are L3 switches which are now responsible for routing between vlans.
R1 and R2 are not now using subinterfaces and are not running 802.1q.
If H1 sends a packet to H2 it's pretty much the same process as above except that the vlan tagging only takes place between the switches in either sites. When the routers receive the frames on their LAN interfaces there is no vlan tagging at all.
In both the above examples each site would have it's own VTP domain and there would be no communication between the 2 domains. You could if you wanted give them the same name and it would make no difference ie. they would still be independant VTP domains with no communication between each other. Note also that in the above examples the vlan numbers are different in each site but you could if you wanted use the same vlan numbers in each site. This does not make them the same vlan ie. a host in vlan 5 in site1 is not in the same vlan as a host in vlan 5 in site2.
What you can't do is have a vlan in site1 using the same IP subnet as a vlan in site2 and then expect them to be able to communicate with each other. Because you cannot route to the same subnet. You can switch within the same subnet but not route within the same subnet.
Jon
