InterVLAN Routing | [Link] [Link]

Search...

Table of Contents
CCIE Routing & Switching

 Unit 1: Preparation

 Unit 2: Switching

 Unit 3: IP Routing

Cisco IP Classless Command

ICMP Redirect on Cisco IOS

CEF (Cisco Express Forwarding)

TCLSH and Macro Ping Test on Cisco Routers and Switches

Routing between VLANS

O�set-Lists

Administrative Distance

Policy Based Routing

Introduction to Redistribution

Redistribution between RIP and EIGRP

Redistribution between OSPF and RIP

How to con�gure Route Tagging

Metric Based Redistribution Problems

AD Based Redistribution Problems

1 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

GRE Tunnelling

GRE Tunnelling Recursive Routing Error

IP Unnumbered Explained

MTU Troubleshooting

Introduction to PPP on Cisco IOS Router

PPPoE Server

Proxy ARP Explained

Reliable Static Routing with IP SLA

Introduction to OER (Optimized Edge Routing)

Bidirectional Forwarding Detection (BFD)

OER (Optimized Edge Routing) Basic Con�guration

OER (Optimized Edge Routing) Timers for Labs

OER Variance to solve Policy Con�icts

OER (Optimize Edge Routing) Phases

 Unit 4: RIP

 Unit 5: EIGRP

 Unit 6: OSPF

 Unit 7: BGP

 Unit 8: Multicast

 Unit 9: IPv6

 Unit 10: Quality of Service

 Unit 11: Security

 Unit 12: System Management

 Unit 13: Network Services

 Unit 14: MPLS

You are here: Home » Cisco » CCIE Routing & Switching

InterVLAN Routing
a d k y v

2 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

In this lesson we are going to take a look at routing between VLANs. When we want
communication between di�erent VLANs we’ll need a device that can do routing. We
could use an external router but it’s also possible to use a multilayer switch (aka layer 3
switches).

Let’s look at the di�erent options!

Router on a Stick

SW1 has two VLANs so we have two di�erent subnets. If we want communication
between these VLANs we’ll have to use a device that can do routing. In this example we’ll
use a router for the job. R1 will need access to both VLANs so we’ll create a 802.1Q trunk
between SW1 and R1. Here’s how to con�gure this:

SW1(config)#interface fa0/3
SW1(config-if)#switchport trunk encapsulation dot1q
SW1(config-if)#switchport mode trunk
SW1(config-if)#switchport trunk allowed vlan 10,20

3 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

This is how we con�gure SW1. Make interface fa0/3 a trunk port and for security
measures I made sure that only VLAN 10 and 20 are allowed.

R1(config)#interface fa0/0.10
R1(config-subif)#encapsulation dot1Q 10
R1(config-subif)#ip address [Link] [Link]
R1(config)#interface fa0/0.20
R1(config-subif)#encapsulation dot1Q 20
R1(config-subif)#ip address [Link] [Link]

Create two sub-interfaces on the router and tell it to which VLAN they belong. Don’t
forget to add an IP address for each VLAN.

R1#show ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter
area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external
type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 -
IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user
static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C [Link]/24 is directly connected, FastEthernet0/0.10

C [Link]/24 is directly connected, FastEthernet0/0.20

4 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

The router will be able to route because these two networks are directly connected.

C:\Documents and Settings\H1>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : [Link]
Subnet Mask . . . . . . . . . . . : [Link]
Default Gateway . . . . . . . . . : [Link]

C:\Documents and Settings\H2>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : [Link]
Subnet Mask . . . . . . . . . . . : [Link]
Default Gateway . . . . . . . . . : [Link]

Don’t forget to set your IP address and gateway on the computers.

Let’s try a ping:

C:\Documents and Settings\H1>ping [Link]

Pinging [Link] with 32 bytes of data:

5 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

Reply from [Link]: bytes=32 time<1ms TTL=128

Reply from [Link]: bytes=32 time<1ms TTL=128
Reply from [Link]: bytes=32 time<1ms TTL=128
Reply from [Link]: bytes=32 time<1ms TTL=128

Ping statistics for [Link]:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

That’s how you do it. So why would you want to use a solution like this? It’s cheap! You
don’t need a multilayer switch for your routing. Any layer 2 switch will do.

The Cisco Catalyst 2960 is a layer 2 switch; the cheapest multilayer switch is the Cisco
Catalyst 3560. Compare the price on those two and you’ll see what I’m talking about.

Some of the disadvantages of this solution is that your router is a single point of failure
and that tra�c �ows up and down on the same link which might cause congestion.

Configurations

Want to take a look for yourself? Here you will �nd the con�guration of each device.

R1
hostname R1
!
interface fastEthernet0/0.10
encapsulation dot1Q 10
ip address [Link] [Link]
!

6 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

interface fastEthernet0/0.20
encapsulation dot1Q 20
ip address [Link] [Link]
!
end

SW1
hostname SW1
!
interface fastEthernet0/1
switchport mode access
switchport access vlan 10
!
interface fastEthernet0/2
switchport mode access
switchport access vlan 20
!
interface fastEthernet0/3
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10,20
end

So what other solutions do we have?

SVI (Switch Virtual Interface)

7 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

This is the picture of a multilayer switch. This switch has routing capabilities! I can
con�gure something called a SVI (Switch Virtual Interface) for each VLAN and put an IP
address on it. This IP address can be used for computers as their default gateway. Here’s
how to con�gure it:

SW1(config)#ip routing
SW1(config)#interface vlan 10
SW1(config-if)#no shutdown
SW1(config-if)#ip address [Link] [Link]
SW1(config)#interface vlan 20
SW1(config-if)#no shutdown
SW1(config-if)#ip address [Link] [Link]

Start by enabling routing using the ip routing command. If you forget this your switch
won’t build a routing table! Next step is to create a SVI for VLAN 10 and 20 and con�gure
IP addresses on them. This con�guration might look familiar if you worked with layer 2

8 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

switches before. On a layer 2 switch like the Cisco Catalyst 2950/2960 we also have a SVI
but you can only use it for remote management.

Once you create a SVI and type no shutdown it will normally be “up” since it’s only a
virtual interface, there are however a number of requirements or it will show up as
“down”:

The VLAN has to exist in the VLAN database and it should be active.
At least one access or trunk port should use this VLAN actively and it should be in
spanning-tree forwarding mode.

Simply said: the VLAN has to be active somehow or your SVI will go down.

I have two computers in VLAN 10 and created a SVI for VLAN 10.

SW1#show ip interface brief vlan 10

9 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

Interface IP-Address OK? Method Status

Protocol
Vlan10 [Link] YES manual up up

You’ll see that the status says up/up so that’s good.

If I shutdown one interface nothing will change, my SVI will still show up/up because
interface fa0/2 is still active.

10 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

SW1#show ip interface brief vlan 10

Interface IP-Address OK? Method Status
Protocol
Vlan10 [Link] YES manual up down

Once I shut both interfaces we don’t have anything active anymore in VLAN 10. As a
result the SVI will go to up/down.

Now if I want I can exclude an interface from the SVI state. Imagine I want to make sure
that whatever happens to interface fa0/2 doesn’t in�uence the SVI state:

SW1(config)#interface fa0/2
SW1(config-if)#switchport autostate exclude

I can use the switchport autostate exclude command. This means it won’t in�uence the

11 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

state of the SVI interface anymore. Fa0/1 is the only interface that can now in�uence the
SVI state, as soon as it goes down you’ll see that SVI state go down as well, even though
fa0/2 is still up and running.

Enough about the SVI, there’s another method we can use our multilayer switch for
routing. By default all interfaces on a switch are switchports (layer 2) but we can change
them to routed ports (layer 3). A routed port is the exact same interface as what we use
on a router.

Configurations

Want to take a look for yourself? Here you will �nd the con�guration of SW1.

SW1
hostname SW1
!
ip routing
!
interface vlan 10
ip address [Link] [Link]
!
interface vlan 20
ip address [Link] [Link]
!
interface FastEthernet0/2
switchport autostate exclude
!
end

Enough about SVI, there’s another method we can use for routing on multilayer switches.

12 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

Routed Port
By default all interfaces on a switch are switchports (layer 2) but we can change them to
routed ports (layer 3). A routed port is the exact same interface as what we use on a
router.

Here’s an example of the routed port. SW2 is a layer 2 switch and SW3 is a multilayer
switch. The fa0/16 interface on SW3 has been con�gured as a router port so it can be
used as the default gateway for the clients in VLAN 10.

SW2(config)#interface fa0/16
SW2(config-if)#switchport mode access
SW2(config-if)#switchport access vlan 10

I’m going to con�gure the fa0/16 interface to SW3 as a normal access port and put it in
VLAN 10.

SW3(config)#interface fa0/16
SW3(config-if)#no switchport
SW3(config-if)#ip address [Link] [Link]

13 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

Make it a routed port by typing no switchport and put an IP address on it, it can now be
used by the computers as a gateway!

There are two things you should remember about this routed port:

It’s no longer a switchport so it’s not associated with any VLAN.

It’s a routed port but it doesn’t support sub-interfaces like a router does.

Configurations
Want to take a look for yourself? Here you will �nd the con�guration of each device.

SW2
hostname SW2
!
interface fa0/1
switchport mode access
switchport access vlan 10
!
interface fa0/2
switchport mode access
switchport access vlan 10
!
interface FastEthernet0/16
switchport mode access
switchport access vlan 10
!
end

SW3
hostname SW3

14 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

!
interface fa0/16
no switchport
ip address [Link] [Link]
!
end

What should you use? The SVI or the routed port? If you only have one interface in a
VLAN it’s �ne to use the routed port, con�gure an IP address on it and you are ready to
go. If you have multiple interfaces in a VLAN you should use the SVI.

Routing Protocols
Multilayer switches can use routing protocols. Let me show you an example:

I have two multilayer switches and the link in between is layer 2. Let’s con�gure these
switches:

SW2(config-if)#switchport trunk encapsulation dot1q

SW2(config-if)#switchport mode trunk

SW3(config-if)#switchport trunk encapsulation dot1q

SW3(config-if)#switchport mode trunk

15 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

I’m creating a 802.1q trunk in between the switches but it doesn’t matter what you pick. I
also could have used access interfaces and use a single VLAN.

SW2(config)#vlan 10
SW2(config)#interface vlan 10
SW2(config-if)#ip address [Link] [Link]

SW3(config)#vlan 10
SW3(config)#interface vlan 10
SW3(config-if)#ip address [Link] [Link]

Create a SVI interface on each Switch and con�gure an IP address.

SW3#ping [Link]

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to [Link], timeout is 2
seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4
ms

The switches can reach each other so the SVI interfaces and trunk are working.

SW2(config)#ip routing
SW2(config)#router eigrp 10
SW2(config-router)#network [Link]

SW2(config)#ip routing

16 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

SW3(config)#router eigrp 10
SW3(config-router)#network [Link]

Let’s con�gure EIGRP to see if we can form a neighbor adjacency.

SW2 %DUAL-5-NBRCHANGE: EIGRP-IPv4:(10) 10: Neighbor [Link]

(Vlan10) is up: new adjacency

There goes…the switches have found each other.

SW3#show ip eigrp neighbors

EIGRP-IPv4:(10) neighbors for process 10
H Address Interface Hold Uptime SRTT
RTO Q Seq
(sec) (ms)
Cnt Num
0 [Link] Vl10 13 00:01:25 1
200 0 1

We have successfully con�gured EIGRP between these two switches using the SVI
interfaces.

Configurations

Want to take a look for yourself? Here you will �nd the con�guration of each device.

SW2
hostname SW2
!
ip routing

17 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

!
interface FastEthernet 0/16
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface vlan 10
ip address [Link] [Link]
!
router eigrp 10
network [Link]
!
end

SW3
hostname SW3
!
ip routing
!
interface FastEthernet 0/16
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface vlan 10
ip address [Link] [Link]
!
router eigrp 10
network [Link]
!
end

18 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

We can also do this with the routed ports!

Same switches but now I’m going to make the link in between layer 3 by using the routed
ports.

SW2(config)#no interface vlan 10

SW2(config)#interface fa0/16
SW2(config-if)#no switchport
SW2(config-if)#ip address [Link] [Link]

SW3(config)#no interface vlan 10

SW3(config)#interface fa0/16
SW3(config-if)#no switchport
SW3(config-if)#ip address [Link] [Link]

Get rid of the SVI interfaces and change the interfaces to routed ports. Don’t forget to
add an IP address.

SW2(config)#router ospf 10
SW2(config-router)#network [Link] [Link] area 0

SW#(config-if)#router ospf 10
SW3(config-router)#network [Link] [Link] area 0

19 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

Let’s con�gure OSPF this time just for fun!

SW2#show ip ospf neighbor

Neighbor ID Pri State Dead Time Address

Interface
[Link] 1 FULL/DR 00:00:37 [Link]
FastEthernet0/16

We have established an OSPF neighbor adjacency by using the routed ports!

Configurations

Want to take a look for yourself? Here you will �nd the con�guration of each device.

SW2
hostname SW2
!
ip routing
!
interface FastEthernet0/16
no switchport
ip address [Link] [Link]
!
router ospf 10
network [Link] [Link] area 0
!
end

SW3

20 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

hostname SW3
!
ip routing
!
interface FastEthernet0/16
no switchport
ip address [Link] [Link]
!
router ospf 10
network [Link] [Link] area 0
!
end

These are all the methods how you can con�gure routing on your multilayer switches.
The router on a stick, SVI interfaces and the routed port. I hope this lesson has been
useful to you!

« Previous Lesson
TCLSH and Macro Ping Test on
Cisco Routers and Switches
Next Lesson
O�set-Lists »

Forum Replies

jtharvey
January 9, 2015

Rene,

21 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

I have a Cisco SG300-28 PoE+ switch and am having an old age moment in setting up VLans.
Would you know the answer to or be able to assist with the following:

My network has:

1 router, which also handles DHCP duties with one range currently speci�ed 192.168.1.x/24
1 switch
1 WAP
and about 40 nodes

I want to create multiple VLANS on the Cisco SG300 switch.

Vlan10 - Mgmnt
Vlan20 - Children
Vlan30 - AV
Vlan40 - Automation
Vlan50 - VoIP
Vlan60 - Guest

What are the steps necessary after creating the Vlans in this scenario to make things work?

WAP is on port 1 of the switch

ROUTER is on port 2 of the switch

I am using a browser to access and manage the Cisco SG300-28PP switch

I currently have the switch in L3 mode.

I was planning on establishing the following network ranges to match Vlan IDs.

Vlan10 - Mgmnt - 192.168.10.x/24

Vlan20 - Children - 192.168.20.x/24
Vlan30 - AV - 192.168.30.x/24
Vlan40 - Automation - 192.168.40.x/24
Vlan50 - VoIP - 192.168.50.x/24
Vlan60 - Guest - 192.168.60.x/24

In each network range I will be using x.x.x.200 to x.x.x.230 as the DHCP range

What is necessary to accomplish all of this?

22 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

ReneMolenaar
August 31, 2015

Hi Thomas,

The default native VLAN 1 is one but it's not used or required in that example. We use the native
vlan for some management protocols like PaGP, LACP, VTP, CDP, etc.

Rene

lagapides
July 21, 2016

Hello Dinh.

I had a production network where I wanted to implement exactly what you describe. The solution I
used was access lists as you mentioned. It is probably the fastest and most immediate solution.
However, there are a couple of other solutions that may be more �exible as well. These are
described below:

VLAN access list - This is just an access list but it �lters based on VLAN rather than IP. It is a layer
2 solution. An example con�guration can be seen below:

interface Vlan1
no ip address
shutdown
!
interface Vlan2
description VLan connected to Internet
ip address [Link] [Link]
!
interface Vlan10
description User VLAN
ip address [Link] [Link]
!
interface Vlan20

23 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

description Server VLAN

ip address [Link] [Link]
!
interface Vlan30
description Management VLAN
ip address [Link] [Link]
!
ip route [Link] [Link] [Link]

ip access-list standard INTERNET

permit any

ip access-list extended DENY-INTERNAL

permit ip [Link] [Link] [Link] [Link]

-----------------------------------------------------

vlan access-map MY-VLAN-MAP 10

action drop
match ip address DENY-INTERNAL

vlan access-map MY-VLAN-MAP 20

action forward
match ip address INTERNET

vlan filter MY-VLAN-MAP vlan-list 10-30

-------------------------------------------------------

In this example, users on the three VLANs can access ONLY VLAN2 to connect to the internet,
however, any attempt for inter VLAN connectivity will be dropped. So intervlan routing is
essentially blocked for VLANs 10, 20 and 30.

The other option, which is a layer 3 solution is the use of policy based routing. An example can
be seen below:

access-list 100 permit ip [Link] [Link] any

access-list 110 permit ip [Link] [Link] any

24 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

route-map vlan500 permit 10

match ip address 100
set ip next-hop [Link]

route-map vlan600 permit 10

match ip address 110
set ip next-hop [Link]

interface vlan 500

ip address [Link] [Link]

ip policy route-map vlan500

interface vlan 600

ip address [Link] [Link]

ip policy route-map vlan600

This is probably the most �exible of the above solutions because you can con�gure it per range of
IP addresses. Your access lists can be more speci�c to include speci�c hosts within a subnet/VLAN
so that some hosts will have access to speci�c VLANs and others won't.

I hope this has been helpful.

Laz

25 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

andrew
August 18, 2016

Prem,
In most cases, there is a one-to-one relationship between VLANs and subnets. However, this is not
always so. For example, in a shared hosting environment, it is common for multiple customers to
be using the same network on the same provider's equipment. In this case, in order to keep the
tra�c separated, the provider must use something called Private VLANs. Private VLANs can use
the same subnet but spread across di�erent VLANs.

If you are interested, there is a Network Lesson available on Private VLANs

lagapides
May 11, 2017

Hello Brian

Please allow me to step in and participate, as this is an issue that I had trouble in visualising and
understanding. I hope I can be of some help. For the most part, you've got it, maybe I can make
things a little bit clearer for you.

wilder7bc:
so four switches all four are in same subnet, and lets just say they are in VLAN 10.

I think I have been coming at this all wrong. when I thought of SVI I thought about Default
Gateway when we gave it an IP but that does not seem to be the case???

It is possible to have SVIs on multiple switches be in the same subnet, and depending on how you
have set up your network, you can make any one of those SVIs a default gateway for use by the
hosts on the [Link]/24 subnet. In the same way, you can place multiple routers on the same
subnet and have them function as multiple possible default gateways. The concept is the same.

wilder7bc:
so if I had four di�erent PC each one could if manually con�gured have each have a di�erent
default gateway. which makes sense when you think about what a Default Gateways job is in
regards to a speci�c device.

Yes, that is correct.

26 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

Keep in mind that:

An SVI can be thought of as a (virtual) layer three interface that resides on a VLAN.
It can be used for several purposes, one of which is to function as a default gateway for
inter-VLAN routing, so devices on that speci�c VLAN will be able to communicate with other
subnets, either on or o� of the speci�c layer three switch.
It can also used as an interface to con�gure the switch itself, either via telnet/ssh or via http.

wilder7bc:
so if I have an SVI on a switch with the [Link] subnet for VLAN 10 and I have on that
switch also VLAN 20, 30, and 40 and they all have an SVI interface then that switch will allow all
that tra�c from those VLANs and their di�erent subnets to communicate.

Yes, that is absolutely right!

wilder7bc:
However, an SVI does not mean its a Default Gateway it only means it could be its real
purpose is just inter vlan routing.

Keep in mind that inter-VLAN routing is still routing, and as such, it still requires a default gateway,
so in this sense, an SVI will function as a default gateway.

I hope this has been helpful!

Laz

 52 more replies! Ask a question or join the discussion by visiting our Community
Forum

About [Link]
Hello There! I'm René Molenaar (CCIE #41726), Your main Instructor of
[Link]. I'd like to teach you everything about Cisco, Wireless and Security.

27 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

I am here to Help You Master Networking!

Read my story

Social Fans

 
14,368 9,659
FANS FOLLOWERS

 
101 3,129
FOLLOWERS SUBSCRIBERS

New Lessons
OSPF Graceful Shutdown
OSPF Stub Router
OSPF Pre�x Suppression
OSPF Incremental SPF
OSPF LSA Throttling

Tag Cloud
802.1Q 802.1X ACL ARP Authentication Certi�cate Default Route DHCP DMVPN Filtering
Firewall GRE IGMP IKE IOS IP Routing IPSec LDP Linux
Load Balancing LSA NAT Network Management Network Services Network Type

OER OSPFv3 PAT PFR PIM PPP Redistribution RIP Security Shaping
SNMP SSH Stub Summarization Trunk Tuning VLAN VPN VRF Wireless

Disclaimer
Privacy Policy

28 of 29 08/16/2017 03:56 AM
InterVLAN Routing | [Link] [Link]

Support

© 2013 - 2017 [Link] 11681

29 of 29 08/16/2017 03:56 AM