snagrat Posted July 22, 2015 Posted July 22, 2015 It seems a lot of us are doing VLANs this summer with all the questions popping up, so sorry but here is another. What I don't understand with VLANs is how the gateway works. Assume I assign the IP range 192.168.1.0/24 to VLAN1 - what should the gateway be? Should it be the IP address of the Layer3 switch? Any explanation would be great. Feel free to explain the whole process
Muz Posted July 22, 2015 Posted July 22, 2015 If you're using a Cisco switch you create and assign an ip address to what's known as a SVI (switched virtual interface), this will handle the routing to and between other VLANs. If this is your main / core switch you will also have a 'routed port' which probably connects to a firewall or edge router and your switch should have a default route to it. We'll use 2 VLANs for our example (10 and 20) On a cisco switch the whole process would be: Enable Configure Terminal Vlan 10 name Data exit Vlan 20 name Management exit Int vlan 10 ip address 10.10.10.254 255.255.255.0 no shut exit Int vlan 20 ip address 10.10.20.254 255.255.255.0 no shut exit ip routing ip route 0.0.0.0 0.0.0.0 10.255.255.2
FN-GM Posted July 22, 2015 Posted July 22, 2015 It seems a lot of us are doing VLANs this summer with all the questions popping up, so sorry but here is another. What I don't understand with VLANs is how the gateway works. Assume I assign the IP range 192.168.1.0/24 to VLAN1 - what should the gateway be? Should it be the IP address of the Layer3 switch? Any explanation would be great. Feel free to explain the whole process In short: You create a vlan and assign an ip to that vlan. That IP address assigned to that vlan will be the default gateway for the hosts.
snagrat Posted July 22, 2015 Author Posted July 22, 2015 In short: You create a vlan and assign an ip to that vlan. That IP address assigned to that vlan will be the default gateway for the hosts. OK get that. Next question - how does the VLAN know the IP of the layer3 switch?
Muz Posted July 22, 2015 Posted July 22, 2015 Switches don't have IP addresses unless for management purposes. Everything communicated within a VLAN is switched and everything leaving the VLAN is routed out. Just for FYI, ARP is used to get the MAC Address of a device that you want to send data to, ARP basically maps IP Addresses to MAC addresses.
FN-GM Posted July 22, 2015 Posted July 22, 2015 OK get that. Next question - how does the VLAN know the IP of the layer3 switch? As far as this is concerned the switch doesn't have an IP. The VLANs have the IP. You program the IP to whatever you want (in the private range).
simonm Posted July 23, 2015 Posted July 23, 2015 When you're doing L3, the Vlans on the switches doing the routing DO have IP addresses ( think of them as virtual interfaces ) which is not only potentially for management but for the routing of data as well ( the default gateway for devices on it's IP range). Remember not all switches do L3, and typically you will only be doing L3 routing in the core of your network. You don't have to use the switch to do routing, you could use say a host with more than 1 NIC in it, however you'll typically get faster performance out of a good L3 switch. Other key thing to remember is with IP routing not only do you need a route out to wherever you want to go, you need a route back as well. Sometimes you can't do this just with a default gateway, you might need to put static routing entries in server / firewalls etc. Different switches have different mechanisms for setting up these IP addresses.
howartp Posted July 23, 2015 Posted July 23, 2015 OK get that. Next question - how does the VLAN know the IP of the layer3 switch? As FN-GM says, the VLAN only needs to know the gateway IP of whichever VLAN it is in. This is mainly given out by DHCP. You can either have a DHCP server in each VLAN, or you can have one DHCP server somewhere and tell each VLAN where it is. Of my 12 VLANs, I have a DHCP server on the FRDC which has individual scopes for VLANS 7-13 which are all my client PCs. Within the settings of each DHCP scope, you set option 003 Router to be the gateway of that VLAN. (Other options such as 004 Time server, 006 DNS servers etc are set at global level, but 003 Router is set per scope) There is no DHCP scope for 2-6 because they are static servers, network devices, ESX management etc. If you're using one DHCP server for everything, you need an extra line in the Cisco config per VLAN. If you take Muz's example and have your DHCP server on the Management VLAN at 10.10.20.1 then you'd need the following: Enable Configure Terminal Vlan 10 name Data exit Vlan 20 name Management exit Int vlan 10 ip address 10.10.10.254 255.255.255.0 ip helper-address 10.20.1.1 no shut exit Int vlan 20 ip address 10.10.20.254 255.255.255.0 no shut exit ip routing ip route 0.0.0.0 0.0.0.0 10.255.255.2 Peter
GeekyPete Posted July 23, 2015 Posted July 23, 2015 OK get that. Next question - how does the VLAN know the IP of the layer3 switch? It doesn't, it doesn't need to. It just needs to know the DFG, the VLAN doesn't know what's on the other side of the gateway, it just needs to know where the gateway is. You can have your L3 switch or you can have your Router on the other side of it or your Smoothwall. The VLAN doesn't care. But whatever you have on the other side it need to know what to do with the traffic when it comes out. L3 switch will route it according to the static routes you set up. If you are going directly to a router, Smoothwall or any other such device they'll need an interface setting up on the VLAN which will be the DFG. That's OK on a flat network, but if it was a flat network we wouldn't be talking about VLANs. The most elegant solution is to have one upstream interface from your core switch to your router or filtering solution of your choice. Static routes from each VLAN to the upstream interface.
FN-GM Posted July 23, 2015 Posted July 23, 2015 (edited) Static routes from each VLAN to the upstream interface. You don't have to have them for each vlan. You have 1 static route. In the Cisco world it would be IP Route 0.0.0.0 0.0.0.0 Edited July 23, 2015 by FN-GM Typo 1
GeekyPete Posted July 23, 2015 Posted July 23, 2015 @FN-GM That's much more elegant... and would save time when adding new vlans.
CyberNerd Posted July 23, 2015 Posted July 23, 2015 @FN-GM That's much more elegant... and would save time when adding new vlans. It could be quite inefficient if you think about it. You are sending ALL traffic across the interface to smoothwall just so that it can make a routing decision, yet you have a (probably) expensive layer 3 hardware switch which is designed to do this. My advice would be to give every internal vlan an IP address on the interface of the switch and ONLY use the default gateway for where you intend on having a firewall between areas. For example if you VLAN maths and science separately, you probably won't want to firewall them so you make the routing decision at the layer 3 switch by defining the routing table and setting an ip address of the interface. The DMZ is different, because you do want to firewall it - so there you send the traffic to ASA/smoothwall etc) and don't set an interface on the switch.
Muz Posted July 23, 2015 Posted July 23, 2015 As FN-GM says, the VLAN only needs to know the gateway IP of whichever VLAN it is in. This is mainly given out by DHCP. You can either have a DHCP server in each VLAN, or you can have one DHCP server somewhere and tell each VLAN where it is. Of my 12 VLANs, I have a DHCP server on the FRDC which has individual scopes for VLANS 7-13 which are all my client PCs. Within the settings of each DHCP scope, you set option 003 Router to be the gateway of that VLAN. (Other options such as 004 Time server, 006 DNS servers etc are set at global level, but 003 Router is set per scope) There is no DHCP scope for 2-6 because they are static servers, network devices, ESX management etc. If you're using one DHCP server for everything, you need an extra line in the Cisco config per VLAN. If you take Muz's example and have your DHCP server on the Management VLAN at 10.10.20.1 then you'd need the following: Peter Oops, completely forgot about DHCP Relay!
snagrat Posted July 23, 2015 Author Posted July 23, 2015 So, if I understand what people have said: 1) VLAN is given an IP address. Also assigned a Gateway. The gateway is given to the clients on that vlan (by whatever method used) 2) Layer 3 switch is setup the same way but also have static routes. These tell the VLANs how to see each other Do I sound even a little bit correct?
FN-GM Posted July 23, 2015 Posted July 23, 2015 (edited) 1. The VLAN has an IP. It does not have a gateway. The clients gateway is the VLAN IP. 2. You need the static route to access the internet. The switch needs to know where to send the traffic. If your serious about learning this have a look at the Cisco ICND 1 materials. It doesn't cover Layer 3 switches but does cover routing something that is key to layer 3 vlans. Edited July 23, 2015 by FN-GM
ass17 Posted July 23, 2015 Posted July 23, 2015 The gateway on each switch is only specified on the default VLAN 1 which is the switches actual IP.
FN-GM Posted July 23, 2015 Posted July 23, 2015 (edited) The gateway on each switch is only specified on the default VLAN 1 which is the switches actual IP. What is not the gateway. You specify the gateway using the ip default-gateway command. The switch doesn't actually need either to operate. You are talking about setting the IP address to manage the switch. Also you should never ever use VLAN 1 for anything. Edited July 23, 2015 by FN-GM
ass17 Posted July 23, 2015 Posted July 23, 2015 What is not the gateway. You specify the gateway using the ip default-gateway command. The switch doesn't actually need either to operate. You are talking about setting the IP address to manage the switch. Also you should never ever use VLAN 1 for anything. Apologies, quite correct, just checked on of my switches and the gateway is specified in config mode. Our switch ip is on the default VLAN. nothing goes over VLAN 1 for us.
FN-GM Posted July 24, 2015 Posted July 24, 2015 Apologies, quite correct, just checked on of my switches and the gateway is specified in config mode. Our switch ip is on the default VLAN. nothing goes over VLAN 1 for us. To add, you don't actually need a ip for management. You can use any VLAN IP for management (providing there is not ACL in place).
ass17 Posted July 24, 2015 Posted July 24, 2015 To add, you don't actually need a ip for management. You can use any VLAN IP for management (providing there is not ACL in place). Yep got a shed load of ACLs on our two ore switches [emoji106]🏻
simonm Posted July 27, 2015 Posted July 27, 2015 When you're doing routing / L3 switching ( just think of them as the same for this conversation), then if you want to get further than the local subnet, then each subnet needs a gateway address whether physical or virtual. On a L3 switched network this will be a Vlan with an IP address associated with it. For a router or firewall it will mostprobably be a physical interface. What a device does is this .. it looks at it's own IP address and subnet mask to determine what it's network address is, if the destination network is different then it sends the packet to the next hop in it's routing table, or failing that the default gateway ( 0.0.0.0 / 0.0.0.0 ) That IP address is the default gateway, or next hop for the devices on that particular network / subnet. The way that devices get told about that IP address is either by DHCP, or manually ( hard coded gateway). On a network with lots of subnets then you might need a combination of a default gateway and static or dynamic routes. the default gateway tells you where to go if you don't have an explicit routing entry about how to get a particular subnet. As long as your default gateway knows how to get everywhere then you're fine, otherwise you might need some other routing entries.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now