Intervlan Routing

Objectives

Configure intervlan routing using : Layer 3 Switch (SVI Method), Routed Ports Method (Physical Interfaces as L3) ,Router on a Stick(ROAS)
Understanding the advantages and disadvantage of each of the technique used for intervlan routing

Theory

PCS in different Vlans cannot communicate with each other. To make Communication between two vlans we need a L3 device that routes traffic between different Vlans

Method	How it Works	Advantages	Disadvantages
Router-on-a-Stick (ROAS)	One router interface with multiple subinterfaces using 802.1Q VLAN tagging.	Cost-effective, uses a single router port, easy to configure in labs.	Single point of failure, limited scalability, and the router link can become a bottleneck.
SVI (Layer 3 Switch)	VLAN interfaces (SVIs) are created on a multilayer switch to perform inter-VLAN routing.	Fast hardware-based routing, scalable, and no external router is required for local routing.	Requires a Layer 3 switch, higher initial cost, and more complex configuration.
Legacy Router (Multiple Interfaces)	Each VLAN connects to a separate physical router interface, with each interface acting as its VLAN's gateway.	Simple concept and easy to understand.	Not scalable, requires many physical router ports, and is expensive for larger networks.

Network Topology

Intervlan_Routing — Fig 1 — Network topology

Interface Details & IP Addresses

Sl.No	Device	Interface	IP Address
1	MLS	Fa0/0	192.168.10.1
1	MLS	Fa0/1	192.168.20.1
2	R1	Gi0/0	192.168.10.1
2	R1	Gi0/1	192.168.20.1
3	S1	Fa0/3	NA
3	S1	Fa0/4	NA
4	R2	Gi0/0.10	192.168.10.1
4	R2	Gi0/0.20	192.168.20.1
5	S1	Fa0/3	NA
5	S1	Fa0/4	NA

Configuration Commands

1. Router-on-a-Stick (ROAS) Method

Switch

enable
configure terminal

vlan 10
 name VLAN10
vlan 20
 name VLAN20

interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10

interface FastEthernet0/2
 switchport mode access
 switchport access vlan 20

interface FastEthernet0/3
 switchport mode trunk
 switchport trunk allowed vlan 10,20

end

Router

enable
configure terminal

interface GigabitEthernet0/0/0
 no shutdown

interface GigabitEthernet0/0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0

interface GigabitEthernet0/0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

end

2. Routed Ports Method

Switch

enable
configure terminal

vlan 10
 name VLAN10
vlan 20
 name VLAN20

interface FastEthernet0/1
 switchport access vlan 10
 switchport mode access

interface FastEthernet0/2
 switchport access vlan 20
 switchport mode access

interface FastEthernet0/3
 switchport access vlan 10
 switchport mode access

interface FastEthernet0/4
 switchport access vlan 20
 switchport mode access

end

Router

enable
configure terminal

ip routing

interface FastEthernet0/3
 no switchport
 ip address 192.168.10.1 255.255.255.0
 no shutdown

interface FastEthernet0/4
 no switchport
 ip address 192.168.20.1 255.255.255.0
 no shutdown

end

3. Layer 3 Switch (SVI) Method

L3 Switch

enable
configure terminal

vlan 10
 name VLAN10
vlan 20
 name VLAN20

ip routing

interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10

interface FastEthernet0/2
 switchport mode access
 switchport access vlan 20

interface Vlan10
 ip address 192.168.10.1 255.255.255.0
 no shutdown

interface Vlan20
 ip address 192.168.20.1 255.255.255.0
 no shutdown

end

Verification Commands & Outputs

1. Router-on-a-Stick (ROAS) Method

On Switch (S1)

S1# show vlan brief

VLAN Name                             Status    Ports
1    default                          active
10   VLAN10                           active    Fa0/1
20   VLAN20                           active    Fa0/2

S1# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Fa0/3       on           802.1q         trunking      1

Port        Vlans allowed on trunk
Fa0/3       10,20

Port        Vlans allowed and active in management domain
Fa0/3       10,20

On Router (R2)

R2# show ip interface brief

Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0/0   unassigned      YES unset  up                    up
GigabitEthernet0/0/0.10 192.168.10.1   YES manual up                    up
GigabitEthernet0/0/0.20 192.168.20.1   YES manual up                    up

R2# show ip route

Gateway of last resort is not set

C    192.168.10.0/24 is directly connected,
     GigabitEthernet0/0/0.10
L    192.168.10.1/32 is directly connected,
     GigabitEthernet0/0/0.10
C    192.168.20.0/24 is directly connected,
     GigabitEthernet0/0/0.20
L    192.168.20.1/32 is directly connected,
     GigabitEthernet0/0/0.20

PC1> ping 192.168.20.10

Reply from 192.168.20.10: bytes=32 time=1ms TTL=127
Reply from 192.168.20.10: bytes=32 time=1ms TTL=127
Reply from 192.168.20.10: bytes=32 time=1ms TTL=127
Reply from 192.168.20.10: bytes=32 time=1ms TTL=127

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

2. Routed Ports Method

On Switch (S1)

S1# show vlan brief

VLAN Name                             Status    Ports
1    default                          active
10   VLAN10                           active    Fa0/1, Fa0/3
20   VLAN20                           active    Fa0/2, Fa0/4

On Multilayer Switch (MLS)

MLS# show ip interface brief

Interface              IP-Address      OK? Method Status                Protocol
FastEthernet0/3        192.168.10.1    YES manual up                    up
FastEthernet0/4        192.168.20.1    YES manual up                    up

MLS# show ip route

Gateway of last resort is not set

C    192.168.10.0/24 is directly connected, FastEthernet0/3
L    192.168.10.1/32 is directly connected, FastEthernet0/3
C    192.168.20.0/24 is directly connected, FastEthernet0/4
L    192.168.20.1/32 is directly connected, FastEthernet0/4

MLS# show running-config

!
ip routing
!
interface FastEthernet0/3
 no switchport
 ip address 192.168.10.1 255.255.255.0
!
interface FastEthernet0/4
 no switchport
 ip address 192.168.20.1 255.255.255.0
!

PC1> ping 192.168.20.10

Reply from 192.168.20.10: bytes=32 time=1ms TTL=127
Reply from 192.168.20.10: bytes=32 time=1ms TTL=127
Reply from 192.168.20.10: bytes=32 time=1ms TTL=127
Reply from 192.168.20.10: bytes=32 time=1ms TTL=127

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

3. Layer 3 Switch (SVI) Method

On Multilayer Switch (MLS)

MLS# show vlan brief

VLAN Name                             Status    Ports
1    default                          active
10   VLAN10                           active    Fa0/1
20   VLAN20                           active    Fa0/2

MLS# show ip interface brief

Interface              IP-Address      OK? Method Status                Protocol
Vlan10                 192.168.10.1    YES manual up                    up
Vlan20                 192.168.20.1    YES manual up                    up
FastEthernet0/1        unassigned      YES unset  up                    up
FastEthernet0/2        unassigned      YES unset  up                    up

MLS# show ip route

Gateway of last resort is not set

C    192.168.10.0/24 is directly connected, Vlan10
L    192.168.10.1/32 is directly connected, Vlan10
C    192.168.20.0/24 is directly connected, Vlan20
L    192.168.20.1/32 is directly connected, Vlan20

MLS# show running-config

!
ip routing
!
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
!
interface Vlan20
 ip address 192.168.20.1 255.255.255.0
!

PC1> ping 192.168.20.10

Reply from 192.168.20.10: bytes=32 time=1ms TTL=127
Reply from 192.168.20.10: bytes=32 time=1ms TTL=127
Reply from 192.168.20.10: bytes=32 time=1ms TTL=127
Reply from 192.168.20.10: bytes=32 time=1ms TTL=127

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

Learning Outcomes

Understood the advantage and disadvantage of various intervlan technology

Verify configurations using Cisco IOS show commands and test connectivity between different VLANs using ping.

VLANS

Objectives

Configuring VLAN
Understanding Access port, Native VLAN , Trunk port and Vlan numbers

Theory / Background

VLANS are used to logically segment a network at Layer 2, even when everything is connected to the same physical switch infrastructure. The goal is control—over traffic, security, and scalability.
VLAN ID identifies and separates VLANs on a switch (0 and 4095 is reserved, 1 is default, 1006-4096 is extended VLANS.
Trunking port(tagged port) : it carries multiple VLANS over the same physical connection. It uses 802.1q or ISL
Access port(untagged port): it carries a single VLAN on a single physical interface Native VLAN: The native VLAN is the VLAN on a trunk port whose traffic is sent without VLAN tagging (untagged).

Network Topology

Configuration Commands

Switch_1

interface FastEthernet0/1                                                                      
switchport mode trunk
interface FastEthernet0/2
switchport mode trunk
interface FastEthernet0/3
switchport access vlan 20
switchport mode access
interface FastEthernet0/4
switchport access vlan 20
switchport mode access
interface FastEthernet0/5
switchport access vlan 30
switchport mode access
interface FastEthernet0/6
switchport mode trunk

Switch_2

interface FastEthernet0/1
 switchport mode trunk
interface FastEthernet0/2
 switchport access vlan 10
 switchport mode access
interface FastEthernet0/3
 switchport access vlan 30
 switchport mode access
interface FastEthernet0/4
 switchport access vlan 30
 switchport mode access

Switch_3

interface FastEthernet0/1
switchport mode trunk
interface FastEthernet0/2
switchport access vlan 10
switchport mode access
interface FastEthernet0/3
switchport access vlan 10
switchport mode access
interface FastEthernet0/4
switchport access vlan 20
switchport mode access

Verification Commands & Outputs

Show vlan Show interface status

Notice that PCS in same vlan can communicate with each pther but PCS in different vlans cannot communicate with each other

Learning Outcomes

Understood the basic configuration of vlans

Understood access and trunk ports, native vlans

Basic Device Configuration

Objectives

Understanding the differnce between User EXEC Mode,Privileged Exec Mode and Global Configuration Mode
Configuring basic device setup(username,passwords,banner.etc)
Understanding the difference between Password,and Secret

Theory / Background

User Exec Mode it is the first mode when we enter the networking device. It allows basic commands and does not allow change in configuration. It is represented by >
Privileged Exec ModeProvides more advanced commands including debugging and the viewing of detailed device information. It is represented by #
Global Configuration Mode is the CLI mode in which you can begin to configure the device. It is represented by config
Password is used to protect access to a networking device by requiring users to enter a password before accessing certain modes or connecting to the device. It helps prevent unauthorized access.
Secret is used to secure privileged EXEC mode on a networking device. It stores the password in an encrypted form and provides better security than the regular password command.

Network Topology

Basic Device Configuration — Fig 1 — Network topology

Configuration Commands

Switch

en
conf t
hostname SWITCH_1
banner motd !NOT PERMITTED TO ACCESS WITHOUT PERMISSION!
username sk priviledge 15 password sksk
username sks priviledge 15 secret sksk
line console 0
login local
wr

Router

en
conf t
hostname ROUTER_1
banner motd !NOT PERMITTED TO ACCESS WITHOUT PERMISSION!
username sk priviledge 15 password sksk
username sks priviledge 15 secret sksk
line console 0
login local
wr

Verification Commands & Outputs

show running-config | sec username

username sk privilege 15 password 0 sksk
username sks secret 5 $1$mERr$TkCGNxXhxXu3Phdk/9PPS.

Notice the difference between enable password and secret. The secret encrypts the password using MD5 algorithm while passwords are stored in plain text. To encrypt password we can use enable service password-encryption command in configuration mode

Learning Outcomes

Understood the basic configuration of network devices

Understood different modes in cisco CLI

Difference between password and secret

Total Pageviews

Blog Archive