InterVLAN Routing and Switching Guide
InterVLAN Routing and Switching Guide
INTRODUCTION
The logical division of areas or departments within companies allows for determining and
manage the workspace of an entity by providing organization and ease for the
administrative management of the network, this results in better performance of it. The
the implementation of VLANs allows for flexible management of membership to a
specific network segment, creating virtual LANs in independent and non
necessarily contiguous.
Switching
Keywords
Native VLAN: it is the VLAN associated with the trunk ports of the switch, in case of
that no association will be made will be the same as the default VLAN, that is,
for Cisco devices VLAN 1.
Data VLAN: these are the VLANs through which data traffic flows.
Voice VLAN: they are the VLANs through which the telephone service is distributed.
IP(VoIP)
Administrative VLAN: it is the VLAN that can be created on the Switch to have a
IP within the segment and be able to remotely manage the device.
Before starting to develop the proposed activities in this document, you must
to implement the following topology with its own basic configurations
of a Switch such as:
Name
Access passwords to the console
Access passwords for privileged EXEC mode
Configuración IP. (DIRECCION IP , MASCARA Y GATEWAY)
In addition, you must perform IPv4 addressing (VLSM) and IPv6 (subnets) for three
subnets, for this work will be done for IPv4 with a Class C network [Link]/24 and for IPv6
with the network 2001:1234:1234::/48, taking into account the parameters of the following table:
Page 3 of 20
10 1 NETWORKS 10
20 2 MAINTENANCE 70
30 3 ADSI 20
Note 1: The VLAN interfaces of the switches that we are going to use in this
implementation does not support IPv6 addressing so only the
remote management of these devices with IPv4.
Note2: The two switches form a different subnet than the corresponding subnets.
to the VLANs, this network is used as an administrative network for active devices, this network
is composed in this case of two devices, that is, the two switches, therefore both
they must have an IP within the same network; a different network can be used
[Link]/24 used for IP addressing. A network can be used
[Link]/24; remember that switches share the same network segment and for that reason
they have the same default gateway.
The proposed topology for the work is shown in the following image, for this
implementation and development of all activities contained in this document
You must use the Catalyst 2960 switches.
Página4de20
For the creation and assignment of VLANs to the switch ports, carry out the following
steps:
[Link] starting, check the status of the current VLANs, for this run the following
command in privileged mode:
Switch0#show vlan
Note:Check that there is only one VLAN, VLAN 1, which is the VLAN.
default to which all the ports of the Switch belong. Carry out
this step on the two switches belonging to the topology
10 NETWORKS
20 MAINTENANCE
30 ADSI
Switch0 Switch1
Switch0>enable Switch1>enable
Switch0#configure terminal Switch1#configure terminal
Switch0(config)#vlan 10 Switch1(config)#vlan 10
Switch0(config-vlan)#name Networks Switch1(config-vlan)#name Networks
Switch0(config-vlan)#exit Switch1(config-vlan)#exit
Switch0(config)#vlan 20 Switch1(config)#vlan 20
Switch0(config-vlan)#name Maintenance Switch1(config-vlan)#name Maintenance
Switch0(config-vlan)#exit Switch1(config-vlan)#exit
Switch0(config)#vlan 30 Switch1(config)#vlan 30
Switch0(config-vlan)#name ADSI Switch1(config-vlan)#name ADSI
Switch0(config-vlan)#exit Switch1(config-vlan)#exit
[Link] creating the VLANs, the switch ports must be assigned to the
respective VLANs created. According to the following table, associate the VLANs with the
ports:
Page 5 of 20
Switch0 11 10
Switch0 12 20
Switch0 13 30
Switch1 11 10
Switch1 12 20
Switch1 13 30
In order to assign certain ports to the different VLANs, the following are executed
commands; please note that the commands shown below are generic
and you must adjust them according to the requirements of the activity
Switch0 Switch1
Switch0>enable Switch1>enable
Switch0#configure terminal Switch1#configure terminal
Siwtch0(config)#interface FastEthernet 0/[# Siwtch1(config)#interface FastEthernet 0/[#
port port
Siwtch0(config-if)#switchport mode access Siwtch1(config-if)#switchport mode access
Siwtch0(config-if)#switchport access vlan [ID Siwtch1(config-if)#switchport access vlan [ID
VLAN VLAN
Siwtch0(config-if)#exit Siwtch1(config-if)#exit
4. Now check that the ports are associated with the different VLANs as per
activity requirements, for this execute the following command:
Switch1#show vlan
Questions:
Note:To this end, you can simply select the text on your screen.
interest and 'copy and paste' in notepad and save it as [Link] and as [Link]
respectively.
c) Compare the configuration files '[Link]' and '[Link]', citing the differences.
found between the two configuration files.
d) Run the command Switch0#show vlan brief, answer the following questions
e) Take a screenshot of the output of the show Vlan command that evidences the membership.
from the different ports of the Switch.
It can be observed that both PC0 and PC04 belong to VLAN 10 called NETWORKS.
but even though the devices belong to the same VLAN and have addressing within
the same subnet do not have connectivity and this can be verified by pinging between them
equipment; this is because the traffic travels labeled and therefore a type of is needed
special link called trunk link, which allows traffic to flow through it
with different tagging, that is, traffic associated with different VLAN.
With the following steps, you will be able to associate the connection ports between switches as
trunk links and verify connectivity between the equipment.
5. In order to create the trunk link, the access mode of the interface must be changed.
interconnect both switches, for this, execute the following commands:
Switch0 Switch1
Switch0>enable Switch1>enable
Switch0#configure terminal Switch1#configure terminal
Siwtch0(config)#interface FastEthernet 0/# Siwtch1(config)#interface FastEthernet 0/#
Page 7 of 20
Note: Observe that the command "interface FastEthernet" is executed in the mode of
general configuration of the Switch and that the parameter '0/#' corresponds to the number of the
interface that interconnects the two switches and will act as a trunk link
6. Now that the trunk links are configured through which it can pass the
labeled traffic of the VLANs, check the connectivity and functionality of the link
trunk. To do this, ping between the devices belonging to the same VLAN
Note: Remember that the switch reduces collision domains, creating a domain of
collision by port, but regarding broadcast domains it remains a domain
shared by all switch ports when it has the default configuration
(VLAN 1 - default VLAN) and no additional VLANs are created; when segmenting the switch
logically (creating VLANs) several virtual switches are created, creating a domain of
Page 8 of 20
unique broadcast for each of the ports associated with the VLANs, thus there exists one for each
VLAN a different broadcast domain.
Questions:
Switch1>enable
Switch1#configure terminal
Switch1#interface FastEthernet 0/#
Note: Observe that interface FastEthernet 0/# corresponds to the interface chosen to be
configured in trunk mode.
Note1: There are several methods to add VLANs to the trunk port, you can specify
a range (Switch1(config-if)#switchport trunk allowed vlan 1-30) or adding each
one of the VLANs manually as is the case with the commands executed before
this note.
Page 9 of 20
For this activity, basic configuration will be done to allow communication between the different
VLANs created previously, for this it is necessary to add a router (2901) to the
topology with which activities 1 to 4 were worked (to make the connection between the
router and the switch used the GigabitEthernet ports, thus remaining:
Both the router and the switch have their boot sequence, following the system load.
the router enters a dialogue for its respective configuration, we are not going to use
this assistant, since the configurations that will be made do not cover globally
the parameters for the advanced operation of the router; to carry out the configuration
basic that allows configuring the router for Inter-VLAN traffic the following are executed
commands:
Page 10 of 20
7. Enter the interface with which I connect the router to the Switch to activate it
Note: Observe that the interface gigabitEthernet 0/# corresponds to the chosen interface to be
configured in trunk mode and is directly connected to Switch0. Have
it also states that only the physical interfaces are activated.
8. Create and configure the subinterfaces for each VLAN on the same physical link
Note2: The encapsulation notation dot1Q 'idvlan' corresponds as follows: the dot1Q
corresponds to the encapsulation method in this case is dot1Q and the 'id-vlan'
corresponds to the number of the VLAN that will be assigned to this encapsulation.
Note 3: The notation 'IP address' and 'netmak' correspond to a valid IP address within
from the subnet of the devices associated with each VLAN, so if the network address to which
the devices connected to VLAN 10 belong to [Link]/28, then the address
The IP of this subinterface will be the Gateway chosen in that subnet, being the first address.
Valid IP within this [Link]/28.
Note4: The notation 'IPv6 address' and 'network prefix' correspond to an IPv6 address
valid within the subnet of the devices associated with each VLAN, so if the IPv6 address
the network to which the devices connected to VLAN 10 belong is
2001:1234:1234:1::/64, then the IP address of this subinterface will be the Gateway.
chosen in that subnet, being the first valid IPv6 address within it
2001:1234:1234:1::1/64.
Note5: This procedure must be repeated for each of the VLANs desired.
route with the router
Page 11 of 20
[Link], the router is configured with three subinterfaces corresponding to each VLAN.
The virtual ports or subinterfaces on the router have dot1Q encapsulation enabled.
that allows the circulation of tagged traffic from VLANs, but is lacking
configure the port that interconnects the switch with the router, this port must be a link
trunk to allow traffic from the different VLANs to the router, the configuration is
just like it was done to connect both switches. To do this, the following are executed
comandos:
Switch0>enable
Switch0#configure terminal
Siwtch0(config)#interface gigabitEthernet 0/#
Siwtch0(config-if)#switchport mode trunk
Siwtch0(config-if)#CTRL-Z
Note: Observe that the command 'interface gigabitEthernet 0/#' is executed in mode
general configuration of the Switch and that the parameter '0/#' corresponds to the number of the
interface that interconnects the switch with the router.
At this point, all the devices in the topology should have connectivity for that.
ping from a device belonging to a specific VLAN to another device belonging to a
Different VLAN.
Questions:
Router>enable
Router#show ip interface brief
Router#show ip route
Satisfactory PING
YES NO YES NO
PC4 PC2
PC4 PC1
PC0 PC5
PC0 PC6
PC0 Switch0
N/A
PC1 Switch1
Note: At this point for the previous table all connectivity tests must be
be satisfactory, if there is any that fails, check the previous procedures until
reach this section.
Sometimes the growth of the network brings with it the need for new network devices,
manually configuring VLANs is a laborious process for a network that
It has many switches, at this point the management of the VLANs has been carried out in
manual form, the increase of Switches in the infrastructure makes it necessary the
implementation of the VTP protocol, which allows centralized management of VLANs
admitting the replication of configurations to other Switches, returning the management of the
Segmentation, at layer 2 level, of the network into a comfortable and efficient task.
It should be noted that although the VTP protocol replicates basic information of the VLANs
(name, ID and other data), this protocol does not replicate the belonging of the ports to such
VLANs, so in the switches, the membership of the ports to the VLANs will have to be configured.
manually.
Before we start configuring the VTP protocol, we need to add certain components.
additional to the topology that has been worked on, review the following topology and
determine what should be added to the existing topology:
Page 13 of 20
Note: Observe that in the topology there is a new switch (switch2) and that this switch will have
for each existing VLAN a new device, the intention is that the new switch
acquire the VLAN configuration automatically from switch0, so NO
I TRIED TO CREATE THE VLANS MANUALLY, below is the process
to follow in order to achieve the proposed topology.
Before continuing with the VTP protocol configuration, remember to perform the
basic configurations on the new Switch (Switch2), for this I configured
Name
Access passwords for the console
Passwords for access to privileged EXEC mode
IP configuration. (IP ADDRESS, SUBNET MASK AND GATEWAY)
Trunk link configuration (Between Switch1 and Switch2)
Note:Please note that for the moment you should not make any kind of configuration.
VLAN
10. In the new switch (switch2) that has just been added to the topology, run the following
commands
Switch2>enable
Switch2#show vtp status
Page 14 of 20
Questions:
The following are a series of steps that will allow you to assign the different modes.
VTP to each of the switches in the topology.
Nota: The Server mode configuration on Switch0 does not need to be done, since
By default, the switches come with VTP server mode enabled to prevent any modification.
to the VLANs that are created manually
Switch1>enable
Switch1#configure terminal
Switch1(config)#vtp domain admon-redes
Switch1(config)#vtp mode transparent
Switch1(config)#exit
Page 15 of 20
Switch2>enable
Switch2#configure terminal
Switch2(config)#vtp domain admon-redes
Switch2(config)#vtp mode client
Switch2(config)#exit
Now, you have made the necessary configurations to replicate the VLANs, only
It is necessary to make some changes to the Switch that acts as the VTP server and verify that the Switch
Transparent VTP allows changes to pass through but does not apply them, while the VTP Switch
the client applies the changes and creates the Vlans automatically.
Note: Please note that when creating VLANs, a file is created in the flash called
[Link] the configuration file contains everything related to VLANs in the
Switch, it is important that when a backup of the files is needed
switch configuration, a backup of this file should also be made, since if not
performing a backup may result in losing all VLAN configurations
Questions:
k) In switch2 execute the command Switch2#show vtp status, starting from the
obtained results respond:
l) On switch1, execute the command Switch1#show vtp status, starting from the
results obtained respond:
ID-VLAN=40
Page 16 of 20
Nombre=VTP-VLAN
After creating the VLAN (VTP-VLAN), execute the necessary commands on the
different switches to answer the following questions:
What differences do you find in the review value when compared to the one obtained in Switch2?
in the itemL?
How many VLANs are there in Switch2?
How many VLANs are there in Switch1?
Were the changes from switch0 replicated in switch1? (Y/N) Justify your answer
answer
Are there ports assigned to the new VLANs created on switch2? (Y/N)
Justify your answer
Note: Carry out the assignment of the ports to their respective VLANs, and carry out the
IP configuration required on the PCs, as well as the configuration of the trunk link between
the switch1 and switch0 to allow traffic from the new VLAN (vlan40), so we can already
guarantee full connectivity with the other elements of the topology
Satisfactory PING
YES NO YES NO
PC7 PC5
PC8 PC2
PC9 PC0
The Switch, as a device of great value within the functioning of a LAN network, must
have security mechanisms that allow for secure management of our network, from
Page 17 of 20
There is a very useful command that allows you to encrypt (make unreadable) all passwords.
configured in the system, for this the following command is executed in mode of
global configuration:
Switch2(config)#service password-encryption
From this moment on, all passwords entered will be encrypted. This helps us
keep the access keys hidden.
The switch as a layer 2 device in the OSI reference model uses the addresses
MAC to do its job, this is how it takes the MAC address of the devices connected to
the ports to configure the security parameters.
There are several options to configure MAC address learning, which are
switchport port-security
15. We configure the learning of MAC addresses on the specific port and the action
what will be taken in case of a security breach
Note3: Observe that the command 'switchport port-security maximum' is executed in the
configuration mode interface and the parameter "#" indicates the number of addresses
maximum MACs that will be allowed on that port.
Note 4: Please note that the command 'switchport port-security violation' is executed on the
interface configuration mode and the parameter 'shutdown' indicates the action that is
take over the interface when a security breach occurs.
Questions:
Note: Observe that the command "show port-security interface FastEthernet" is executed
in the general configuration mode of the Switch and the parameter "0/#" corresponds to the
interface number that was secured.
What is the MAC address learned on the port and which VLAN does it belong to?
Change the MAC address of the device that is connected to the switch port.
which configured the security, for this click on the PC, go to the tab
Config, and select the FastEthernet section, there in the MAC Address section change
some of the digits of the MAC address. Please answer the following question:
EVIDENCES TO BE SUBMITTED:
Performance evidence
Complete development of the activities proposed in: activity 5: Intermediate Switching and
InterVLAN Routing
Evidence of knowledge
Product evidence