How to configure VLANs on Cisco Catalyst Switch

Hello Rene,
it would be good to mention somewhere about default-gateway vs default-network config. I have never had a chance to use default-network command. Is it usable? if so in what scenarios. I assume it can be pointing to L3 GW network address if L3 routing is enabled on a L3 switch. Please elaborate either privately or add some content if possible.

Hello Vitaly

There are essentially three ways to configure a gateway of last resort on an L3 switch or on a router. These differ in their implementation and their functionality.

The ip default-gateway command should only be used when routing is disabled. It essentially tells the device what its default gateway is much like a PC has the default gateway configured. It is used only for the purposes of connectivity with subnets other than its own.

The ip default-network command can be used only when routing is enabled. When you configure ip default-network the router considers routes to that network for installation as the gateway of last resort on the router. In other words, routes to that network become candidate default routes.

A third way of configuring a gateway of last resort is to install a static default route with the command ip route 0.0.0.0 0.0.0.0. Of course, routing must be enabled for this case as well.

You can find more information about these three commands and their uses at this Cisco documentation.

I hope this has been helpful!

Laz

renee or laz do you know where the voice vlan is stored on a switch also in the vlan.dat file or is it depend on wether it is a normal or extended vlan then stored accordingly to the either vlan.dat or nvram according to rules ? many thanks

Hello William

A voice VLAN is the same as any other VLAN. What makes it a voice VLAN is the fact that you define it as such on an interface where a phone is installed. Otherwise, it is no different than any other VLAN. So as far as where it is stored, it is stored in the same place and in the same way as all other VLANs.

I hope this has been helpful!

Laz

Hi all,

what is the different beetween a creation of a VLAN beetween following configuration examples:

!
interface vlan10
 description Clients
 ip address 10.10.10.1 255.255.255.0
 exit
!
!
interface vlan20
 description Servers
 ip address 10.10.20.1 255.255.255.0
 exit
!
!
interface vlan30
 description IP-Cameras
 no ip address
 shutdown
 exit
!
!
vlan 40
name Video-Conference
exit
!
!

From my understanding:
vlan 10 can comunicate with vlan 20 ( intra vlan routing )

But whats the difference beetween vlan 30 and vlan 40?
Both have no ip address so both are isolated from other vlans?

I dont understand on which case i just create a vlan ( like vlan 40 ) and a vlan with an interface but without IP address ( like vlan 30 )

Thanks!

Salvatore

Hello Salvatore

First of all, we must define the difference between a VLAN and a VLAN Interface.

A VLAN is a virtual LAN found within the switch. It’s definition simply states that a subdivision of the switch exists within which a single subnet will function. A VLAN is created using the vlan command such as vlan 40. Such a command just defines the new VLAN with a VLAN ID.

A VLAN Interface, more correctly known as a Switched Virtual Interface (SVI) is a virtual interface that functions in the same way as a layer 3 physical interface. It is an interface that exists on the VLAN number it represents, and can be assigned an IP address, be shutdown or enabled, or have other configurations that can be applied to any interface. An SVI will most often function as the default gateway of the subnet that corresponds to the VLAN ID. In other words, the VLAN10 interface functions as the default gateway for all clients in the 10.10.10.0/24 subnet.

In order for a layer 3 switch to function correctly, you MUST configure both a VLAN and an SVI. By creating the VLAN interface, the VLAN is automatically created, but it doesn’t go the other way around.

So, in the above configuration, you have created an SVI in VLAN 10 (this automatically creates the VLAN as well) and assigned it an IP address. The same happend for VLAN 20, and yes you are correct, that interVLAN routing makes those two VLANs communicate.

Now you created another SVI for VLAN30, so VLAN 30 was also created. But, you haven’t assigned an IP address to this interface. That’s fine, but you won’t be able to have inter-VLAN routing between VLAN 30 and the other VLANs if you don’t, and SVIs are usually created for this purpose.

Finally, you created VLAN 40 but this does not automatically create a corresponding SVI, you must do that manually, so any ports on VLAN 40 will be isolated from any other networks.

None of the above configurations are wrong, it really depends on what you want to do. You may want VLAN 40 to be completely isolated from everything else, and that’s fine. I hope the above explanations have made the various entities you create for VLANs clearer for you. If you have any other questions for clarification, please feel free to ask!

I hope this has been helpful!

Laz

1 Like

Hi Laz,

thank you very much for your reply!
I understood the difference now.

I have another question regarding VLAN:

Let’s take VLAN 40.
I configure 3 ports in the VLAN 40, on all ports a client is connected.
Client 1 has the IP 192.168.240.10/24
CLient 2 has the IP 192.168.240.11/24
Client 3 hast the IP 192.168.242.10/24

How do both clients communicate with each other with no gateway in the VLAN 40 ?
I think Client 1 & 2 can comunicate because they are in the same Subnet?
e.g. The client 1 sent a Brodcast and reach the Client 2 because they are in the same Brodacast Domain.
Client 3 is not able to comunicate because it is in a differnet Subnet / Broadcast Domain.

Are my thoughts right?

Thanks!
Salvatore

Hello Salvatore

Yes you are correct. Client 1 and Client 2 will be able to communicate because they are on the same subnet, and the same VLAN. Client 3 however will not be able to communicate. However, even if you have an SVI configured on VLAN 40, Client 3 will still not be able to communicate. This is because it is in the same VLAN, but in a different subnet. All clients within a single VLAN should be configured on the same subnet. In other words, each VLAN should correspond to a specific subnet. For example:

VLAN 10 --> 192.168.210.0/24
VLAN 20 --> 192.168.220.0/24
VLAN 30 --> 192.168.230.0/24
VLAN 40 --> 192.168.240.0/24
VLAN 50 --> 192.168.241.0/24

etc

Otherwise if you put 192.168.242.10/24 and 192.168.240.10/24 on the same VLAN, it’s like connecting these two devices to an unmanaged 8 port switch. If their subnets are different, they don’t have any hope of communicating. Even if you create an SVI as a gateway, what would the IP address of the SVI be? Would it be in the 192.168.242.0/24 or the 192.168.240.0/24 subnet? If it is in one of the two, the other host will not have connectivity.

I hope this has been helpful!

Laz

1 Like

Excellent explanation

Hello Abilash

Thanks for your kind words, your encouragement is appreciated!! :sunglasses:

Laz

Hey, I still don’t understand about the native VLAN.

I read that trunk frames can be tagged or untagged and the latter are native VLANs.
But what is a native VLAN, is it an untagged VLAN?
But what is an untagged frame?
*This is a loop and I don’t understand it

Hello Alexis.

A trunk will tag frames upon egress of the frame from the trunk port. This means that if a frame comes to the trunk port on VLAN 10 for example, a tag of VLAN 10 will be added to the frame and sent out of the port. The switch on the other end will receive the frame, will examine the tag, and if the VLAN ID is in the allowed VLAN list, the frame will be accepted, the tag removed, and the frame will be forwarded to the appropriate port. If it is not in the allowed VLAN list, it will be discarded.

Now the native VLAN configuration on a trunk port simply tells the switch that if an untagged frame is received on the trunk port, it should be placed on the VLAN configured as native.

You can find out more information about this in the following post:

I hope this has been helpful!

Laz

1 Like

Hello, thank you for your excellent response.

This means that, if traffic arrives from an unconfigured VLAN (it would be VLAN 1), this frame must go to the native VLAN (VLAN 1) right?

So, the default VLAN always has to be the same as the native VLAN?

For example, if I have 3 VLANs: (1) unconfigured, (2) VLAN 10, (3) VLAN 20. And the native VLAN is 99. Unconfigured VLAN frames when sent to other VLANs will be discarded?

Hello Alexis

Not quite. First of all, let’s not confuse the default and native VLANs. The default VLAN is always VLAN 1 on Cisco switches (and most other switches as well). This cannot change. Now the native VLAN is something that only exists on a trunk port. The native VLAN is configured on every trunk port, and can actually be different on each trunk port of a switch (but it should be the same on both ends of a trunk link). By default, the native VLAN is set to VLAN 1. But this can be changed, and should be changed for security purposes. So if you don’t configure the native VLAN on a trunk port, its native VLAN will be 1.

Now what does this mean? Well, it simply means that if an untagged frame arrives on a trunk port, it will be placed on the native VLAN configured on that port.

However, this does not mean that the native VLAN can be transmitted over the trunk. Take a look at this diagram:
image

When A communicates with B, the frame exits Fa0/1 on SW1 with a tag because VLAN 10 is allowed on the trunk. When the frame reaches SW2, the tag will be removed and the frame forwarded to the appropriate port and host, because VLAN 10 is allowed on the trunk port. So a tagged frame only exists on the wire between the two trunk ports.

Now what if C tries to communicate with D? That communication will fail because VLAN 99 is not one of the allowed VLANs. Only allowed VLANs will be tagged, sent across the trunk, and untagged at their destination. The native VLAN configuration does not make that VLAN allowed across the trunk, nor will it send any such traffic as untagged traffic.

The only thing the native VLAN configuration does is, if an untagged frame arrives on a trunk port, that frame is placed on the configured native VLAN. In this topology however, this will never happen.

But take a look at this topology:
image
Here we have a hub between two of the switches, and a PC connected to that hub. In this case, the trunks on both SW1 and SW2 will receive untagged frames from PC1. These will be sent on the configured native VLAN on each switch. Note, that this is a very bad network design, but it is used to illustrate the concept.

I hope this has been helpful!

Laz

Thank you for that good answer. I’m sorry if I’m a little incomprehensible.

One last thing, when you say “The native VLAN configuration does not make that VLAN allowed across the trunk”…what happens if the native vlan is not configured as 99?

Hello Alexis

No problem, you comprehensible just fine!!

So let’s take a look at this diagram again:


Notice that we changed the native VLAN on the trunk and make it VLAN 10. What does that mean? Well this just means that if an untagged frame reaches a trunk port on either SW1 or SW2, it will be put on VLAN 10. But VLAN 10 is also allowed on the trunk. This means that any communication between host A and B, will be tagged with VLAN 10 as usual.

So you see the native VLAN, can also be an allowed VLAN on the trunk. If a frame is transmitted using that VLAN, it will be tagged normally. If however an untagged frame arrives on a trunk port, it will be put in the native VLAN.

Remember an untagged frame is a frame that has no indication of which VLAN it belongs to. If it arrives on an access port, it is placed on the VLAN that the access port is configured on. This is normal behaviour. But a trunk port is designed to take tagged frames and place them in the proper VLAN. An untagged frame arriving at a trunk port is unusual, and a trunk port just doesn’t know what to do with it. So it will put it in the native VLAN.

I hope this has been helpful!

Laz

Thank you very much! You explain well.

So, when the native VLAN is placed, what happens next? Is it discarded?

Another thing, if C is not in VLAN 99 and does not belong to any VLAN and wants to get to B. It could get there without any problem because it would be labeled as VLAN 10 and VLAN 10 is allowed?

Hello Alexis

I’m not sure what you mean. Can you clarify your question?

All access ports on a switch (the ports to which hosts are connected) must belong to a VLAN. If no VLAN has been configured on an access port, the VLAN by default is VLAN 1. Now the only way that C can communicate with B is if its access port was configured on VLAN 10. Otherwise, C cannot communicate with B.

The following lessons describe these concepts in more detail:



I hope this has been helpful!

Laz

I understand, thank you very much. Sorry for all the questions :smiley:

Hello Alexis

No problem! And don’t apologize for the questions, that’s what we’re here for, to answer any questions you may have…

Laz