Communication between VLANs

Just a clarification.  You said one of your client is connected to port 8 on the 5324 and the other to port 17.  You said the one connected to port 8 is VLAN 3 and the one to port 17 is VLAN 1?  According to your config, port 9-20 belongs to VLAN 3 (access mode) and port 8 is not configured so it must be the default access mode member of only VLAN 1.

Also the "default gateway" configuration on the 5324 doesn't do what you think it might.  The 5324 is an L2 switch.  It doesn't do any routing at all so the "default gateway" configuration only affects the management interface.  It is used only when the management application on the switch attempts to send a packet.  It is not used to cause packets not meant for management inteface to be "routed" to particular interface.

VLAN 1 is a special "management VLAN" and should probably not be used for non-management traffic.  Probably you might want to assign a different VLAN (other then 1) for your production traffic.  VLAN 1 should be used only to access the management interface on the switch.

So knowing that the 5324 does not do routing, if port 8 and 17 are not on the same VLAN then the two PCs on those ports would not be able to communicate with each others.  The L2 switch will not forward across VLANs.

If you connected your PCs on the 6024 then you could use the 6024 L3 (routing) feature to route between those VLAN and the 6024 would change the VLAN tags when it route the packets between the two VLANs (again don't use VLAN 1 for production traffic).

Cuong.

Hi,

You said I can route between the two vlans if I were to "connect the PC's onto the "6024" and use the L3 routing.  So does that mean if I have two 5324 switches that are connected to the 6024, one switch is Vlan 2 and the other switch is Vlan 3, if I were to connect PC's on each switch they are not able to communicate with eachother (Vlan 2 to Vlan 3), even though they are connected to the 6024 which does the routing?  Does that mean inorder for me to have the two vlans to communicate, the PC's will have to be DIRECTLY connected to the 6024 rather than the switches?

BTW, you should NOT use VLAN 1 for user traffic.  VLAN 1 is used only for management traffic.  You might want to change your setup to use another VLAN instead of 1.

Cuong.

Hi Cuong,

I'm sorry, but I'm still can't get the two PC's to communicate.

Here is my current config:

Router Configuration
-----------------------------

interface range ethernet g(1-3)
switchport mode trunk
exit
vlan database
vlan 2-4
exit
interface range ethernet g(1-3)
switchport trunk allowed vlan add 2
exit
interface range ethernet g(1-3)
switchport trunk allowed vlan add 3
exit
interface range ethernet g(1-3)
switchport trunk allowed vlan add 4
exit
interface vlan 2
name Servers
[0mMore: ,  Quit: q, One line:
                                           
exit
interface vlan 3
name "Engineering/Art Team"
exit
interface vlan 4
name IT
exit
interface vlan 1
ip address 192.168.0.1 255.255.255.0
exit
interface vlan 2
ip address 192.168.1.1 255.255.255.0
exit
interface vlan 3
ip address 192.168.2.1 255.255.255.0
exit
interface vlan 4
ip address 192.168.3.1 255.255.255.0
exit
ip route 192.168.0.0 255.255.255.0 192.168.0.2 
ip route 192.168.0.0 255.255.255.0 192.168.2.2 
ip route 192.168.1.0 255.255.255.0 192.168.1.2 
[0mMore: ,  Quit: q, One line:
                                           
ip route 192.168.2.0 255.255.255.0 192.168.2.2 
ip route 192.168.3.0 255.255.255.0 192.168.3.2 
ip dhcp relay address 192.168.0.2
ip dhcp relay enable

5324A Switch Configuration
-----------------------------

interface ethernet g1
switchport mode trunk
exit
vlan database
vlan 2-4
exit
interface ethernet g1
switchport trunk allowed vlan add 2
exit
interface range ethernet g(9-20)
switchport access vlan 3
exit
interface ethernet g1
switchport trunk allowed vlan add 3
exit
interface ethernet g1
switchport trunk allowed vlan add 4
exit
interface vlan 2
name Servers
exit
interface vlan 3
More: ,  Quit: q, One line:
[Kname "Engineering/Art Team"
exit
interface vlan 4
name IT
exit
interface vlan 1
ip address 192.168.0.203 255.255.255.0
exit
interface vlan 2
ip address 192.168.1.1 255.255.255.0
exit
interface vlan 3
ip address 192.168.2.1 255.255.255.0
exit
interface vlan 4
ip address 192.168.3.1 255.255.255.0
exit
ip default-gateway 192.168.0.1
ip name-server  192.168.0.2
More: ,  Quit: q, One line:
[Kconsole# show run
interface ethernet g1
switchport mode trunk
exit
vlan database
vlan 2-5
exit
interface ethernet g1
switchport trunk allowed vlan add 2
exit
interface ethernet g1
switchport trunk allowed vlan add 3
exit
interface range ethernet g(9-20)
switchport access vlan 4
exit
interface ethernet g1
switchport trunk allowed vlan add 4
exit
interface vlan 2
name Network
exit
interface vlan 3
More: ,  Quit: q, One line:
[Kname Servers
exit
interface vlan 4
name "Engineering/Art Team"
exit
interface vlan 5
name IT
exit
interface vlan 1
ip address 192.168.5.203 255.255.255.0
exit
interface vlan 2
ip address 192.168.0.1 255.255.255.0
exit
interface vlan 3
ip address 192.168.1.1 255.255.255.0
exit
interface vlan 4
ip address 192.168.2.1 255.255.255.0
exit
interface vlan 5
ip address 192.168.3.1 255.255.255.0
More: ,  Quit: q, One line:
[Kexit
ip default-gateway 192.168.5.1
ip name-server  192.168.0.2

5324B Switch Configuration
--------------------------------------

interface ethernet g1
switchport mode trunk
exit
interface ethernet g2
switchport mode trunk
exit
vlan database
vlan 2-5
exit
interface range ethernet g(3-22)
switchport access vlan 2
exit
interface range ethernet g(1-2)
switchport trunk allowed vlan add 2
exit
interface range ethernet g(1-2)
switchport trunk allowed vlan add 3
exit
interface range ethernet g(1-2)
switchport trunk allowed vlan add 4
exit
interface vlan 2
More: ,  Quit: q, One line:
[Kname Network
exit
interface vlan 3
name Servers
exit
interface vlan 4
name "Engineering/Art Team"
exit
interface vlan 5
name IT
exit
interface vlan 1
ip address 192.168.5.202 255.255.255.0
exit
interface vlan 2
ip address 192.168.0.1 255.255.255.0
exit
interface vlan 3
ip address 192.168.1.1 255.255.255.0
exit
interface vlan 4
ip address 192.168.2.1 255.255.255.0
More: ,  Quit: q, One line:
[Kexit
interface vlan 5
ip address 192.168.3.1 255.255.255.0
exit
ip default-gateway 192.168.5.1
ip name-server  192.168.0.2 192.168.0.5
console#

I have PC1 connected to port G9 of 5324A which is on VLAN4 and PC2 connected to port G7 on 5324B on VLAN2.  What am I configuring wrong on the Router, that is not allowing them to communicate?

Hi Arion,

I must have confused you with my earlier answers - sorry about that.  So this time let me be a bit more precise:

• First, I wanted to point out that the 5324 is an L2 switch so it doesn't do any routing function at all.  So if you had intended for the "ip-default gateway" command on the 5324 to be used to cause packet with unknown route to be sent to the default gateway, this will not do it.  The "ip default-gateway" command on the 5324 only affect the traffic from the 5324 management interface and will have no affect on your production traffic.
• Also the IP addresses you configured on the 5324 VLAN have no affect on routing on the 5324.  It doesn't matter what you configure for IP addresses on VLANs on the 5324 since the 5324 is not a router and will not use that information for routing.  The only thing that does is to configure the management IP addresses that the 5324 will use for those VLAN.  Meaning that the switch management interface will response to those IP addresses.
• In the dump you show below there seems to be two different configuration for the 5324A - in the first one port G9 is on VLAN 3 and in the second one port G9 is on VLAN 4?
• On the 6024, for this particular simple test you actually did not need to define those routing entries because once you defined an IP address for a given VLAN on the 6024, the switch will already know which VLAN interface should be used for a given network anyway and didn't need the routing entries - in fact the 6024 will probably ignore the routing entries for these directly connected network.
• On the 6024, you only need to add routing entries if the subnet you are trying to get to does not match any of the IP addresses of the directly connected interface.  For example, if your 6024 has a VLAN with IP address 192.168.1.1/24 and that interface connects to another router that knows about other network such as 192.168.2.1/24 and you want the first 6024 to route through the 192.168.1.1/24 interface to get to the router that knows about the second network then you would need to add a routing entry (192.168.2.0/24 192.168.1.2 - assuming the second router IP address is 192.168.1.2).  In this case, if you send a packet to the first 6024 destined for 192.168.2.10 for example, it would match the 192.168.2.0/24 rule and the 6024 would see that you need to send that packet to the address 192.168.1.2 which matches the interface defined with the IP 192.168.1.1 so the packet would get sent to the second router and the second router would figure out where to send the packet to get it to the correct destination.
• Also if you note on your 6024 routing table you actually had two rules for "ip route 192.168.0.0...", whenever this happens the first rule would apply and the second one would be ignored.  The routing algorithm find the first best match in case there are two matching rule.  You probably did not intend to do this.

I'm going to give you a more detail example below but first here is the routing algorithm in summary assuming you are trying to route a packet to IP address A:

• Compare A against all the directly connected network on the switch (basically you examine all the IP addresses for the VLANs and ports configured on the switch and find the best matching network).  If you find a matching network then you send the packet over that interface.
• If no interface match then you compare A against the routing table and find the first best matching rule and send the packet to the next hop specified in that rule.
• If no routing rule match and a default route is specified then send the packet to the next hop defined for the default route.
• If nothing match then drop the packet.

Ok so let's go back to your simplest scenario and use a single 6024 and a single 5324 and two PCs:

• Let's say PCA is configured with IP address 192.168.1.100/24 and PCB is configured as 192.168.2.100/24.
• Now let's say PCA is connected to port 5 on the 5324 and PCB is connected to port 6 on the 5324.
• Let's say port 5 on the 5324 is configured as an "access port" and VLAN 2 (access mode - VLAN 2 untag - PVID 2).
• Let's say port 6 on the 5324 is configured as an "access port" and VLAN 3 (access mode - VLAN 3 untag - PVID 3).
• Let's say the 5324 is connected to the 6024 on port 10 (on both switches).
• The 5324 port 10 is configured as a "trunk port" and member of VLAN 2 and 3 (trunk mode - VLAN 2 and 3 tag - accept tag only - PVID 4095).
• The 6024 port 10 is configured as a "trunk port" and member of VLAN 2 and 3 (trunk mode - VLAN 2 and 3 tag - accept tag only - PVID 4095).
• On the 6024, VLAN 2 is configured with an IP = 192.168.1.1/24 and VLAN 3 is configured with an IP = 192.168.2.1/24.
• On the 6024 you may also want to configure an IP for VLAN 1 if you want to be able to manage the switch on the other ports - so you might configure VLAN 1 with IP = 192.168.3.1/24 (or whatever - assuming 192.168.3.x is the management network).
• On the 5324 you may also want to configure an IP for VLAN 1 if you want to be able to manage the switch so you might configure the VLAN 1 IP = 192.168.3.2/24 (or whatever - assuming 192.168.3.x is the management network).
• Then finally, you must properly configure PCA NIC so that its default gateway is the 6024 IP on VLAN 2 (192.168.1.1) and you must properly configure PCB NIC so that its default gateway is the 6024 IP on VLAN 3 (192.168.2.1).  Note that if you didn't configure defautl gateway on your PC, likely your PC didn't even send the packet out since for example PCA network is 192.168.1.100/24 and it would not know how to send to 192.168.2.100 (no matching interface).

Ok I hope this is a bit clearer.  Let me know if this helps any.  I can also recommend some additional books or links to more information if you like.

Cuong.

Hi Arion, you are correct, once you set the mode to trunk then the other options (accept tag only and pvid set to 4095) are basically done automatically and once you set the mode to access then the other options (allow untag and pvid set to the same as the port VLAN membership which may only be one VLAN) are also automatic.  Normally when I configure the switch I just do everything using general mode so that I get the configurations exactly as I want it.  The trunk and access modes are really only convenient but if you know what you want then using general mode is actually more flexible.

There are several books that would help:

• The Switch Book - Seifert (L2 switching)
• TCP/IP Principles - Comer (L3 routing and L4 application)

Good luck,

Cuong.