Here is a paper on how VLAN routing works:

http://www.dell.com/downloads/global/products/pwcnt/en/app_note_38.pdf

When you use the routing feature on a 6024 you actually allow any host on one VLAN to be able to communicate to any other host on another VLAN.  So you can of lost the segmentation nature of VLAN so if you still want to make sure host on one VLAN can't communicate with host on another VLAN then you also need to setup ACL on the 6024 to control access to your services.  I discussed that a bit here:

http://forums.us.dell.com/supportforums/board/message?board.id=pc_managed&message.id=6115

And here is another paper on ACL:

http://www.dell.com/downloads/global/products/pwcnt/en/app_note_3.pdf

Cuong.

thanks again!

I have been reading that app_note_38.pdf many times and still could not figure out the routing on section 4 of page 4.  It assigned the IP address for the interface vlan as X.X.X.1 (i.e. 10.10.0.1 /24) but when define the route to the subnet (i.e. 10.10.0.0 /24) it used the gateway of X.X.X.2 (i.e. 10.10.0.2).  What device was assigned the IP 10.10.0.2 ?   Should the 6024 do the routing, hence should it be 10.10.0.1?

Andy

First, thank you for your response.

You mentioned in the other post that the vlan overlap problem can be overcome by using the layer 3 switch.  If I am going to use the 6024 switch, how do I configure for this problem?  Should it be the same (as your example in the post - port 47 with vlan 10, 30 ...) and the only difference is the addition of ip address for the vlan interface.

How do you make the switch using IP address instead of MAC address?

Thanks,

Andy

Yes you can make it work using a concept call "vlan overlapping" but this method is not really recommended normally unless you have no other option :-).  I explained this concept on another discussion thread here:

http://forums.us.dell.com/supportforums/board/message?board.id=pc_managed&message.id=5941&query.id=809913#M5941

Cuong.

• Let's say the 6024 has two VLANs 10 and 20:
• • VLAN 10 IP is 10.10.0.1/24.
  • VLAN 20 IP is 10.20.0.1/24.
  • Port 23 is on VLAN 10.
  • Port 24 is on VLAN 20.
• Let's say that 6024 is connected to another router on port 23.  That router IP address is 10.10.0.2 and it knows about another subnet beyond this 6024 such as 10.30.0.0/24.

• Consider all the directly connected network first and see if the packet can be routed to those connected subnets.
• If nothing matches then consider any configured (static or learn) routes to see if any of those would work.
• If still nothing matches then look for a default route if it is defined and use that.

So let's use an example to see how it would work.  Let's say a packet is destined for 10.10.0.20 enters the 6024.  What should it do:

• First it looks at its directly connected subnets.  In this case the directly connected subnets are the 10.10.0.0/24 subnet connected to VLAN 10 and the 10.20.0.0/24 subnet connected to VLAN 20.  Why?  Because of the mask we used to define the IP address for the VLAN 10 and 20 is 255.255.255.0 (10.10.0.1 IP is in 10.10.0.0/24 subnet and 10.20.0.1 is in 10.20.0.0/24 subnet).
• So which subnet maps to the 10.10.0.20 destination IP?  It would be the subnet connected to VLAN 10!
• So the router now knows that it needs to route the packet destined for 10.10.0.20 to the VLAN 10.

So if the destination IP is 10.20.0.15 the router would do the same steps and conclude that it needs to route to 10.20.0.0/24 subnet which is VLAN 20.

So doing nothing more then just defining the IP addresses on those VLANs on the 6024 you actually created implicit routes on the 6024!  So far you didn't even have to use the "ip route" command at all.

So when do you have to setup the "ip route" command?  Well you have to do that if you want to be able to send packet to a subnet that you are not directly connected to.  So for example if you need to route to 10.30.0.40 how would you do it?

If you didn't do anything else, the 6024 router would first check its directly connected subnets and find that it doesn't know how to route to 10.30.0.40 so it would simply drop the packet.  But in fact you know that 10.30.0.40 can be reached through port 23 because the router at the next hop (10.10.0.2) does know how to route to 10.30.0.0/24 subnet.  So you have to tell this router how to route to that subnet.  To do that you use the command:

ip route 10.30.0.0 255.255.255.0 10.10.0.2

What this tells the router is that it must send the packet to the next hop router at 10.10.0.2 whenever it wants to route a packet to the 10.30.0.0/24 subnet.  The 10.10.0.2 IP address is reachable (see above rules) through VLAN 10 (connected to port 23).  Also remember that the 10.10.0.2 router must actually exist and it must know about this subnet for everything to finally get where they need to go.  Also on the next hop router at 10.10.0.2 subnet you must also configure a return route to this router otherwise the return packet will get lost.

Finally you might also want to setup a default route so that if no other route works, the 6024 will send the packet to a default next hop router just in case it does know something :-).  This is also called the route of last resort.

Normally if you have only one router in the network and just routing between subnets that are all directly connected to the single router you don't really have to use the "ip route" command.  You just need to define the IP address (or addresses - a single VLAN can have more then one subnets on it) for your directly connected interfaces on the 6024 and all the implicit routes are setup for you.

Hopefully this is clearer then the whitepaper :-).

Cuong.