VLAN Communication [All About Switches] - 15

Latest reply: May 2, 2018 05:41:38 9422 7 0 0

This post emphasizes the VLAN communication. The previous two issues describe the VLAN basics and VLAN assignment.


After VLAN assignment is performed, users in the same VLAN can communicate at Layer 2 and users in different VLANs are isolated at Layer 2. In some scenarios, users in different VLANs need to communicate. How is this requirement met?


A VLAN is a broadcast domain, and data packets between broadcast domains are relayed by routers. Inter-VLAN routing is often used for communication between VLANs. A common router or Layer 3 switch can be used to implement inter-VLAN routing. Later, I will describe how to use a Layer 3 switch to implement inter-VLAN communication.


55b722a58234d.gifScenario 1: Hosts on different network segments in different VLANs need to communicate and are connected through a Layer 3 switch.

Technology: VLANIF interface

55b722a5a27b4.png

Principle: Inter-VLAN routing must be created to implement inter-VLAN communication. Hosts are directly connected to the Layer 3 switch in this scenario. You only need to configure direct routes. The VLANIF interface is a Layer 3 logical interface. After an IP address is assigned to the VLANIF interface and used as the gateway address of hosts, a direct route is generated on the Layer 3 switch. The switch uses the VLANIF interface to send packets from different VLANs at Layer 3.

55b722a5c04e1.gifTip: Only a direct route is generated for the VLANIF interface, that is, only neighboring devices can communicate. On the live network, multiple Layer 3 switches (such as Layer 3 network) may be deployed between hosts. In addition to configuring the VLANIF interface, you need to configure static routes or routing protocols to implement interworking.

55b722a58234d.gifScenario 2: Hosts on different network segments in different VLANs need to communicate and are connected through a Layer 2 switch. Only one Layer 3 switch is used to implement inter-VLAN communication.

Technology: sub-interface, also called router-on-a-stick

55b722a5d4c39.png

Principle: Similar to a VLANIF interface, a sub-interface is also a Layer 3 logical interface. After the sub-interface's IP address is configured as the gateway address of hosts, a direct route is also generated on the Layer 3 switch. Then packets in different VLANs are forwarded by the sub-interfaces. For example, the user gateways in VLAN 2 and VLAN 3 are Port1.1 and Port2.1.

55b722a5c04e1.gifTip: The sub-interface can implement Layer 3 interworking and reduce the number of physical interfaces. There are communication bottlenecks when the network is busy because outgoing traffic preempts the bandwidth of the physical interfaces.

55b722a58234d.gifScenario 3: Hosts on the same network segment in different VLANs need to communicate.

Technology: super-VLAN, also called VLAN aggregation

As shown in the following figure, due to finite IP addresses, hosts in different VLANs share the network segment. The hosts need to communicate with each other and access the external network.

55b722a5f1d83.png

Principle: Define the super-VLAN and sub-VLANs. A super-VLAN is used to create a Layer 3 VLANIF interface and contains no physical interface. A sub-VLAN contains only physical interfaces, and no VLANIF interface is created in a sub-VLAN. Sub-VLANs are used to isolate broadcast domains. A super-VLAN can contain one or more sub-VLANs.

Each common VLAN can contain a Layer 3 logical interface and several physical interfaces; however, super-VLAN technology differentiates them. A sub-VLAN corresponds to only physical interfaces and reserves its independent broadcast domain; a super-VLAN allows all its sub-VLANs to share the same Layer 3 interface so that hosts in sub-VLANs can share the same gateway. The Layer 3 logical interface is associated with physical interfaces through the mapping between the super-VLAN and sub-VLANs. Super-VLAN technology provides functions of common VLANs and saves IP addresses.

55b722a5c04e1.gifTip: Communication between hosts in sub-VLANs and external devices is similar to communication using the VLANIF interface. The difference is that the switch needs to search the mapping between the super-VLAN and sub-VLANs. Proxy ARP needs to be enabled to implement communication of hosts between sub-VLANs. Why? This is because hosts in a sub-VLAN share the same gateway. The hosts can only forward packets at Layer 2, but cannot implement Layer 3 forwarding through the gateway. Hosts in different sub-VLANs are isolated at Layer 2, so proxy ARP is required to implement communication between sub-VLANs.

55b722a58234d.gifIn the preceding networking, hosts between VLANs can communicate with each other at Layer 3 through the Layer 3 switch. The switch needs to search for the routing table to implement Layer 3 interworking, so the forwarding efficiency is low. The Layer 2 forwarding efficiency is high. Can Layer 2 interworking between VLANs be implemented?

VLAN switch or VLAN mapping can be used to implement Layer 2 interworking between VLANs.

55b722a58234d.gifScenario 4: Hosts in different VLANs are connected through one or more switches.

Technology: VLAN Switch

55b722a61b89f.png

Principle: A static forwarding path (that is, VLAN switch table that defines VLAN IDs before and after VLAN switch and outbound interface) is predefined on each switching node (switch in the figure). The switch changes VLAN 2 in packets received by Port2 to VLAN 3 and sends the packets from Port3, and changes VLAN 3 in packets received by Port3 to VLAN 2 and sends the packets from Port2. In this manner, Layer 2 interworking between VLAN 2 and VLAN 3 is implemented.

55b722a5c04e1.gifTip: The switch searches for the VLAN switch table but not the MAC address table, so the forwarding efficiency of VLAN switch is high. Can VLAN switch be applied to many networks? No, VLAN switch cannot be applied to many networks. This is because a static forwarding path needs to be configured for each VLAN user on each switching node along the path where VLAN packets pass. When there are many VLAN users or devices are connected across the ISP network, VLAN switch is inapplicable.

55b722a58234d.gifScenario 5: Hosts in different VLANs are connected across the ISP network.

Technology: VLAN mapping

 

55b722a636a33.png

Principle: VLAN mapping needs to be configured on devices at both ends (SwitchA and SwitchB in the preceding figure), but the outbound interface does not need to be specified. After SwitchA receives packets from VLANs 10 to 50, it maps VLANs 10-50 to VLAN 100. SwitchA searches for the MAC address table and finds that VLAN 100 corresponds to Port2. When packets from VLAN 100 reach Port2 on SwitchB over the ISP network, SwitchB finds the outbound interface of Port1 for sending packets from VLAN 100. SwitchB maps VLAN 100 in packets to VLANs 60-90 before sending the packets from Port1. Then the packets reach the destination host through the access switch of branch 2.

VLAN mapping only needs to be configured on devices at both ends, and the configuration on the ISP network does not need to be changed.

55b722a5c04e1.gifTip: VLAN mapping greatly simplifies the configuration. The switch enabled with VLAN mapping needs to search for the MAC address table, so the forwarding efficiency is low. In addition, broadcast storms and MAC address attacks may easily occur.

I will introduce the commonly used technology, VLANIF interface.

55b722a58234d.gifConfiguration Case 1: As shown in the following figure, PC1 belongs to the R&D department and PC2 belongs to the quality department. The two departments are connected through one Layer 3 switch and have service exchange requirements. Layer 2 isolation and Layer 3 communication are required.

55b722a65045c.png

Configuration Roadmap

The configuration is simple. You only need to add interfaces connected to PCs to VLANs, create VLANIF interfaces, and configure IP addresses of VLANIF interfaces as the gateway addresses of PCs.

Procedure

l  Configure the switch.

#

sysname Switch
#
vlan batch 10 20
#
interface Vlanif10
ip address 10.1.1.1 255.255.255.0  //Configure the IP address as the gateway address of PC1.
#
interface Vlanif20
 ip address 10.1.2.1 255.255.255.0   //Configure the IP address as the gateway address of PC2.
#
interface GigabitEthernet0/0/1     //Add PC1 to VLAN 10.
 port link-type access
 port default vlan 10
#
interface GigabitEthernet0/0/2    //Add PC2 to VLAN 20.
port link-type access
port default vlan 20
#return

After the configuration is complete, run the display ip routing-table command to check routes on the device.

55b722a66ae28.png

 

In the routing table, there are direct routes to the network segments of VLAN 10 and VLAN 20. Then check whether PC1 and PC2 can be pinged.

Before verification, set the IP address of PC1 to 10.1.1.2 and its gateway address to 10.1.1.1/24; set the IP address of PC2 to 10.1.2.2 and its gateway address to 10.1.2.1/24. Then perform the ping operation.

55b722a695860.png

55b722a6c4d7d.png

The ping operation is successful, that is, the configuration is successful.

55b722a58234d.gifConfiguration Case 2: As shown in the following figure, a VLAN is dedicatedly assigned to the server to ensure security and facilitate management. Hosts belong to VLAN 10 and the server belongs to VLAN 20. The access, aggregation, and core switches are deployed between hosts and the server. The access switch is a Layer 2 switch, and aggregation and core switches are Layer 3 switches. Host and the server need to communicate with each other.

55b722a6eff98.png

Configuration Roadmap

Multiple Layer 2 and Layer 3 switches are deployed between hosts and the server. You can configure VLANIF interfaces, and use the AGG (aggregation switch) as the gateway of hosts and CORE (core switch) as the gateway of the server. The VLANIF interfaces can be used to implement only interworking of neighboring devices because only direct routes are generated for VLANIF interfaces. To enable the hosts to communicate with the server, you need to configure routes from the AGG to the network segment of VLAN 20 and from the CORE to the network segment of VLAN 10. You can use static or dynamic routes. This example uses the static routes.

Procedure

1.      Configure interfaces of the ACC, AGG, and CORE, add interfaces to VLANs, and enable user packets form VLAN 10 and VLAN 20 to be transparently transmitted to the AGG and CORE respectively.

l  Configure ACC1.

#
sysname ACC1
#
vlan batch 10
#
interface GigabitEthernet0/0/1  //Add this interface to VLAN 10.
 port link-type access
 port default vlan 10
#
interface GigabitEthernet0/0/2   //Enable packets from VLAN 10 to be transparently transmitted to the AGG.
 port link-type trunk
 port trunk allow-pass vlan 10
#return

The configuration of ACC2 is similar. The difference is that the interface is added to VLAN 20 and packets from VLAN 20 are transparently transmitted.

l  Configure the AGG.

#
sysname AGG
#
vlan batch 10 30
#
interface GigabitEthernet0/0/1     //Add the interface to VLAN 10.
 port link-type trunk
 port trunk allow-pass vlan 10
#
interface GigabitEthernet0/0/2  //Add the interface to VLAN 30.
 port link-type trunk
 port trunk allow-pass vlan 30
#return

 

l  Configure the CORE.

#
sysname CORE
#
vlan batch 20 30
#
interface GigabitEthernet0/0/1     //Configure the interface to transparently transmit packets from VLAN 20.
 port link-type trunk
 port trunk allow-pass vlan 20
#
interface GigabitEthernet0/0/2  //Configure the interface to transparently transmit packets from VLAN 30.
 port link-type trunk
 port trunk allow-pass vlan 30
#return

 

2.      Configure an IP address for VLANIF 10 on the AGG as the gateway address of hosts, configure an IP address for VLANIF 20 on the CORE as the gateway address of the server, and configure an IP address for VLANIF 30 to implement interworking between the AGG and CORE.

l  Configure the AGG.

#
interface Vlanif10
 ip address 10.1.1.1 255.255.255.0  //This IP address is the gateway address of hosts.
#
interface Vlanif30
 ip address 10.10.30.1 255.255.255.0 //This IP address cannot conflict with the IP network segment of hosts and the server.

 

l  Configure the CORE.

#
interface Vlanif20
 ip address 192.168.1.1 255.255.255.0  //This IP address is the gateway address of the server.
#
interface Vlanif30
 ip address 10.10.30.2 255.255.255.0 //This IP address cannot conflict with the IP network segment of hosts and the server.

 

Check whether the hosts can ping the server.
The hosts cannot ping the server because the AGG has no route to the network segment of 192.168.1.0/24.

3.      Configure static routes on the AGG and CORE.

l  Configure the AGG.

ip route-static 192.168.1.0 255.255.255.0 10.10.30.2

l  Configure the CORE.

ip route-static 10.1.1.0 255.255.255.0 10.10.30.1

Tip: For logical interfaces such as VLANIF interfaces and Eth-Trunks, the next hop address must be specified in the static route. This is because the logical interface often has many member interfaces, and there are many next hops. 
After the configurations are complete, ping the server from hosts.

The hosts can ping the server. The configuration is successful.

I finish the VLAN communication. For more information about VLAN technology, see the next issue.

To be continued...

Issue

Name

Description

First issue

[All About Switches - Beginner] VLAN Basics

This issue describes the definition and purpose of VLAN technology and modes in which interfaces are added to VLANs.

Second issue

[All About Switches - Beginner] VLAN Assignment

This issue describes VLAN assignment modes and applicable scenarios, and mainly describes the configuration and scenario of interface-based assignment.

Third issue

[All About Switches - Beginner]

VLAN Communication

This issue describes main technologies and applicable scenarios of inter-VLAN communication, including the VLANIF interface, sub-interface, and super-VLAN. This issue also describes common VLANIF interface configuration.

Fourth issue

[All About Switches - Beginner] VLAN Isolation

This issue describes main technologies and applicable scenarios of VLAN isolation, such as MUX VLAN and ACL.

 ★★★Summary★★★ All About Huawei Switch Features and Configurations


This article contains more resources

You need to log in to download or view. No account?Register

x
  • x
  • convention:

liuliuliu
Created Jul 28, 2015 07:13:58 Helpful(0) Helpful(0)

Good !
  • x
  • convention:

nklsureshkumar
Created Aug 30, 2016 18:42:13 Helpful(0) Helpful(0)

Excellent PPT

  • x
  • convention:

yaba_mobhe
Created Sep 7, 2016 08:24:23 Helpful(0) Helpful(0)

THANK YOU..

  • x
  • convention:

vanjp01
Created Sep 14, 2016 14:32:20 Helpful(0) Helpful(0)

Hello,

I noted that each vlanif have a different mac-address. In Extreme or Brocade L3 swiches, for example,  all vlanifs have the same mac address.

Is there any way for all VLANIFs have the same mac?

Thanks.

  • x
  • convention:

All_About_Switch
Official Created Sep 18, 2016 01:50:15 Helpful(0) Helpful(0)

Hello

This is the fixed attribute of the device and cannot be changed.

  • x
  • convention:

Josivan
Created May 31, 2017 20:25:38 Helpful(0) Helpful(0)

This can be resolved using sub-interface (router-on-stick). Mac is same from ethernet interface.
But ipv6 don't works on sub-interfaces. I tested in S6720 V200R009C00SPC500. :(
  • x
  • convention:

wissal
MVE Created May 2, 2018 05:41:38 Helpful(0) Helpful(0)


useful document, thanks
  • x
  • convention:

Telecommunications%20engineer%2C%20currently%20senior%20project%20manager%20at%20an%20operator%2C%20partner%20of%20Huawei%2C%20in%20the%20radio%20access%20network%20department%2C%20for%2020%20years%20I%20managed%20several%20types%20of%20projects%2C%20for%20the%20different%20nodes%20of%20the%20network.

Reply

Reply
You need to log in to reply to the post Login | Register

Notice Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."
If the attachment button is not available, update the Adobe Flash Player to the latest version!
Login and enjoy all the member benefits

Login and enjoy all the member benefits

Login