Module 3 and Module 4

SRWE Detailed Notes: Module 3 (VLANs) & Module 4 (Inter-VLAN Routing)

Module 3: VLANs

3.1 What Is a VLAN?

A VLAN (Virtual Local Area Network) is a logical grouping of devices within the same broadcast domain, regardless of their physical location or which physical switch they're connected to.

Without VLANs: A switch is one single broadcast domain — every broadcast (like ARP requests) is flooded to every device.

With VLANs: The switch is logically divided into multiple broadcast domains. Devices in VLAN 10 don't see broadcast traffic from VLAN 20, even though they're plugged into the same physical switch.

Key Benefits of VLANs

• Smaller broadcast domains → improved performance (less unnecessary traffic).

• Improved security → sensitive systems (e.g., HR, Finance) can be isolated into their own VLAN.

• Simplified administration → devices can be grouped logically (by department/function) instead of physical location.

• Cost efficiency → reduces the need for separate physical switches/networks to segment traffic.

3.2 Types of VLANs

⚠ Best Practice Note: It is strongly recommended to change the native VLAN and management VLAN away from the default VLAN 1, to reduce the risk of VLAN hopping attacks.

VLAN ID Ranges

• Normal range: VLANs 1–1005 — supported on all switches, stored in the VLAN database file (vlan.dat) in flash memory.

  • VLAN 1, and 1002–1005 (legacy Token Ring/FDDI VLANs), are reserved and cannot be deleted or renamed.

• Extended range: VLANs 1006–4094 — supported on newer switches, saved in the running configuration instead of vlan.dat. In VTPv1/v2, extended-range VLANs can only be configured in VTP transparent mode.

3.3 VLAN Configuration (CLI Reference)

Creating a VLAN

enable
configure terminal
vlan 10                          ! Create VLAN 10 (or enter its config if it exists)
 name SALES                      ! Give it a descriptive name
exit
vlan 20
 name IT
exit

Assigning a Port to a VLAN (Access Port)

interface fastethernet 0/2
 switchport mode access
 switchport access vlan 10
exit

Assigning a Range of Ports

interface range fastethernet 0/3 - 10
 switchport mode access
 switchport access vlan 20
exit

Verifying VLAN Configuration

show vlan brief          ! Shows VLAN IDs, names, and assigned ports
show vlan id 10          ! Details for a specific VLAN
show interfaces vlan 10  ! Info about the VLAN's SVI (if configured)
show running-config      ! Full running configuration

Deleting a VLAN

no vlan 10

Note: Deleting a VLAN that ports are still assigned to leaves those ports in an "inactive" state until reassigned.

3.4 Trunking

What Is a Trunk Link?

A trunk port carries traffic for multiple VLANs between switches (or between a switch and a router). Normal access ports only carry traffic for a single VLAN — trunks are needed so VLAN traffic can span multiple switches.

802.1Q Encapsulation

• The IEEE standard for VLAN tagging.

• Inserts a 4-byte tag into the Ethernet frame header, containing:

  • VLAN ID (12 bits — supports VLANs 1–4094)

  • Priority bits (for QoS — 802.1p)

• All VLAN traffic across the trunk is tagged except for the native VLAN, which is sent untagged.

Configuring a Trunk Port

interface gigabitethernet 0/1
 switchport mode trunk
 switchport trunk native vlan 99      ! Change native VLAN (best practice)
 switchport trunk allowed vlan 10,20,30   ! (Optional) restrict which VLANs cross the trunk
exit

Verifying Trunks

show interfaces trunk
show interfaces gigabitethernet 0/1 switchport

Common Trunking Issues

3.5 VLAN Trunking Protocol (VTP)

VTP allows VLAN configuration to be created once on one switch and automatically propagated to other switches in the same VTP domain — reducing manual configuration errors.

VTP Modes

Note: normal-range VLAN info (1–1005) is stored in vlan.dat in flash on all modes. The real practical difference for Client mode in VTPv1/v2 is that it doesn't independently retain authority over the VLAN list — it depends on the VTP server for updates, and extended-range VLANs (1006–4094) aren't configurable in Client mode at all.

Key VTP Concepts

• All switches must be in the same VTP domain name to exchange updates.

• VTP uses a revision number — the switch with the highest revision number is treated as authoritative. (⚠ Common real-world pitfall: plugging in an old switch with a higher revision number can accidentally overwrite the VLAN database of the whole network!)

• VTP pruning can be enabled to prevent unnecessary flooding of VLAN traffic to switches that don't have ports in that VLAN.

vtp mode server
vtp domain CORP
vtp password Cisco123
show vtp status

3.6 VLAN Security Considerations

• VLAN hopping: An attack where a host on one VLAN gains access to traffic on another VLAN. Two common methods:

  • Switch spoofing: Attacker's device negotiates a trunk link using DTP (Dynamic Trunking Protocol).

  • Double tagging: Attacker sends a frame with two 802.1Q tags; if the native VLAN matches the attacker's VLAN, the outer tag is stripped and the inner tag lets the frame hop into another VLAN.

• Mitigation:

  • Disable DTP / set unused ports to switchport nonegotiate.

  • Move the native VLAN off VLAN 1 to an unused VLAN ID.

  • Manually configure trunk and access ports explicitly rather than relying on auto-negotiation.

  • Shut down or place unused ports into an unused "parking lot" VLAN.

3.7 Module 3 Quick-Reference Command Summary

Module 4: Inter-VLAN Routing

4.1 Why Inter-VLAN Routing Is Needed

VLANs are separate broadcast domains — by design, devices in different VLANs cannot communicate with each other at Layer 2, even if plugged into the same physical switch. This is the entire point of VLANs (segmentation/security), but it means a Layer 3 device (router or Layer 3 switch) is required to route traffic betweenVLANs, just as it would be needed to route between two entirely separate physical networks.

Benefits of Inter-VLAN Routing:

• Retains the security/segmentation benefits of VLANs.

• Still allows controlled communication between departments/VLANs that legitimately need to talk to each other (e.g., a workstation VLAN reaching a shared file-server VLAN).

• Can be combined with Access Control Lists (ACLs) on the routing device to further restrict which VLANs can reach each other.

4.2 Methods of Inter-VLAN Routing

1. Legacy (Traditional) Inter-VLAN Routing

• The oldest method — uses a router with a separate physical interface for each VLAN.

• Each router interface is connected to a separate access port on the switch, configured for that specific VLAN, with an IP address in that VLAN's subnet.

• Major drawback: Doesn't scale — you run out of physical router interfaces quickly as VLANs grow. Rarely used today except in legacy or teaching contexts.

2. Router-on-a-Stick (ROAS)

• Uses a single physical router interface, divided into multiple logical sub-interfaces — one per VLAN.

• The physical switch port connecting to the router must be configured as a trunk port (since it now needs to carry multiple VLANs over one cable).

• Each sub-interface is tagged with 802.1Q encapsulation matching a specific VLAN.

Configuration Steps

! On the router:
interface gigabitethernet 0/0
 no shutdown                              ! Enable the physical interface (sub-interfaces depend on it)
exit

interface gigabitethernet 0/0.10          ! Sub-interface for VLAN 10
 encapsulation dot1Q 10                   ! Tag traffic on this sub-interface for VLAN 10
 ip address 192.168.10.1 255.255.255.0
exit

interface gigabitethernet 0/0.20          ! Sub-interface for VLAN 20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
exit

! On the connected switch port:
interface gigabitethernet 0/1
 switchport mode trunk
exit

Key point: The physical interface itself (gi0/0) is not assigned an IP address in this model — only the sub-interfaces are. The physical interface just needs to be enabled with no shutdown.

Native VLAN sub-interface: If a native VLAN sub-interface is used, it typically does not need the encapsulation dot1Q [id] command tagged the same way — instead you can add the native keyword: encapsulation dot1Q 1 native. Untagged native VLAN traffic is matched to that sub-interface.

Drawback of ROAS: All inter-VLAN traffic funnels through a single physical link, which can become a bandwidth bottleneck as VLAN count/traffic grows.

3. Layer 3 Switching (Switch-Based Inter-VLAN Routing) — Modern/Preferred Method

• Uses a Layer 3 switch, which can perform both switching (Layer 2) and routing (Layer 3) internally — no external router required.

• Two components are used:

  • SVIs (Switched Virtual Interfaces) — one logical Layer 3 interface per VLAN, each assigned an IP address that acts as the default gateway for that VLAN.

  • Routed Ports — physical switch ports converted to act like router interfaces (no longer part of a VLAN's Layer 2 domain) using no switchport, often used for uplinks to other routers/switches.

Configuration Steps

! Enable routing capability on the Layer 3 switch (disabled by default):
ip routing

! Create VLANs (if not already done):
vlan 10
 name SALES
exit
vlan 20
 name IT
exit

! Configure an SVI for each VLAN:
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown
exit

interface vlan 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown
exit

! Assign access ports to their VLANs as usual:
interface fastethernet 0/2
 switchport mode access
 switchport access vlan 10
exit

Critical command: ip routing must be enabled globally on a Layer 3 switch, or it will not route between VLANs even if SVIs are configured correctly — this is one of the most common reasons inter-VLAN routing "doesn't work" in labs.

Advantages of Layer 3 Switching over Router-on-a-Stick:

• Much faster — routing is done in hardware (ASICs) rather than relying on a single router CPU/interface. – No single-link bottleneck like ROAS.

• Scales far better for larger networks.

4.3 Comparison of Inter-VLAN Routing Methods

4.4 Verifying Inter-VLAN Routing

4.5 Troubleshooting Inter-VLAN Routing

Common causes of inter-VLAN routing failure, roughly in the order to check them:

1. ip routing not enabled (Layer 3 switch method only) — routing simply won't happen without it.

2. SVI or sub-interface is down — check no shutdown was applied; an SVI also requires at least one access port in that VLAN to be active/up for the SVI itself to come up.

3. Encapsulation mismatch (ROAS) — the VLAN ID in encapsulation dot1Q [id] must exactly match the VLAN ID configured on the switch side.

4. Switch port not trunked (ROAS) — the port connecting to the router must be switchport mode trunk, not access.

5. VLAN not allowed on trunk — if switchport trunk allowed vlan was used to restrict VLANs, make sure all needed VLANs are included.

6. Incorrect IP addressing — sub-interface/SVI IP must be in the same subnet as the hosts in that VLAN, and end devices must have the correct default gateway configured.

7. VLAN doesn't exist on the switch — double check with show vlan brief that the VLAN was actually created and isn't just referenced in an interface command.

4.6 Module 4 Quick-Reference Command Summary

Study Tips (Modules 3 & 4 Combined)

• Know the difference between access and trunk ports, and why a router-on-a-stick setup requires the switch side to be trunked.

• Memorize the ip routing requirement for Layer 3 switches — it's one of the most common "gotcha" points in labs and exams.

• Be able to explain why VLANs need inter-VLAN routing at all — this ties Module 3 and Module 4 together conceptually (VLANs separate broadcast domains at L2; routing is required to cross that boundary at L3).

• Practice both Router-on-a-Stick and SVI-based (Layer 3 switch) configurations — many exams expect you to configure or troubleshoot either method.

• When troubleshooting, always check in this order: VLAN exists → port assigned to VLAN → trunk configured correctly (if ROAS) → sub-interface/SVI IP and no shutdown → ip routing enabled (if L3 switch) → end device default gateway correct.