[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Are vlan interfaces layer 2 or layer 3?

Posted on 2011-10-11
12
Medium Priority
?
593 Views
Last Modified: 2012-06-21
To me vlan interfaces seem to be a wierd combination of layer 2 and layer 3.

I cannot find a switchport/no switchport on a vlan interface so that tells me that it is a layer 3 and I can add an ip address.

But when I set them up with an ip address and then use the remote ip on the same vlan as a default-gateway thereby bypassing the local vlan interface address and seemingly extending the broadcast domain that feels more like layer 2.

Does having ip routing on change the behavior of vlan interfaces?
0
Comment
Question by:Dragon0x40
  • 3
  • 3
  • 2
  • +3
12 Comments
 
LVL 3

Expert Comment

by:shbasm
ID: 36950049
layer 2
0
 
LVL 4

Accepted Solution

by:
SCarrison earned 400 total points
ID: 36950110
Your question is about the nature of VLANs but I believe you are referencing Cisco terminology....

A VLAN that has an IP address is layer three (hence the term, Layer 3 VLAN), if you can route IP traffic between two networks (subnets in VLANs for example) you are operating at Layer 3.

However, you can of course have a VLAN with no IP address, where traffic within that VLAN cannot "escape" unless there is an independent router connected to a port assigned to that VLAN.  For example if you had an "internet" VLAN where your firewall and internet connection maybe at two ends of a building and you use the L2 VLAN to make the router accessible to the firewall.  In that case you would have a L2 VLAN.
0
 
LVL 6

Assisted Solution

by:ipajones
ipajones earned 800 total points
ID: 36950405
A VLAN interface or VLAN SVI (Switched Virtual Interface) is a L3 virtual routed interface shared between all ports assigned to the VLAN.  The VLAN itself is a L2 broadcast domain but the SVI provides a route out of /into the VLAN for devices that are connected to ports assigned to the VLAN.

Enabling IP routing on a layer 3 or multi-layer switch enables routing between the VLANs using the SVI's as the connected interfaces for the assigned VLAN subnets.  When IP routing is enabled the ip default-gateway on the switch is not used.
--IJ
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:Dragon0x40
ID: 36950567
vlan interface without an ip address is layer2?

vlan interface with an ip address is layer 3 but does not route and passes broadcasts?

vlan interface with an ip address and ip routing enabled on the switch is layer 3 and does not pass broadcasts?
0
 
LVL 6

Assisted Solution

by:ipajones
ipajones earned 800 total points
ID: 36950627
>>>>>vlan interface without an ip address is layer2?

A VLAN interface without an IP address is not an SVI so therefore it's not an interface accept that it identifies the VLAN - I'm not sure how best to answer this.  Except to add that if an IP isn't assigned then it's not processing traffic at either L3 or L2.  However, the VLAN itself is L2.

>>>>>vlan interface with an ip address is layer 3 but does not route and passes broadcasts?

A VLAN SVI or VLAN interface with IP does route and is L3.  No L3 device will pass broadcasts.

>>>>>vlan interface with an ip address and ip routing enabled on the switch is layer 3 and does not pass broadcasts?

enabling IP routing provides IP routing on the switch, it doesn't change the properties or features of the SVI.  Except that having multiple SVI's on a switch without enabling ip routing wouldn't really be of any benefit unless you wanted to just connect to the switch for management purposes using different VLANs and different subnets.


0
 
LVL 3

Expert Comment

by:shbasm
ID: 36950779
vlan interface in layer 2 devices is layer 2
vlan interface in layer 3 devices is layer 3
0
 
LVL 26

Assisted Solution

by:Soulja
Soulja earned 400 total points
ID: 36950917
vlan interface without an ip address is layer2?

A vlan interface is always layer 3. Without an ip address and it is useless.


vlan interface with an ip address is layer 3 but does not route and passes broadcasts?

vlan interface with an ip address on a layer 3 switch will route. On a layer 2 switch it will not route.

vlan interface with an ip address and ip routing enabled on the switch is layer 3 and does not pass broadcasts?

Yes, that is correct.
0
 
LVL 17

Assisted Solution

by:rochey2009
rochey2009 earned 400 total points
ID: 36950944
http://en.wikipedia.org/wiki/Switch_virtual_interface

If it has a layer 3 address such as an IP address, then it works at layer 3.
0
 

Author Comment

by:Dragon0x40
ID: 36956881
I think my confusion started by not remembering that a vlan is a layer 2 broadcast domain. Every switch that has that vlan and trunks between them carrying that vlan can broadcast to each other.

Each switch can have a vlan interface for that vlan and the entire vlan is still a broadcast domain but with multiple entrance and exit points (SVI)?

These entrance and exit points can only be used to get to another vlan if they have an ip address and have ip routing enabled on the switch on which the vlan interface is configured.

I was thinking about the scenario where an access layer switch had an interface vlan 20 with an ip address and the upstream distribution switch also had an interface vlan 20 with an ip address. Even if both switches had ip routing turned on the hosts attached to vlan 20 would still broadcast for local addresses and send remote addresses to the gateway on the distribution switch.  In other words having multiple vlan interfaces on the same vlan would not cause routing inside a vlan because the hosts will only have one gateway address of the distribution switch.

I guess that would still be a bad idea because the routing between two vlans should only take place on one switch?
0
 
LVL 26

Expert Comment

by:Soulja
ID: 36956915
If both switches have vlan 20 interfaces and routing enabled, either could route for the vlan, but it would be based on which gateway is configured on the hosts.
0
 
LVL 6

Expert Comment

by:ipajones
ID: 36957035
@Dragon0x40:  There is nothing incorrect about you description.  As @Soulja has said which device performs the routing function will be determined by the IP address of the default gateway used by the client.  In fact, technically you could have some clients using the SVI on one switch as their DGW and some clients using the IP of the SVI on the other switch as their DGW.  Generally Cisco's model recommends that the distribution layer switches should have the SVI for a VLAN.  In addition, it would be unusal and expensive to find L3 switches as access layer switches.
--IJ
0
 
LVL 26

Expert Comment

by:Soulja
ID: 36957106
@ipajones

I hear ya. I have actually deployed 6500's with gigabit at the access layer for a company, as well as 3750's. Not as uncommon as you may think.
0

Featured Post

Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
In this article, we’ll look at how to deploy ProxySQL.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question