Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 395
  • Last Modified:

vlan device gateways

If I have a layer 3 switch trunking down 5 vlans to a layer 2 switch.....what should the gateway be of the devices plugged into that layer 2 switch?  

What if i'm trunking down those same vlans through two layer 2 switches?  Is there any problems with this?  Can I trunk through as many layer 2 switches as I want?  Any best practices here?   Thanks!
0
readymade
Asked:
readymade
  • 3
  • 2
  • 2
2 Solutions
 
gt2847cCommented:
If you're sending 5 VLANs down a trunk to a layer 2 switch, the gateway for devices plugged into that layer 2 switch would depend on which VLAN their device's port was configured to use.  Assuming your VLANs are carrying IP traffic, each VLAN would typically have an IP subnet associated with it (doesn't necessarily have to or could have more than one, but generally speaking will have one).  Whatever is routing that subnet would be the appropriate gateway.

Trunking through multiple layer 2 switches is fine, there is an upper limit based on distance and latency, but two is completely fine.  You would simply have to have trunk ports in between them.
0
 
traoherCommented:
If you trunking is working correctly, your gateway still is the layer 3 switch VLAN interface IP for systems from within each VLAN.

For example, if your vlan5 has vlan interface ip 10.10.10.5 for 10.10.10.0/24 subnet then, your gateway for vlan 5 computers would be 10.10.10.5, no matter where they are as long as they are in the same vlan 5.
0
 
readymadeAuthor Commented:
What if the layer 2 switch has an interface ip on that vlan?
0
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

 
gt2847cCommented:
So long as the IP address is not the same as the layer 3 switch interface, fine.  You can use it to remotely manage the layer 2 switch.  It would not be the gateway address for other devices, however as the layer 2 switch can't route.  The layer 2 switch would need to have a default route pointing to the layer 3 switch interface so that it could reach and be reached by other networks.
0
 
readymadeAuthor Commented:
I would have thought so too.  I had the layer 3 switch as the gateway for those devices, however any time I was on any of the other vlans other than the management vlan, I could not go anywhere.  

I called Dell this morning and they looked at all my routing, gateways, etc.  They said if the vlan has an interface IP, it should be the gateway of those devices.  I made that interface ip my gateway and that solved it.  

Now, I know making the layer 3 switch your gateway works sometimes, but it seems when I was on this 3rd switch in the chain, it wasn't.  

The layer 2 switch doesn't need to route in this case.

So i'm not really sure what the deal is.
0
 
traoherCommented:
The problem comes about if your other layer 2 switches doesn't forward the arp request (a broadcast request), the originating device would not know which MAC to use as a destination MAC.

The question is the why wouldn't the switches in between relay the arp request for MAC?

anyway, glad you got it resolved.
0
 
readymadeAuthor Commented:
I understand what you're saying.  This is all still a little above my head.  There is probably more than one way to make it work.  Thanks for the help guys.
0

Featured Post

Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

  • 3
  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now