Route between VLANs with SVIs on a layer 3 switch and a routed uplink

Cisco IOSWorking

Make DSW1 the gateway for VLANs 10 and 20 with SVIs, carry both VLANs to the access switch on a trunk, and connect DSW1 to the edge router R1 with a routed /31 point-to-point link and a default route.

Network	Subnet	Addresses
VLAN 10 USERS	10.10.0.0/24	gateway 10.10.0.1 on DSW1
VLAN 20 SALES	10.20.0.0/24	gateway 10.20.0.1 on DSW1
DSW1 to R1	10.0.0.0/31	R1 10.0.0.0, DSW1 10.0.0.1

Tasks

Enable routing on DSW1, create VLANs 10 and 20, and give each an SVI with its gateway address.
Trunk VLANs 10 and 20 from DSW1 Gi1/0/1 to ASW1 and put PC1 and PC2 in their VLANs.
Make DSW1 Gi1/0/48 a routed port to R1 and add a default route.
Give R1 routes back to both user subnets.

Solution

1Routing, VLANs and SVIs on DSW1DSW1

DSW1 on Cisco IOS

ip routing
!
vlan 10
 name USERS
vlan 20
 name SALES
!
interface Vlan10
 ip address 10.10.0.1 255.255.255.0
 no shutdown
interface Vlan20
 ip address 10.20.0.1 255.255.255.0
 no shutdown

Creating interface Vlan10 does not create VLAN 10. Without the VLAN, or without an active port in it, the SVI stays up/down because of autostate.

2Trunk from DSW1 to ASW1DSW1

DSW1 on Cisco IOS

interface GigabitEthernet1/0/1
 description Trunk to ASW1
 switchport mode trunk
 switchport nonegotiate
 switchport trunk allowed vlan 10,20

3Access switchASW1

ASW1 on Cisco IOS

vlan 10
 name USERS
vlan 20
 name SALES
!
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
interface GigabitEthernet1/0/48
 description Trunk to DSW1
 switchport mode trunk
 switchport nonegotiate
 switchport trunk allowed vlan 10,20

4Routed uplink and default routeDSW1
DSW1 on Cisco IOS
```
interface GigabitEthernet1/0/48
 description Routed link to R1
 no switchport
 ip address 10.0.0.1 255.255.255.254
!
ip route 0.0.0.0 0.0.0.0 10.0.0.0
```
no switchport turns the port into a router interface: no VLAN, no spanning tree, no DTP. A /31 needs no network or broadcast address, so both addresses are usable.

5Return routes on R1R1

R1 on Cisco IOS

interface GigabitEthernet0/0/1
 description Link to DSW1
 ip address 10.0.0.0 255.255.255.254
 no shutdown
!
ip route 10.10.0.0 255.255.255.0 10.0.0.1
ip route 10.20.0.0 255.255.255.0 10.0.0.1

In production you would run OSPF between DSW1 and R1 instead of static routes.

Verify

DSW1 output

DSW1# show ip interface brief | include Vlan[12]0|1/0/48
Vlan10                 10.10.0.1       YES manual up                    up
Vlan20                 10.20.0.1       YES manual up                    up
GigabitEthernet1/0/48  10.0.0.1        YES manual up                    up

Both SVIs are up/up, which proves the VLANs exist and have active ports, and the routed port is up.

DSW1 output

DSW1# show ip route | begin Gateway
Gateway of last resort is 10.0.0.0 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 10.0.0.0
      10.0.0.0/8 is variably subnetted, 6 subnets, 3 masks
C        10.0.0.0/31 is directly connected, GigabitEthernet1/0/48
L        10.0.0.1/32 is directly connected, GigabitEthernet1/0/48
C        10.10.0.0/24 is directly connected, Vlan10
L        10.10.0.1/32 is directly connected, Vlan10
C        10.20.0.0/24 is directly connected, Vlan20
L        10.20.0.1/32 is directly connected, Vlan20

A connected and a local route for each SVI and for the /31, plus the static default toward R1.

DSW1 output

DSW1# show interfaces GigabitEthernet1/0/48 switchport
Name: Gi1/0/48
Switchport: Disabled

Gi1/0/48 is a routed port, not a switch port.

PC1 output

PC1# tracert -d 10.20.0.10
Tracing route to 10.20.0.10 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.10.0.1
  2    <1 ms    <1 ms    <1 ms  10.20.0.10

Trace complete.

One routed hop, the VLAN 10 SVI on DSW1. Inter-VLAN traffic never goes to R1.

PC1 output

PC1# ping 10.0.0.0
Reply from 10.0.0.0: bytes=32 time=1ms TTL=254

R1 answers with TTL 254 (IOS starts at 255, minus one hop through DSW1), which proves R1's return route works.

Mistakes people make

Forgetting ip routing. The SVIs come up and hosts can ping their own gateway, but nothing is routed between VLANs.
Creating the SVI but not the VLAN, so the SVI stays up/down.
Leaving the trunk without VLAN 20 in the allowed list. SVI 20 may still be up through another port, but PC2 is unreachable.
Forgetting the return routes on R1. DSW1 reaches R1, but replies to the user subnets go nowhere.
Running no switchport on a port that still carries other configuration. The layer 2 settings are discarded.

On other platforms

NX-OS needs the SVI feature enabled first, and SVIs are shut by default.

NX-OS

feature interface-vlan
vlan 10,20
interface Vlan10
  no shutdown
  ip address 10.10.0.1/24
interface Vlan20
  no shutdown
  ip address 10.20.0.1/24
interface Ethernet1/48
  no switchport
  ip address 10.0.0.1/31
  no shutdown
ip route 0.0.0.0/0 10.0.0.0

Arista EOS

ip routing
vlan 10,20
interface Vlan10
   ip address 10.10.0.1/24
interface Vlan20
   ip address 10.20.0.1/24
interface Ethernet48
   no switchport
   ip address 10.0.0.1/31
ip route 0.0.0.0/0 10.0.0.0

Say it in the interview

"Routing on, VLANs created, one SVI per VLAN as the gateway, a trunk down to the access layer, and a routed /31 uplink to the edge with a default route. Inter-VLAN traffic stays inside DSW1 at line rate. The uplink is a routed port rather than another VLAN, so it goes down the moment the link fails and has no spanning tree on it."

Book 3.3 Internet (IP)