This blog covers CCNA the below Topics: 2.2 Configure and verify interswitch connectivity 2.2.a Trunk ports 2.2.b 802.1Q 2.2.c Native VLAN
However we will also dive into 2.1.c InterVLAN connectivity in much more detail.
2.2.A - Trunks
Instead of having multiple links between two switches we can have 1 link between the switches. This one link will carry over all the VLANs we have defined over this link. See in the below diagram I have removed the two links and now there is only 1 link between the two switches:
On this link we cannot configure "switchport access vlan [x]" right because then it would become an access port and we would get the same issue. Instead, we configure this as a trunk port. As you can guess, a trunk port is a link that carry's multiple VLANs over a single link.
The way we can do this is via "switchport trunk vlan [x]" here we define how many VLANs we want to carry over this single trunk link. How does this actually work? It works through something called a dot1q tag.
2.2.B - Dot1Q tag
Remember that whenever anything is sent on the wire, it is a Layer 2 Ethernet Frame. What happens in the case of normal access VLANs they do not get tagged with a VLAN. its just like its transparent, the switch knows hey this link is in VLAN 10 or this 2nd link is VLAN 20 and forwards it. But how can it do this if we have a single link carrying multiple VLANs?
This is where a DOT1Q tag (also known as 802.1Q) is added to this Layer 2 Ethernet Frame. So when this frame hits the Layer 2 switch, the switch will tag this L2 Frame and say hey, this L2 frame belongs in VLAN 10, or VLAN 20 etc. So before putting the frame back onto the wire it will tag the L2 frame with the VLAN ID/Number into this DOT1Q header/tag.
The host has NO IDEA about VLANs the switch is what does this. When the host generates the L2 frame it is "vlanless" you can say, its when it hits the L2 switch that's when this tagging is happening.
This is amazing because it doesn't matter if that L2 frame is an ARP or any other type of broadcast, once SW1 gets this L2 frame, it tags it and sends it to SW2. SW2 knows from the tag value not to flood it out of all its ports/VLANs. Same applies to unicast frames. The frame is only to be forwarded out to the specific VLAN that the 802.1Q tag has specified.
We can see this below when Alice is pinging Tony:
This it the L2 Ethernet Frame remember. I have removed the Preamble/SFD/FCS but they would absolutely be on the wire, but the main parts are above.
Notice the VLAN tag is 4 bytes long. Within this 4 bytes 12 bits (2 bytes) is reserved for the VLAN ID. 212 =4096 possible values for the VLAN ID.
I wont show the whole path but you should understand that this L2 frame is once it hits SW1 it tagged the L2 frame and will flood it out of all ports except the once it got it on. Meaning it will also travel across the Gi0/23 link and reach SW2 which will also flood it, however it will STRIP the VLAN tag when it floods it into its own VLAN. Tony will receive the message and send back an ARP reply. SW2 will tag the ARP reply in VLAN 10.
Warning
To be clear, even with a trunk link between switches you CANNOT have VLAN 10 on SW1 communicate to VLAN 20 in SW2. They are part of separate L3 Networks and separate L2 Broadcast domains cannot communicate. We will discuss later how to facilitate this communicate between different VLANs.
Notice that VLAN tag is 4 bytes long so this is important in later concepts of MTU/MSS.
2.2.C - Native VLAN
To go back, we are sending just L2 frames over a Layer 2 Trunk Link. Of course, if its a trunk it is likely doing 802.1Q tagging. That would make sense.
However, lets say we have SW1 which is forwarding an UNTAGGED frame out of the L2 trunk link. Untagged means no dot1Q tag. And this reaches SW2. How would SW2 know where to forward this untagged L2 frame?
This is where the concept of Native VLAN Comes in. If the switch on the other end of a Trunk Link receives an Untagged L2 Frame and does not know where to forward it, instead of dropping it, it will send it to the Native VLAN. By default the Native VLAN is 1.
So this means if both sides we have configured the Native VLAN as 1, then the only untagged frames will be from VLAN 1. Meaning if a host (lets presume Alice has been repatched into VLAN1 switchport) and they want to communicate to another host on SW2 which is also in VLAN1. Between these two switches is a trunk, and since the L2 frame initiates from the Native VLAN it is untagged and will go over the trunk link and reach the other host in VLAN 1. Same ARP broadcasts and unicast forwarding still happens.
Note
VLAN 1 = Default VLAN VLAN 1 = Also the Native VLAN by default.
Now, we wont discuss it, but there are VLAN Hopping/Native VLAN attacks that can happen. We can define any VLAN to be our native VLAN, so its best to create an isolated, unused VLAN and set this as the native VLAN on both sides.
This is important! Because if we have a brand new switch and plug in a trunk link to SW1, if SW1 is VLAN999 native VLAN and the new switch 3 by default is native VLAN 1 we have a mismatch. Do you see why?
Because now an untagged frame that comes in on SW3 for VLAN1. it goes over the trunk link as untagged. SW1 receives this untagged frame and looks in its native VLAN and forwards it out of VLAN999. This means if we have legitimate hosts on VLAN1 on SW3, they will never be able to communicate to VLAN1 hosts on SW1 because of this VLAN Mismatch.
Warning
MAKE SURE ALWAYS THAT NATIVE VLANS MATCH ACROSS SWITCHES. If not this can cause issues and you will see log messages regarding native VLAN mismatch on the Cisco switches.
This can also cause outages. A small thing like Native VLAN mismatch. For example if you add in a new core switch (CSW1) and all other switches have native VLAN as 999, but you have legitimate traffic on VLAN1 which is native VLAN on the CSW1. This will go out as untagged when it is forwarded by CSW1 on the trunk link. if this reaches on CSW2 and CSW2 has a server that is on VLAN1 that is critical. Well CSW2 will instead look at the frame and forward it out of VLAN999. And if VLAN999 is just a logical VLAN and not connected to any port you've blackholed traffic.
Router on a Stick
Refer back to 2.1 Configure and verify VLANs (normal range) spanning multiple switches - Here we discuss if we have multiple links from a switch to a router, the router can just do pure Layer 3 routing to route traffic from one VLAN to another.
This is all well and good. But we get the same issue of needing a cable per VLAN. If we have 20 VLANs thats 20 cables that would need to be uplinked from the switch to the router. We need a mechanism to achieve just a single cable from switch to router to allow the inter-vlan communication.
This is possible through Router on a stick, also known as ROAS. This is where we use VLAN's/Layer 2 capabilities on the router itself. Remember that a Router is a L3 device. This means it can do L3, L2 and L1 functionality.
Comments