VLAN routing

Why we need routing between VLANs

We're going to talk about the different options we have to route between our different VLANs. What we have set up right now: in our last module we set up all of our VLANs, but the last thing that we left off with is that now we can't communicate between the VLANs. For some circumstances we may want that — for instance, our management VLAN, we don't necessarily want everyone to be able to communicate to that VLAN network. Or maybe we do want them to communicate to that VLAN network, but we want to control the traffic. Well, the first step in doing that is first of all allowing the traffic to get from one VLAN to the next.

The options that we are going to talk about here are, first of all, the legacy kind of how we set things up. A lot of networks were set up with just a simple network, and maybe you would use this as kind of a stop gap as you move into other options in the future as your network grows. One of those other options would be router on a stick, so we'll talk about router on a stick, and then we'll end up with layer 3 routing, which is going to be what most of us are probably going to want to use. There's a lot of advantages to that layer 3 routing if you have a decent sized network.

How things develop over time

Just a note about how things develop over time. When you're dealing with a small simple network, maybe you don't have any VLANs; maybe the business that you're working with just doesn't really need the complexity of having multiple VLANs. That's what this is right here. We have a demo laptop — and ignore that VLAN 10 on there, let's just say this is all one network, it's all the native VLAN, it's all VLAN one. What you have is this local area network. You've got simple switches in there, and then it connects into a router from a layer 2 perspective, and the router itself does all of the routing. This gets a connection out to the outside world, to the internet, to the cloud.

That is a typical router. The job of the router is that it is the division line between the local area network, which typically is communicating on that layer 2 level, and the rest of the world. It's the gateway, and a lot of times we call it the default gateway, because it is the gateway that is going to go out to the rest of the world if there is no local area network resource and it's trying to get out to the rest of the world. That is a typical small network.

But when we start using VLANs, we have a different need. Things change a little bit, and that's because we've got our different VLANs, and between those VLANs somehow we need to route traffic. VLAN 10 is sectioned off and it's on a different network than VLAN 20, which is a different network from VLAN 30. That's how it's supposed to work, that's the point of segmenting — this is for security purposes or management purposes or scalability. So we section out these networks differently, and somehow we need to get our traffic going from one VLAN to the next VLAN to get these different devices communicating.

And as I mentioned, we perhaps want to control that traffic. We only want to give certain rights to the people to communicate. For instance, our management VLAN might be locked down, but we still have to set up routing to at least have some functionality, and then we can set up different access control lists to really tailor that traffic in the future. But we'll probably want some sort of functionality, some sort of routing, to happen.

The legacy option

One option that I have is this legacy way of setting things up. This is a valid way of setting it up, and if I didn't know a lot about how to configure this, then this might be the way that I would jump to and say, hey, I could just set it up this way.

Let me explain a little more in depth. Our router right here has multiple interfaces on it, and we can connect into these different interfaces, and each one of those is a different network. And then to the outside world is another interface that connects to the outside world, the internet, the cloud. So each of these interfaces represents a network. If I didn't know any better, or if I just wanted to set this up simplistically, or I wanted some great bandwidth between these different VLANs, then what I can do is I can assign an access port on this side, and it connects into the router, and that is a separate network. So VLAN 10 would be assigned right here and then it would be connected to one of these ports, and then I would have VLAN 20 connected to a different access port, and then VLAN 30 connected to a different VLAN access port.

What I'm setting up here is that there is a connection for each one of those VLANs for it to communicate. I could do the same thing between the switches as well — I mentioned that in one of my prior videos — but for routing purposes I need a router, so I could do this and set it up for the router. It's really simplistic. You have all the tools right now to do this, because you know how to set up an access port to be part of a specific VLAN, and one of my prior videos also talked about setting up a port on a router with an IP address. Once you set that up, a router is designed to route between these different networks. So once you set this up, now you have connectivity between all of your different VLANs, and it will work just like that.

With the legacy routing, you have to have an interface for each one of those VLANs. If you have to take up switch real estate doing that, if you have to take up ports on your switch to do that, that could be a little bit costly. If you have to do it on the router, that could definitely add up, and it could make you have to buy the next model up from a router perspective, or buy cards to slip in there to give it extra functionality. So it can actually really ramp up your cost.

Router on a stick

Another way that we can do that is the router on a stick. The idea behind this is that rather than having multiple lines connected into your router, you would just have a single line. This is the stick right here, and this is the router, so that's the router on a stick.

The way we set this up is just like we set up a trunk line — it is a trunk line. We've set up already in one of our prior videos the 802.1Q on these lines to turn this into a trunk line, so that the VLANs can communicate across these devices. Well, we can do the same thing right here: we can set this up as a trunk line so it has that 802.1Q tag on there. Then as these packets, these frames, go into the router, it knows what VLAN it's a part of. The router essentially has the same thing, but the router has these virtual interfaces, so rather than an actual physical interface, it's just got one port. On the inside — we'll just mark it here — there are these virtual interfaces that you set up with IP.

Now, one of the problems with a router on a stick is it can be very limiting in the amount of traffic. Let's say we have our server network right here and there's a lot on VLAN 20, there's a lot of servers, and a lot of your traffic is going to these servers. You're maybe downloading and uploading quite a bit of content on this local area network. If you have it all going across the same line, that line can get saturated, and that can be problematic. If this is a 100 Meg connection and you want a gig connection between all your devices, your servers and stuff, this is just not going to cut it, it's not going to facilitate that.

Layer 3 switching

What we can do is we can set it up where the layer 3 acts as the router. Essentially we're installing the router right here, on the edge of the network still. It's like a virtual router that's inside of the switch right here. And then, just like we have on this router right here, just like I showed you in my last diagram where we had virtual interfaces, essentially that's what we do with this router right here: we create these virtual interfaces, or what we call an SVI, a switch virtual interface, on this switch right here. Those then route traffic between those different devices.

So this VLAN 10 right here — if this laptop wants to communicate to the server network, then it lands on its switch virtual interface, it gets routed to the VLAN 20 switch virtual interface, and then gets put on the line as a VLAN 20 packet, and then it makes it to whatever device it's trying to communicate with on VLAN 20. So there you have it, that's a layer 3 switch. Essentially there's a virtual router that's inside of it, and inside that virtual router you have switch virtual interfaces, or SVIs — virtual interfaces that do the routing between those interfaces to communicate between your different VLANs. That's the third option right there.

Quite typically you'll see these layer 3 switches, especially if you have a decent sized network, because it has the most advantages. The disadvantage to this would just be the expense, because these layer 3 switches can get a little spendy. But as we see equipment being driven down cost wise, it's much easier to get these layer 3 switches than it has been in the past, and you're even seeing some more simplistic switches that are coming with some of these capabilities on them. So that is the layer 3 switch and how a layer 3 switch works.

So we talked about the legacy option, we talked about a router on a stick, and we talked about layer 3 switching. Now what we get to do is see what those actually look like when we're applying them to our equipment.