0

I always thought the Interface VLAN number had to match the VLAN number that the interface was to belong to. However, recently I saw that it isn't in one instance. Can anyone confirm a) if interface VLAN num should = VLAN num, or b) they are mapped to each other in another way? They've always worked properly when I gave them the same number.

Confusing Example: PC<--->[L2 Switch]<---->[L2/L3 Switch] ---> Cloud

PC is connected to VLAN10 access port on L2 switch. PC IP is 192.168.200.5/24. PC gateway is 192.168.200.1.

L2 switch is connected to L2/L3 switch over trunk containing VLAN 10.

L2/L3 switch has Interface VLAN 20 with the IP 192.168.200.1.

The PC can communicate with the gateway and the rest of the network.

So, Interface VLAN 20 can be a part of VLAN 10?!?!?! I thought the numbers had to match and the SVI<->VLAN = 1:1.

Improve this question
5
  • To be able to tell you what is possible or required on a device, we would need to know exactly what device you are talking about. Do you have configs for the L2 and L3 switch? Also, could vlan 10 be bridged into vlan 20 somewhere?
    – Gerben
    Jul 30, 2015 at 20:52
  • Cisco 2960 and 6509. No bridging.
    – user16942
    Jul 30, 2015 at 22:35
  • Simply - should an SVI be named the same as the VLAN to which is will be attached to, ex "VLAN 10" = "Interface VLAN 10", "VLAN 20" = "Interface VLAN 20", or does the naming not have to match? If the naming does not have to match, then what ties and SVI to a certain VLAN?
    – user16942
    Jul 30, 2015 at 22:36
  • As you've described your network, you should not be able to ping the gateway. So there must be something else going on. Can you post your configs?
    – Ron Trunk
    Jul 31, 2015 at 3:23
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin ♦
    Aug 7, 2017 at 16:08

2 Answers 2

Reset to default
3

Yes, the layer 2 VLAN ID must match the layer 3 SVI interface.

It may be proxy ARP at work. (On by default in most if not all 6500 code)

Take a look at the ARP table on the PC and the MAC address that corresponds to, presumably on the 6500. If that MAC is for the VLAN 10 interface and that interface doesn't have the 192.168.200.1 address then it's proxying it.

"no ip proxy-arp" under the VLAN 10 interface would disable this behavior.

Or, something else has the .1 IP and you're hitting that. The ARP table on the PC would be the first place to look.

Improve this answer
3

In Catalyst switches, VLAN ID must match the SVI number.

Anyway, my guess is that you're confusing SVI (used by the switches) with sub-interfaces (used in routers).

If this is the case, your configuration may look like:

interface GiX/Y.20
 encapsulation dot1Q 10
 ip address 192.168.200.1 255.255.255.0

With sub-interfaces, the sub-interface number doesn't need to match the VLAN ID (even if it's a best practice).

However, many other possible answers exist, for instance:

  • Native VLAN is set to 20 in the 2960 while native VLAN of the 6509 is set to 10.
  • 2960 has no knowledge of VLANs/802.1Q field at all as the port is configured in "access" (but from your question it seems not the case).

About the mentioned "Proxy ARP", I don't think it is the case, because the packets from one VLAN are not allowed to jump in another VLAN; "Proxy ARP" might work in the case of a matching VLAN ID with a mismatching IP addressing, but this is not the case (even if no 802.1Q support, "Proxy ARP" is not needed as the gateway IP and the host IP match).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.