A customer has a network: The gateway is represented by an SVI for VLAN 10 on a core switch. Downstream there is an ACE Load balancer, which has a BVI. This BVI's IP address is and bridges two VLAN's 20 and 30.

New applications are all build in the same /24. The VIP IP allocate for these new apps also is assigned from the same /24. As an example:

!-- Example application
!-- Frontend VIP IP

!-- Backend Servers

In ARP in the Core, the SVI is (obviously) part of VLAN 10, however, the same IP is shown belonging to VLAN 20 down in the ACE per ARP. VIP IP's show up in VLAN 20, backend servers show up in VLAN 30. All the same /24.

!-- SVI in the core
Interface Vlan10
  ip address
  hsrp version 2
  hsrp 10
  no shut

!-- Sh ip arp output (simulated)    -    0000.0cxx.xxxx    vlan10    -    xxxx.xxxx.xxxx    vlan10

!-- Int/BVI config in the ACE
 interface vlan 20
  bridge-group 20
  no normalization
  mac-sticky enable
  no icmp-guard
  service-policy input VIP-policy
  no shut

Interface vlan 30
  bridge-group 20
  no normalization
  mac-sticky enable
  no icmp-guard
  service-policy input backend-server-policy
  no shut

Interface bvi 20
  ip address
  peer ip address
  no shut

!-- Sh arp output (simulated)    0000.0cxx.xxxx    vlan20    xxxx.xxxx.xxxx    bvi20    xxxx.xxxx.xxxx    vlan20    xxxx.xxxx.xxxx    vlan30    xxxx.xxxx.xxxx    vlan30

How does this work (It does by the way)? Specifically from a tagging perspective, how is it possible for the traffic to move from the endpoint through the LB and the core successfully? Again, the only bridging is internal to the LB, not between the LB and anything else.

  • 5
    Unless you are configuring VLAN trunks, VLAN tags are meaningless. If two VLANs are bridged, then for all intents and purposes, they are the same VLAN. – Ron Trunk Jun 22 '16 at 15:48
  • How are they meaningless? A host on SW1, on a port tagged for VLAN30, isn't going to be able to see it's gateway (and SVI for VLAN 10 on SW2) - even if there is no trunk link connecting the two switches... ARP's are going to stay in VLAN30, and no routing will be possible if the gateway can't be found (no ARP). What am I missing Ron? No indignation here just general curiosity. Thank you in advance for your reply ! – A L Jun 22 '16 at 16:57
  • 3
    The port is not tagged unless it's a trunk port. If you bridge vlans, you make them the same vlan. ARP and other bcast will be forwarded on both vlans. By definition that makes them the same vlan. – Ron Trunk Jun 22 '16 at 17:02
  • That part I get / understand. My problem is that there is no bridging between the ACE and the upstream switch.. The bridging aspect of the above config is completely local to the ACE - for example BVI20 / VLAN20, is still VLAN20 to the core switch where the SVI sits, which represents VLAN10. The ACE is a linecard in a 6500, there is definitely a trunk between the ACE/6500 and the core switch containing all 3 VLAN's. Thanks in advance for your help and continued feedback Ron! – A L Jun 22 '16 at 18:11
  • 1
    What is the link between SW1 and the ACE configured as? I'd say it is an access port. The reason being that if it is an access port, as Ron mentioned above there won't be any tagging of the packets. Therefore on SW1 everything will appear as though it's in VLAN10 because it is the ACE combining (bridging) the VLANs together. In other words, SW1 will see the traffic on VLAN10 even though the ACE may be sending it on VLAN20 and SW1 has a VLAN20 as well. (I hope that makes sense but I fear it doesn't.) – OzNetNerd Jun 23 '16 at 7:03

I think the answer is that switches don't care about VLANs in other switches. The boundaries created by a VLAN only apply on that switch.

In this case it sounds like an access port on VLAN 10 in the core switch is plugged into an access port in either VLAN 20 or 30 in the switch with the ACE. Since they're access ports there's no tagging and while I would consider that a misconfiguration and "wrong" it will work just fine as a way to bridge VLAN 10 and the other VLAN. Since VLANs 20 and 30 are bridged explicitly by the ACE that makes all three VLANs into one broadcast domain.

You might think of the VLANs as ethernet hubs. Each VLAN is a hub, a broadcast domain. The bridge statement in the ACE connects the 20 and 30 "hub" and turns them into one domain so they can see each other. There is obviously something connecting 10 into the one of the others as well but there isn't enough info to know what. Probably it's an access port with each end in a different VLAN or it's a trunk port with "mismatched" default VLAN.

Bonus info because hubs aren't common anymore: In the olden days people used hubs for ethernet connections (when they weren't hiding from dinosaurs). Computers were plugged into hubs and each hub was a broadcast domain (and a collision domain but we're not going there). VLANs didn't exist so each hub was it's own domain and computers plugged into hub 20 couldn't see other computers that were plugged into hub 30 unless the two hubs were connected by running a cable between them (a crossover cable because MDIX didn't exist yet).

  • I was going to wait for OzNerd to post the answer as well but honestly you posted the same solution in the form of an actual answer so I'll accept this. I get what you're saying but in this case I believe it was a trunk link upstream and that all of the VLAN's were tagged. Regardless - if anyone were to have this similar problem, your solution is going to be the likely correct answer. Thanks Dave / Oz !! – A L Jan 13 '18 at 14:58

Based on your question, my best guess is that you have some configurations similar to Private Vlan. So here primary vlan will be Vlan10 and both Vlan20 & Vlan30 will be the secondary vlans for Vlan10.



IP connectivity between devices on all three VLANs works because they are bridged together by a networking device, the ACE load balancer. Neither the BVI or SVI have anything to do with it. The SVI is presumably the default gateway out of the Ethernet segment(s).

  • Not the case - only VLAN20/30 are bridged, VLAN 10 is not and is completely localized within the upstream switch. See my last posted comment on the main question for context. Regardless thanks for taking a stab at this. – A L Jan 13 '18 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.