1

My question is: if a switch can only have one global default-gateway, does that mean that he can be managed remotely (out side of the LAN) by only one interface VLAN IP address, and if so, why isn't there a default-gateway in every VLAN interface.

I know it isn't a very technical question, but if someone could explain it, it would help me clear things up in my head.

  • 2
    A layer 2 switch doesn't use the global gateway to route traffic. It's used when you telnet to the switch for example. Think of it just like your computers gateway. It doesn't route. – Fixitrod Sep 18 '16 at 19:19
  • Technically the L2 switch should only have one vlan interface. Access switches with multiple vlan interfaces/IP addresses assigned are usually built by people confusing the L2 vlan and the vlan interface. – cpt_fink Mar 18 '17 at 20:54
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 2:19
2

A switch only needs a single management address. That address is like a host connected to a VLAN (most hosts only have one address), and that host needs an address and a default gateway. Why would you think this host needs multiple addresses?

We live in a layer-3 world, and you should be able to get to the switch management address from any network which you allow in your router(s) (all by default). Yes, you must go through a router to get to the switch management address if you are starting from a different network, but that doesn't really matter.

You can also place ACLs between networks in your router(s) to restrict access between VLANs. This lets you create a management VLAN for your network infrastructure devices, like switches, WAPs, etc., and you can restrict access to this VLAN to certain people. Security should be layered: first restrict any access to the management of the devices, then use AAA to manage the devices.

1

A layer 2 switch doesn't use the global gateway for routing any traffic. It's only used when you use the switch to ping something or telnet into it, things like that. Since it's layer two it doesn't really care about ip addresses in the routing since. The ip address of the switch, subnet and global gateway are just like your computers address.

With traffic fromm other devices it uses the arp request and Mac address table. A computers requests it's own gateway if it tries to talk out side of its own subnet. The layer 2 switch doesn't do any of that.

As far as multiple vlans talking to the switches ip addresses, it works just like your computer. You can use diffrent subnets to get to diffrent subnets if there is a router. If you do not have a router I found that only vlan 1 works switch to switches with a 2950. Switches that let you change the management vlan can choose which vlan is that "primary" usable network.

This question did intrigue me and I thought it might help others to do some tests and show the results so I came to the above conclusion by testing it. I took my virtual setup and tested this because I had more than one way it could work in mind. My findings were a little diffrent than I expected when no router is used.

Test 1 I used two older Cisco 2950s. I set up vlan 1 and vlan two. I set vlan 1 192.168.10.1 and 10.2 on second switch. I set vlan 2 192.168.20.1 and 20.2. I plugged a pc into a vlan 1 and 2 port on each switch so the vlans would go up up on both switches. I tried this experiment with a single trunk cable between them and also tried with two cables on access ports. One cable carried vlan 1 and one cable carried vlan 2. Results were the same either way.

Result 1.. from the switch I could ping both of "my" addresses. I could ping the remote vlan 1 address but not vlan 2 address.

Test 2 With the same setup I thought if I set a global gateway address of 192.168.20.50 it would force vlan 2 to be the usable subnet. Remember, I do not actually have a router in this test.

Result 2. The switch still pinged vlan 1 local and remote. It did not ping the remote vlan 2. So, by putting a global gateway as vlan 2 it did not change how the switch reacted.

Test 3 I introduced a router and 3 subnets. I had 192.160.10.50, 20.50 and 30.50. On the switch I connected to I had 192.168.10.1, 20.1, 20.2. Global gateway was not set.

Result 3 From the switch I could ping all 3 router address.

Test 4 I disabled vlan interface 3 on the switch.

Result 4 I could no longer ping 192.168.30.50 on the switch since it didn't have a directly connected interface.

Test 5 I disabled vlan 1 to see if vlan 2 could still ping with no vlan 1.

Result 5 Ping on vlan two to 192.168.20.50 worked fine.

Test 6 I enabled vlan 1 and added a default gateway of 192.168.20.50 (vlan 2s gateway) I left interface vlan 3 disabled.

Result 6 The switches was able to ping 193.168.30.50 ( a subnet not currently up on the switch) with no issue. Even though the default gateway was on vlan 2s address I can still ping any viable address the router can get too.

That's enough for now. If you get a chance to get the network simulator packet tracer it's great for testing things. Some people share it on www.4shared.com packet tracer 6.1 you get it free when going to a Cisco class.

  • I think it's great that you went to great lengths to test all this but it doesn't really answer the question, which is: can you manage the switch using any of its addresses? So e.g. in your test 6 scenario can you telnet to 192.168.10.1 from vlan 3? Or is your 3rd paragraph saying you can only telnet to the vlan1 interface (or whichever is configured as mgmt lan)? The wording there is a bit confusing (IMHO) – hertitu Sep 18 '16 at 21:15
  • It shows you can. You can manage from any of the switches interfaces as long as you are on that subnet or have routing to that subnet. – Fixitrod Sep 18 '16 at 22:20
  • Sorry about the confusion. – Fixitrod Sep 18 '16 at 22:21
  • To clarify number 6 I had a switch with 192.168. 10. 1 and 192.168.20.1. The router had 192.168.10.2, 192.168.20.2 and 192.168.30.2. I was able to ping from the switch to the router at 192.168.30.2 even though the switch had no associated ip address. This just shows the router is doing the work. – Fixitrod Sep 18 '16 at 22:27
0

If a switch has 3 subnets and the global gateway points to a router that has routes to all 3 subnets from whatever network your management computer is on then you can manage the switch with any of the addresses on the switch.

The reason is when you point to the gateway with that one address the router will look at the data and route it properly, as long as it has an interface with the proper subnet.

I think i understand why your asking thing. If a computer had a gateway address from a diffrent subnet it wouldn't work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.