3

Yesterday I had a look at my router configuration, and I saw that my office's local LAN gateway's IP address is written on the router's VLAN1 interface.

  • What is a VLAN1 interface in a router?
  • Is it different from a switch's VLAN?
  • Why is it not configured on a gigabit interface?
  • Does it mean that all interfaces refer to VLAN1?
  • If yes, how can we assign each port to VLAN1?
  • How can we create VLANs?
2
  • What is the router model?
    – Ron Maupin
    Jan 29 '17 at 18:59
  • @Ron Maupin, dont exactly remember. But latest models of Cisco. Jan 29 '17 at 19:03
3

Since you have not included the router model, I will assume it is a Cisco router, something like an ISR with a built-in switch module.

Some Cisco routers can have a built-in or optional, add-on switch modules. The interfaces for this module are switch interfaces, not router interfaces. You need to create VLAN interfaces to link the layer-2 switch to the layer-3 router.

You configure the switch interfaces the same way that you do for a layer-2 switch. They are switch interfaces, not router interfaces, so you cannot configure layer-3 on those interfaces. That is where the SVIs come in. You assign a VLAN to each switch interface, and create an SVI for each VLAN. The SVIs get configured with the layer-3 information for the VLAN. The layer-3 addresses configured on the SVIs will be the gateways for the VLANs.

The router will also have some router interfaces that get configured for layer-3. Routers will, by default, route everything between its layer-3 interfaces, including SVIs configured for layer-3.


Let's assume you have eight switch interfaces (GigabitEthernet0 - 7), and two router interfaces (GigabitEthernet8 - 9), like a Cisco 892 router. There are two connections to other routers, and there are four VLANs (two switch interfaces on each VLAN). The first eight interfaces are switch interfaces, and they are configured like a layer-2 switch. The last two interfaces are router interfaces, and they are configured with layer-3. The four VLAN interfaces are configured as layer-3 interfaces. Routing between the VLANs and the router interfaces will happen, as long as they are configured for layer-3, and there are no other configurations to block, e.g. ACLs. The gateways for the VLANs will be the addresses configured on the VLAN interfaces.

You could have something like this:

interface GigbitEthernet0
 description VLAN 1
 switchport access vlan 1
 switchport mode access
 no shutdown
!
interface GigbitEthernet1
 description VLAN 1
 switchport access vlan 1
 switchport mode access
 no shutdown
!
interface GigbitEthernet2
 description VLAN 2
 switchport access vlan 2
 switchport mode access
 no shutdown
!
interface GigbitEthernet3
 description VLAN 2
 switchport access vlan 2
 switchport mode access
 no shutdown
!
interface GigbitEthernet4
 description VLAN 3
 switchport access vlan 3
 switchport mode access
 no shutdown
!
interface GigbitEthernet5
 description VLAN 3
 switchport access vlan 3
 switchport mode access
 no shutdown
!
interface GigbitEthernet6
 description VLAN 4
 switchport access vlan 4
 switchport mode access
 no shutdown
!
interface GigbitEthernet7
 description VLAN 4
 switchport access vlan 4
 switchport mode access
 no shutdown
!
interface GigbitEthernet8
 description Link to Router 2
 ip address 10.2.0.1 255.255.255.252
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown
!
interface GigbitEthernet9
 description Link to Router 3
 ip address 10.3.0.1 255.255.255.252
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown
!
interface Vlan1
 description VLAN1
 ip address 192.168.1.0 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown
!
interface Vlan2
 description VLAN2
 ip address 192.168.2.0 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown
!
interface Vlan3
 description VLAN3
 ip address 192.168.3.0 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown
!
interface Vlan4
 description VLAN4
 ip address 192.168.4.0 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 no shutdown
!
6
  • Very good explanation. But, in my router, just VLAN1 is written, and other ports of switch are not assigned to VLAN1. Is it possible? Jan 30 '17 at 4:31
  • 1
    Yes. VLAN 1 is the default VLAN. You can have only that VLAN, or you could have a different VLAN. I was simply giving you an example of multiple VLANs because you asked how to create VLANs. It is the same as on a switch.
    – Ron Maupin
    Jan 30 '17 at 4:33
  • just one more question. If there is an ACL, can we apply it to VLAN1 interface as in usual method? For example, int VLAN1, ip access-group 1 OUT. Jan 30 '17 at 18:14
  • Yes. That is how you place restrictions between VLANs. Most Cisco routers will use subinterfaces for VLANs, and the physical interface will be a trunk. If the ACLs are outbound, then they are going to be standard ACLs, which can route traffic unnecessarily, but using extended ACLs inbound eliminates that, and they can be more granular, even to the transport protocol level.
    – Ron Maupin
    Jan 30 '17 at 18:19
  • 1
    You can put the separate VLANs on subinterfaces, which are logical interfaces that use a physical interface. That makes the physical interface a trunk. A trunk is a link that carries multiple VLANs. That is how you do it on routed interfaces. The switch module interfaces use the switchport mode trunk command, just like switches do.
    – Ron Maupin
    Jan 31 '17 at 2:21
-1

It's gonna look like Interface GigabitEthernet0/0.1 in the running configuration, e.g. show run from the admin console. It's the dot, ...after the dot. The main interface will probably show encapsulation dot1q or something like that. We call them subinterfaces typically for the .x VLAN interfaces. The dot1q has nothing to do with the VLAN number, it's the specification for handing VLAN's. So you might have subinterface int G0/0.2 for VLAN2, for example.

2
  • in show run, all interfaces are shown withouty any dot. Jan 30 '17 at 4:33
  • in that case, you have not configured the interface as a trunk interface. Mar 11 '19 at 23:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.