Let's say we have 4 machines connected to a layer 2, managed switch which is connected to a layer 3 switch. Say that is routed to the layer 3 switch. Our goal is to have usable only by the first machine, usable only by the second machine and so on.

If I understand correctly, from the layer 3 switch, we have to create 4 VLAN's and assign to the first, to the second and so on. This will VLAN tag the Ethernet frames. We then have, on the layer 2 switch, to assign a VLAN for each port and mark it as tagged.


  1. Does the VLAN number configured on the L2 and L3 switches have to be the same?
  2. What will be the broadcast IP address for each machine?
  3. What will be the usable IP addresses for each machine?

We normally only use L3 switches, so in that case, for the first machine, for instance, the broadcast IP address would have been and would have been usable.

  • I'm seeing some web hosting providers offer a /30 assignment with their servers and 3 of the IP addresses are usable. I'm trying to understand how that is possible.
    – John Doe
    Commented Feb 6, 2017 at 17:13
  • Your description is inconsistent. What do you mean is routed to the L3 switch if your switch is layer 2?
    – Ron Trunk
    Commented Feb 6, 2017 at 17:16
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 12, 2017 at 5:14

2 Answers 2


Frames on trunk interfaces get 802.1Q tags in order to marks which frames belong to which VLANs. Frames on access interfaces do not get tagged. The access interfaces are assigned a VLAN number (default is VLAN 1), but the traffic on the access interfaces is not tagged. Most end-devices don't understand VLAN tags (some servers do, but that would be for sending traffic for multiple VLANs on a trunk to the server).

The link between your two switches would be a trunk. The gateway for each VLAN would be the address assigned to the SVI on the layer-3 switch. The broadcast address is always the last address in the network. The first address in the network is the network address. Those two addresses are unusable for host addresses.

  • Thanks. Any idea how some web hosting providers manage to provide servers with 3 usable addresses per /30?
    – John Doe
    Commented Feb 6, 2017 at 17:22
  • They don't. There are only two usable addresses in a /30 network. If you break the /30 into two /31 networks, you will have two usable addresses per /31, effectively using the two "wasted" addresses in the /30.
    – Ron Maupin
    Commented Feb 6, 2017 at 17:26
  • @JohnDoe If an answer on this Q&A has satisfied you, please mark it as the correct answer. As for your /30 and 3 IPs, your ISP is likely assigning a /29 to each customer, which is a chunk of 8 IP addresses. Of which two are unusable, three are used for a FHRP (Router A, Router B, VIP), and three are left available for the customer -- seemingly from the same /30 (when in fact they are pulled from a /29).
    – Eddie
    Commented Jul 7, 2017 at 0:43

The term managed switch is meaningless in the context of telecommunications engineering. As for VLAN tagging, you are speaking of tagging frames. Simply think of frames as signals (shouts, if you will) passing through the switch. The tag on the frame (the signal or shout) determines whether the switch will allow it to pass out of a particular port. Access ports are assigned to a VLAN, Trunk ports can allow more than one VLAN to pass.

That's a tiny bit oversimplified, but basically how it works.

In terms of IP addressing and subnets, typically, each VLAN carries traffic for one and only one subnet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.