1

I have a layer 3 switch with two vlans 10 and 20. This is the only configuration i made on the switch:

Switch(config)#vlan 10
Switch(config-vlan)#name IT
Switch(config-vlan)#vlan 20
Switch(config-vlan)#name TEST
Switch(config-vlan)#exit
Switch(config)#int f0/1
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#int f0/2
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 20
Switch(config-if)#exit
Switch(config)#int vlan 10
Switch(config-if)#ip add 10.10.10.1 255.255.255.0
Switch(config-if)#int vlan 20
Switch(config-if)#ip add 10.20.20.1 255.255.255.0
Switch(config-if)#end

PC from vlan 10 on f0/1 and PC from vlan 20 on f0/2:

PC vlan 10:
IP: 10.10.10.99
Default Gateway: 10.10.10.1
Subnet: 255.255.255.0

PC vlan 20:
IP: 10.20.20.99
Default Gateway: 10.20.20.1
Subnet: 255.255.255.0

No ip routing enabled:

Switch#show ip route
Default gateway is not set

Host               Gateway           Last Use    Total Uses  Interface
ICMP redirect cache is empty

Here is my problem. From PC vlan 10 i can ping the int vlan 20 on the switch, which has a totally different subnet. Also, from PC vlan 20, i can ping the default gateway of vlan 10. How is this possible without routing? I feel like everything I knew about networking is crumbling.

I did this in packet tracer. Switch is WS-C3560-24PS.

Full config:

Current configuration : 1395 bytes
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
no service password-encryption
!
hostname Switch
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface FastEthernet0/1
 switchport access vlan 10
 switchport mode access
!
interface FastEthernet0/2
 switchport access vlan 20
 switchport mode access
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan10
 mac-address 00d0.bc5a.8101
 ip address 10.10.10.1 255.255.255.0
!
interface Vlan20
 mac-address 00d0.bc5a.8102
 ip address 10.20.20.1 255.255.255.0
!
ip classless
!
ip flow-export version 9
!
!
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
end
  • What is the switch model and full configuration? – Ron Maupin Aug 31 '17 at 14:42
  • Add the command "no ip routing". – Ron Trunk Aug 31 '17 at 14:50
  • What happens if you try no ip directed-broadcast on your interface VLAN? – user36472 Aug 31 '17 at 16:55
  • Make sure the port the pc is plugged into is an access port. Assuming it probably already is. Default they are dynamic desirable and focus that out fine but it is a simulator. This could be an issue with packet tracer. Normally no ip-route prevents this. – Fixitrod Aug 31 '17 at 21:30
  • Is it two PCs or one PC? The description of the PCs is a little unclear – Ross Aug 31 '17 at 23:15
1

On Cisco layer 3 switches, routing is enabled by default. Add the command

no ip routing

to turn it off.

  • 1
    I did the no ip routing command. I am still able to ping from vlan 10 to the default gateway of vlan 20. I cant ping hosts from vlan 20, only the int vlan 20. – danneehbrawn Aug 31 '17 at 15:36
  • Probably a fault of packet tracer. You're right in assuming that's not how things normally work. – Ron Trunk Aug 31 '17 at 16:34
1

This is just some thoughts addressing the question - A packet cannot hop from one sub-net to another without routing - but the frame can go from VLAN10 to VLAN20 by a bridge eg a cable between two access ports would do that. But then the PC would be wrong to send an IP broadcast to 10.20.20.255 out a port configured as 10.20.10.10/24 as it should send it to a gateway based on its routing table

So if a PC is only connected to 10.20.10.10/24 and you have no routers - the PC should not even bothering putting the data on the wire. So it appears you have no routers but you have set up a gateway or the PC is doing something with a packet for which its would appear there are no routes.

So I would look at what the PC is configured as to see where the packet goes, then look at what that port is - and try and follow what the frame would do

Still your understanding is correct - if no router then no way to swap from one subnet to another. However a VLAN is not a subnet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.