InterVLAN Routing Plan

Question

My network currently has 7 VLANs (2 user, 1 voice, 1 server, 2 wireless, and 1 for our networked A/V equipment). All of our switches are layer 3 Cisco Catalysts. However, we currently have a router-on-a-stick configuration - our SonicWall firewall does all the interVLAN routing. We will be migrating to a Cisco ASA shortly. Prior to the migration, I would like to set up interVLAN routing on the switches.

My question is: is it better to set up the interVLAN routing on just our core switch (and set all of our endpoints' gateways to that switch), or should the interVLAN routing be set up on all the switches (and each endpoint's gateway will be the switch that it is connected to)?

The VLANs and trunk ports are already configured on all the switches.

Thanks in advance for your help.

Answer 1

It is better to set the inter vlan routing on the coore switch only. Otherwise it will be very complicated and you will set the gateway for each vlan based on the switch and if you have DHCP that will not be possible . I do not see any nenifit to set the intervlan routing on each access switch

Answer 2

It's better to do the routing as simply as possible: in this case on the core L3 switch. You describe your VLANs are "2 user, 1 voice, 1 server, 2 wireless, and 1 A/V" which doesn't sound as if there is any material inter-VLAN traffic except to the server VLAN and presumably wherever you have the internet connection.

Consider putting higher bandwidth servers directly on your core switch (on correct VLAN). Traffic to internet is presumably limited by external bandwidth not ethernet.

If any of the VLANs have security implications (guest wifi?) you definitely want it simple, with good logging.

I'd only recommend multiple inter-VLAN routing if you had a lot of traffic or required unusual resilience. With much traffic, do it close (on the switches), for resilience, of course multiple cables and spanning tree, perhaps also HSRP or similar.

Answer 3

If you do interVLAN routing prior to the network security appliance, your local area network, LAN, traffic will never get to the security device for inspection. Setup the new ASA to do the interVLAN routing. Do not do the interVLAN routing on the LAN switch(es).

Answer 4

The best option is to configure inter-Vlan routing on core switch only for optimised and scalable network .

Switch virtual interfàce (SVI) are configured in core switch and further connect all Access -switch from core switch enabling trunk ports between core and access-switch . Further connect firewall and core switch . Configure default route in core switch pointing towards firewall interface . And configure specific Routes in firewall pointing towards core switch interfàce ..