1

I need help with something.

I have this topology and i want to know how to go about configuring it:

I have 4 vlans and 10 hosts and 6 switches
I have created 4 vlans
 vlan 2- Admin
 Vlan 3 - Academic
 Vlan 4 - Research
 Vlan 5 - Server
  1. I want all the traffic originating from academic and research should not reach admin vlan
  2. All the vlans can reach server vlans
  3. generate traffic from hosts

I have created trunk in all the switches and allowed all the vlans to pass through, but what I don't understand is how to go about the rest.

enter image description here

  • 1
    You need a router to route traffic between VLANs. VLANs are layer 2 constructs, and are logically isolated from each other. You need a router and layer 3 addressing to route from one VLAN to another. – Ron Trunk Apr 16 '18 at 12:14
  • firstly i have created the vlans Admin,Academic,Research and server on all the 6 switches and also have configured trunking on the ports connecting to these switches. I have configured vlan interfaces with ips aswel, m i going the right way ? – Tutu Apr 16 '18 at 12:21
  • 1
    You need a router. You can't do what you want with just switches. – Ron Trunk Apr 16 '18 at 12:28
  • OKay, So i connect the router to any switch and configure router on a stick ? – Tutu Apr 16 '18 at 12:35
  • 1
    That is only the first part. A router will allow you to forward traffic between VLANs. But to restrict some VLANs from others, you will need to create access lists on the router interfaces. – Ron Trunk Apr 16 '18 at 13:10
2

VLANs separate traffic into distinct layer-2 segments - nodes in separate VLANs can't 'see' each other on the Ethernet network. If your network is limited to layer 2 switches only, no communication between different VLANs is possible, only within each VLAN.

To enable nodes from different VLANs to communicate with each other you need an IP subnet for each VLAN and a router. It is usually on this router that you control the inter-VLAN traffic. The router can be a layer-3 switch or a 'real' router.

On the router, you can connect the VLANs with a dedicated port each or you can define one or more trunk ports were frames are tagged, depending on their VLAN ID. The trunk ports can then carry frames from different VLANs.

In extreme, you could configure all VLANs on all switches (with the edge ports assigned as required), use all inter-switch links as trunk ports and add a router with a trunk port anywhere in the network, let's say on switch 3.

However, from the traffic flow perspective this would mean that inter-VLAN packets from PC 6 to PC 7 would need to traverse across the entire network to switch 3 and the router connected to it, and back across the entire network again. This would not be considered a good design.

The router should be located central to the switches, so that paths are kept short and unneccessary L2 hops are avoided. Ideally, each switch is connected directly to the router or with just one hop in between (roughly spine-leaf).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.