New to Cisco stuff so bear with me (only a little L2 Procurve experience). I have a development network connected to an Aruba/HPE managed switch feeding a trunk with tagged VLAN's to an internal network Cisco C2960. I am not in charge of the C2960, but it looks like the VLAN's appear to be sending and receiving correctly, based on some testing from a hypervisor server hanging off the C2960. Now, this C2960 has an trunk uplink to a C3850 router which should have the necessary VLAN's configured. From the C3850 is another trunk to yet another C2960, with the correct trunk settings for the VLAN's I want to haul from the development network to the second switch.

I can't do basic pings on the dev VLAN's from the second switch. Some people involved with setting up the C3850 said I would have to add an IP in the subnet of the VLAN at the Cisco router to make it bridge the VLAN's from the first to the second switch, but I don't want routing and setting a next hop seems bizarre. Ideally, I want to do no routing (more like a managed switch transparently forwarding VLAN's). Since the Cisco router is currently a core router, I can't ask to make the whole thing behave like a dumb switch.

Is there a proper way to transparently bridge the VLAN's between ports on the router without routing or needing an IP at the router, while preserving existing routing, so I can send traffic from the second C2960 to the Aruba switch?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25, 2018 at 9:54

2 Answers 2


That should be possible - provided that...

  • the same set (or at least a common subset) of VLAN IDs is used across the chain of switches
  • this same (sub)set of VLANs is configured/added on all the switches along the path
  • this same (sub)set of VLANs is "allowed" and "tagged" on all segments (the inter-switch links) along the path.
  • some very diligent attention is directed towards spanning tree interoperability between HP/Aruba and Cisco (the latter by default run Cisco's own PVST or RPVST, the former usually use the IEEE variants STP, RSTP or MST).
  • the admins of the said Cat2960s and Cat3850 are willing to add "your" set of VLANs to their device (which they might deny, because they might want to run their Cat3850 as a L3 device only)

The Cat3850 and the Cat2960s are definitely capable of what you intend to do, which is what VLANs, trunking and switching are all about. There is no technical reason why the Cat3850 should get any (additional) IP address(es) to bridge these VLANs. But - there may be operational guidelines preventing it.

  • I agree. It sounds like the 2nd 2960 switch hanging off the 3850 is on a different vlan or they have restricted which vlans can pass through the trunk. It's very common to see vlans restricted on the core switch (i.e. 3850), so I would ask the network admin if the trunks have any restrictions.
    – aletoledo
    Oct 29, 2018 at 14:13
  • I can confirm the same set of VLAN ID's are supposed to be used in the whole chain (I was allowed to determine the ID's to be used, and those were set as such). As far as I am aware, the trunks connecting the three Cisco devices should have also had the VLAN's tagged and allowed. I am a bit afraid about spanning tree, as on the Aruba side I don't use it and had asked for the Aruba->C2960 trunk to not use it. I feel like there's some sort of additional prep work at the C3850 to make the jump to the second C2960 that I don't clearly understand.
    – Asteroza
    Oct 30, 2018 at 6:24

To get traffic from one network (VLAN) to another requires a router. Even if you bridge the VLANs at layer-2, the devices on the different networks will be unable to communicate. A host will look at the destination address, and it can tell that it is on a different network. If it is, then it will send the frame to its configured gateway (router). A router is a host on the LAN that knows how to forward packets to a different network.

The purpose of VLANs is to break up the network into separate layer-2 domains, and it requires a router (at layer-3) to forward packets between the separate networks.

  • Not doing any inter-VLAN routing here, just plain same VLAN/subnet from one end of the chain to other. I am hauling multiple VLAN's, but the subnets they contain don't interact with each other and never mix. Sorry if that wasn't clear enough in the description.
    – Asteroza
    Oct 30, 2018 at 6:31
  • Then you should provide a diagram and the network device configurations so that we can see what you mean and what is going on.
    – Ron Maupin
    Oct 30, 2018 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.