0

I believe what I am about to ask is on-topic. I have Cisco DPC3828S (wireless router/modem) from ISP, which I cannot turn into bridge. So, it does routing.

I have layer 3 switch, Cisco SG350-10. Rather than letting the DPC3828S to do routing for all the connected devices, I am planning to let the layer 3 switch to handle every routing instead, as, I believe, DPC3828S cannot handle many devices and would be slow if many devices are connected...(about 20-30 devices will be connected in the network). I am right or wrong?

Opt 1: DPC3828S and switch (SG350) will have different subnets. SG350 will run DHCP. So, the SG350 will be acting like the main router.

Opt 2: Let DPC3828S to be the main router and just use SG350 as normal switch.

I believe opt 1 should be better because DPC3828S works lesser. Since I am a newbie to layer 3 switch, can someone please give me hint of what is the best practice for this setup? Should I make a vlan for the network (I only need 1 network tho)? Or is there better way to make L3 switch to do routing? I would prefer performance or speed than security. Thank you.

Since all answers are stating about problem, may be I better put a diagram to make it clear of what I am trying to do: enter image description here

EDIT: I have tried to configure the L3 switch. To be able to connect the modem/router network with the L3 new network for other devices, I would need to make 2 VLANs in L3 switch, right? 1 that match the modem/router network and 1 with DHCP.

Improve this question
9
  • In your drawing, the WAN router has no idea that the 192.168.0.0/24 network even exists behind the layer-3 switch, so when it gets packets destined to that network, it will send them out the Internet instead of to the layer-3 switch. Routers learn routes in three ways: directly connected networks, statically configured routes, or through a routing protocol. Router that do not know how to reach a destination network drop the packets destined for that network, or, if they have a default route (like to the Internet), the will send the packets to the default route.
    – Ron Maupin ♦
    Apr 7, 2020 at 22:07
  • Ahh, now I understand, thank you. But I have been doing this with simple home router. Can't we do what the simple home router does and duplicate it in L3 switch?
    – user67185
    Apr 7, 2020 at 22:16
  • No, as I explained, the layer-3 switch does not NAT, and you really do not want to use a double NAT anyway. That would prevent you from properly running a server to the Internet. Business networks need to use business network equipment.
    – Ron Maupin ♦
    Apr 7, 2020 at 22:18
  • I see. Okay then. I guess, the answer is that it can't be done. Thank you.
    – user67185
    Apr 7, 2020 at 22:20
  • That is incorrect. It can be done, with the proper equipment. A business network needs business network equipment.
    – Ron Maupin ♦
    Apr 7, 2020 at 22:21

3 Answers 3

Reset to default
1

Whatever you do, with the equipment you have the router will need to provide routing and nat between your local network and the outside world.

If you only plan to have one subnet locally then there isn't really any point in doing routing on the L3 switch.

If you do want to do routing on the L3 switch then you need to arrange for packets from the "router" to find their way back to the L3 switch. In general there are a few approaches to this.

  1. Run a routing protocol between the router and the L3 switch.
  2. Configure a static route on the L3 switch.
  3. Use proxy arp.

Looking at the manual for the DPC3828S it does not seem to support either routing protocols or static routes (which means even by "home router" standards it's a pretty crippled device).

So that leaves option 3. Proxy arp. To make this work you would.

  1. Configure the DPC3828S with a subnet mask that covers your entire network, not just the subnet linking the SG350 to the DPC3828S. e.g. 255.255.0.0
  2. Configure the interface on the SG350 that faces the DPC3828S as normal.
  3. Enable proxy arp on the SG350, ideally you would only enable proxy arp on the interface facing the DPC3828S, but unfortunately that doesn't seem to be an option, at least according to https://www.cisco.com/c/dam/en/us/td/docs/switches/lan/csbms/350xg/admin_guide/AG_Tesla_350_550.pdf it seems you can only enable it globally.
Improve this answer
4
  • Ahh, positive answer. Thank you. So, Proxy ARP is the snwer, I would need to learn alot. Thank you for the hint.
    – user67185
    Apr 8, 2020 at 7:32
  • Ok searching about Proxy ARP, it says that the method is not reliable and may burden the switch. This taken from practicalnetworking.net/series/arp/proxy-arp "That being said, it does impose additional work load on the Router. We used the specific example of Host D’s single IP address, but due to Host B’s misconfigured subnet mask there are roughly 65,000 IP addresses that Host B now considers on its local network. When in reality only about 250 could possibly exist on its local network."
    – user67185
    Apr 9, 2020 at 0:42
  • It's a tool that certainly has some downsides, I wouldn't want to rely on it for a large important network, but then I wouldn't want to rely on a "broadband" connection for a large important network either. For a lab or small buisiness setup I don't think it will be a problem.
    – Peter Green
    Apr 9, 2020 at 7:53
  • Okay, thank you for consideration, I will try to work on it for learning. If I cannot make it to work, I guess, I will just try to change my old modem, hopefully, the ISP allows it..
    – user67185
    Apr 10, 2020 at 3:24
0

You have a couple of problems.

If you have your consumer-grade router from the ISP (off-topic here) be a router, and you have different networks behind the layer-3 switch, then you must somehow tell the consumer-grade router about the networks behind the layer-3 switch. You can either use static routing on the consumer-grade router, or you need to run a common routing protocol between the consumer-grade router and the layer-3 switch. This may not be possible with a consumer-grade device.

Trying to use the layer-3 switch as the only router will not work because the switch cannot NAT to send traffic over the public Internet. You need a router to NAT the private addressing to public addressing for the public Internet.

Your business should buy a business-grade router to do the routing and not depend on a consumer-grade router to run your business.

Improve this answer
5
  • Ron Maupin, "then you must somehow tell the consumer-grade router about the networks behind the layer-3 switch." ---sorry for my lack of knowledge. But, I think, the switch can be set to have static IP, like you said. Yes, I cannot make the switch to be the only router, I just want the consumer-grade router to work less. It is the best practice for now, right?
    – user67185
    Apr 7, 2020 at 14:29
  • 1
    Ron is referring to the problem that when you've got 10.0.1.0/24 attached to the router and the L3 switch and 10.0.2.0/24 to the L3 switch only, the router needs to know how to route to 10.0.2.0/24 internally instead of following its default route towards the Internet.
    – Zac67 ♦
    Apr 7, 2020 at 15:26
  • Excuse my ignorance, I may not understand what you mean, as so far I have only worked with easy or simple home devices. So, what I mean is: the modem ip is 192.168.10.1. I was thinking to make the L3 switch 192.168.10.2. Then, the L3 runs it's own DHCP and all other devices connected to the L3. No other device connected to the "real" router, only L3 switch. At least that's what I am doing at the moment but with home router instead of L3 switch. I think, it can be done as the NAT is done by the modem/router, am I wrong?
    – user67185
    Apr 7, 2020 at 21:22
  • @user67185, the problem is that your WAN router only knows how to send stuff to the 192.168.10.0/24 network, or the Internet. If the layer-3 switch has other networks behind it, the WAN router will not know to send traffic for those other networks to the layer-3 switch, and will simply try to send that traffic out to the Internet. You business needs a business router. Home routers really are not designed to work in a business.
    – Ron Maupin ♦
    Apr 7, 2020 at 22:00
  • I am curious tho, I can do it with a home router. I am hoping L3 switch can do it too. EDIT: So, it seems as Ron Maupin explained, what I want to do cannot be done.
    – user67185
    Apr 7, 2020 at 22:19
0

The optimised way is to configure default route in L3 switch Pointing gateway towards router interfàce.

L3(switch)#ip route 0.0.0.0 0.0.0.0 gateway192.168.10.1

As nating is configured on router configure a specific static route in router pointing towards L3 switch interfàce with destination as supernet used for LAN subnet

Router(config)# destination 192.168.0.0 mask 255.25&.0.0 Gateway 192.168.10.2

To forward packets to internet configure default route in router pointing ISP as gateway.

Router(config) # ip route 0.0.0.0 0.0.0.0 gateway ISP

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.