Modulo 4-Implementing Inter-VLAN Routing.Parte3

4.3.4 Describing CEF Configuration Commands

Use the commands in Figure to configure CEF and verify its operation. Figure describes the CEF configuration and verification commands.

4.3.5 Enabling CEF-Based MLS

Hardware Layer 3 switching is permanently enabled on Cisco Catalyst 6500 Series Supervisor Engine 720s with Policy Feature Card 2 (PFC2) or PFC3, Multilayer Switch Feature Card 3s (MSFC3s), and Distributed Forwarding Cards (DFCs). No configuration is required, and CEF cannot be disabled.

You can use the no ip cef command to disable CEF on the Cisco Catalyst 4000 or the no ip route-cache cef command on a Cisco Catalyst 3550 interface.

If CEF is enabled globally, it is automatically enabled on all interfaces as long as IP routing is enabled on the device. You can then enable or disable CEF on an interface basis. Cisco recommends that CEF be enabled on all Layer 3 interfaces. If CEF is disabled on an interface, you can enable CEF as follows:

• On the Cisco Catalyst 3550 switch, use the ip route-cache cef interface configuration command.

• On the Cisco Catalyst 4000 switch, use the ip cef interface configuration command.

Per-destination load balancing allows the router to use multiple paths to achieve load sharing. Packets for a given source-destination host pair are guaranteed to take the same path, even if multiple paths are available. This ensures that packets for a given host pair arrive in order. Per-destination load balancing is enabled by default when you enable CEF, and it is the load balancing method of choice for most situations.

Because per-destination load balancing depends on the statistical distribution of traffic, load sharing becomes more effective as the number of source-destination pairs increases.

The show ip cef command displays entries in the FIB.

4.3.6 Describing Common CEF Problems and Solutions

CEF is the fastest means of switching Layer 3 packets in hardware. The CEF tables stored in hardware are populated from information gathered by the route processor. There are two primary steps in troubleshooting CEF operations:

• Ensure that the normal Layer 3 operations on the route processor are functioning properly so that the switch tables are populated with accurate and complete information.

• Verify that information from the route processor has properly populated the FIB and adjacency table, and is being used by CEF to switch Layer 3 packets in hardware.

Troubleshooting CEF is, in essence, verifying that packets are indeed receiving the full benefit of CEF switching and not being punted to a slower packet switching or processing method. The Cisco term "punt" describes the action of sending a packet down to the next-fastest switching level. The following list defines the order of preferred Cisco IOS switching methods, from fastest to slowest:

• Distributed CEF

• CEF

• Fast switching

• Process switching

A punt occurs when the preferred switching method did not produce a valid path or, in CEF, a valid adjacency. If the CEF lookup process fails to find a valid entry in the FIB, CEF installs a punt adjacency to the less-preferred system. CEF punts all packets with that adjacency to the next-best switching mode to forward all the packets by some means, even if that means is less efficient.

Figure describes some basic CEF problems and associated solutions.

4.3.7 Describing CEF Troubleshooting Commands

The commands available to troubleshoot CEF are platform dependent. The commands in Figure can be used to troubleshoot CEF on the Cisco Catalyst 4500 series switch.

You can use the show interface command with the | begin L3 argument to verify that Layer 3 traffic is being switched, thereby utilizing CEF.

Use the show interfaces command with the | include switched command to show switching statistics at each layer for the interface and to verify that Layer 3 packets are being switched.

Figure illustrates the command used to display detailed information about the adjacency table.

Each time an adjacency entry is created, a Layer 2 data link–layer header for that adjacent node is pre-computed and stored in the adjacency table. This information is subsequently used for encapsulation during CEF switching of packets.

The show adjacency detail command displays the information to be used during this Layer 2 encapsulation. The header information displayed should be the same as would be expected during normal (non-CEF) Layer 2 forwarding operations. Adjacency statistics are updated approximately every 60 seconds.

The show cef drops command displays whether packets are being dropped because of incomplete or nonexistent adjacencies. The two known reasons for incomplete or nonexistent adjacencies are as follows:

• The router cannot use ARP successfully for the next-hop interface.

• After a clear ip arp or a clear adjacency command, the router marks the adjacency as incomplete, and then it fails to clear the entry.

The debug facility can be used to display detailed information on CEF operations. Use the debug ip cef command to view CEF drops because of an incomplete adjacency. You can include arguments to limit the output, which reduces overhead and allows you to focus on a specific CEF operation.

The following arguments limit the debug output:

• drops: Records dropped packets.

• access-list: Limits the collection of debugging information from specified lists.

• receive: Records packets that are not switched using information from the FIB but that are received and sent to the next switching layer.

• events: Records general CEF events.

• prefix-ipc: Records updates related to IP prefix information, including the following:

• Debugging of IP routing updates in a line card

• Reloading of a line card with a new table

• Notification that adding a route update from the route processor to the line card exceeds the maximum number of routes

• Control messages related to FIB prefixes

• table: Produces a table showing events related to the FIB. Possible types of events include the following:

• Routing updates that populate the FIB

• Flushing of the FIB

• Adding or removing entries to the FIB

• Table reloading process

4.3.8 Troubleshooting Layer 3 CEF-Based MLS

The CEF tables stored in hardware are populated from information gathered by the route processor. To properly troubleshoot CEF operations, first ensure that the normal Layer 3 operations on the route processor are functioning properly so that the CEF tables are populated with accurate and complete information. Next, verify that information from the route processor has properly populated the FIB and adjacency table used by CEF to perform Layer 3 switching of packets.

The steps below verify whether packet transfer between the following hosts is occurring using CEF:

• Host 1 in VLAN10 with an IP address of 192.168.10.10

• Host 2 in VLAN150 with an IP address of 192.168.150.3

Step 1 Verify CEF.

Verify that CEF is operational at global or interface level using these commands:

show ip cef summary
show ip cef vlan 10

Note:

CEF cannot be turned off on most Cisco Catalyst platforms. If CEF is not operational, it is likely that the Cisco Catalyst has disabled the feature. This may be because of a software, feature, or hardware incompatibility or inadequate memory to support a large FIB and adjacency table.

Step 2 Verify the configuration.

If CEF is not operational, display the running configuration to determine whether any switching functions have been configured that might disable CEF operations.

If CEF is operational, display the running configuration to verify the IP configuration of the Layer 3 interfaces used for the hosts to communicate. The IP addresses should be appropriate for the subnet, and the interfaces should not be shut down. The following is a sample of the configuration output expected for the VLANs associated with the host communication. On this router, VLAN 199 is the transit path that is traversed to arrive at subnet 192.168.150.0:

Switch#show running-config
interface VLAN 10
description Source VLAN
ip address 192.168.10.1 255.255.255.0
!
interface VLAN 199
description Transit VLAN
ip address 192.168.199.1 255.255.255.0

Step 3 Verify the population of the routing table on the route processor.

The routing protocols and route processor must populate the routing table accurately before those routing table entries can be of use, because they are transferred to the FIB to facilitate Layer 3 switching. Verify the routing table by referring to a network diagram, knowing which routes should appear in the routing table, and then execute the show ip route command. In the case of troubleshooting connectivity to the specific network of the destination host (192.168.150.3/24), use the following command:

Switch#show ip route | include 192.168.150.0
O 192.168.150.0/24 [110/2] via 192.168.199.3, 00:13:00, VLAN 199

Step 4 The network is accessible via the next-hop address 192.168.199.3. Therefore, the ARP entry by which to access 192.168.150.3 should be the MAC address resolved for 192.168.199.3.

Verify an ARP entry on the route processor.

Verify that there is an ARP entry for the next-hop IP address before checking whether that entry is represented in the adjacency table.

Switch#show ip arp 192.168.199.3
Protocol Address Age Hardware Addr Type Interface
Internet 192.168.199.3 176 0030.7150.6800 ARPA VLAN 199

Step 5 Verify the CEF FIB table entry for the route.

Step 3 verified that a route to network 192.168.150.0 existed in the routing table. Now verify that a CEF FIB entry exists to that same destination to ensure that packets are CEF-switched using the FIB rather than process-switched using the routing table.

Switch#show ip cef 192.168.150.0
192.168.150.0/24, version 298, cached adjacency 192.168.199.3
0 packets, 0 bytes
via 192.168.199.3, VLAN 199, 0 dependencies
next−hop 192.168.199.3, VLAN 199
valid cached adjacency

This output verifies that there is a valid CEF entry for the destination network. Packets can be CEF-switched to the destination host.

Step 6 Verify an adjacency table entry for the destination.

Verify that the FIB entry shown in step 5 has an associated adjacency table entry by using this command:

Switch#show adjacency detail | begin 192.168.199.3
IP VLAN 199 192.168.199.3(7)
0 packets, 0 bytes
003071506800
.....
...
.

The above output indicates that there is an adjacency for the next-hop IP address. The destination MAC address (003071506800) is the MAC address in the ARP table, as displayed in step 4.

The counters (0 packets, 0 bytes) are almost always 0, since packets are switched in hardware and, as such, they never reach the route processor, which is required to increment counters.

Step 7 Verify CEF from the supervisor engine.

The CEF FIB and adjacency table entries shown in the example can also be verified from the supervisor engine on modular switch platforms, such as the 6500 series switches. This step is not necessary on fixed configuration switches, such as the 3560.

To display an FIB entry for the specific network from the supervisor engine:

Console> (enable) show mls entry cef ip 192.168.150.0/24
Mod FI-Type Destination-IP Destination-Mask NextHop-IP Weight
--------------------------------------------------------------
15 resolved 192.168.150.0 255.255.255.255 192.168.199.3 1
To display an FIB entry for the specific network from the supervisor engine:
Console> (enable) show mls entry cef ip 192.168.150.0/24 adjacency
Mod:15
Destination-IP : 192.168.199.3 Destination-Mask : 255.255.255.255
FIB-Type : resolved

AdjType NextHop-IP NextHop-Mac VLAN Encp TX-Packets
--------------------------------------------------------------
connect 192.168.199.3 00-30-71-50-68-00 199 ARPA 0

४.4Inter-VLAN Routing Lab Exercises

4.4.1 Lab 4-1 Inter-VLAN Routing with an External Router

Lab Activity

Lab Exercise: Lab 4-1 Inter-VLAN Routing with an External Router

This lab configures inter-VLAN routing using an external router, also known as a router-on-a-stick.

4.4.2 Lab 4-2 Inter-VLAN Routing with an Internal Route Processor and Monitoring CEF Functions

Lab Activity

Lab Exercise: Lab 4-2 Inter-VLAN Routing with an Internal Route Processor and Monitoring CEF Functions

This lab routes between VLANs using a 3560 switch with an internal route processor using Cisco Express Forwarding (CEF)

Module Sumary

The configuration of multiple VLANs usually requires that Layer 3 routing occurs between those VLANs. This inter-VLAN routing can be provided external to a Layer 2 switch or within a multilayer switch through the configuration of Switch Virtual Interfaces (SVIs) and IP routing. When routing occurs within a Cisco Catalyst multilayer switch, Cisco Express Forwarding (CEF) is deployed to facilitate Layer 3 switching through hardware-based tables, providing an optimal packet-forwarding process.

Modulo 4-Implementing Inter-VLAN Routing.Parte2

4.2 Enabling Routing Between VLANs

4.2.1 Describing Layer 3 SVI

An SVI is a virtual Layer 3 interface that can be configured for any VLAN that exists on a Layer 3 switch. It is virtual in that there is no physical interface for the VLAN, and yet it can accept configuration parameters applied to Layer 3 router interfaces. The SVI for the VLAN provides Layer 3 processing for packets from all switch ports associated with that VLAN. Only one SVI can be associated with a VLAN. You configure an SVI for a VLAN for the following reasons:

• To provide a default gateway for a VLAN so that traffic can be routed between VLANs

• To provide fallback bridging if it is required for non-routable protocols

• To provide Layer 3 IP connectivity to the switch

• To support routing protocol and bridging configurations

By default, an SVI is created for the default VLAN (VLAN1) to permit remote switch administration. Additional SVIs must be explicitly created.

SVIs are created the first time a VLAN interface configuration mode is entered for a particular VLAN SVI. The VLAN corresponds to the VLAN tag associated with data frames on an Ethernet trunk or to the VLAN ID (VID) configured for an access port. An IP address is assigned in interface configuration mode to each VLAN SVI that is to route traffic off of and on to the local VLAN.

4.2.2 Describing Configuration Commands for Inter-VLAN Communication on a Multilayer Switch

The commands in Figure are used to configure inter-VLAN routing on a multilayer switch using SVIs. These commands are described in Figure .

4.2.3 Configuring Inter-VLAN Routing on a Multilayer Switch

To configure inter-VLAN routing on a Cisco Catalyst SVI, perform the steps in Figure . Figure describes each of these steps.

4.2.4 Describing Routed Ports on a Multilayer Switch

A routed switch port is a physical switch port on a multilayer switch that is capable of Layer 3 packet processing. A routed port is not associated with a particular VLAN, as contrasted with an access port or SVI.

The switch port functionality is removed from the interface. A routed port behaves like a regular router interface, except that it does not support VLAN subinterfaces. Routed switch ports can be configured using most commands applied to a physical router interface, including the assignment of an IP address and the configuration of Layer 3 routing protocols.

A routed switch port is a standalone port that is not associated with a VLAN, whereas an SVI is a virtual interface that is associated with a VLAN. SVIs generally provide Layer 3 services for devices connected to the ports of the switch where the SVI is configured. Routed switch ports can provide a Layer 3 path into the switch for a number of devices on a specific subnet, all of which are accessible from a single physical switch port.

The number of routed ports and SVIs that can be configured on a switch is not limited by software. However, the interrelationship between these interfaces and other features configured on the switch may overload the CPU because of hardware limitations.

4.2.5 Configuration of Routed Ports on a Multilayer Switch

Routed switch ports are typically configured by removing the Layer 2 switch port capability of the switch port. On most switches, the ports are Layer 2 ports by default. On some switches, the ports are Layer 3 ports by default. The layer at which the port functions determines the commands that can be configured on the port.

A routed port has the following characteristics and functions:

• Physical switch port with Layer 3 capability

• Not associated with any VLAN

• Serves as the default gateway for devices out that switch port

• Layer 2 port functionality must be removed before it can be configured

4.2.6 Configuring Routed Ports on a Multilayer Switch

To configure a routed port, perform the steps in Figure . Figure describes each of these steps.

4.3 Deploying CEF-Based Multilayer Switching

4.3.1 Explaining Layer 3 Switch Processing

Layer 3 switching refers to a class of high performance routers optimized for the campus LAN or intranet, providing both wire-speed Ethernet routing and switching services.

A Layer 3 switch router performs the following three major functions:

• Packet switching

• Route processing

• Intelligent network services

Compared to other routers, Layer 3 switch routers process more packets faster by using ASIC hardware instead of microprocessor-based engines. Layer 3 switch routers also improve network performance with two software functions: route processing and intelligent network services.

Layer 3 switching software employs a distributed architecture in which the control path and data path are relatively independent. The control path code, such as routing protocols, runs on the route processor, whereas most of the data packets are forwarded by the Ethernet interface module and the switching fabric.

Each interface module includes a microcoded processor that handles all packet forwarding. The control layer functions between the routing protocol and the firmware datapath microcode with the following primary duties:

• Manages the internal data and control circuits for the packet-forwarding and control functions

• Extracts the other routing and packet forwarding-related control information from the Layer 2 and Layer 3 bridging and routing protocols and the configuration data, and then conveys the information to the interface module to control the datapath

• Collects the datapath information, such as traffic statistics, from the interface module to the route processor

• Handles certain data packets sent from the Ethernet interface modules to the route processor

Layer 3 switching can occur at two different locations on the switch:

• Centralized: Switching decisions are made on the route processor by a central forwarding table, typically controlled by an ASIC.

• Distributed: Switching decisions are made on a port or line-card level. Cached tables are distributed and synchronized to various hardware components so that processing can be distributed throughout the switch chassis.

Layer 3 switching uses one of these two methods, depending on the platform:

• Route caching: Also known as flow-based or demand-based switching, a Layer 3 route cache is built in hardware, since the switch sees traffic flow into the switch.

• Topology-based: Information from the routing table is used to populate the route cache regardless of traffic flow. The populated route cache is called the forwarding information base (FIB). CEF builds the FIB.

4.3.2 Explaining CEF-based Multilayer Switches

Cisco Layer 3 devices can use a variety of methods to switch packets from one port to another. The most basic method of switching packets between interfaces is called process switching. Process switching moves packets between interfaces on a scheduled basis, based on information in the routing table and the Address Resolution Protocol (ARP) cache. As packets arrive, they are put in a queue to wait for further processing. When the scheduler runs, the outbound interface is determined, and the packet is switched. Waiting for the scheduler introduces latency.

To speed the switching process, strategies exist to switch packets on demand as they arrive and to cache the information necessary to make packet-forwarding decisions.

CEF uses these strategies to expediently switch data packets to their destination. It caches information generated by the Layer 3 routing engine. CEF caches routing information in one table (the FIB), and caches Layer 2 next-hop addresses for all FIB entries in an adjacency table. Because CEF maintains multiple tables for forwarding information, parallel paths can exist and enable CEF to load balance per packet.

CEF operates in one of two modes.

• Central CEF: The FIB and adjacency tables reside on the route processor, and the route processor performs the express forwarding. Use this mode when line cards are not available for CEF switching, or when features are not compatible with distributed CEF.

• Distributed CEF (dCEF): Supported only on Cisco Catalyst 6500 switches. Line cards maintain identical copies of the FIB and adjacency tables. The line cards can perform the express forwarding by themselves, relieving the main processor of being involved in the switching operation. Distributed CEF uses an interprocess communications (IPC) mechanism to ensure that the FIBs and adjacency tables are synchronized on the route processor and line cards.

There is a wide range of CEF-based Cisco multilayer switches:

• Catalyst 2970

• Catalyst 3550

• Catalyst 3560

• Catalyst 3750

• Catalyst 4500

• Catalyst 4948

• Catalyst 6500

The Cisco Catalyst 6500 is a modular switch in which the Multilayer Switch Feature Card (MSFC) is responsible for control-plane operations, and the supervisor Policy Feature Card (PFC) is responsible for the data-plane operations.

4.3.3 Identifying the Multilayer Switch Packet Forwarding Process

CEF separates the control plane hardware from the data plane hardware and switching. ASICs separate the control plane and data plane, thereby achieving higher data throughput. The control plane is responsible for building the FIB and adjacency tables in software. The data plane is responsible for forwarding IP unicast traffic using hardware.

When traffic cannot be processed in hardware, the traffic must receive processing in software by the Layer 3 engine, thereby not receiving the benefit of expedited hardware-based forwarding. A number of different packet types may force the Layer 3 engine to process them. Some examples of IP exception packets are the following :

• IP packets that use IP header options. (Packets that use TCP header options are switched in hardware because they do not affect the forwarding decision.)

• Packets that have an expiring IP Time to Live (TTL) counter.

• Packets that are forwarded to a tunnel interface.

• Packets that arrive with non-supported encapsulation types.

• Packets that are routed to an interface with non-supported encapsulation types.

• Packets that exceed the maximum transmission unit (MTU) of an output interface and must be fragmented.

CEF-based tables are initially populated and used as follows :

• The FIB is derived from the IP routing table and is arranged for maximum lookup throughput.

• The adjacency table is derived from the ARP table, and it contains Layer 2 rewrite (MAC) information for the next hop.

• CEF IP destination prefixes are stored in the TCAM table, from the most specific to the least specific entry.

• When the CEF TCAM table is full, a wildcard entry redirects frames to the Layer 3 engine.

• When the adjacency table is full, a CEF TCAM table entry points to the Layer 3 engine to redirect the adjacency.

• The FIB lookup is based on the Layer 3 destination address prefix (longest match).

The FIB table is updated when the following occurs:

• An ARP entry for the destination next hop changes, ages out, or is removed.

• The routing table entry for a prefix changes.

• The routing table entry for the next hop changes.

These are the basic steps for initially populating the adjacency table:

Step 1	The Layer 3 engine queries the switch for a physical MAC address.
Step 2	The switch selects a MAC address from the chassis MAC range and assigns it to the Layer 3 engine. This MAC address is assigned by the Layer 3 engine as a burned-in address for all VLANs and is used by the switch to initiate Layer 3 packet lookups.
Step 3	The switch installs wildcard CEF entries, which point to drop adjacencies (for handling CEF table lookup misses).
Step 4	The Layer 3 engine informs the switch of its interfaces participating in MLS (MAC address and associated VLAN). The switch creates the (MAC, VLAN) Layer 2 CAM entry for the Layer 3 engine.
Step 5	The Layer 3 engine informs the switch about features for interfaces participating in MLS.
Step 6	The Layer 3 engine informs the switch about all CEF entries related to its interfaces and connected networks. The switch populates the CEF entries and points them to Layer 3 engine redirect adjacencies.

Only the first few packets for a connected destination reach the Layer 3 engine so that the Layer 3 engine can use ARP to locate the host. A throttling adjacency is installed so that subsequent packets to that host are dropped in hardware until an ARP response is received. The throttling adjacency is removed when an ARP reply is received (and a complete rewrite adjacency is installed for the host). The switch removes the throttling adjacency if no ARP reply is seen within 2 seconds to allow more packets through to reinitiate ARP. This relieves the Layer 3 engine from excessive ARP processing or from ARP-based denial of service attacks.

Figure provides an example of ARP throttling, which consists of these steps:

Step 1	Host A sends a packet to host B.
Step 2	The switch forwards the packet to the Layer 3 engine based on the “glean” entry in the FIB. A glean adjacency entry indicates that a particular next hop should be directly connected, but there is no MAC header rewrite information available.
Step 3	The Layer 3 engine sends an ARP request for host B and installs the drop adjacency for host B. At this point, subsequent frames destined for host B from host A are dropped (ARP throttling).
Step 4	Host B responds to the ARP request. The Layer 3 engine installs an adjacency for host B and removes the drop adjacency.

The adjacency table is populated as adjacencies are discovered. Each time an adjacency entry is created (such as through the ARP protocol) a link-layer header for that adjacent node is pre-computed and stored in the adjacency table. After a route is determined, it points to a next hop and corresponding adjacency entry. The route is subsequently used for encapsulation during CEF switching of packets.

A route might have several paths to a destination prefix, as when a router is configured for simultaneous load balancing and redundancy. For each resolved path, a pointer is added for the adjacency corresponding to the next-hop interface for that path. This mechanism is used for load balancing across several paths.

In addition to adjacencies associated with next-hop interfaces (host-route adjacencies), other types of adjacencies are used to expedite switching when certain exception conditions exist. When the prefix is defined, prefixes requiring exception processing are cached with one of the following special adjacencies:

• Null adjacency: Packets destined for a null0 interface are dropped. This can be used as an effective form of access filtering.

• Glean adjacency: When a router is connected directly to several hosts, the FIB table on the router maintains a prefix for the subnet rather than for the individual host prefixes. The subnet prefix points to a glean adjacency. When packets need to be forwarded to a specific host, the adjacency database is gleaned for the specific prefix.

• Punt adjacency: Features that require special handling, or features that are not yet supported in conjunction with CEF switching paths, are forwarded to the next switching layer for handling. For example, the packet may require CPU processing. Features that are not supported are forwarded to the next-higher switching level.

• Discard adjacency: Packets are discarded.

• Drop adjacency: Packets are dropped, but the prefix is checked.

When a link-layer header is appended to packets, FIB requires the appended header to point to an adjacency corresponding to the next hop. If an adjacency was created by FIB and not discovered through a mechanism such as ARP, the Layer 2 addressing information is not known, and the adjacency is considered incomplete. The packet is forwarded to the route processor where an ARP request would be used to find the Layer 2 information and complete the adjacency.

These are the steps that would occur when you use CEF to forward frames between host A and host B on different VLANs:

Step 1	Host A sends a packet to host B. The switch recognizes the frame as a Layer 3 packet because the destination MAC (MAC-M) matches the Layer 3 engine MAC.
Step 2	The switch performs a CEF lookup based on the destination IP address (IP-B). The packet hits the CEF entry for the connected (VLAN20) network and is redirected to the Layer 3 engine using a glean adjacency.
Step 3	The Layer 3 engine installs an ARP throttling adjacency in the switch for the host B IP address.
Step 4	The Layer 3 engine sends ARP requests for host B on VLAN20.
Step 5	Host B sends an ARP response to the Layer 3 engine.
Step 6	The Layer 3 engine installs the resolved adjacency in the switch (removing the ARP throttling adjacency).
Step 7	The switch forwards the packet to host B.
Step 8	The switch receives a subsequent packet for host B (IP-B).
Step 9	The switch performs a Layer 3 lookup and finds a CEF entry for host B. The entry points to the adjacency with rewrite information for host B.
Step 10	The switch rewrites packets per the adjacency information and forwards the packet to host B on VLAN20.

Modulo 4-Implementing Inter-VLAN Routing

Module 4: Implementing Inter-VLAN Routing

Module Overview

A switch with multiple VLANs requires a means of passing Layer 3 traffic between those VLANs. This module describes the process and methods of routing traffic from VLAN to VLAN. A router that is external to the Layer 2 switch hosting the VLANs can provide the inter-VLAN routing. When routing occurs within a Catalyst multilayer switch, Cisco Express Forwarding (CEF) is deployed to facilitate Layer 3 switching through hardware-based tables, providing an optimal packet forwarding process. On a multilayer switch, routing is enabled between VLANs through the configuration of switch virtual interfaces (SVIs) associated with the various VLANs on the multilayer switch.

4.1 Describing Routing Between VLANs

4.1.1 Inter-VLAN Routing Using an External Router

If a switch supports multiple VLANs but has no Layer 3 capability to route packets between those VLANs, the switch must be connected to a router external to the switch. This setup is accomplished most efficiently by providing a single trunk link between the switch and the router that can carry the traffic of multiple VLANs and which, in turn, can be routed by the router. This single physical link must be Fast Ethernet or greater to support Inter-Switch Link (ISL) encapsulation, but 802.1Q is supported on 10-Mbps Ethernet router interfaces.

In Figure , the clients on VLAN10 need to establish sessions with a server that is in VLAN20, which requires that traffic be routed between the VLANs. Figure describes the actions necessary for traffic to be routed between VLANs using an external router.

With inter-VLAN routing, the router receives frames from the switch with the source VLAN tagged (for example VLAN10). It associates the frames with the proper subinterface and then decodes the frame payload (the IP packet). The router then performs Layer 3 processing based on the destination network address contained in the IP packet to determine which subinterface should forward the IP packet. The IP packet is now encapsulated in a dot-1Q (or ISL) frame that is tagged with the VLAN identification (for example VLAN20) of the forwarding subinterface and transmitted across the trunk toward the switch.

In Figure , the router can receive packets on one VLAN and forward them to another. To perform inter VLAN routing functions, the router must know how to reach all VLANs that are being interconnected. The router must have a separate logical connection (subinterface) for each VLAN and ISL or 802.1Q trunking must be enabled on the single physical interface between the router and the switch. The routing table lists all the subnets associated with the VLANs that are configured on the router subinterfaces as directly connected. The router must learn routes to networks that are not configured on directly connected interfaces through dynamic routing protocols or static routes.

There are advantages and disadvantages of inter-VLAN routing on an external router.

The advantages are as follows:

The advantages are as follows:

• Implementation is simple.

• Layer 3 services are not required on the switch.

• The router provides communications between VLANs.

The disadvantages are as follows:

• The router is a single point of failure.

• The single traffic path between the switch and the router may become congested.

• • Latency is higher than on a Layer 3 switch.

4.1.2 Describing Inter-VLAN Routing Using External Router Configuration Commands

You can configure inter-VLAN routing using an external router over either ISL or 802.1Q trunks. The commands for configuring the trunk interface on the router are shown in Figure . Figure provides a description of the commands.

4.1.3 Configuring Inter-VLAN Routing Using an External Router

A router interface providing inter-VLAN routing on a trunk link must be configured with a subinterface for each VLAN that will be serviced across the link. Each subinterface on the physical link must then be configured with the same trunk encapsulation protocol. That protocol, either 802.1Q or ISL, is typically determined by what was configured on the switch side of the link.

Use the encapsulation dot1q subinterface configuration command to enable 802.1Q encapsulation on a router subinterface. The subinterface number does not have to match the dot-1Q VLAN number, but it is good practice to do so.

Since traffic on the native VLAN is not tagged, all native VLAN frames are received as normal Ethernet frames, so it is not necessary to define a specific encapsulation tag for those networks. Some versions of Cisco IOS allow for the creation of a subinterface for the native VLAN. If the native VLAN is configured as a subinterface, you should use the encapsulation dot1q native command. All other non-native VLANs have an 802.1Q tag inserted into their frames. These non-native VLANs should always be configured as subinterfaces on the router, and the VLANs must be defined as 802.1Q tagged frames and have the VLAN associated to them identified. The subinterface command encapsulation dot1q accomplishes this task.

The VLAN subnets are directly connected to the router. Routing between these subnets does not require a dynamic routing protocol, because the subnets are directly connected. Routes to the subnets associated with each VLAN appear in the routing table as directly connected interfaces.

Use the encapsulation isl vlan_id subinterface configuration command to enable ISL trunking on a router subinterface.

The native keyword is not used with the encapsulation ISL subinterface command, because ISL does not have the concept of a native VLAN.

Figure describes the actions needed to perform ISL encapsulation on external routers.

After the router is properly configured and connected to the network, the router or the switch can communicate with other nodes on the network.

To test connectivity to remote hosts, use the ping command from privileged mode :

Switch#ping destination-ip-address

Step 1 From the router, ping a host address on each VLAN to verify router connectivity.

Step 2 From a host on a particular VLAN, ping a host on another VLAN to verify routing across the external router.

The ping command returns one of these responses:

• Success rate is 100 percent or ip-address is alive: This response occurs in 1 to 10 ms, depending on network traffic and the number of Internet Control Message Protocol (ICMP) packets sent.

• Destination does not respond: No answer message is returned if the host does not respond.

• Unknown host: This response occurs if the targeted host cannot be resolved.

• Destination unreachable: This response occurs if the default gateway cannot reach the specified network or is being blocked.

• Network or host unreachable: This response occurs if the Time to Live (TTL) times out. The default is 2 seconds.

Use show commands to display the current (running) configuration, IP routing information, and IP protocol information to verify whether the routing table represents the subnets of all VLANs.

Router#show vlans
Virtual LAN ID: 10 (Inter Switch Link Encapsulation)
vLAN Trunk Interface: FastEthernet0/0.10
Protocols Configured: Address: Received: Transmitted:
IP 10.10.1.1 0 20

Virtual LAN ID: 20 (Inter Switch Link Encapsulation)
vLAN Trunk Interface: FastEthernet0/0.20
Protocols Configured: Address: Received: Transmitted:
IP 10.20.1.1 0 20


Router#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is not set
10.0.0.0/24 is subnetted, 2 subnets
C 10.10.1.0 is directly connected, FastEthernet0/0.10
C 10.20.1.0 is directly connected, FastEthernet0/0.20

4.1.4 Explaining Multilayer Switching

Traditionally, a switch makes forwarding decisions by looking at the Layer 2 header, whereas a router makes forwarding decisions by looking at the Layer 3 header.

A multilayer switch combines the functionality of a switch and a router into one device, therefore enabling the device to switch traffic when the source and destination are in the same VLAN and to route traffic when the source and destination are in different VLANs (that is, different subnets).

In Figure , traffic between PC A and PC B are switched at Layer 2, whereas traffic between PC B and PC C are switched at Layer 3.

Multilayer switches forward frames and packets at wire speed by using application-specific integrated circuit (ASIC) hardware. Specific Layer 2 and Layer 3 components, such as routing tables or access control lists (ACLs), are cached into hardware. These tables are stored in content-addressable memory (CAM) and ternary content-addressable memory (TCAM).

Layer 2 forwarding in hardware is based on the destination MAC address. The Layer 2 switch learns and records the source MAC addresses from all frames that it receives. The MAC address table lists MAC addresses paired with the associated VLANs and interfaces. When a frame is received on an interface, the switch determines which VLAN the frame originated from, searches all interfaces that belong to that VLAN for the destination MAC, and forwards the frame out the appropriate interface.

Figure describes how a Layer 2 switch forwards packets.

Layer 3 forwarding is based on the destination IP address. Layer 3 forwarding occurs when a packet is routed from a source in one subnet to a destination in another subnet. When a multilayer switch (MLS) sees its own MAC address in the Layer 2 header, it recognizes that the packet is either destined for itself or is to be routed. If the packet is not destined for the MLS, the destination IP address is compared against the Layer 3 forwarding table for the longest match. In addition, router ACL checks are performed. In this case, the frame header needs to be rewritten with new source and destination MAC addresses.

Figures and describe how a Layer 3 switch forwards packets.

4.1.5 Frame Rewrite

Figure shows how the frame and packet header would be altered if CEF is used to forward frames. When frames are received on an interface, the trailer checksum is first calculated to verify accurate delivery of the frame. The frame is discarded if the calculation is not accurate. Next the payload is extracted. The IP header checksum is tested to verify that it is an accurate IP header. Once the packet is processed, IP unicast packets are rewritten on the output interface as follows:

• The source MAC address changes from the sender MAC address to the router MAC address.

• The destination MAC address changes from the router MAC to the next-hop MAC address.

• The TTL is decremented by one and, as a result, the IP header checksum is recalculated.

• The frame checksum is recalculated.

Routing, switching, ACL, and QoS tables are stored in a high-speed table memory so that forwarding decisions and restrictions can be made in high-speed hardware. Cisco Catalyst switches create and use two primary table architectures:

• CAM table: Primary table used to make Layer 2 forwarding decisions. The table is built by recording the source address and inbound port of all frames. When a frame arrives at the switch with a destination MAC address of an entry in the CAM table, the frame is forwarded out only through the port associated with that specific MAC address.

• TCAM table: Stores ACL, QoS, and other information generally associated with upper-layer processing.

Table lookups are done with efficient search algorithms. A “key” is created to compare the frame to the table content. For example, the destination MAC address and VLAN ID (VID) of a frame constitute the key for a Layer 2 table lookup. This key is fed into a hashing algorithm, which produces a pointer into the table. The system uses the pointer to access a smaller specific area of the table without requiring searching the entire table.

In a Layer 2 table, all bits of all information are significant for frame forwarding (for example, VLANs, destination MAC addresses, and destination protocol types). However, in more complicated tables associated with upper-layer forwarding criteria, some bits of information may be too inconsequential to analyze. For example, an ACL may require a match on the first 24 bits of an IP address, but the last 8 bits may be insignificant information.

In specific high-end switch platforms, the TCAM is a portion of memory designed for rapid, hardware-based table lookups of Layer 3 and Layer 4 information. In the TCAM, a single lookup provides all Layer 2 and Layer 3 forwarding information for frames, including CAM and ACL information.

Figure displays the ACL information stored in the TCAM table that would result in a packet being permitted or denied.

TCAM matching is based on three values: 0, 1, or X (where X is either number), hence the term “ternary.” The memory structure is broken into a series of patterns and masks. Masks are shared among a specific number of patterns and are used as wildcards in some content fields.

The following two ACL entries are referenced in Figure , which shows how their values are stored in the TCAM:

access-list 101 permit ip host 10.1.1.1 any
access-list 101 deny ip 10.1.1.0 0.0.0.255 any

The TCAM table entries in Figure consist of the following types of regions:

• Longest match region: Each longest match region consists of groups of Layer 3 address entries (“buckets”) organized in decreasing order by mask length. All entries within a bucket share the same mask value and key size. The buckets can change their size dynamically by borrowing address entries from neighboring buckets. Although the size of the whole protocol region is fixed, you can reconfigure it. The reconfigured size of the protocol region takes effect only after the next system reboot.

• First-match region: The first-match region consists of ACL entries. Lookup stops after the first match of the entry.