Lab – Configure Layer 3 Switch Inter-VLAN Routing

Topology

Addressing Table

Device Interface IP Address Subnet Mask Default Gateway

VLAN 10 192.168.10.1 255.255.255.0 N/A
MLS Catalyst 3560 VLAN 20 192.168.20.1 255.255.255.0 N/A
R1
R1 VLAN 30 192.168.30.1 255.255.255.0 N/A
VLAN 99 192.168.99.1 255.255.255.0 N/A
S1 Cisco 2960 VLAN 99 192.168.99.11 255.255.255.0 192.168.99.1
S2 Cisco 2960 VLAN 99 192.168.99.12 255.255.255.0 192.168.99.1
Student-1 NIC to S1:F0/6 192.168.10.101 255.255.255.0 192.168.10.1
Faculty-1 NIC to S1:F0/11 192.168.20.101 255.255.255.0 192.168.20.1
Staff-1 NIC to S1:F0/16 192.168.30.101 255.255.255.0 192.168.10.1
Admin-1 NIC to S1:F0/21 192.168.99.101 255.255.255.0 192.168.99.1
Student-2 NIC to S2:F0/6 192.168.10.102 255.255.255.0 192.168.10.1
Faculty-2 NIC to S2:F0/11 192.168.20.102 255.255.255.0 192.168.20.1
Staff-2 NIC to S2:F0/16 192.168.30.102 255.255.255.0 192.168.10.1

VLAN Table

VLAN Name Interface Assigned

99 Management S1: VLAN 99
S2: VLAN 99
S1: F0/21
10 Student S1: F0/6-10, S2: F0/6-10
20 Faculty S1: F0/11-15, S2: F0/11-15
30 Staff S1: F0/16-20, S2: F0/16-20
100 Native N/A
Objectives
Part 1: Build the Network and Configure Basic Device Settings
Part 2: Create VLANs and Assign Switch Ports
Part 3: Configure an 802.1Q Trunk between the Switches
Part 4: Configure Layer 3 Switch Inter-VLAN Routing
Part 5: Verify Inter-VLAN Routing is working

Background / Scenario
A multilayer switch like the Cisco Catalyst 3560 is capable of both Layer 2 switching and Layer 3 routing.
One of the advantages of using a multilayer switch is this dual functionality. A benefit for a small to
medium-sized company would be the ability to purchase a single multilayer switch instead of separate
switching and routing network devices. Capabilities of a multilayer switch include the ability to route from
one VLAN to another using multiple switched virtual interfaces (SVIs), as well as the ability to convert a
Layer 2 switchport to a Layer 3 interface.

Instructions
Part 1:Build the Network and Configure Basic Device Settings
In Part 1, you will set up the network topology and configure basic settings on the PC hosts and
switches.
Step 1:Cable the network as shown in the topology.
Attach the devices as shown in the topology diagram, and cable as necessary.
Step 2:Configure basic settings for each switch (S1 and S2).
Open configuration window

1. Console into the switch and enable privileged EXEC mode.

Open configuration window

switch> enable
2. Enter configuration mode.
switch# config terminal
3. Assign a device name to the switch.
switch(config)# hostname S1

switch(config)# hostname S2
4. Disable DNS lookup to prevent the router from attempting to translate incorrectly entered
commands as though they were host names.
S1(config)# no ip domain-lookup

S2(config)# no ip domain-lookup
5. Assign wmsu as the privileged EXEC encrypted password.
S1(config)# enable secret wmsu

S2(config)# enable secret wmsu

6. Assign coeconsole as the console password and enable login.
S1(config)# line console 0
S1(config-line)# password coeconsole
S1(config-line)# login

S2(config)# line console 0

S2(config-line)# password coeconsole
S2(config-line)# login
 7. Assign coevty as the vty password and enable login.
S1(config)# line vty 0 4
S1(config-line)# password coevty
S1(config-line)# login

S2(config)# line vty 0 4

S2(config-line)# password coevty
S2(config-line)# login
8. Encrypt the plaintext passwords.
S1(config)# service password-encryption

S2(config)# service password-encryption

9. Create a banner that warns anyone accessing the device that unauthorized access is
prohibited.
S1(config)# banner motd $ Authorized Users Only! $

S2(config)# banner motd $ Authorized Users Only! $

Close configuration window

Step 3:Configure PC hosts.

Refer to the Addressing Table for PC host address information.

Part 2:Create VLANs and Assign Switch Ports

In Part 2, you will create VLANs, as specified in the table above, on both switches. You will then
assign the VLANs to the appropriate interface. The show vlan command is used to verify your
configuration settings. Complete the following tasks on each switch.
Step 1:Create VLANs on both switches.
Open configuration window

1. Create and name the required VLANs on each switch from the table above.
S1(config)# vlan 99
S1(config-vlan)# name Management
S1(config-vlan)# vlan 10
S1(config-vlan)# name Student
S1(config-vlan)# vlan 20
S1(config-vlan)# name Faculty
S1(config-vlan)# vlan 30
S1(config-vlan)# name Staff
S1(config-vlan)# vlan 100
S1(config-vlan)# name Native

S2(config)# vlan 99
S2(config-vlan)# name Management
S2(config-vlan)# vlan 10
S2(config-vlan)# name Student
S2(config-vlan)# vlan 20
S2(config-vlan)# name Faculty
S2(config-vlan)# vlan 30
S2(config-vlan)# name Staff
S2(config-vlan)# vlan 100
S2(config-vlan)# name Native
 2. Configure the management interface and default gateway on each switch using the IP
address information in the Addressing Table.
S1(config)# interface vlan 99
S1(config-if)# ip address 192.168.99.11 255.255.255.0
S1(config-if)# no shutdown
S1(config-if)# exit
S1(config)# ip default-gateway 192.168.99.1
S2(config)# interface vlan 99
S2(config-if)# ip address 192.168.99.12 255.255.255.0
S2(config-if)# no shutdown
S2(config-if)# exit
S2(config)# ip default-gateway 192.168.99.1

Step 2:Assign VLANs to the correct switch interfaces.

1. Assign used ports to the appropriate VLAN (specified in the VLAN table above) and
configure them for static access mode. Be sure to do this on both switches
S1(config)# interface range f0/6-10
S1(config-if-range)# switchport mode access
S1(config-if-range)# switchport access vlan 10
S1(config)# interface range f0/11-15
S1(config-if-range)# switchport mode access
S1(config-if-range)# switchport access vlan 20
S1(config)# interface range f0/16-20
S1(config-if-range)# switchport mode access
S1(config-if-range)# switchport access vlan 30
S1(config)# interface f0/21
S1(config-if)# switchport mode access
S1(config-if)# switchport access vlan 99

S2(config)# interface range f0/6-10

S2(config-if-range)# switchport mode access
S2(config-if-range)# switchport access vlan 10
S2(config)# interface range f0/11-15
S2(config-if-range)# switchport mode access
S2(config-if-range)# switchport access vlan 20
S2(config)# interface range f0/16-20
S2(config-if-range)# switchport mode access
S2(config-if-range)# switchport access vlan 30

2. Issue the show vlan brief command and verify that the VLANs are assigned to the correct
interfaces.

Close configuration window

Part 3:Configure an 802.1Q Trunk Between the Switches
In Part 3, you will manually configure interface F0/1 as a trunk.
Step 1:Manually configure trunk interface F0/1.
Open configuration window

1. Change the switchport mode on interface F0/1 to force trunking. Make sure to do this on
both switches.
S1(config)# interface f0/1
S1(config-if)# switchport mode trunk
S2(config)# interface f0/1
S2(config-if)# switchport mode trunk
2. As a part of the trunk configuration, set the native VLAN to 8 on both switches. You may
see error messages temporarily while the two interfaces are configured for different native
VLANs.
S1(config-if)# switchport trunk native vlan 100
S2(config-if)# switchport trunk native vlan 100
3. Issue the show interfaces trunk command to verify trunking ports, the Native VLAN and
allowed VLANs across the trunk.
S1# show interfaces trunk
Close configuration window

Part 4: Configure L3 Switch Inter-VLAN Routing on MLS (Multi-Layer Switch)

Open configuration window

Step 1: Add VLANs.

Add VLANs to MLS according to the table below. Packet Tracer scoring is case-sensitive, so type
the names exactly as shown.

VLAN Number VLAN Name

10 Student
20 Faculty
30 Staff
100 Native

Step 2: Configure SVI (Switch Virtual Interface) on MLS.

Configure and activate the SVI interfaces for VLANs 10, 20, 30, and 99 according to the
Addressing Table. The configuration for VLAN 10 is shown below as an example. Add the
other VLANs.
MLS(config)# interface vlan 10
MLS(config-if)# ip address 192.168.10.1 255.255.255.0

Step 3: Configure Trunking on MLS.

Trunk configuration differs slightly on a Layer 3 switch. On the Layer 3 switch, the trunking
interface needs to be encapsulated with the dot1q protocol, however it is not necessary to specify
VLAN numbers as it is when working with a router and subinterfaces.
a. Change the Switch hostname to MLS
b . On MLS, configure interface g0/1.
c. Make the interface a static trunk port.
MLS(config-if)# switchport mode trunk
d. Specify the native VLAN as 99.
MLS(config-if)# switchport trunk native vlan 100

e. Encapsulate the link with the dot1q protocol.

MLS(config-if)# switchport trunk encapsulation dot1q
Note: Packet Tracer may not score the trunk encapsulation.
 Step 4: Configure trunking on S1.
a. Configure interface g0/1 of S1 as a static trunk.
S1(config)# interface g0/1
S1(config-if)# switchport mode trunk

b. Configure the native VLAN on the trunk.

S1(config-if)# switchport trunk native vlan 100

Step 5: Enable routing.

a. Use the show ip route command. Are there any active routes?
MLS# show ip route
No.
b. Enter the ip routing command to enable routing in global configuration mode.
MLS(config)# ip routing
c. Use the show ip route command again to verify routing is enabled.
MLS# show ip route

Part 5:Verify Inter-VLAN Routing is Working

l

Step 1: Complete the following tests. All should be successful.

Note: You may have to disable the PC firewall for pings to be successful.

a. From Student-1, ping Student-2 or MLS to verify connectivity within VLAN 10.

b. From Faculty-1, ping Faculty-1 or MLS to verify connectivity within VLAN 20.

c. From Staff-1, ping Staff-2 or MLS to verify connectivity within VLAN 30.

d. From S1, ping S2, S3, or MLS to verify connectivity with VLAN 99.

e. To verify inter-VLAN routing, ping devices outside the sender’s VLAN.

Part 6: Secure Inter VLAN Routing

l

As part of trunk configuration, you may allow specific VLANs to cross the trunk and prohibit
other VLANs to cross the trunk (for this activity prohibit the default vlan 1 and Student vlan).

MSL(config)# interface g0/1

MSL(config-if)# switchport trunk allowed vlan 20,30,100)

Issue the show interfaces trunk command to verify trunking ports, the Native VLAN and allowed VLANs
across the trunk.