WEBVTT 00:00:01.000 --> 00:00:04.680 All right, now it's time for our last discussion of the day and that is on 00:00:04.680 --> 00:00:10.800 inter-VLAN routing. Okay, so inter-VLAN routing is about what? Inter-VLAN routing 00:00:10.800 --> 00:00:15.760 is about us routing in and out of our VLANs. That's what it's about, right? Many 00:00:15.760 --> 00:00:18.680 people just think, oh, inter-VLAN routing, routing from one VLAN to another VLAN. 00:00:18.680 --> 00:00:23.160 Okay, wait, what is a VLAN? A VLAN is what? A VLAN is a subnet. A VLAN is a 00:00:23.160 --> 00:00:27.600 broadcast domain. If you want to route from a VLAN to anywhere else, you have to 00:00:27.600 --> 00:00:31.959 or if you want to go from your VLAN to anywhere else, you need a route. So it's 00:00:31.959 --> 00:00:34.799 not just between VLANs, it's to everything in this entire world. If 00:00:34.799 --> 00:00:38.400 you're in VLAN 10 and you want to go to the internet, you need inter-VLAN 00:00:38.400 --> 00:00:41.240 routing. If you're in VLAN 10 and you want to talk to somebody in VLAN 30, you need 00:00:41.240 --> 00:00:48.279 inter-VLAN routing. So we're going to look at two different options today. We're 00:00:48.279 --> 00:00:54.439 going to look at inter-VLAN routing from an actual router standpoint and then 00:00:54.439 --> 00:01:01.119 we're going to look at it from the perspective of using our multi-layer 00:01:01.119 --> 00:01:05.519 switches. So let's go to our branch office right now. This diagram we looked 00:01:05.519 --> 00:01:11.239 at earlier today. And when it comes to setting up inter-VLAN routing in this 00:01:11.239 --> 00:01:17.760 type of scenario, what are we dealing with? Well, we're dealing with a router 00:01:17.760 --> 00:01:22.680 interface. That is a layer 3 interface. That's what that is, a layer 3 router 00:01:22.720 --> 00:01:31.360 interface that can support what? IP addresses. And down here we're dealing 00:01:31.360 --> 00:01:35.800 with a layer 2 interface that supports what? That supports VLANs. That's kind of 00:01:35.800 --> 00:01:40.839 a discrepancy, don't we, right? And by default this works because if this is 00:01:40.839 --> 00:01:46.680 VLAN 1 and even though this is layer 3, right, there's no tagging, there's no 00:01:46.680 --> 00:01:51.779 nothing, it works because VLAN 1 doesn't tag by default, doesn't do any of that. So 00:01:51.779 --> 00:01:55.980 that's why this just works right out of the box for us if you only have what? One 00:01:55.980 --> 00:02:02.099 subnet. One subnet and it's VLAN 1. Everything would work just fine. But when 00:02:02.099 --> 00:02:07.779 all of a sudden we have multiple subnets, multiple VLANs, multiple broadcast 00:02:07.779 --> 00:02:12.539 domains with one interface here going down to a switch, this is where things 00:02:12.539 --> 00:02:16.820 have to get creative for us. And so now we're going to set up what is called 00:02:16.820 --> 00:02:27.820 router on a stick or router on a trunk. So what do we need to do? Well let's 00:02:27.820 --> 00:02:35.740 pretend we have VLAN 255 down here. Let's pretend we have VLAN 254 down here. So 00:02:35.740 --> 00:02:42.059 we're gonna have to create a trunk link here for that. But then how in the world 00:02:42.059 --> 00:02:48.300 do we configure that interface? Let's come back to that after we configure ASW2 00:02:48.300 --> 00:02:53.619 rapidly here. So why rapidly? Because we've already seen all of this so far 00:02:53.619 --> 00:02:59.259 today. So I'm with the magic, oh look at that, okay, so ASW2 now folks is over in 00:02:59.259 --> 00:03:04.179 branch. I'm just reusing the same switch, magic of virtualization. Alright so 00:03:04.179 --> 00:03:07.300 pretend this is the switch over here ASW2 just to give you an idea what's 00:03:07.300 --> 00:03:12.020 going on. So what's happening is that we'd go to configure terminal, we'd have 00:03:12.020 --> 00:03:18.660 to create our VLAN, so VLAN 254 and VLAN 255. And then what else might we want to 00:03:18.660 --> 00:03:23.059 do? We'd have to go to interface, gigabit ethernet, 1 slash 0 slash 31 and we 00:03:23.059 --> 00:03:27.619 would have to type in switchport mode trunk switchport no negotiate. Why? 00:03:27.619 --> 00:03:32.500 Because these routers here do not support DTP. So switchport mode trunk 00:03:32.500 --> 00:03:36.779 switchport no negotiate. What else might we type in? Oh switchport trunk allowed 00:03:37.500 --> 00:03:45.059 VLAN 254 and 255 right? What about switchport trunk native VLAN? Let's say 00:03:45.059 --> 00:03:52.539 we're using native VLAN 99 right? All of that stuff. So just like we did back in 00:03:52.539 --> 00:03:56.779 our VLAN and trunking discussion, same thing here on our switchport. So nothing 00:03:56.779 --> 00:04:00.460 new there, not a big deal. And whatever access ports here you want to configure, 00:04:00.619 --> 00:04:08.539 like maybe for example interface gigabit 1 slash 0 slash 35, we'll say switchport 00:04:08.539 --> 00:04:19.980 mode access switchport access VLAN let's say 254. Alright so again we have 00:04:19.980 --> 00:04:24.459 interface 35 here and there's a PC connected to it as an example. That's 00:04:24.459 --> 00:04:28.140 what we've done. Alright so no surprise there. So if this comes up 00:04:28.140 --> 00:04:31.140 in the exam you already know how to do that. You've seen it in our trunk and 00:04:31.140 --> 00:04:35.540 VLAN configuration plus here as well. But now the branch configuration is going to 00:04:35.540 --> 00:04:39.260 be slightly different for you. What did I just do? Alright branch configuration is 00:04:39.260 --> 00:04:43.059 gonna be slightly different for you now. So the port is fastethernet 0 slash 0 00:04:43.059 --> 00:04:47.500 slash 0 on branch. Notice that this port is up up right now. Why? Because we're 00:04:47.500 --> 00:04:51.140 connected to our ASW2 switch in our branch office on gigabit ethernet 1 00:04:51.140 --> 00:04:54.540 slash 0 slash 31 and it's already configured as it needs to be configured. 00:04:54.540 --> 00:04:57.140 But now what we're going to do is we're going to show you how to configure 00:04:57.140 --> 00:05:00.980 fastethernet 0 slash 0 slash 0 to support these two different VLANs. So 00:05:00.980 --> 00:05:04.420 first of all what we need is we need to come over their IP addressing space. So 00:05:04.420 --> 00:05:11.100 our IP addressing space for VLAN 255 is going to be 10.0.255.0 slash 24. And 00:05:11.100 --> 00:05:19.299 then our IP addressing space for VLAN 254 let's say we do 10.0.254.0 slash 24. 00:05:19.299 --> 00:05:24.500 Alright so notice there's two different IP addressing spaces there. So I need two 00:05:24.540 --> 00:05:28.059 default gateways therefore I need two interfaces. How many interfaces do I have 00:05:28.059 --> 00:05:33.179 on my router right now? Just one. That's all I have. So what I need to do now is I 00:05:33.179 --> 00:05:38.100 need to create virtual interfaces. I need a virtual interface for this and I need 00:05:38.100 --> 00:05:42.579 a virtual interface for this. So how do we do that on our physical routers? 00:05:42.579 --> 00:05:49.779 We create what are called sub interfaces. And we're going to create one sub 00:05:49.779 --> 00:05:55.700 interface for each of these. So I'll create let's say fastethernet 0 slash 0 00:05:55.700 --> 00:06:03.339 slash 0.24 for this one. And we'll go with fastethernet 0 slash 0 slash 0.25 00:06:03.339 --> 00:06:10.299 for this one. That's what we're going to do. So type in configure terminal 00:06:10.299 --> 00:06:16.700 interface fastethernet 0 slash 0 slash 0. Notice that I can put a period. So 00:06:16.700 --> 00:06:21.820 let's put a period question mark. And now it's asking for the sub interface. So 00:06:21.820 --> 00:06:26.980 we said we're going to use sub interface 24. Now I'm in sub interface configuration 00:06:26.980 --> 00:06:34.059 mode. Let's do interface fastethernet 0 slash 0 slash 0.25 as well. And then 00:06:34.059 --> 00:06:40.260 let's type in do show IP interface brief. And you'll see we have two sub 00:06:40.260 --> 00:06:45.299 interfaces created now. So anytime you see a period that is a sub interface for 00:06:45.339 --> 00:06:49.739 that physical interface. Now you might be asking hey why are these ones deleted? 00:06:49.739 --> 00:06:55.540 These ones are deleted because they were created and they have been removed. But 00:06:55.540 --> 00:07:00.179 the router hasn't been rebooted yet. So if you ever delete a sub interface it'll 00:07:00.179 --> 00:07:05.059 say delete it in the output. But it won't be removed until you reboot the device. 00:07:05.059 --> 00:07:09.459 That's not exam relevant. But I get that question asked a lot. Why delete? What 00:07:09.459 --> 00:07:15.059 does that mean? All right so .24 .25 there they are. So we got to configure them 00:07:15.059 --> 00:07:19.700 now. So let's go back into the interface configuration mode for those. Let's go 00:07:19.700 --> 00:07:24.179 24 first. And what are we going to type in here? Well if I type in the IP address 00:07:24.179 --> 00:07:27.899 you're going to see it won't let me do that. So let's type in 10.0.254.1 00:07:27.899 --> 00:07:35.260 255.255.255.0. Some bad typing on my part right there. Right and we 00:07:35.260 --> 00:07:39.540 got a perfect preface that with IP address. Right and you'll see I can't do 00:07:39.540 --> 00:07:42.859 it. Why can't I do that? Because I haven't specified the VLAN. You got to specify 00:07:42.859 --> 00:07:47.179 the VLAN first. So it's encapsulation. Exactly Jeffrey. Thank you. So 00:07:47.179 --> 00:07:53.059 encapsulation. And on this device we support only .1Q for this. So .1Q 00:07:53.059 --> 00:07:59.059 and then what is the VLAN? We said it's going to be VLAN 254. All right so let's 00:07:59.059 --> 00:08:06.059 do now the IP address and you'll see it takes it. So do show run interface fast 00:08:06.059 --> 00:08:10.179 Ethernet 0.0.0.0.24 00:08:12.859 --> 00:08:15.739 Right so there you go. There's the configuration to create the sub 00:08:15.739 --> 00:08:23.540 interface. We'll do the same thing for .25. So .25 but instead we'll do 00:08:23.540 --> 00:08:28.299 encapsulation 255 and then the IP address is going to be what? We said the 00:08:28.299 --> 00:08:32.580 IP address is going to be 255.1. 00:08:34.059 --> 00:08:37.900 All right so there we go. All right and then also if you want to do the native 00:08:37.900 --> 00:08:42.500 VLAN. I wanted to show you here do show VLANs is a command that will show me 00:08:42.500 --> 00:08:47.979 the VLANs that are now on the router. So branch a router and you'll see that 00:08:47.979 --> 00:08:52.619 VLAN 1 is automatically there. It's for the physical interface and you'll see 00:08:52.619 --> 00:08:56.299 that it's automatically the native VLAN. So VLAN 1 is automatically the native 00:08:56.299 --> 00:09:00.780 VLAN on the Cisco devices. So if you ever want to change that and remember we set 00:09:00.780 --> 00:09:03.820 the native VLAN here to 99 right? What you would have to do is you'd have to 00:09:03.820 --> 00:09:08.820 create another sub interface for that particular VLAN. So I'm just going to 00:09:08.820 --> 00:09:11.380 create a sub interface of 99. You could do whatever you want but I'm going to do 00:09:11.380 --> 00:09:17.940 99 in this case. And now we're going to say encapsulation.1q and we'll type in 00:09:17.940 --> 00:09:22.380 99 and we'll type in native. That makes it the native VLAN. Now I'm not going to 00:09:22.380 --> 00:09:24.619 put an IP address within it because I don't want to route for the native VLAN 00:09:24.619 --> 00:09:27.820 in this scenario. If you had a need to go ahead if not then don't worry about it. 00:09:27.820 --> 00:09:30.780 But I'm not going to put an IP address for safety and security reasons because 00:09:30.780 --> 00:09:34.539 we're not going to have traffic in that VLAN. But again we're dealing with a 00:09:34.539 --> 00:09:39.020 chunk link right? VLAN 99 here's the native VLAN therefore VLAN 99 that 00:09:39.020 --> 00:09:45.099 should be there as a native VLAN. So do show VLANs you'll now see that the VLAN 00:09:45.099 --> 00:09:50.059 1 is no longer the native VLAN. If we go to VLAN 99 you'll see it's now the 00:09:50.059 --> 00:09:54.859 native VLAN. If we scroll down a little bit more you'll see VLAN 254 is 00:09:54.859 --> 00:09:59.739 associated with this sub interface and has this IP address. VLAN 255 using 802.1q 00:09:59.739 --> 00:10:03.380 encapsulation associated with this sub interface with this IP address. 00:10:03.380 --> 00:10:10.780 Now if we look at do show IP interface brief you'll see that we have an IP 00:10:10.780 --> 00:10:15.580 address on an interface and the interface is up up. What does that mean? 00:10:15.580 --> 00:10:19.979 That would mean folks that we should have an entry in our routing table for 00:10:19.979 --> 00:10:26.780 these networks. Network 10.0.254.0.24 and 10.0.255.0.24. 00:10:26.780 --> 00:10:29.820 Let's type in do show IP route and you're going to see that that is true. 00:10:29.820 --> 00:10:35.979 Why does this happen? Because when you have an IP address on an 00:10:35.979 --> 00:10:41.099 interface and the interface is up up that means the network ID of that 00:10:41.099 --> 00:10:44.219 interface gets installed in the routing table. You would have learned that in 00:10:44.219 --> 00:10:50.700 your CCNA days. So as a result of that we now have those in a routing 00:10:50.700 --> 00:10:55.619 table. So let's just give you a little example of what would happen in regards 00:10:55.619 --> 00:11:01.659 to router decision-making process and traffic flow in this particular case. So 00:11:01.659 --> 00:11:07.219 for example let's say we have traffic coming to let's say there's a device 00:11:07.219 --> 00:11:17.219 here 10.0.255.25. So you have a packet with a destination IP of 10.0.255.25. 00:11:17.219 --> 00:11:22.900 Arrives at the router branch. Branch A now does a routing table lookup and when 00:11:22.900 --> 00:11:27.380 it does a routing table lookup it realizes that the best entry is this one. 00:11:27.380 --> 00:11:33.219 Directly connected network out fast Ethernet 0.0.0.25. So what does it 00:11:33.219 --> 00:11:36.260 need to do now? It needs to create an ART message to get the MAC address of this 00:11:36.260 --> 00:11:40.979 PC. So how does it do that? Well it's going to have to encapsulate the 00:11:40.979 --> 00:11:47.700 ART message in what? An 802.1Q tag. So it's going to have to do. Because what it 00:11:47.700 --> 00:11:52.299 needs to do is it needs to send an ART message out asking hey if you're 10.0.255 00:11:52.299 --> 00:11:57.219 10.0.255.25 give me your MAC address but it has to stay in what VLAN? It has to 00:11:57.219 --> 00:12:02.859 stay in VLAN 255. How does it know that? With the output of show VLANs. Show VLAN 00:12:02.859 --> 00:12:09.780 says what? Anything out this interface has to be tagged with 255 using 802.1Q. 00:12:09.780 --> 00:12:15.820 So now it tags it the ART message with 802.1Q therefore it only ends up 00:12:15.820 --> 00:12:21.780 going to those devices in VLAN 255 and no one else and therefore this PC gets 00:12:21.780 --> 00:12:25.859 it responds back with the ART reply and the switch would tag it as it needs to 00:12:25.859 --> 00:12:30.780 right and eventually comes back. And now what can I do? I can write the packet now 00:12:30.780 --> 00:12:35.820 so I can go ahead and build the the new frame so source MAC the source MAC would 00:12:35.820 --> 00:12:42.859 be what? The MAC address of fastethernet 0 0 0 dot 25 and in the destination MAC 00:12:42.859 --> 00:12:46.020 is the one we just got back in the ART message which is the MAC address of that 00:12:46.020 --> 00:12:50.260 device and now we can send the frame out on the network oh after we tag it 802.1Q 00:12:50.580 --> 00:12:55.820 tagging right and then we tag it with 255 so this switch knows it stays in 255 00:12:55.820 --> 00:12:58.539 and then we can forward it out and so the same thing would happen in reverse 00:12:58.539 --> 00:13:03.020 traffic arrives inbound on this interface it's part of VLAN 255 it gets 00:13:03.020 --> 00:13:07.380 forwarded up to our default gateway default gateway gets it it looks at the 00:13:07.380 --> 00:13:13.979 tag the tag says VLAN 255 since the tag is VLAN 255 the router knows it belongs 00:13:13.979 --> 00:13:19.299 to this sub interface and therefore I can check the destination MAC address of 00:13:19.299 --> 00:13:22.580 the frame compared to the destination MAC address of the sub interface and 00:13:22.580 --> 00:13:28.820 therefore in the end it has everybody's abiding by our what our switch rules 00:13:28.820 --> 00:13:36.539 when it's all said and done. All right so that is a configuration example of 00:13:36.539 --> 00:13:43.900 interview and routing with router on a trunk. You know more than you need to 00:13:43.900 --> 00:13:46.979 know to pass anything on the certification exam about that. Right now 00:13:46.979 --> 00:13:53.140 let's talk about interview and routing in regards to our multi-layer switches 00:13:53.140 --> 00:13:55.580 because things are significantly different here compared to what we just 00:13:55.580 --> 00:13:59.219 discovered and we just discussed. We're going to be using things called SVIs 00:13:59.219 --> 00:14:05.580 instead and routed ports. SVIs and routed ports two different things for two 00:14:05.580 --> 00:14:11.380 different purposes but we need them both. So when we're dealing with interview and 00:14:11.380 --> 00:14:15.659 routing on a multi-layer switch what are we doing we are creating these virtual 00:14:15.739 --> 00:14:19.020 interfaces that are going to ultimately in the end give us the opportunity to 00:14:19.020 --> 00:14:26.460 route traffic. So SVIs routed ports pay very close attention to how I have 00:14:26.460 --> 00:14:32.940 labeled these. Notice how I'm pointing right to the middle of the switches for 00:14:32.940 --> 00:14:40.219 SVIs but the routed ports I'm actually pointing to the physical ports. Big 00:14:40.219 --> 00:14:45.140 significant difference there. Routed ports are really important because if we 00:14:45.140 --> 00:14:50.500 go back to our architecture or diagram that we have here what I want you to 00:14:50.500 --> 00:14:58.059 realize is that in our modern-day networks where we have layer 2 layer 3 00:14:58.059 --> 00:15:07.940 as such this is all layer 2 and the rest is all layer 3. Where do the SVIs go? The 00:15:07.940 --> 00:15:12.179 SVIs are going to go here. The SVIs are going to go here. The SVIs are going to 00:15:12.179 --> 00:15:16.979 go here. The SVIs are going to go here. But then every other port in that layer 3 00:15:16.979 --> 00:15:22.460 environment has to be a routed port. That's right. Meaning this is a routed 00:15:22.460 --> 00:15:26.020 port. This is this is this is this is this is this is this is this is this is 00:15:26.020 --> 00:15:29.659 this is this is this. All of these are routed ports. Why? Because I want to route. 00:15:29.659 --> 00:15:34.739 We can run OSPF on a routed port. We can run EIGRP on a routed port. We can run 00:15:34.739 --> 00:15:45.260 BGP on a routed port. We can run ISIS on a routed port. So routing. Routed 00:15:45.260 --> 00:15:53.099 ports. So we would create for example like your slash 30 networks. Slash 30 00:15:53.099 --> 00:16:00.820 networks can go on routed ports between those two devices. I can run OSPF and 00:16:00.820 --> 00:16:08.739 EIGRP on them as an example. So no trunks, no VLANs there. Trunks and VLANs 00:16:08.739 --> 00:16:12.340 are only here. Trunks and VLANs are only here. Everywhere in here is what? Routed 00:16:12.340 --> 00:16:18.580 ports and dynamic routing protocols. So that's why over here right I'm showing 00:16:18.580 --> 00:16:23.099 you your routed ports as they are. So how do we do that? Well first of all we have 00:16:23.099 --> 00:16:27.580 to realize that on a multi-layer switch typically what we're gonna have is we 00:16:27.580 --> 00:16:31.099 are gonna have if I type in stew show interface gigabit ethernet 1 size 0 00:16:31.099 --> 00:16:37.140 size 13 switch port you're gonna see that I am a layer 2 switch port. When you 00:16:37.140 --> 00:16:42.460 see this output folks this means layer 2. This means we do not support IP 00:16:42.460 --> 00:16:46.340 addressing. We do not support dynamic routing protocols. So if I type in 00:16:46.340 --> 00:16:50.140 interface gigabit 1 size 0 size 13 and I'm like hey I want to put a slash 30 00:16:50.140 --> 00:17:03.340 network here like we have in our diagram. So 10.40.23.2. 255.255.255.252. 00:17:03.340 --> 00:17:07.780 Why do I keep forgetting IP address today? 00:17:09.339 --> 00:17:13.939 You're gonna see it's not even a valid command. Why is it not a valid command? 00:17:13.939 --> 00:17:22.060 Because I am a layer 2 switch port. I support VLANs. I support trunks. I support 00:17:22.060 --> 00:17:30.699 spanning tree protocol. How do I convert a layer 2 switch port on my devices my 00:17:30.699 --> 00:17:34.060 multi-layer switches to layer 3? Another one I want to show you is do show 00:17:34.060 --> 00:17:39.579 interface status. When look at the output of show interface status for this port 00:17:39.579 --> 00:17:45.260 you're gonna see right now it says I am connected but I'm in VLAN 1. I'm in 00:17:45.260 --> 00:17:48.859 VLAN 1 okay. Then you might be saying why not make it a trunk port because I 00:17:48.859 --> 00:17:52.020 don't want VLANs up there. I don't want trunks up there. Right this is our 00:17:52.020 --> 00:17:56.020 distribution to core area. Fast fast fast fast. That spanning tree protocol is slow. 00:17:56.020 --> 00:18:00.020 Spanning tree protocol blocks more than 50% of our links. Dynamic routing 00:18:00.020 --> 00:18:06.260 protocols don't do that. So I don't want trunks and VLANs up in my distribution 00:18:06.260 --> 00:18:11.859 and core nowadays. Yeah Jeffrey says you know what we got to type no switch port 00:18:11.859 --> 00:18:16.819 to make this happen. All right so no switch port. So don't confuse this on the 00:18:16.819 --> 00:18:20.500 exam if you've never seen this before. No switch port means layer 3 port. That's 00:18:20.500 --> 00:18:28.140 what it means. So I'm gonna now type in do show interface gig 1 size 0 size 13 00:18:28.140 --> 00:18:31.900 switch port. Look at this. Disable. Now again on the exam don't let that trick 00:18:31.900 --> 00:18:36.140 you. If it says switch port disabled that doesn't mean it's not on. It means 00:18:36.140 --> 00:18:41.540 layer 3. Layer 3. That's what it means. So let's look at the output of show 00:18:41.540 --> 00:18:45.619 interface status now and you'll see it no longer shows that I'm in VLAN 1. It 00:18:45.619 --> 00:18:51.780 shows I'm a routed port. Routed port. Now that means I can support IP addressing. 00:18:51.780 --> 00:18:57.020 Boom. Now that means I can support a dynamic 00:18:57.020 --> 00:19:01.300 routing protocol like OSPF which I think is already running on this device. So I 00:19:01.380 --> 00:19:04.380 might be able to form an OSPF neighborship really really soon. All 00:19:04.380 --> 00:19:13.099 right maybe not. Let's type in IP OSPF 1 area 0. Let's see if that helps me out. 00:19:14.819 --> 00:19:18.219 Maybe the other devices aren't configured yet properly. That's why. 00:19:18.219 --> 00:19:21.619 Because I haven't configured the whole environment. All right I'm just gonna 00:19:21.619 --> 00:19:25.140 leave that alone. 10.40.23.2. 00:19:25.140 --> 00:19:27.979 2.5. 2.5. 2.5. . 00:19:27.979 --> 00:19:31.579 That looks right. I do have my previous commands typed here. Let me just double 00:19:31.579 --> 00:19:38.900 check that. 10.40.23.2 there you go. So yeah there you go. I'm running OSPF it 00:19:38.900 --> 00:19:43.260 just took a while. I'm impatient. And there you go. Right so I want a routed 00:19:43.260 --> 00:19:47.060 port here on gigabit 1 0 14 as well. So I'm just going to copy 00:19:47.060 --> 00:19:53.859 and paste it out of my notepad file. I'm going to paste it in just to make it a 00:19:53.859 --> 00:20:01.660 little quicker. Alright so there you go. Another routed port. IP OSPF 1 area 0 as 00:20:01.660 --> 00:20:06.819 well. And now we can participate in OSPF and all that fun stuff. So we need to do 00:20:06.819 --> 00:20:12.819 the same thing on DSW 2 as well. So I've got my everything previously typed in 00:20:12.819 --> 00:20:17.099 here. So interface gig 1 size 0 size 13. No switch port but the IP address. 14 no 00:20:17.099 --> 00:20:21.619 switch port but the IP address. So let's go and do that on DSW 2 now. And I'll 00:20:21.619 --> 00:20:25.660 have my environment the way I want it. So for the exam think about it anytime you 00:20:25.660 --> 00:20:29.420 are beyond the distribution layer. If this is our demarcation point. If they're 00:20:29.420 --> 00:20:35.500 telling you on the exam or even in the real world that this is layer 3 up here 00:20:35.500 --> 00:20:38.819 and this is layer 2 down here. Right typically these are all going to be 00:20:38.819 --> 00:20:42.500 routed ports then for you. And on the certification exam because that's 00:20:42.660 --> 00:20:46.579 configuration best practices. And in here these are all going to be what VLANs 00:20:46.579 --> 00:20:52.380 trunks. So what do you need now over here? We need SVIs. Now folks if you're 00:20:52.380 --> 00:20:54.979 looking at the time we are almost out of time but I'm going to finish this 00:20:54.979 --> 00:20:57.819 discussion because we need to get through it. And there's not much left to 00:20:57.819 --> 00:21:02.979 cover here. So SVIs. This is a confusing point for a lot of people in the 00:21:02.979 --> 00:21:08.819 industry. SVIs. I find there's a lot of people who are a little foggy on SVIs 00:21:08.819 --> 00:21:12.459 and they don't understand the full purpose of what an SVI is. So I'm going 00:21:12.459 --> 00:21:16.020 to clarify that for everybody here who has any at all fogginess about SVI. So 00:21:16.020 --> 00:21:23.979 what is an SVI? It is a virtual layer 3 interface that has the ability to route 00:21:23.979 --> 00:21:34.819 traffic in and out of the VLANs they're configured for. For any link that is a 00:21:34.900 --> 00:21:41.140 member of that VLAN. So what I want you to realize right now is that this is a 00:21:41.140 --> 00:21:44.780 trunk. This is a trunk. This is a trunk. This is a trunk. This is a trunk. This is a 00:21:44.780 --> 00:21:49.060 trunk. This is a trunk. This is a trunk. All of these trunk ports are supporting 00:21:49.060 --> 00:21:58.540 which VLANs? 10, 20, 50, 200 in my environment. Therefore I need an SVI for 00:21:58.540 --> 00:22:09.060 10. That's 50. This one is 20 and this one is 200. What this means now is that 00:22:09.060 --> 00:22:15.540 this SVI, think of it as a virtual layer 3 router interface, that is now going to 00:22:15.540 --> 00:22:23.579 be able to route traffic in and out of that VLAN on any one. Any one of those 00:22:23.579 --> 00:22:31.140 trunk links. It is your default gateway and every access port or trunk port that 00:22:31.140 --> 00:22:42.260 can pass traffic for that VLAN is allowed to use it. There are way too many 00:22:42.260 --> 00:22:47.260 interfaces here to do routed ports. You can't do sub interfaces on multi-layer 00:22:47.339 --> 00:22:56.459 switches. So what do you use? SVIs. So if I had a hundred trunk links for VLAN and 00:22:56.459 --> 00:23:01.979 they all supported VLAN 10, then that one SVI for VLAN 10 can take traffic on and 00:23:01.979 --> 00:23:07.540 off all 100 of those trunk links. Every single one of them and route for them. That's what 00:23:07.540 --> 00:23:14.219 an SVI does for us. It's that simple. That's all it does. So it's gonna have an 00:23:14.219 --> 00:23:17.239 IP address. It's gonna have a subnet mask. It's gonna have a MAC address. Why? 00:23:17.520 --> 00:23:27.280 Because it is going to be the default gateway. The default gateway. Conrad says, 00:23:27.280 --> 00:23:30.880 are they quicker? Quicker than what? Quicker than what? There is no alternative. 00:23:30.880 --> 00:23:36.520 That's the thing, right? There is no alternative. I can't do routed ports 00:23:36.520 --> 00:23:40.880 because a routed port is for one interface, which means that only one 00:23:40.880 --> 00:23:46.520 interface could be used then for that subnet, for that VLAN, for that broadcast 00:23:46.680 --> 00:23:50.959 So I can't use routed ports. Some interfaces are not even allowed. So can't even do those. 00:23:50.959 --> 00:23:56.920 SVI is the only option. So they're not quicker because there's no other way. 00:23:56.920 --> 00:23:59.040 There's no other option. This is what you have to do. 00:24:16.520 --> 00:24:29.400 You could, Jeffrey, but not designed for that purpose. And as a result, 00:24:29.400 --> 00:24:35.079 you're not going to get the benefits you necessarily need. All right? They weren't 00:24:35.079 --> 00:24:40.079 designed for that. Weren't designed for that. Always keep that in mind, right? 00:24:40.079 --> 00:24:44.719 The SVI is designed specifically to be your default gateway for your VLANs. 00:24:44.959 --> 00:24:48.000 Not a routed port as an Ether channel bundle. Okay? 00:24:48.000 --> 00:24:57.160 Because, Jeffrey, I would not technically be allowed to what? Bundle all of these together. 00:24:57.160 --> 00:25:03.520 Unless I was doing VSS and stacking. Unless I was doing VSS and stacking, 00:25:03.520 --> 00:25:11.000 I would not be allowed to do that. Anyways, so that would only allow me to do these two 00:25:11.119 --> 00:25:16.040 ports together in that particular case, which would not have the same benefit as using the SVI. 00:25:16.040 --> 00:25:22.920 Right? But also, you're saying routed Ether channel. The problem is, 00:25:22.920 --> 00:25:27.000 if we're doing routed Ether channel down to here, that now messes with Spanachy protocol, 00:25:27.000 --> 00:25:30.760 messes with a lot of different things. So it really changes what's going on, 00:25:30.760 --> 00:25:34.000 and can create a lot of issues that have to be solved after the fact. 00:25:34.000 --> 00:25:40.239 So we're not going to go down that path. But SVIs, exam, this is what you're doing. 00:25:40.239 --> 00:25:45.920 Real world, this is what you're supposed to do. So let me show you how easy it is to do this now. 00:25:45.920 --> 00:25:58.199 DSW1. Let's create an SVI. Interface, VLAN, 10. Done. There you go. I'm done. I just created it. 00:25:58.199 --> 00:26:04.839 And on this platform, they automatically go up. Right? As long as conditions are met, 00:26:04.839 --> 00:26:09.599 and that is what? They're not shut down. So they're not shut down by default on this device. 00:26:09.599 --> 00:26:15.839 They're automatically enabled. Okay? So number two, the VLAN exists. Does VLAN 10 exist on this device? 00:26:22.079 --> 00:26:29.680 Oh, my gosh. All right. Yes, it does. VLAN 10 does exist on this device. Okay. What else? 00:26:30.400 --> 00:26:36.560 Do show interface trunk. Do you have at least one interface that is in the spanning tree 00:26:36.560 --> 00:26:45.760 forwarding state? In the spanning tree forwarding state for VLAN 10? Yes, I do. Yes, absolutely. 00:26:45.760 --> 00:26:52.959 Hunter, yes. I have at least one. So if those three conditions are met, then my SVI is up. 00:26:53.599 --> 00:26:58.000 Now I got to put an IP address on that. So what is the IP address of this particular subnet going 00:26:58.000 --> 00:27:02.160 to be? Or the IP address of this interface in our subnet? Well, we said this is going to be 00:27:02.160 --> 00:27:11.760 10.0.0.0 size 24. So let's put an IP address 10.0.0.1, 255, 255, 255, 0. You can do anything 00:27:11.760 --> 00:27:16.560 you want as long as it's in the right subnet as the users. So what is the IP addressing space 00:27:16.560 --> 00:27:21.040 you created for VLAN 10? You're going to want an IP address for that on your SVI. 00:27:21.760 --> 00:27:25.439 Now what can I do? I can route traffic in and out of this particular SVI. 00:27:32.160 --> 00:27:43.599 We've done a lot today, but I have a device here with the IP address 10.0.0.10. 00:27:48.079 --> 00:27:52.479 It's in the same subnet as that interface. We've done a lot. 00:27:52.479 --> 00:27:57.359 Okay, I've messed around a lot. I've made some changes. Here's hoping the ping works. 00:27:57.520 --> 00:28:02.640 Okay, so what does that mean? It successfully means this is configured right, this is right, 00:28:02.640 --> 00:28:08.160 this is right, this is right, this is okay. Uh-oh, we got a bunch of stuff right, and that SVI 00:28:08.719 --> 00:28:15.680 is taking whatever interface that frame came in on and has processed it successfully for me. 00:28:17.680 --> 00:28:20.719 And there you go. It could be my default gateway for my subnet. 00:28:21.439 --> 00:28:25.920 It could be my default gateway for my subnet. So if we look at the open to do show 00:28:27.760 --> 00:28:38.160 IP interface brief, you're going to see that it shows up now as an interface with its IP address, 00:28:38.160 --> 00:28:42.880 and it's up up. Why? Because the VLAN exists, it's not shut down, and there's at least one 00:28:42.880 --> 00:28:47.359 interface in the spanning tree forwarding state for that VLAN, so we're perfect there. 00:28:47.920 --> 00:28:57.359 This is beautiful. I love it. Looking good. Let's type in show IP interface VLAN 10. 00:28:58.479 --> 00:29:04.319 All right, so there's our IP address, our subnet mask, any multi-cast groups we join, that's for 00:29:04.319 --> 00:29:09.199 OSPF because I have OSPF to automatically get enabled on my interfaces on my device, 00:29:09.760 --> 00:29:13.920 right, MTU. So even though it's a virtual interface, it still has to abide by MTU. 00:29:14.160 --> 00:29:17.439 If I want to set up access control lists on an SVI, why? It's the default gateway. 00:29:17.439 --> 00:29:21.359 It's no different than a physical router interface that's being used as a default gateway, 00:29:21.359 --> 00:29:25.280 except it's virtual in this case. That's it. So I can still set up ACLs on it to control 00:29:25.280 --> 00:29:30.319 traffic coming in and out of the subnet. What else do we want to do? Take a look at show 00:29:30.319 --> 00:29:34.959 interface VLAN 10, and we're going to see that it even gets its own MAC address. That was 00:29:34.959 --> 00:29:41.119 dynamically assigned from a pool MAC addresses that are available on this platform. So that way, 00:29:41.680 --> 00:29:46.400 anytime it wants to build a frame and send it to somebody in the subnet VLAN or broadcast domain, 00:29:46.400 --> 00:29:50.880 it can use it as its source MAC address. Anytime somebody wants to talk to this device 00:29:50.880 --> 00:29:54.880 at 10.0.0, it's going to have to learn the MAC address. So that way, they can talk to it. So 00:29:54.880 --> 00:30:01.119 we should be able to see our minus A. There it is. There's that MAC address. That is on the SVI, 00:30:02.000 --> 00:30:09.920 9647, 9647. Yep, there it is, 9647. So again, right, we're going to be able to see our MAC 00:30:09.920 --> 00:30:14.640 address. So again, right, sending out our ARP message from PC, getting the MAC address of that 00:30:14.640 --> 00:30:20.479 device's IP address, return to us. Now we can talk to that device in our own subnet. So yeah, 00:30:20.479 --> 00:30:24.239 it's great. Right now, it's not set up as the default gateway on my client, as you can see. 00:30:24.239 --> 00:30:30.800 My client is using a different address as its default gateway. It's configured with 10.0.0.254. 00:30:30.800 --> 00:30:35.439 Why? Because that'll be something we talk about tomorrow, not today. But we'll get back to that 00:30:35.439 --> 00:30:41.040 later on. MTU for the physical interface, bandwidth of the interface that we have. It's 00:30:41.040 --> 00:30:44.959 a gigabit Ethernet interface, the SVIs, because this is a gigabit platform device. 00:30:46.160 --> 00:30:48.800 It even keeps track of the packets that are coming in and out of the interface, 00:30:48.800 --> 00:30:53.760 just like a physical interface would. Right, so this is great. This is our SVI. This is our 00:30:54.719 --> 00:30:58.560 default gateway for the subnet to VLAN broadcast domain. Traffic comes in and out of that subnet 00:30:58.560 --> 00:31:03.599 VLAN broadcast domain through here. So if we look at do show IP route now, you'll see that there's 00:31:03.599 --> 00:31:09.760 an entry in our routing table for it as well. 10.0.0.0.24 directly connected to VLAN 10. So 00:31:09.760 --> 00:31:18.800 anybody in 10.0.0.0.24 can be reached through SVI, interface VLAN 10, not VLAN 10. I don't like the 00:31:18.800 --> 00:31:25.199 way that is worded. It should say interface VLAN 10, but it doesn't. Okay, it's interface VLAN 10, 00:31:25.199 --> 00:31:30.400 not VLAN 10, interface VLAN 10. There's a difference, right? Because VLAN 10 is a layer 00:31:30.400 --> 00:31:37.119 two thing. Interface VLAN 10 is a layer three thing. Interface VLAN 10 routes traffic in and 00:31:37.119 --> 00:31:46.160 out of VLAN 10. Good stuff. All right, so let's create the rest of them. So that way, 00:31:46.160 --> 00:31:52.640 there we can wrap up today's class. So we've got interface VLAN 20. And that's going to be 00:31:53.359 --> 00:32:09.199 IP address 10.0.2, according to my diagram up there, 10.0.2.1, 255.255.255.0. What did I do wrong? 00:32:12.400 --> 00:32:20.959 I need one more D. Yep. Okay, now let's go interface VLAN 50. And that's going to be 1.1. 00:32:23.599 --> 00:32:28.719 And now let's do interface VLAN 200. And according to my, it's going to be 3.1. 00:32:32.160 --> 00:32:36.719 All right, so now we've got all the SVIs configured here. But look, we've got another router, 00:32:36.719 --> 00:32:41.119 another router that could also be an entry exit point in our environment, right? We want redundancy, 00:32:41.119 --> 00:32:45.439 we want high availability. So does that mean over on DSW2, we want to create SVIs as well? 00:32:45.439 --> 00:32:49.199 Absolutely. One for each and every single one of our subnets, VLAN broadcast domains. 00:32:49.280 --> 00:32:55.680 So interface VLAN 10. Now, we want to, we're going to put in the exact same subnet. So 10.0, 00:32:58.800 --> 00:33:07.040 10.0.0.1. Can't use that, right? Why? Because who else is using that? DSW1. So I got to 00:33:07.040 --> 00:33:12.959 use an address that's not being used in the same subnet. Now I'm going to ping 00:33:12.959 --> 00:33:22.640 10.0.0.1. Successful. Okay, the question is, did we go through the layer two environment or the 00:33:22.640 --> 00:33:26.800 layer three environment? Okay, I'm pretty confident we went through the layer two environment, not the 00:33:26.800 --> 00:33:31.760 layer three environment, meaning I was able to test connectivity through here. That's what I've 00:33:31.760 --> 00:33:39.920 done. But to be sure, let's do a trace instead to 10.0.0.1. And if the trace route only shows 00:33:39.920 --> 00:33:43.040 one hop, it means we went through the layer two environment and that's it. 00:33:43.040 --> 00:33:47.359 One hop, we went through from here, stayed in the layer two environment, hit the next router, 00:33:47.359 --> 00:33:52.400 the next router was 10.0.0.1. We're good. So we know we have basic connectivity between our 00:33:52.400 --> 00:33:58.400 default gateways now. One's 10.0.0.2, the other one's 10.0.0.1. So let's go ahead and create, 00:33:58.400 --> 00:34:03.119 for example, interface VLAN 20. Over here, we'll do the same thing, but in this case, 00:34:03.119 --> 00:34:14.159 it's going to be 2.1 or 2.2, pardon me, not 2.1, 2.2. We'll do the same thing for 50. And so we 00:34:14.159 --> 00:34:18.719 said this was going to be 1.2 now on this side. And then we're going to do the same thing for 00:34:18.719 --> 00:34:26.479 VLAN 200, and it's going to be 3.2, right? So now we have our SVI set up on both sides, 00:34:26.479 --> 00:34:36.080 interface VLAN 10, 20, 50, 200, 10, 20, 50, 200, 10.0.0.1, 10.0.0.1.2, 10.0.0.2, right? 00:34:37.760 --> 00:34:42.000 And so on and so forth for our addressing that we need. So those addresses are now reserved for 00:34:42.000 --> 00:34:45.679 our default gateway. We would not hand them out to any clients in those particular subnets, 00:34:45.679 --> 00:34:49.439 but we have ourselves in a really good spot now, in a really, really, really good spot. 00:34:49.439 --> 00:34:52.719 Jeffrey says, do a source ping, Raymond, if you can. Sure, absolutely. We can do that. 00:34:53.280 --> 00:35:00.639 So if we did, for example, ping, where was that ping we did? Do ping 10.0.0.1 from source, 00:35:00.639 --> 00:35:05.679 10.0.0.2. There you go. And we trace. 00:35:05.679 --> 00:35:17.679 It won't let me do that. What command do I got to do here for traceroute? 00:35:26.320 --> 00:35:27.439 That's all you're going to let me do? 00:35:35.679 --> 00:35:54.239 Yep. There you go. Okay. So we're pinging through the layer two environment, which is beautiful. 00:35:54.239 --> 00:35:58.639 It's exactly what we want. So folks, what I want you to realize is today we've successfully set 00:35:58.639 --> 00:36:04.560 up our VLANs on all of our four switches. We set up all of our trunks. We played around with VTP, 00:36:04.560 --> 00:36:08.959 and we've set up, what, our default gateways for each of those VLANs we created, 00:36:08.959 --> 00:36:13.439 and we set up our routed ports as well to connect us up to the core of our environment. 00:36:13.439 --> 00:36:19.360 So all of these configs, all of these core elements of your network are extremely important 00:36:19.360 --> 00:36:23.520 for your certification exam success. So if there's anything we covered today where you're a 00:36:23.520 --> 00:36:28.159 little bit foggy on, make sure you go back and review what we've covered at some point in time. 00:36:28.159 --> 00:36:32.159 And if you have any questions, comments, or concerns, make sure you reach out using the 00:36:32.159 --> 00:36:37.600 request mentoring option anytime. So that way there we can clarify anything about these topics 00:36:37.600 --> 00:36:41.760 for you, and therefore you're going to be successful in the real world as well as on the 00:36:41.760 --> 00:36:45.760 certification exam. All right. Great job there today, folks. Well done.