1

This question arose after some some Snort efficiency issues we were having. In this scenario, say we have three Catalyst switches, each connected to a single layer 3 switch, and each configured to switch traffic from any VLAN configured. The "core" layer 3 switch will route each packet based on its VLAN tag and ID. This core switch acts as the default gateway for every switch and VLAN.

The question is: If we have two workstations, each on the same switch and VLAN, will their traffic be routed by the layer 3 "core" switch if they attempt to communicate with one another? Both workstations are in the same subnet, VLAN, and broadcast domain. ARP broadcasts would hit the core and be routed, and workstation two would respond. Will the following IP traffic also be managed by the core switch, or will they communicate without the core switch?

Under usual circumstances, the switch would handle this and there wouldn't be any involvement from the layer 3 core...however with our VLAN setup, things can get a bit removed.

2 Answers 2

5

No, they'll be switched as they're in the same vlan, in fact the whole L3 thing in this question is a red-herring for this scenario as all your switches have the same vlans defined on their trunks, so that they're in the same switch is irrelevant. Only when they want to transit vlans will routing happen.

0
1

The traffic shouldn't go through the router as both workstations are in the same subnet and VLAN. Also, the layer 3 switch doesn't "route" ARP broadcasts as they are broadcasts, which are normally dropped by routers. In addition, a workstation will never ARP for an ip address not in it's own subnet as the workstation knows that the ip address is not local and will send the traffic to it's default gateway.

3
  • Sorry, several VLAN's span several switches...the only physical connection is through the layer 3 switch. That fact being omitted, you're correct. Oct 20, 2010 at 14:51
  • OK, but in your scenario you said that you have two workstations in the same VLAN connected to the same switch. In that scenario traffic between these two workstations should be confined to the switch. In addition, even if the workstations were on different switches, the traffic isn't "routed" by the layer 3 switch, it's "switched" by the layer 3 switch. Intra-VLAN traffic is switched while Inter-VLAN traffic is routed.
    – joeqwerty
    Oct 20, 2010 at 15:27
  • I agree, switch traffic is switched and routed traffic is routed. Oct 20, 2010 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .