multiple subnets on the same cisco switch port

Question

We have several servers on colocation and now trying to re-organize the network by utilizing Cisco ASA 5505 as a router and Cisco 3750x series switch.

Network topology is looking like that:

    uplink
      |
+----------+
| ASA 5505 |
+----------+
      |
      |(trunk vlan10,101,102)
      |
+-----------+
|   3750x   |
+-----------+
      |
      |
      |
+--------------------------+
| Server N                 |
| 192.168.10.10  : vlan10  |
| 192.168.101.10 : vlan101 |
| 192.168.102.10 : vlan102 |
+--------------------------+

The problem with 3750x configuration as we need to deliver three different subnets (vlan 10,101,102) to the "Server N". "Server N" has multiple IPs from different subnets (vlan101 and 102) assigned to the same NIC. Plus, it has Base Motherboard Controller on board with another IP from vlan10. BMC shares the NIC - thus there is only one physical link from the server to switch.

Since 3750x doesn't allow having multiple vlans allowed on the same port with out trunking - what is the best way to configure the switch to allow this configuration?

UPDATE 2014-02-24:

The original question was asked a long time ago, so let me post the solution i found working for me with out messing with trunks and recompiling the system.

I used static routes to deliver traffic over a vlan to a server secondary addresses.

for the configuration above, the NIC has three subnets. Let's consider one of them as primary and include into VLAN configuration. Other two are going to be a routed subnets.

Here is the simple config:

    interface Vlan1
     ip address 192.168.10.1 255.255.255.0
    !
    ip route 192.168.101.0 255.255.255.0 192.168.10.10
    ip route 192.168.102.0 255.255.255.0 192.168.10.10

This way you can add multiple secondary subnets to your server.

However, i believe this is not the best way to configure it as it keeps secondary subnets out of VLANs - thus it's not as secure as we want it. But this is going my next questions to professionals.

Answer 1

Trunk the interface going to the server.

Answer 2

Although it is common to have a 1-to-1 Layer 2 to Layer 3 mapping (aka vlan to IP network mapping), you don't have to.

If you really don't want a trunk, it might be appropriate to have multiple L3 networks exist within a single vlan. However, keep in mind that this could be a security risk as all that is needed to bypass firewall rules between the L3 networks on the ASA is a host to change its IP settings since they are all in the same vlan.

You need to decide the appropriate solution on your own of course. However, if you get comfortable configuring vlan trunks on both switches servers then you can feel confident that your decision wasn't made due to a bias towards taking a shortcut.

Answer 3

Well, I'm not going to waste time telling you you're doing it wrong, but there is a way to achieve what you want that's going to burn ports on your 3750 :)

Set the following: Port 1 on VLAN10 Port 2 on VLAN101 Port 3 on VLAN102

Ports 4-7 on a fourth VLAN, let's call it 103.

Now... connected Port 1 to Port 4, Port 2 to Port 5, Port 3 to Port 6, Port 7 to your server.

Ta da... you have just bridged your three VLANs back together... YAY.

This is all sorts of the "wrong way to do it", but I suppose it does get you what you want, all three broadcast domains merged back together. Your ASA may get pissy with you, you've been warned.