Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a 4 port module in my 3800 router, an HWIC-4ESW, that acts like a switch. I can configure IPs on each port if I do something like the following:

conf t
int F1/1
switchport access vlan 20
vlan database
vlan 20
int vlan20
ip address

If I do this for multiple ports, and then connect different switches to each port:

  1. Do I need to do any configuring of the vlans on those switches? I would think not since I am using switchport access instead of trunking?
  2. If I configure multiple ports this way, will the clients be able to talk to each other via Layer 3 (Through the router) and not layer 2? I have seen some posts that vlans are not entirely secure, but my research makes me question that.... (Maybe that is another question)
  3. How does this end up being different from having multiple interfaces in the router?
share|improve this question
up vote 1 down vote accepted
  1. No. You are right about not having to do anything due to configuring the port as an access port. There may be concerns about certain types of broadcast traffic (such as Spanning-Tree) that you may want to look into filtering.

  2. Yes, provided that the router has a layer 3 address configured for those interfaces/vlans (which in your example, it does.) If this is not desireable, you can always configure an access list to deny access between VLANs.

  3. I'm not sure I fully understand this question. If another way to word this question is "How is this different than having all of these switchports as separate interfaces in the router?" then I suppose the only major difference is that you can't manage all of them from the router. Also, bandwidth/throughput to the router is limited by whatever speed the uplink is from the switch, though this isn't usually a problem is most scenarios.

share|improve this answer
For number 3, your rephrasing was what I meant, had to run into meeting so typed that one fast :-). Can you tell me ( or link to) anything more about the Broadcast traffic concerns? I don't quite follow that.... – Kyle Brandt Oct 6 '09 at 18:53
Sure. Most types of broadcast traffic stays within the confines of the broadcast domain (VLAN), but Cisco will still send certain PDUs/frames regardless of VLAN configuration such as Spanning-Tree protocol PDUs and CDP (Cisco Discovery Protocol) PDUs. Cisco can probably explain this better than I can, so what follows is a link to Cisco's knowledge base. You probably want to read up on the BPDU Guard and BPDU Filter and pick one of those based on what your requirements are.… – Charles Hooper Oct 6 '09 at 20:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.