1

I have a 4 port module in my 3800 router, an HWIC-4ESW, that acts like a switch. I can configure IPs on each port if I do something like the following:

conf t
int F1/1
switchport access vlan 20
<CTRL-Z>
vlan database
vlan 20
exit
int vlan20
ip address 192.168.1.1 255.255.255.0

If I do this for multiple ports, and then connect different switches to each port:

  1. Do I need to do any configuring of the vlans on those switches? I would think not since I am using switchport access instead of trunking?
  2. If I configure multiple ports this way, will the clients be able to talk to each other via Layer 3 (Through the router) and not layer 2? I have seen some posts that vlans are not entirely secure, but my research makes me question that.... (Maybe that is another question)
  3. How does this end up being different from having multiple interfaces in the router?

1 Answer 1

1
  1. No. You are right about not having to do anything due to configuring the port as an access port. There may be concerns about certain types of broadcast traffic (such as Spanning-Tree) that you may want to look into filtering.

  2. Yes, provided that the router has a layer 3 address configured for those interfaces/vlans (which in your example, it does.) If this is not desireable, you can always configure an access list to deny access between VLANs.

  3. I'm not sure I fully understand this question. If another way to word this question is "How is this different than having all of these switchports as separate interfaces in the router?" then I suppose the only major difference is that you can't manage all of them from the router. Also, bandwidth/throughput to the router is limited by whatever speed the uplink is from the switch, though this isn't usually a problem is most scenarios.

2
  • For number 3, your rephrasing was what I meant, had to run into meeting so typed that one fast :-). Can you tell me ( or link to) anything more about the Broadcast traffic concerns? I don't quite follow that.... Oct 6, 2009 at 18:53
  • 1
    Sure. Most types of broadcast traffic stays within the confines of the broadcast domain (VLAN), but Cisco will still send certain PDUs/frames regardless of VLAN configuration such as Spanning-Tree protocol PDUs and CDP (Cisco Discovery Protocol) PDUs. Cisco can probably explain this better than I can, so what follows is a link to Cisco's knowledge base. You probably want to read up on the BPDU Guard and BPDU Filter and pick one of those based on what your requirements are. cisco.com/en/US/docs/switches/lan/catalyst4000/7.4/… Oct 6, 2009 at 20:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .