Ive never done VLAN before, in our own LAN i create subnets physically by using CISCO ASA 5505.

We now have added a new site and Ive been requested to create a VPN connection and 2 or 3 VLANs between 2 sites, this is the same VLANs in site 1 to have them in site 2. As example, one of the vlans will be use for the ip phones at both sites. Another VLAN will be used for Applications.

Sites will be connected over a 10mb leased line.

Im going to be given a Cisco 2821 router at either end. but ive been looking on the internet and this is a Layer 2 router.

Now, what is the best whay to do this? Should i request to have a different router which is layer 3 or should i request a layer 3 switch to plug into that router?



  • This is what ive been requested Nico, The system being deployed is based around a larger system spanning over a WAN. As you grow into these types of systems you are required to design the network to match standard requirements and good practices. We need: - 1x Voice VLAN on each site. - 1x Apps VLAN on each site. Both of the VLAN's are required to keep the time sensitive traffic isolated. - DHCP setup for issuing IP addressing to the handsets. - QOS on the network to prioritise the voice traffic. To be implemented on all network devices that the voice transverses. – Nicolas Marengo Jul 7 '09 at 10:54

Firstoff, the Cisco 2821 is just a router. I don't know where you've gotten this "layer 2 router" business from (the statement is an oxymoron in itself), but a 2821 is a perfectly capable IP router.

You don't want to extend a layer 2 broadcast domain across a VPN. You won't like how it performs.

Let's call your existing location "site A" and the new location "site B". Let's call the networks:

  • Site A Data subnet - VLAN id 1 -
  • Site A Voice subnet - VLAN id 2 -
  • Site B Data subnet - VLAN id 1 -
  • Site B Voice subnet - VLAN id 2 -

In your 2821's, you'd setup an IPSEC tunnel between the sites. Here's a decent example using a static key: http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080094634.shtml

Once you've got that, you'll create VLAN interfaces on the routers on each end, assigning the routers IP addresses in each VLAN:

Router in Site A:

interface FastEthernet0/0
no ip address
no shutdown
interface FastEthernet0/0.1
encapsulation dot1q 1 native
ip address 
interface FastEthernet0/0.2
encapsulation dot1q 2
ip address

Router in Site B:

interface FastEthernet0/0
no ip address
no shutdown
interface FastEthernet0/0.1
encapsulation dot1q 1 native
ip address 
interface FastEthernet0/0.2
encapsulation dot1q 2
ip address

Assuming you've set the IPSEC tunnel up properly w/ the proper addresses being excluded from NAT, traffic between the various subnets in the sites will be transparently encrypted and sent to the other end. The routers at each end will, because of their VLAN interfaces and static routing table entries, automatically tag traffic with the appropriate VLAN tags and drop them onto the Ethernet.

You'll need to configure the switches at both ends with trunk ports to connect the routers to, and you'll have to figure out how to integrate the Site A router into your existing routing topology re: the existing ASA-5505, but this should give you enough to go on to get started.

  • just a little mistake... happens when you look at too many websites at once. Meant to say that the router has got Optional Layer 2 switching support. But I read that is better to have a switch with Layer 3, as it works faster because they are basically "routers" built on "switching" hardware. Rather than just a router given switching support.... Hence the question, should i use the vlans from the router or get a switch to do it and how to expand it over wan if using the switch behind a router.. Thanks for all the info, think ive got enough to start drawing my plans. Nico – Nicolas Marengo Jul 7 '09 at 13:29

What you want to do is really not recommand. Extending a broadcast domain over a WAN is not a good idea.
There is 2 way to do this. If you have layer 2 link between you site, just use a switch. But as you talk about router I guess your site are connected with layer 3 so you can use L2TP to do Layer 2 over Layer 3 (4 in fact).

Please take a look to :

  • Sites will be connected over a 10mb leased line. they are not connected yet. And i havent got a router or switch yet, but they will send us cisco 2821 to do the connection at either end. – Nicolas Marengo Jul 7 '09 at 10:50

It is generally not a good idea to extend layer-2 (vlans) across long distances. If the propagation delay is to long, you will get a lot retransmissions (at best). This is the same reason why Cat-5 and fiber links have distance limitations. For every TCP packet that a machine sends, it is expecting an ACK back within a certain period of time -- if it does not get one it will have to retransmit (assuming the connection is able to be established at all).

This may be a good time to dig a little deeper and ask some more questions to try and determine what the goals are verse having someone who may not have the technical background say "I want vlans".

You can certainly use the same vlan numbers at both locations and just have a layer-3 link in the middle. The IP addresses will be different at each location, but the vlan numbers could be the same.

If you absolutely need to do this, you will need to establish a layer-2 tunnel between the locations. You may also need an appliance at both ends to do local ACKs and re-timing of the packets.

I would highly suggest you do some additional investigation into the technical and business requirements.


-- For every TCP packet that a machine sends, it is expecting an ACK back within a certain period of time

So what? TCP works even over satellites (with ~5s latency). It will adapt as needed.

For the author, L2TP may be of choice, but it places a whole lot of load on router. Personally, I find mini-ITX platform with Linux and VTUN/TAP or OpenVPN/TAP onboard a better choice. While not nearly as robust, it gives excellent uptime and can be replaced easily and cheap in case of failure.


(This is assuming that the link between sites is secure and encryption is not required.)

How are you creating subnets using ASA. Are you using subinterfaces and vlans OR are you using seperate ethernet interface for each LAN segment.

In any case although it is bad design I think switch will be more useful then router. You do not need router to connect vlans at two sites as same VLANs are required at both sides. Router would have helped in connecting from one network to another.

For you application any layer 2 or layer 3 manageable switch that can do trunking using VTP (VLAN Trunking Protocol) is more than enough. Just trunk VLANs from both side on the interface that is common to both sides and similar VLANs on both sides will get connected.

  • The Asa assings VLAN id automatically but im using seperate ethernet interface for each LAN segment. You also say that it is a bad design. what would be a good one then? Thanks. – Nicolas Marengo Jul 7 '09 at 12:10
  • Keep different LANs/VLANs in both offices. Offices separated by so much distance having same VLANs will make managing difficult. Where will you keep DHCP server? How will you handle things like IP conflict in case you reserve few IPs for static use. – Saurabh Barjatiya Jul 7 '09 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.