Solved Route from a layer 3 switch through a layer 2 then to Layer 3

---

I have an interesting scenario that I'm trying to wrap my head around. I'm hoping someone can lend some guidance on how I can set this up to work.

I wish I could add an image, but I can't seem to figure it out.

Essentially I have a Layer 3 CORE switch with various VLAN interfaces.

For example VLAN 4 is using network 10.80.4.0 /22. The inside interface or gateway for VLAN4 is 10.80.4.1 and it connects to the inside interface on the router at 10.80.4.254. The default route on the layer 3 switch is 10.80.4.254 which then routes to the MPLS/Internet

so some vrf's that live here are:

10.80.4.1 /22 VLAN 4
10.80.20.1 /22 VLAN 20

Here is the scenario:

I have another layer 3 switch that is doing routing as well, but there is a layer 2 switch in between physically downstream from the layer 3 CORE trunking the two vlans previously mentioned with only 1 vrf for management. Downstream from the layer 2 switch is my second layer 3 switch which has IP Routing enabled.

The vrf's on this Layer 3 switch are

10.200.4.1 /22 VLAN 4
10.200.20.1 /22 VLAN 20

I haven't trunked the 2nd layer 3 switch to the layer 2 switch because the networks differ between the VLANs ie. 10.80.x.x on the CORE and 10.200.x.x on the 2nd layer 3 switch.

How can I configure layer 3 routing so that I can accomplish the goal of having two private autonomous networks on my LAN and can reach the MPLS and internet from both?

This should help give an idea of what the physical looks like.

NMF

If not allowing traffic from one VLAN to another is your concern place ACLs where appropriate. Both routers must see the network that connects them via the switch. Both routers must see the VLAN which provides the access to the internet. Create ACLs that deny traffic on both routers denying each other so unneeded traffic isn't sent through the switch.

I just want to be able to get out to the MPLS/Internet and back. I didn't think I could trunk because the VLANs on each layer 3 switch represent differing networks. How can I setup layer 3 routing to accomplish this goal?

NMF

@Amador-Torrez,

First things first (Test for connectivity)

• ping from 10.80.4.1 to 10.200.4.1 - should fail
• ping from 10.80.4.1 to 10.200.20.1 - should fail

If both are successful, do the following

• type Show IP Route on both Layer 3 switches, you should see the internal switch has routes to every network. except the connection to the WAN network. On the one connected to the router, you should see the same thing too.

You should find that it's not working. You need a separate vlan number for each subnet you will use. Essentially the easiest breakdown is this A VLAN = Broadcast Domain= Subnet So when you use the same VLAN numbers throughout your network but have them in separate networks it will not work because it doesn't see the other logical subnet number as being in the same broadcast domain.

The trunk between the switches allow for multiple vlans to use the same physical connection, regardless of the subnets but on both side of the trunk the VLAN numbers should match and of course the subnets should also match too!

Great job on getting the diagram to appear, I too have failed at this before!

Thanks for looking at this.

I now understand that two networks cannot share the same VLAN number.

So on the downstream layer 3 switch I should be able to set the default gateway to the upstream network 10.80.4.1.

On the upstream switch I would need to create static routes for each network on the downstream switch correct?

So a route statement on the upstream switch would look like this right?

ip route 10.200.20.0 255.255.252.0 10.80.4.1?

On the downstream switch I would make a default route.

ip route 0.0.0.0 0.0.0.0 10.80.4.1?

@Amador-Torrez,

a little later in my reply than I'd like but it's been a hectic few days. I've tried to make a little more sense of your diagram for routing but I'm not sure if I've understood it totally so let's start at the top and work down to make sure I have it correct then we'll talk about routing. Correct the following if I'm wrong in my logical understanding.

1. You've got a connection to your WAN from Router (Network 1 )
2. From your Router to the Core Switch (Network 2)
3. From the Core Switch to Layer 2 to the Lab Core (Networks 3 and 4)
4. From the Lab Core to the last layer 2 (Networks 5 and 6)

Requirements:
You need to be able to have all VLANs access the WAN?
You need to have all VLANs access one another or not?

Question, what is the goal of using VRFs in your configuration? just curious.

The goal was to try to have a separate private network within a private network I guess . I understand how vlan Routing works because most of the or rather all of the environments I manage are router to layer 3 switch where the outside interface of the router faces an MPLS network and the inside interface faces the inside layer 3 router private network. I wanted the VLANS on the 2nd layer 3 router to be autonomous to the networks on the first layer 3 switch. Meaning in order for the network on the 2nd layer 3 switch to communicate, it would have to route its traffic to the first layer 3 switch. Does that makes sense?

This can be considered resolved. After more thought and trials, I was able to get this working.