- Re: VLAN Bridging Problem

PDA

View Full Version : Re: VLAN Bridging Problem


knoesel@gmx.ch
07-25-2004, 01:42 AM
OK, here are some more information:

I want to divide different clients into separate groups (vlans), like
laptops into vlan 2 and workstations into vlan 3. The cause is that i
want be able to shut down all switchports where laptops are connected
to - for security reasons.

actually i have to subnets but also problems with the ads
fileservice...



"Erik Tamminga" <newsgroups@NeOtammiSnPgAaM.nl> wrote in message news:<c2l348$3gu$1@news1.tilbu1.nb.home.nl>...
> Hi,
>
> What are you trying to accomplish? You're creating vlans to split traffic
> but still want IP to pass, effectively joining the two broadcast domains ?!
> Please give us some more information.
>
> Erik
>
> <knoesel@gmx.ch> wrote in message
> news:f6c71560.0403090325.635844ed@posting.google.com...
> > Hello everybody!
> >
> > My issue is to create two VLANs using the same IP Subnet, but I don't
> > know how to do it... :(
> >
> > First I tryed to use IRB/BVI like this:
> >
> > bridge irb
> > !
> > interface vlan 1
> > bridge-group 1
> > !
> > interface vlan2
> > bridge-group 1
> > !
> > interface bvi 1
> > ip address 10.0.0.1 255.255.0.0
> > !
> > bridge 1 protocol dec
> > !
> > ip dhcp pool Subnet
> > network 10.0.0.0 255.255.0.0
> > lease 0 1
> > !
> >
> > But it didn't work at all :-o
> >
> > Thanks for your help!
> >
> > I'm using IOS Rel. 12.1 on a C3550 with EMI Image.

Ivan Ostres
07-25-2004, 01:42 AM
In article <f6c71560.0403150014.419717e2@posting.google.com>,
knoesel@gmx.ch says...
> OK, here are some more information:
>
> I want to divide different clients into separate groups (vlans), like
> laptops into vlan 2 and workstations into vlan 3. The cause is that i
> want be able to shut down all switchports where laptops are connected
> to - for security reasons.
>
> actually i have to subnets but also problems with the ads
> fileservice...
>
>
>

Maybe dot1x would be better solution. It will give you much more than
your design..

--
Ivan

knoesel@gmx.ch
07-25-2004, 01:42 AM
Actually I'm using vmps to assign the clients dynamically.

Perhaps I must re-define my Question: Is it possible in any way to
use the same subnet for clients in different vlans?

> Maybe dot1x would be better solution. It will give you much more than
> your design..

Ivan Ostres
07-25-2004, 01:42 AM
In article <f6c71560.0403150625.5c476ed4@posting.google.com>,
knoesel@gmx.ch says...
> Actually I'm using vmps to assign the clients dynamically.
>
> Perhaps I must re-define my Question: Is it possible in any way to
> use the same subnet for clients in different vlans?
>
>
>

Let's say yes, BUT if you will not route between them.

--
Ivan

knoesel@gmx.ch
07-25-2004, 01:43 AM
> Let's say yes, BUT if you will not route between them.

how? :-)

Ivan Ostres
07-25-2004, 01:43 AM
In article <f6c71560.0403160102.b7d039d@posting.google.com>,
knoesel@gmx.ch says...
> > Let's say yes, BUT if you will not route between them.
>
> how? :-)
>
>

The idea behind the answer was: you can use same subnet on multiple
vlans on one switch if there will not be routing involved, because
problem with routing is that router can't have the same subnet on more
than one interface (because it doesn't know out of which port to forward
packet - it does that on subnet information basis).

So, if you don't need communication between vlans, you can use the same
subnet for all of them, because vlans are at L2 :-).


--
Ivan

knoesel@gmx.ch
07-25-2004, 01:46 AM
> The idea behind the answer was: you can use same subnet on multiple
> vlans on one switch if there will not be routing involved, because
> problem with routing is that router can't have the same subnet on more
> than one interface (because it doesn't know out of which port to forward
> packet - it does that on subnet information basis).
>
> So, if you don't need communication between vlans, you can use the same
> subnet for all of them, because vlans are at L2 :-).

OK... But the problem is, that I need also 2 VLAN Interfaces in the
same subnet and this wont work?!

Erik Tamminga
07-25-2004, 01:47 AM
> OK... But the problem is, that I need also 2 VLAN Interfaces in the
> same subnet and this wont work?!

Please, study vlan theory and think again if you still want this! This is
not what vlans are meant for.
Since you already have vmps, isn't there an other way to shut down all
laptop-ports. Why the stringent need for the same subnet, you have the
hardware to create separate subnets!

Erik