Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

core w/ vlans link to router

whats the best practice when you link a core switch with a say 10 vlans to a router or firewall.

1. Does the interface linking this 2 devices has to be a lone interface in a separate vlan..

2. or is it just ok to connect this interface in a vlan with server farm.

thanks a lot.

VIP Purple

Re: core w/ vlans link to router


it depends on what you want to achieve: is the core switch providing the inter-vlan routing as well ? If not, you need to configure a trunk between the switch and the router. If the core switch is providing the routing, I guess all you need is a default route from the core switch to the router or firewall, and the interface can be member of any VLAN, as long as that VLAN is routed on the core switch.



New Member

Re: core w/ vlans link to router

yes, it provides the inter vlan routing...but what i mean is, is the vlan connecting the router to the core must be a vlan with SINGLE member interface only ? (i am talking about the best practice, becoz i know also that it could also be a member of any vlan with users or servers and use that as default gateway as you mentioned.)..In p


Re: core w/ vlans link to router

If the router is doing interVLAN routing, you need to configure the connection between the core switch and the router as a trunk. A trunk interface will carry traffic from all VLANs. So basically, the router's interface will be in all VLANs. You use subinterfaces on the router like this:

Router(config)# interface fastethernet 2.1

Router(config-subif)# encap dot1q 1

Router(config-subif)# ip address

Router(config-subif)# exit

Router(config)# interface fastethernet 2.2

Router(config-subif)# encap dot1q 2

RRouter(config-subif)# ip address

Router(config-subif)# end

This creates routing between VLAN 1 and VLAN 2...


New Member

Re: core w/ vlans link to router

its the core switch that is doing the inter vlan routing (not the router)

the only thing questionable on me is the vlan in the core switch where the router ethernet interface is connected. Should that Vlan be consisting only of that port. Because it could just be part of a vlan where servers are or where workstations asking about the best practice in this scenario because both of the above are possible.


New Member

Re: core w/ vlans link to router

As long as you are not using VLAN1 I would say that putting the firewall interface in your core or server VLAN/subnet would be best. VLAN1 is discouraged because switches and other devices send CDP, BPDU and other administrative traffic in this VLAN.Putting the firewall in its own VLAN/subnet is not very scalable as it adds more routes/vlans to your core switches.

Common Scenario

All users access servers in a centralized subnet. Basically all servers are in say VLAN 100 with subnet Users are in misc VLANS, ie. 101,102,etc, with different subnets,, You would then put all the servers interfaces and network device interfaces in VLAN 100. With your core switch doing Inter-VLAN routing and a static route to the firewall.

CreatePlease login to create content