So what exactly are these switched virtual interfaces anyways?
Well, if you're like me, you probably refer to these as simply VLAN interfaces.
And if you're like me, you're probably also wondering why is there such a
technical term for it like SVIs.
And I don't have a great answer for that, but I can tell you that Cisco loves
to call them SVIs.
And yet if we want to configure them, we're simply going to get onto an iOSX-E
device.
And we're going to type in interface VLAN and then some kind of ID. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we're going to type in interface VLAN and then some kind of ID.
So VLAN 10, VLAN 20.
And what this is, is it's a layer three interface that is directly bound to a V
LAN.
So there are certain situations where I can create layer three interfaces like
loop X that are part of the layer three domain.
But in our case, this layer three interface is going to be part of a layer two
domain.
It's going to be part of a specific VLAN. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's going to be part of a specific VLAN.
What exactly does that mean?
Well, I like to refer to this as a point of presence or a pop.
We'll call it that.
But it's a point of presence on a VLAN for the switching question.
So what are the uses for this?
Well, very commonly, we're going to rely on these as our default gateways.
So VLAN 10 is going to have a bunch of hosts on it.
I'm going to create a SBI for VLAN 10, give it an IP address, and all of my WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm going to create a SBI for VLAN 10, give it an IP address, and all of my
hosts will use this SBI as their default gateway.
It's their way off of the subnet, which we saw at the end of the last video,
when we were trying to communicate with a host on a different VLAN.
But we can use SBIs for other reasons beyond default gateways.
For example, it can be used as a point of management on the switch.
If I want to log into the switch, I need to have layer three IP address to
connect to. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
connect to.
And even if it's a layer two switch, I'm going to have to log into that switch
somehow.
And using an SBI as a management interface is pretty common.
And lastly, and this is often overlooked, I can tell you I've used this a lot
of situations.
It is a wonderful way to troubleshoot when we're having routing and switching
issues.
So maybe we're not able to get a ping across the network.
Well, I've got switches in the path that I could install or create an SBI on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, I've got switches in the path that I could install or create an SBI on
and use that to run troubleshooting.
And the more we become one with layer two and layer three, well, the more we're
going to be able to look at a situation and say,
"Oh, yeah, I can troubleshoot this just by creating a new SVI."
So let's look at that blended topology once again.
If I'm looking at a switch and I know that I've got this VLAN, let's just again
call it VLAN 10,
and I want to connect VLAN 10 to this layer two domain, well, I might have a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I want to connect VLAN 10 to this layer two domain, well, I might have a
bunch of switches all communicating with one another on VLAN 10 in some
capacity,
and then I've got a bunch of hosts down here as well.
Now notice this blended diagram doesn't tell us how these switches are
physically connected.
We just know that they have presence on VLAN 10's network.
But here's the question, can these hosts communicate with one another without WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But here's the question, can these hosts communicate with one another without
there being an SVI on these switches?
And the answer is yes.
An SVI is not part of the traffic flow, it's very important.
In this situation, I don't even have SVI's configured, and these hosts are able
to communicate, we can see that using the logical side of this diagram.
But what if I do create SVI's?
What if I have an SVI here on the left, an SVI here on the right, and again,
when I create it, as we've said, it gets bound to that VLAN.
So this little connecting line right here, that happens automatically, the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this little connecting line right here, that happens automatically, the
switch says, okay, as part of this layer two domain, I'm going to attach an SVI
.
And so at this point, do I need to go through the SVI, and the diagram didn't
really change that much.
I mean, we can see that I can communicate directly with a host on the same VLAN
.
But can I communicate with a host on a different subnet?
What if I've got this subnet over here, which is kind of what we saw, I'll go
through there, there we go.
What we saw at the end of the last video, and the answer is no, I can't just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
What we saw at the end of the last video, and the answer is no, I can't just
hop from one line to the other like this.
I'm going to have to go up and get routed.
The question is, what am I getting routed to?
In this situation, I have nowhere to go.
From a layer three perspective, I can't jump from this SVI onto this VLAN.
I don't have that path available.
And so this is why this type of diagram can be so useful for troubleshooting,
because this host might not be able to ping this host, and when we diagram this
all out, we realize that there's no routing path. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all out, we realize that there's no routing path.
I don't have a way to route from one VLAN to the other.
So what's the solution? Well, in this case, I need to create an SVI for VLAN 20
, and this will allow the switch to route to another layer three interface, and
then get handed off from a layer two perspective, thus enabling the ping
between those hosts.
Another way of looking at this when we zoom in just on a single switch is to
recognize that I might have, now we can draw this VLAN, let's say VLAN 10, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
recognize that I might have, now we can draw this VLAN, let's say VLAN 10,
inside of the switch, since we're just within a single switch.
So now I've got multiple hosts hanging off of VLAN 10 here, and they can all
communicate.
And then I say, OK, but I want this switch to have an SVI for VLAN 10, and so
this allows me to communicate and ping these hosts from this SVI.
But again, notice the traffic pattern here.
If I want this host to communicate to this host, I just need to hit the layer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If I want this host to communicate to this host, I just need to hit the layer
two network and come immediately down.
I do not pass through the SVI, and the SVI is not part of that traffic flow.
Conversely, now, let's say that we've got a bunch of switches, and so this is
just one of the switches in the path, and I've got this VLAN that I've got some
hosts that connect down off of VLAN 20, let's say this is VLAN 20 in this case.
And the question is, OK, how do I manage this switch? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the question is, OK, how do I manage this switch?
This switch doesn't have a layer three interface, I can't ping it, and I can't
log into it.
Now, the question that we might have to ask is, is this working?
Is this an online switch?
And the answer is yes.
It's working just fine, it's working at layer two.
These hosts can communicate with one another, even though I can't ping the
switch.
How can I ping the switch?
Well, as long as we're talking about being available via VLAN 20, I can again WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, as long as we're talking about being available via VLAN 20, I can again
create that SVI.
Or what if this switch has managed another way?
Maybe it's got an out of band management port on the back, and it goes off to a
management network.
And so now I'm trying to ping, I'm trying to make things work, I can't figure
out, these hosts aren't working very well, or something along the lines of
network connectivity issues.
How could I troubleshoot?
Well, once again, I could create an SVI in VLAN 20.
This is not going to be used as a default gateway, it's not going to be used as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is not going to be used as a default gateway, it's not going to be used as
a way to manage the switch.
But what I can do is, as mentioned, I can start pinging these other hosts.
Or I could ping from this switch out to another switch via VLAN 20.
It starts to give me that point of presence, again, the point of presence, on a
VLAN.
And so that's a great way for us to start to think about how these SVI's can be
used beyond just the most common ways that we deploy them. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
used beyond just the most common ways that we deploy them.
Now, lastly, we've mentioned a couple of times that we like there to be a one-
to-one relationship between our VLAN and our subnets.
Well, let's say like this, our subnets and our VLANs.
But it doesn't have to be this way. We could actually have a many-to-one
relationship between the two.
And the way this works is now I can take all of this that I've applied and
apply now multiple subnets to my SVI. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
apply now multiple subnets to my SVI.
How do I do that? I do it using the concept of secondary IP addresses.
This is a concept that was used more early on in networks, especially as we had
to evolve from network supporting multiple subnets to trying to split them all
out.
And secondary IP addresses can be very useful from the perspective of migrating
or merging networks or maybe demerging networks or whatever the situation is, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or merging networks or maybe demerging networks or whatever the situation is,
where we just have to support multiple addresses.
For example, if I'm converting, if I'm doing a conversion from one subnet to
another, well, then I probably need to support both of those subnets at the
same time within the same VLAN and a secondary is a great way to do it.
The way this works is when I get onto that interface for VLAN, let's say 10, I
can configure a primary IP address, let's say it's 10.0.10.1, and then I give WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
can configure a primary IP address, let's say it's 10.0.10.1, and then I give
it the subnet mask.
We'll just give it a /24 in this case.
So I configure an IP address and that's great, but now I can configure another
IP address, so maybe a different subnet, let's say it's 20.1, and same thing
with a subnet mask, and I tack on this word, secondary.
And what's interesting about this is I can actually add as many secondary WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And what's interesting about this is I can actually add as many secondary
addresses as I want. I can say IP address and then 10.0.30.1, same subnet mask,
and secondary, and both of these commands will remain on the switch
configuration.
So at that point, I support three different subnets all on a single domain. But
if we look at our topology diagrams here, there's no problem with that. We
haven't layered subnets into this conversation.
We've simply pointed out where there's layer two and layer three interfaces. So
now we might actually see where we have a split. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
now we might actually see where we have a split.
Maybe, for example, as we look, let's say this topology right here, maybe these
two hosts are in that 10.0.10.0/24. But maybe we've got a couple of hosts over
here.
And these hosts are actually in one of these secondaries. Let's say it's the 10
.0.20.0/24. So is this okay? Is this topology where two different subnets are WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
.0.20.0/24. So is this okay? Is this topology where two different subnets are
running on the same VLAN? Is that going to work?
And the answer is it's going to work. And these two hosts will be able to
communicate to one another. These two hosts will be able to communicate with
one another. No problem. So what is the problem?
Well, remember, VLAN is a broadcast domain. And because of that, a broadcast
that is sent by this host on the left is going to be received by the host that
's in the same subnet.
And it's going to be received by the hosts that are in the other subnets WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it's going to be received by the hosts that are in the other subnets
because they're all part of the same VLAN and all part of the same broadcast
domain.
And yeah, they'll just have to discard that traffic, but they still have to
receive it and process it. So this is why we don't like to use secondary
addresses.
But as mentioned, for IP address conversions, for network migrations, this can
be a powerful tool in our belt and one that we might just have to use.