Inter-VLAN Routing

Troubleshoot Inter-VLAN Routing (4.4)

In this section, you learn how to troubleshoot issues in an inter-VLAN routing environment.

Common Inter-VLAN Issues (4.4.1)

By now, you know that when you configure and verify, you must also be able to troubleshoot. This section discusses some common network problems associated with inter-VLAN routing.

There are a number of reasons why an inter-VAN configuration may not work. All are related to connectivity issues. First, check the physical layer to resolve any issues where a cable might be connected to the wrong port. If the connections are correct, use the list in Table 4-4 for other common reasons why inter-VLAN connectivity may fail.

Table 4-4 Common Inter-VLAN Issues

Troubleshoot Inter-VLAN Routing Scenario (4.4.2)

Next, examples of some of these inter-VLAN routing problems are covered in more detail.

The topology in Figure 4-8 will be used for all of these issues.

Figure 4-8 Inter-VLAN Routing Troubleshooting Topology

The VLAN and IPv4 addressing information for R1 is shown in Table 4-5.

Table 4-5 Router R1 Subinterfaces

Missing VLANs (4.4.3)

An inter-VLAN connectivity issue could be caused by a missing VLAN. The VLAN could be missing if it was not created, it was accidently deleted, or it is not allowed on the trunk link.

For example, PC1 is currently connected to VLAN 10, as shown in the show vlan brief command output in Example 4-24.

Example 4-24 Verify VLAN for PC1

S1# show vlan brief
VLAN Name                              Status    Ports
---- ------------------------------- --------- -------------------------------
1    default                         active    Fa0/2, Fa0/3, Fa0/4, Fa0/7
                                               Fa0/8, Fa0/9, Fa0/10, Fa0/11
                                               Fa0/12, Fa0/13, Fa0/14, Fa0/15
                                               Fa0/16, Fa0/17, Fa0/18, Fa0/19
                                               Fa0/20, Fa0/21, Fa0/22, Fa0/23
                                               Fa0/24, Gi0/1, Gi0/2
10   LAN10                           active    Fa0/6
20   LAN20                           active
99   Management                      active
1002 fddi-default                    act/unsup
1003 token-ring-default              act/unsup
1004 fddinet-default                 act/unsup
1005 trnet-default                   act/unsup
S1#

Now assume that VLAN 10 is accidently deleted, as shown in Example 4-25.

Example 4-25 VLAN 10 Is Deleted

S1(config)# no vlan 10
S1(config)# do show vlan brief
VLAN Name                              Status     Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/2, Fa0/3, Fa0/4, Fa0/7
                                                Fa0/8, Fa0/9, Fa0/10, Fa0/11
                                                Fa0/12, Fa0/13, Fa0/14, Fa0/15
                                                Fa0/16, Fa0/17, Fa0/18, Fa0/19
                                                Fa0/20, Fa0/21, Fa0/22, Fa0/23
                                                Fa0/24, Gi0/1, Gi0/2
20   LAN20                            active
99   Management                       active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup
S1(config)#

Notice that VLAN 10 is now missing from the output in Example 4-25. Also notice that port Fa0/6 has not been reassigned to the default VLAN. The reason is because when you delete a VLAN, any ports assigned to that VLAN become inactive. They remain associated with the VLAN (and thus inactive) until you assign them to a new VLAN or re-create the missing VLAN.

Use the show interface interface-id switchport command to verify the VLAN membership, as shown in Example 4-26.

Example 4-26 Verify an Interface’s VLAN Membership

S1(config)# do show interface fa0/6 switchport
Name: Fa0/6
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 10 (Inactive)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
(Output omitted)

Re-creating the missing VLAN would automatically reassign the hosts to it, as shown in Example 4-27.

Example 4-27 Attempt to Re-create and Verify VLAN 10

S1(config)# vlan 10
S1(config-vlan)# do show vlan brief
VLAN Name                              Status     Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/2, Fa0/3, Fa0/4, Fa0/7
                                                Fa0/8, Fa0/9, Fa0/10, Fa0/11
                                                Fa0/12, Fa0/13, Fa0/14, Fa0/15
                                                Fa0/16, Fa0/17, Fa0/18, Fa0/19
                                                Fa0/20, Fa0/21, Fa0/22, Fa0/23
                                                Fa0/24, Gi0/1, Gi0/2
20   LAN20                            active
99   Management                       active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup
S1(config-vlan)#

Notice that the VLAN has not been created as expected. The reason is because you must exit from VLAN sub-configuration mode to create the VLAN, as shown in Example 4-28.

Example 4-28 Exit VLAN Configuration Mode and Then Re-create and Verify VLAN

S1(config-vlan)# exit
S1(config)# vlan 10
S1(config)# do show vlan brief
VLAN Name                               Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                            active     Fa0/2, Fa0/3, Fa0/4, Fa0/7
                                                   Fa0/8, Fa0/9, Fa0/10, Fa0/11
                                                   Fa0/12, Fa0/13, Fa0/14, Fa0/15
                                                   Fa0/16, Fa0/17, Fa0/18, Fa0/19
                                                   Fa0/20, Fa0/21, Fa0/22, Fa0/23
                                                   Fa0/24, Gi0/1, Gi0/2
10   VLAN0010                           active     Fa0/6
20   LAN20                              active
99   Management                         active
1002 fddi-default                       act/unsup
1003 token-ring-default                 act/unsup
1004 fddinet-default                    act/unsup
1005 trnet-default                      act/unsup
S1(config)#

Now notice that the VLAN is included in the list and that the host connected to Fa0/6 is on VLAN 10.

Switch Trunk Port Issues (4.4.4)

Another issue for inter-VLAN routing includes misconfigured switch ports. In a legacy inter-VLAN solution, this could be caused when the connecting router port is not assigned to the correct VLAN.

However, with a router-on-a-stick solution, the most common cause is a misconfigured trunk port.

For example, assume PC1 was able to connect to hosts in other VLANs until recently. A quick look at maintenance logs revealed that the S1 Layer 2 switch was recently accessed for routine maintenance. Therefore, you suspect the problem may be related to that switch.

On S1, verify that the port connecting to R1 (i.e., F0/5) is correctly configured as a trunk link using the show interfaces trunk command, as shown in Example 4-29.

Example 4-29 Verify Trunking

S1# show interfaces trunk
Port        Mode              Encapsulation  Status        Native vlan
Fa0/1       on                802.1q         trunking      1
Port        Vlans allowed on trunk
Fa0/1       1-4094
Port        Vlans allowed and active in management domain
Fa0/1       1,10,20,99
Port        Vlans in spanning tree forwarding state and not pruned
Fa0/1       1,10,20,99
S1#

The Fa0/5 port connecting to R1 is mysteriously missing from the output. Verify the interface configuration using the show running-config interface fa0/5 command, as shown in Example 4-30.

Example 4-30 Verify Interface Configuration

S1# show running-config interface fa0/5
Building configuration...
Current configuration : 96 bytes
!
interface FastEthernet0/5
 description Trunk link to R1
 switchport mode trunk
 shutdown
end
S1#

As you can see, the port was accidently shut down. To correct the problem, reenable the port and verify the trunking status, as shown in Example 4-31.

Example 4-31 Reenable and Verify the Port

S1(config)# interface fa0/5
S1(config-if)# no shut
S1(config-if)#
*Mar  1 04:46:44.153: %LINK-3-UPDOWN: Interface FastEthernet0/5, changed state to
  up
S1(config-if)#
*Mar  1 04:46:47.962: %LINEPROTO-5-UPDOWN: Line protocol on Interface
  FastEthernet0/5, changed state to up
S1(config-if)# do show interface trunk
Port         Mode              Encapsulation   Status        Native vlan
Fa0/1        on                802.1q          trunking      1
Fa0/5        on                802.1q          trunking      1
Port         Vlans allowed on trunk
Fa0/1        1-4094
Fa0/5        1-4094
Port         Vlans allowed and active in management domain
Fa0/1        1,10,20,99
Fa0/5        1,10,20,99
Port         Vlans in spanning tree forwarding state and not pruned
Fa0/1        1,10,20,99
Fa0/1        1,10,20,99
S1(config-if)#

To reduce the risk of a failed inter-switch link disrupting inter-VLAN routing, redundant links and alternate paths should be part of the network design.

Switch Access Port Issues (4.4.5)

When a problem is suspected with a switch access port configuration, use verification commands to examine the configuration and identify the problem.

Assume PC1 has the correct IPv4 address and default gateway but is not able to ping its own default gateway. PC1 is supposed to be connected to a VLAN 10 port.

Verify the port configuration on S1 using the show interfaces interface-id switchport command, as shown in Example 4-32.

Example 4-32 Verify the Port Configuration

S1# show interface fa0/6 switchport
Name: Fa0/6
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none

The Fa0/6 port has been configured as an access port, as indicated by “static access”. However, it appears that it has not been configured to be in VLAN 10. Verify the configuration of the interface, as shown in Example 4-33.

Example 4-33 Verify the Port Configuration in the Running-Config

S1# show running-config interface fa0/6
Building configuration...
Current configuration : 87 bytes
!
interface FastEthernet0/6
 description PC-A access port
 switchport mode access
end
S1#

Assign port Fa0/6 to VLAN 10 and verify the port assignment, as shown in Example 4-34.

Example 4-34 Assign the VLAN to the Port and Verify the Configuration

S1# configure terminal
S1(config)# interface fa0/6
S1(config-if)# switchport access vlan 10
S1(config-if)#
S1(config-if)# do show interface fa0/6 switchport
Name: Fa0/6
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 10 (VLAN0010)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
(Output omitted)

PC1 is now able to communicate with hosts on other VLANs.

Router Configuration Issues (4.4.6)

Router-on-a-stick configuration problems are usually related to subinterface misconfigurations. For instance, an incorrect IP address was configured or the wrong VLAN ID was assigned to the subinterface.

For example, R1 should be providing inter-VLAN routing for users in VLANs 10, 20, and 99. However, users in VLAN 10 cannot reach any other VLAN.

You verified the switch trunk link and all appears to be in order. Verify the subinterface status using the show ip interface brief command, as shown in Example 4-35.

Example 4-35 Verify the Status of the Subinterfaces

R1# show ip interface brief
Interface              IP-Address      OK? Method Status                 Protocol
GigabitEthernet0/0/0   unassigned      YES unset  administratively down  down
GigabitEthernet0/0/1   unassigned      YES unset  up                     up
Gi0/0/1.10             192.168.10.1    YES manual up                    up
Gi0/0/1.20             192.168.20.1    YES manual up                    up
Gi0/0/1.99             192.168.99.1    YES manual up                    up
Serial0/1/0            unassigned      YES unset  administratively down down
Serial0/1/1            unassigned      YES unset  administratively down down
R1#

The subinterfaces have been assigned the correct IPv4 addresses, and they are operational.

Verify which VLANs each of the subinterfaces is on. To do so, the show interfaces command is useful, but it generates a great deal of additional unrequired output. The command output can be reduced using IOS command filters as shown in Example 4-36.

Example 4-36 Verify the VLANs Configured on Each Subinterface

R1# show interfaces | include Gig|802.1Q
GigabitEthernet0/0/0 is administratively down, line protocol is down
GigabitEthernet0/0/1 is up, line protocol is up
  Encapsulation 802.1Q Virtual LAN, Vlan ID  1., loopback not set
GigabitEthernet0/0/1.10 is up, line protocol is up
  Encapsulation 802.1Q Virtual LAN, Vlan ID  100.
GigabitEthernet0/0/1.20 is up, line protocol is up
  Encapsulation 802.1Q Virtual LAN, Vlan ID  20.
GigabitEthernet0/0/1.99 is up, line protocol is up
  Encapsulation 802.1Q Virtual LAN, Vlan ID  99.
R1#

The pipe symbol ( | ) along with some select keywords is a useful method to help filter command output. In this example, the keyword include was used to identify that only lines containing the letters “Gig” or “802.1Q” will be displayed. Because of the way the show interface output is naturally listed, using these filters produces a condensed list of interfaces and their assigned VLANs.

Notice that the G0/0/1.10 interface has been incorrectly assigned to VLAN 100 instead of VLAN 10. This is confirmed by looking at the configuration of the R1 GigabitEthernet 0/0/1.10 subinterface, as shown in Example 4-37.

Example 4-37 Verify the Configuration of the Subinterface in the Running-Config

R1# show running-config interface g0/0/1.10
Building configuration...
Current configuration : 146 bytes
!
interface GigabitEthernet0/0/1.10
 description Default Gateway for VLAN 10
 encapsulation dot1Q 100
 ip address 192.168.10.1 255.255.255.0
end
R1#

To correct this problem, configure subinterface G0/0/1.10 to be on the correct VLAN using the encapsulation dot1q 10 subinterface configuration mode command, as shown in Example 4-38.

Example 4-38 Correct and Verify the Subinterface Configuration

R1# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)# interface gigabitEthernet 0/0/1.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# end
R1#
R1# show interfaces | include Gig|802.1Q
GigabitEthernet0/0/0 is administratively down, line protocol is down
GigabitEthernet0/0/1 is up, line protocol is up
  Encapsulation 802.1Q Virtual LAN, Vlan ID  1., loopback not set
GigabitEthernet0/0/1.10 is up, line protocol is up
  Encapsulation 802.1Q Virtual LAN, Vlan ID  10.
GigabitEthernet0/0/1.20 is up, line protocol is up
  Encapsulation 802.1Q Virtual LAN, Vlan ID  20.
GigabitEthernet0/0/1.99 is up, line protocol is up
R1#

When the subinterface has been assigned to the correct VLAN, it is accessible by devices on that VLAN, and the router can perform inter-VLAN routing.

With verification, router configuration problems are quickly addressed, allowing inter-VLAN routing to function properly.

CHECK YOUR UNDERSTANDING—TROUBLESHOOT INTER-VLAN ROUTING (4.4.7)

Refer to the online course to complete this activity.

LAB—TROUBLESHOOT INTER-VLAN ROUTING (4.4.9)

In this lab, you complete the following objectives:

• Part 1: Build the Network and Load Device Configurations

• Part 2: Troubleshoot the Inter-VLAN Routing Configuration

• Part 3: Verify VLAN Configuration, Port Assignment, and Trunking

• Part 4: Test Layer 3 Connectivity