Look at this L3 config of vlan interfaces?

You guys see where it says interface vlan### and then shut down.
Question. This is a layer 3 switch used as a gateway and lan switch.
but I guess my question is if someone created vlans is this one way to create a vlan
is by using vlan interfaces and then shutting them down because the shut down vlans
are actually used on our network but why would someone create all these vlan interfaces and then shut them down? is that a way to create vlans? vs the other normal way?
(this is code from our L3 gateway but IPs have been changed to bogus ips but the meaning is still here.) thanks guys...

interface Vlan141
 description FourthAveData2
 ip address 192.168.61.1 255.255.255.0
!
interface Vlan151
 description FourthAveVPNClients - no ip address - shutdown
 no ip address
 shutdown
!
interface Vlan231
 description FourthAveCore1Firewall1InternetP2P
 ip address 192.168.231.1 255.255.255.252
!
interface Vlan232
 description FourthAveCore1Gateway1P2P
 ip address 192.168.231.5 255.255.255.252
!
interface Vlan233
 description FourthAveFirewall1FRBGatewayP2P - no ip address - shutdown
 no ip address
 shutdown
!
interface Vlan234
 description FourthAveFirewall1ORCCGatewayP2P - no ip address - shutdown
 no ip address
 shutdown
!
interface Vlan235
 description FourthAveFirewall1DebitATMGatewayP2P - no ip address - shutdown
 no ip address
 shutdown
!
interface Vlan236
 description FourthAveCore1Firewall1PrivateP2P
 ip address 192.168.231.33 255.255.255.252
!
interface Vlan237
 description FourthAveFirewall1VPNGateway1P2P - no ip address - shutdown
 no ip address
 shutdown
!
interface Vlan238
 description FourthAveFirewall1CavionGatewayP2P - no ip address - shutdown
 no ip address
 shutdown
!
interface Vlan239
 description FourthAveFirewallELANGatewayP2P
 ip address 192.168.239.1 255.255.255.0
!
interface Vlan900
 description FourthAveDMZ  ***** Do not activate this interface - outside access *****
 no ip address
 shutdown
!
interface Vlan950
 description WebSenseMonitor - no ip address - shutdown
 no ip address
 shutdown

Find more posts tagged with

Comments

pham0329

Not sure if I understood your question, but creating a vlan interface does not create the vlan.

itdaddy

thanks pham0329.
that is what I thought but why are there so many of the interface vlans created and then shutdown? what kind of method is that? Unless he created them and then was going to use them as gateways and then didn't want to (changed his mind) and didn't remove them because it is a bugger to remove them from the what is the vlan.dat file? you think? we just have so many interface vlans every where and then he shuts them down wasn't sure if this was some CCNP method of creating vlans.in exchange for the normal method we all use...thanks bud that was the question I had..

shodown

In my Designs I usually create severfarms, DMZ, PC, and possibly 2 others. I like to to have them in my design in case they are needed.

Forsaken_GA

itdaddy wrote: »

thanks pham0329.
that is what I thought but why are there so many of the interface vlans created and then shutdown? what kind of method is that? Unless he created them and then was going to use them as gateways and then didn't want to (changed his mind) and didn't remove them because it is a bugger to remove them from the what is the vlan.dat file? you think? we just have so many interface vlans every where and then he shuts them down wasn't sure if this was some CCNP method of creating vlans.in exchange for the normal method we all use...thanks bud that was the question I had..

If I had to guess, he did that so he could add the description field. It would allow him to get information about what each vlan is for when he issues show interface description

Pretty good idea. I've never thought of actually setting up no shut vlan interfaces to do that before, but I think I will now.

vinbuck

Just curious what kind of hardware this is? Kind of a shot in the dark but ive seen some switches that will allow you to create multiple interface vlans but only one can be active at a time which keeps the others shutdown. Can't remember what kind of switch it was though.

pham0329

MississippiGuardsman wrote: »

Just curious what kind of hardware this is? Kind of a shot in the dark but ive seen some switches that will allow you to create multiple interface vlans but only one can be active at a time which keeps the others shutdown. Can't remember what kind of switch it was though.

You're referring to a L2 switch. On an L2 switch, you can create multiple VLAN interface, but when you try to activate the 2nd one, the first one will shutdown

itdaddy

could be yep could be for notes like you said..I see alot but it is a L3 3560 switch CORE switch
it is used as a gateway for many things but I guess I have to get use to configs that may not do anything but
be used for notes thanks guys

DPG

pham0329 wrote: »

Not sure if I understood your question, but creating a vlan interface does not create the vlan.

Actually, creating a VLAN interface will create the VLAN if it doesn't already exist.

pham0329

Not from what I've seen...what ios are you using?

ColbyG

DPG wrote: »

Actually, creating a VLAN interface will create the VLAN if it doesn't already exist.

No it won't. Adding a port to a non-existent VLAN will typically create the VLAN (depending on OS and platform).

DPG

ColbyG wrote: »

No it won't. Adding a port to a non-existent VLAN will typically create the VLAN (depending on OS and platform).

Whoops, that is what I meant.

*BB*

pham0329 wrote: »

You're referring to a L2 switch. On an L2 switch, you can create multiple VLAN interface, but when you try to activate the 2nd one, the first one will shutdown

I will disagree to an extent. My older 2950's will only allow a single VLAN to be up at any one time, but the 3750's I use at work are predominately L2 and all have multiple VLANS active and in an up/up state.

Forsaken_GA

*BB* wrote: »

I will disagree to an extent. My older 2950's will only allow a single VLAN to be up at any one time, but the 3750's I use at work are predominately L2 and all have multiple VLANS active and in an up/up state.

3750's are layer 3 switches. Whether or not you use them as such is up to you of course, but I don't believe there's such a thing as a 3750 that can't do layer 3, as layer 3 capability is a requirement in Cisco land for having multiple SVI's active.

pham0329

mmm...aren't 3750s L3 switches?

Edit: Looks like Forsaken beat me to it.

*BB*

My bad, you guys are right. I read it in the wrong context.

ColbyG

Forsaken_GA wrote: »

as layer 3 capability is a requirement in Cisco land for having multiple SVI's active.

Not exactly true. The 2960s (before they could route) supported multiple active SVIs. I believe even the LANBase versions, which cannot route, support it. An odd feature, but it's there.

cisco_trooper

itdaddy wrote: »

interface Vlan141
 description FourthAveData2
 ip address 192.168.61.1 255.255.255.0
!
interface Vlan151
 description FourthAveVPNClients - no ip address - shutdown
 no ip address
 shutdown
!
interface Vlan231
 description FourthAveCore1Firewall1InternetP2P
 ip address 192.168.231.1 255.255.255.252
!
interface Vlan232
 description FourthAveCore1Gateway1P2P
 ip address 192.168.231.5 255.255.255.252
!
interface Vlan233
 description FourthAveFirewall1FRBGatewayP2P - no ip address - shutdown
 no ip address
 shutdown
!
interface Vlan234
 description FourthAveFirewall1ORCCGatewayP2P - no ip address - shutdown
 no ip address
 shutdown
!
interface Vlan235
 description FourthAveFirewall1DebitATMGatewayP2P - no ip address - shutdown
 no ip address
 shutdown
!
interface Vlan236
 description FourthAveCore1Firewall1PrivateP2P
 ip address 192.168.231.33 255.255.255.252
!
interface Vlan237
 description FourthAveFirewall1VPNGateway1P2P - no ip address - shutdown
 no ip address
 shutdown
!
interface Vlan238
 description FourthAveFirewall1CavionGatewayP2P - no ip address - shutdown
 no ip address
 shutdown
!
interface Vlan239
 description FourthAveFirewallELANGatewayP2P
 ip address 192.168.239.1 255.255.255.0
!
interface Vlan900
 description FourthAveDMZ  ***** Do not activate this interface - outside access *****
 no ip address
 shutdown
!
interface Vlan950
 description WebSenseMonitor - no ip address - shutdown
 no ip address
 shutdown

The previous admin of the switches may have created these just for the sake of figuring out which interface is which in netflow exports. In some platforms you can export layer 3 stats that cross the SVIs, but you can also export L2 stats for traffic that stays within the VLAN. Those exports can be hard to line up if you don't have interfaces labled. Just a guess, and I don't know if that applies to the 3560 as I don't actually have a 3560.

cisco_trooper

They could also be leftovers from legacy configurations that were not completely cleaned up. The ip address was removed and the SVI shut, but the SVI was never removed. Always a possibility as some people have a greater degree of OCD than others. Personally this would drive me insane if it did not have a purpose.

Forsaken_GA

cisco_trooper wrote: »

They could also be leftovers from legacy configurations that were not completely cleaned up. The ip address was removed and the SVI shut, but the SVI was never removed. Always a possibility as some people have a greater degree of OCD than others. Personally this would drive me insane if it did not have a purpose.

It's much more likely that it's there for reference. I do the same thing with my interface configurations, stopping what I'm doing to go reference documentation when I can just look at the routers configuration is much more efficient. I normally only tend to do that kind of thing on layer3 interfaces, though. It had never occurred to me to standup SVI's which are shutdown just so I can use the description field to label the vlan (the vlan description field in the vlan commands are somewhat limited), but in retrospect, it seems obvious, and I'm kind of kicking myself for not thinking of it on my own.

What makes me draw this conclusion is the description on the DMZ interface. It specifically says never to bring this interface up, which tells me that the interface exists for a reason, and it's never intended to be activated, and from there, I can infer that the other shutdown SVI's are serving the same purpose.

Panzer919

MississippiGuardsman wrote: »

Just curious what kind of hardware this is? Kind of a shot in the dark but ive seen some switches that will allow you to create multiple interface vlans but only one can be active at a time which keeps the others shutdown. Can't remember what kind of switch it was though.

Cisco 2950 was the model

itdaddy

Finally I think I figured it out. These are old configs and I think he used them as notes. Everything is trunked together. We have a gateway to the ISP with bridging done for public internet to firewall. A L3 core switch, ASA 5510 with 2 contexts Internet and Private. The Private context is specifically used for vlan interfaces called P2P gateways
and he allows on the DMZ IPSEC tunnel to VPN public side of vpn device like permit esp, gre etc so the vpn tunnel can work. Then with the LAN side gateways he uses the private context and creates ACL rules and gateway interfaces on the return with ip route commands on return traffic. Kind of crazy but I think I finally got it. I initially thought he had the IPSE tunnels going thru the firewall but I was initially wrong. He does terminate them at the DMZ/or outside interface and uses ACLs to permit IPSEC to public side of the vpn interface and creates P2P gateways to theLAN side of the vpn devices to further restrict what they can actually do if need be. I have had numerous ccvp and cisco types look at it and has taken much study to see the flow...but very cool nonetheless..