L3 functions include: Layer 3 port management, ARP management and Routing management.<\/p>\n
Layer 3 ports are generally divided into routing ports (physical ports switched to Layer 3 ports) or SVI ports (Switch Virtual Interface, corresponding to a VLAN). The SVI port is a logical interface, which is constructed on top of all the member ports included in the corresponding VLAN, Unlike the routing port, the packets that are forwarded through the SVI at Layer 3 will first pass through Layer 2 (such as VLAN filtering, address learning, etc.) and then go through three layers, and then go through three layers and then two layers when outputting (such as VLAN output rules). At the network layer, routing devices use IP addresses to complete packet forwarding. (Protocol specification: RFC 1918: Address Allocation for Private Internets, RFC 1166: Internet Numbers). Layer 3 port management includes IP address maintenance for Layer 3 ports. An IP address is composed of 32-bit binary. For the convenience of writing and description, it is generally expressed in dotted decimal. When expressed in dotted decimal, it is divided into four groups, each with 8 digits, ranging from 0 to 255. The groups are separated by ".", for example, "192.168.1.1" is the IP address expressed in decimal. The IP address, as the name suggests, is naturally the interconnection address of the IP layer protocol. A 32-bit IP address consists of two parts: 1) the network address part, which indicates which network it is; 2) the host address part, which indicates which host in the network. The network address part and the host address part of the IP address are divided by the network mask. The network mask is also a 32-bit value, consisting of several bits "1" in the front and several bits "0" in the back. The IP address is related to the network. The mask and the obtained is the corresponding part of the network address. Likewise, the netmask can also be directly represented by the mask length. For example, "192.168.1.1 255.255.255.0" and "192.168.1.1\/24" represent the same IP address. The device supports the configuration of the second IP address, that is, a Layer 3 port can be configured with at most one IP address. When a Layer 3 port is configured with an IP address, a network segment is determined. Different Layer 3 ports of the same device must belong to different network segments, and IP addresses configured with different Layer 3 ports must belong to different network segments. The Layer 3 port represented by the SVI, and the corresponding VLAN is used as the unique identifier of the Layer 3 port. After the different Layer 3 ports of the device are divided into different network segments, the forwarding between these different network segments (such as VLAN1 and VLAN2) is called "Layer 3 forwarding" (across network segments, or across different VLANs).<\/p>\n
In a local area network, each IP network device has two addresses: 1) The local address, since it is included in the frame header of the data link layer, should be more precisely the data link layer address, but in fact the local address is processed by the MAC sublayer in the data link layer, Therefore, it is customarily called a MAC address, and a MAC address represents an IP network device on a local area network. 2) The network address represents the IP network device on the Internet, and it also indicates the network to which the device belongs. To communicate between two IP devices on the LAN, they must know each other's 48-bit MAC address. The process of learning the MAC address from the IP address is called address resolution. There are two types of address resolution methods: 1) Address Resolution Protocol (ARP). 2) Proxy Address Resolution Protocol (Proxy ARP). About ARP and Proxy ARP, they are described in RFC 826 and RFC 1027 documents respectively. ARP (Address Resolution Protocol) is used to bind a MAC address and an IP address. Taking the IP address as an input, ARP can know its associated MAC address. Once the MAC address is known, the IP address to MAC address correspondence is stored in the device's ARP cache. With the MAC address, the IP device can encapsulate the link layer frame, and then send the data frame to the LAN. The encapsulation of IP and ARP on Ethernet is Ethernet II type. ARP entries are divided into two categories: dynamic entries generated by the ARP protocol and static entries derived from static configuration. Dynamic ARP entries are formed by triggering the opening of IP packets. The opening process is an ARP request\/response process. If the ARP entries formed after opening are unreachable, they will automatically age out. Static ARP entries do not need to be opened and will not age out.<\/p>\n
Routing management is responsible for managing routing tables, integrate routes issued by various routing protocols to select the optimal route. According to different sources, the routing table is usually divided into the following three categories:<\/p>\n
A routing table entry consists of two parts:<\/p>\n
When forwarding IP packets according to the routing table entry, if the routing table entry specifies the next hop, when the link layer encapsulates the ARP query, the IP of the next hop is used, that is, the destination MAC address of the link layer encapsulation is the next hop. The destination MAC address of the hop. If the routing table entry is directly connected, the destination IP address of the packet is directly used for ARP query, that is, the destination MAC address encapsulated at the link layer is the final destination MAC address of the packet. Either way, if the ARP query fails, the route will be opened (a dynamic ARP entry will be generated). If the connection cannot be made, the IP packet cannot be forwarded and will be discarded. There may be an inclusion relationship between routing table entries (depending on the length of the mask), so the route lookup process satisfies the LPM (Longest Prefix Match). That is, when IP packets are forwarded for route lookup, if multiple routing entries are hit at the same time, the routing entry with the longest prefix mask length is selected.<\/p>\n
Configure SVI Port IP\uff1a<\/p>\n
SWITCH(config)#int vlan10<\/code><\/pre>\nSWITCH(config-if)#ip address IPADDR\/MASKLEN [secondary]<\/code><\/pre>\nSWITCH(config-if)#ipv6 address IP(X:X::X:X\/M)<\/code><\/pre>\nOr<\/h2>\nSWITCH(config-if)#ip address IPADDR MASK [secondary]<\/code><\/pre>\nDelete SVI Port IP\uff1a<\/p>\n
SWITCH(config)#int vlan10<\/code><\/pre>\nSWITCH(config-if)#no ip address IPADDR\/MASKLEN [secondary]<\/code><\/pre>\nSWITCH(config-if)#no ipv6 address IP(X:X::X:X\/M)<\/code><\/pre>\nOr<\/h2>\nSWITCH(config-if)#no ip address IPADDR MASK [secondary]<\/code><\/pre>\nShow the IP\/IPv6 address of the Layer 3 port:<\/p>\n
SWITCH#show ip interface brief<\/code><\/pre>\nSWITCH#show ipv6 interface brief<\/code><\/pre>\nConfigure in the interface mode of the SVI. When a VLAN is created, the SVI is automatically created, and when the VLAN is deleted, the SVI is automatically deleted. int vlanXX is to enter the interface mode of the SVI. Therefore, when the SVI does not exist (the corresponding VLAN does not exist), entering the interface mode of the SVI will fail. At the same time, when the SVI is deleted, the IP address configured on it will be automatically cleared. Layer 3 ports support IP\/IPv6 address configuration update, which has the same effect as deleting and reconfiguring. The IP addresses configured on different Layer 3 ports must belong to different network segments. SVI supports the configuration of the second ip. When configuring the second ip, you need to configure the primary ip first. When deleting the primary ip, if the second ip already exists, you need to delete all the second ip before deleting the primary ip, otherwise it cannot be deleted. Note: After this command is configured, the system will clear the management IP configuration (refer to: Configuring Management IP), and use the Layer 3 port IP address as the device management IP instead. Configure Routing Port IP\uff1a<\/p>\n
SWITCH(config)#interface gigabitEthernet0\/1<\/code><\/pre>\nSWITCH(config-if)#no switchport<\/code><\/pre>\nSWITCH(config-if)#ip address IP(A.B.C.D\/M) [secondary]<\/code><\/pre>\nSWITCH(config-if)#ipv6 address IP(X:X::X:X\/M)<\/code><\/pre>\nOr<\/h2>\nSWITCH(config-if)#ip address IP(A.B.C.D) MASK(A.B.C.D) [secondary]<\/code><\/pre>\nDelete Routing Port IP\uff1a<\/p>\n
SWITCH(config)# interface gigabitEthernet0\/1<\/code><\/pre>\nSWITCH(config-if)#no ip address IP(A.B.C.D\/M)<\/code><\/pre>\nSWITCH(config-if)#no ipv6 address IP(X:X::X:X\/M)<\/code><\/pre>\nOr<\/h2>\nSWITCH(config-if)#no ip address IP(A.B.C.D) MASK(A.B.C.D)<\/code><\/pre>\nSWITCH(config-if)#switchport<\/code><\/pre>\nConfigure in interface mode. Before configuring the routing port IP, since the default attribute of the interface is the Layer 2 port attribute, you need to use the no switchport command to switch the port from the Layer 2 port attribute to the Layer 3 routing port attribute, and then use the ip address command to configure the routing port attribute. IP configuration, otherwise, switch the routing port to the Layer 2 port attribute, use the switchport command. Layer 3 ports support IP address configuration update, which has the same effect as deleting and reconfiguring. The IP addresses configured on different Layer 3 ports must belong to different network segments. The Layer 3 interface supports the configuration of the second ip. When configuring the second ip, you need to configure the primary ip first. When deleting the primary ip, if the second ip already exists, you need to delete all the second ip before deleting the primary ip, otherwise it cannot be deleted.<\/p>\n
SWITCH(config)#arp IPADDR MACADD<\/code><\/pre>\nSWITCH(config)#no arp IPADDR<\/code><\/pre>\nConfigure in global configuration mode. The IP address configured with static ARP must belong to the directly connected network segment, otherwise the configuration fails. Static ARP has a higher priority than dynamic ARP. When the two conflict, static ARP takes effect. When the IP address of the Layer 3 port is deleted or the Layer 3 port is deleted, if the IP address of the static ARP belongs to the directly connected network segment of the Layer 3 port, the static ARP will be invalid (you can see that the entry does not exist through show arp, but show run, you can see that the configuration is still there); Similarly, when a Layer 3 port is configured with an IP address, the ARP entry of the directly connected network segment whose IP address belongs to the Layer 3 port will change from an invalid state to a valid state. (You can see the existence of ARP entries through show arp).<\/p>\n
SWITCH#clear arp-cache<\/code><\/pre>\nClear the ARP cache in privileged mode. This Command only clears dynamic ARP entries, and static ARP entries will not be cleared.<\/p>\n
SWITCH(config)# ipv6 neighbor IPv6(X:X::X:X) IFNAME MAC(XXXX.XXXX.XXXX)<\/code><\/pre>\nSWITCH(config)#no ipv6 neighbor IPv6(X:X::X:X) IFNAME<\/code><\/pre>\nConfigure in global configuration mode. The IPv6 address configured with the static ipv6 neighbor must belong to the directly connected network segment, otherwise the configuration fails. The static ipv6 neighbor has a higher priority than the dynamic ipv6 neighbor. When the two conflict, the static ipv6 neighbor takes effect. When the IPv6 address of the Layer 3 port is deleted or the Layer 3 port is deleted, if the IPv6 address of the static ipv6 neighbor belongs to the directly connected network segment of the Layer 3 port, the static ipv6 neighbor will be invalid (you can see that the table does not exist through show ipv6 neighbors Item, but show run can see that the configuration is still there); Similarly, when a Layer 3 port is configured with an IPv6 address, the ipv6 neighbor entry whose IPv6 address belongs to the directly connected network segment of the Layer 3 port will change from an invalid state to valid state. (You can see that the neighbors table entry exists by show ipv6 neighbors).<\/p>\n
SWITCH(config)#ip route {IPADDR\/MASKLEN) | IPADDR MASK} {NH_IPADDR | IFNAME}<\/code><\/pre>\nSWITCH(config)#no ip route {IPADDR\/MASKLEN | IPADDR MASK} {NH_IPADDR | IFNAME}<\/code><\/pre>\nSWITCH(config)#ipv6 route [IPv6(X:X::X:X\/M) [NH_IPv6(X:X::X:X) | IFNAME]<\/code><\/pre>\nSWITCH(config)#no ip v6 route [IPv6(X:X::X:X\/M) [IPv6(X:X::X:X) | IFNAME]<\/code><\/pre>\nConfigure in global configuration mode. Recursive routing is not supported (the configured next-hop IP must belong to the directly connected network segment); The route prefix cannot belong to the directly connected network segment (that is, the directly connected route is automatically generated and cannot be statically configured). When a Layer 3 port is configured with an IP address, if the prefix of a static routing entry belongs to the directly connected network segment of the Layer 3 port, the static route will be automatically deleted and a LOG prompt will be displayed; When the IP address of a Layer 3 port is deleted or the Layer 3 port is deleted, if the next hop IP of a static routing entry belongs to the directly connected network segment of the Layer 3 port, the static route is automatically deleted and a LOG prompt is displayed. If there are redundant links in the network environment, that is, there are multiple next hops for the route to the same destination address. On devices that support ECMP technology, multiple next hops can work at the same time, so that redundant links can be fully utilized, and when a link failure occurs on a redundant link, traffic can be switched to other redundant links. Network reliability and stability. ECMP (Equal-Cost Multipath Routing), this technology enables the device to use multiple next-hop links of the corresponding route concurrently, and balance the traffic among the multiple next-hop links according to the set balance factor distribution; and supports fast switchover of faulty links.<\/p>\n
Examples<\/h2>\n
Case 1: Weak Layer 3 Gateway As a weak Layer 3 gateway, the Switch reduces the ARP burden for the real gateway.<\/p>\n
\n- Configure PC\uff1a<\/li>\n<\/ul>\n
Configure the IP addresses of PC1, PC2 and PC3 as shown in the figure, and specify the gateway at the same time. For example, the gateway of PC1 and P2 is 192.168.1.1.<\/p>\n
\n- Configure SWITCH\uff1a<\/li>\n
- Configure the Layer 3 port and IP address: (Assume that the interface connecting PC1-PC4 is gigabitEthernet0\/1-4, and the uplink interface is gigabitEthernet0\/17)<\/li>\n<\/ul>\n
SWITCH(config)#vlan 2-3,100<\/code><\/pre>\nSWITCH(config)#interface gigabitEthernet0\/1-2<\/code><\/pre>\nSWITCH(config-if)#switch access vlan 2<\/code><\/pre>\nSWITCH(config)#interface gigabitEthernet0\/3-4<\/code><\/pre>\nSWITCH(config-if)#switch access vlan 3<\/code><\/pre>\nSWITCH(config)#interface gigabitEthernet0\/17<\/code><\/pre>\nSWITCH(config-if)#switch access vlan 100<\/code><\/pre>\nSWITCH(config)#int vlan2<\/code><\/pre>\nSWITCH(config-if)#ip address 192.168.1.1\/24<\/code><\/pre>\nSWITCH(config)#int vlan3<\/code><\/pre>\nSWITCH(config-if)#ip address 192.168.2.1\/24<\/code><\/pre>\nSWITCH(config)#int vlan100<\/code><\/pre>\nSWITCH(config-if)#ip address 192.168.100.2\/24<\/code><\/pre>\nSWITCH(config-if)ip route 0.0.0.0\/0 192.168.100.1<\/code><\/pre>\nCase 2: Intranet Layer 3 Interconnection In the network environment shown above, PC1, PC2 and PC3 are interconnected through S1, S2 and S3 respectively. Configure the IP addresses of PC1, PC2 and PC3 as shown in the figure, and specify the gateway at the same time. For example, the gateway of PC1 is 192.168.1.1.<\/p>\n
SWITCH(config)#vlan 2-4<\/code><\/pre>\nSWITCH(config)#interface gigabitEthernet0\/1<\/code><\/pre>\nSWITCH(config-if)#switch access vlan 2<\/code><\/pre>\nSWITCH(config)#interface gigabitEthernet0\/2<\/code><\/pre>\nSWITCH(config-if)#switch access vlan 3<\/code><\/pre>\nSWITCH(config)#interface gigabitEthernet0\/3<\/code><\/pre>\nSWITCH(config-if)#switch access vlan 4<\/code><\/pre>\nSWITCH(config)#int vlan2<\/code><\/pre>\nSWITCH(config-if)#ip address 192.168.1.1\/24<\/code><\/pre>\nSWITCH(config)#int vlan3<\/code><\/pre>\nSWITCH(config-if)#ip address 192.168.12.1\/24<\/code><\/pre>\nSWITCH(config)#int vlan4<\/code><\/pre>\nSWITCH(config-if)#ip address 192.168.13.1\/24<\/code><\/pre>\nSWITCH(config)#ip route 192.168.2.0\/24 192.168.12.2<\/code><\/pre>\nSWITCH(config)#ip route 192.168.3.0\/24 192.168.11.3<\/code><\/pre>\nDisplay Information<\/h2>\n\n- Show L3 Interface<\/li>\n<\/ul>\n
SWITCH#show ip interface brief<\/code><\/pre>\nInterface IP-Address Admin-Status Link-Status GiE0\/3 10.10.20.1 up down vlan10 192.168.65.166 up up<\/p>\n
SWITCH#show ipv6 interface brief<\/code><\/pre>\nInterface IPv6-Address Admin-Status vlan10 2001:db8:0:f104::1 [up\/up] vlan1000 unassigned [up\/up]<\/p>\n
SWITCH#show arp<\/code><\/pre>\nAddress HWaddress Interface Type<\/h2>\n
192.168.1.238 00:00:00:00:04:86 vlan2 Static 192.168.2.46 00:00:00:00:05:45 vlan3 Static 192.168.3.110 00:00:00:00:08:59 vlan4 Static 192.168.0.12 00:00:00:00:00:09 vlan1 Static 192.168.0.1 00:0e:c6:d8:c7:f7 vlan1 Dynamic 10.100.2.2 00:01:a0:00:10:11 GiE0\/2 Dynamic<\/p>\n
\n- Show Ipv6 Neighbor Entries<\/li>\n<\/ul>\n
SWITCH #show ipv6 neighbors<\/code><\/pre>\nIPv6 Address MAC Address Interface Type ff02::16 3333.0000.0016 vlan10 dynamic ff02::1:ff00:1 3333.ff00.0001 vlan10 dynamic ff02::1:ff40:251a 3333.ff40.251a vlan10 dynamic<\/p>\n
SWITCH#show ip route<\/code><\/pre>\nCodes: K – kernel, C – connected, S – static, R – RIP, B – BGP O – OSPF, IA – OSPF inter area N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2 E1 – OSPF external type 1, E2 – OSPF external type 2 i – IS-IS, L1 – IS-IS level-1, L2 – IS-IS level-2, ia – IS-IS inter area * – candidate default IP Route Table for VRF "default" Gateway of last resort is 192.168.1.3 to network 0.0.0.0 S* 0.0.0.0\/0 [1\/0] via 192.168.1.3, vlan2 S 192.168.0.0\/16 [1\/0] via 192.168.0.10, vlan1 C 192.168.0.0\/24 is directly connected, vlan1 C 192.168.1.0\/24 is directly connected, vlan2 C 192.168.2.0\/24 is directly connected, vlan3 C 192.168.3.0\/24 is directly connected, vlan4 C 10.100.2.0\/30 is directly connected, gigabitEthernet0\/2<\/p>\n
SWITCH #show ipv6 route<\/code><\/pre>\nIPv6 Routing Table Codes: K – kernel route, C – connected, S – static, R – RIP, O – OSPF, IA – OSPF inter area, E1 – OSPF external type 1, E2 – OSPF external type 2, N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2, I – IS-IS, B – BGP Timers: Uptime IP Route Table for VRF "default" C 2001:db8:0:f104::\/64 via ::, vlan10, 00:00:56<\/p>\n","protected":false},"excerpt":{"rendered":"
Networking \u203a Switching \u203a Edge \u203a Synapse<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":6349,"menu_order":17,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[115,119,116],"class_list":["post-6366","docs","type-docs","status-publish","hentry","doc_tag-connexite","doc_tag-network","doc_tag-synapse-cli-documentation","no-post-thumbnail"],"acf":[],"_links":{"self":[{"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs\/6366","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=6366"}],"version-history":[{"count":1,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs\/6366\/revisions"}],"predecessor-version":[{"id":6414,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs\/6366\/revisions\/6414"}],"up":[{"embeddable":true,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/docs\/6349"}],"wp:attachment":[{"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=6366"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/docs.connexite.co.uk\/index.php\/wp-json\/wp\/v2\/doc_tag?post=6366"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}