All language subtitles for Free CCNA - VLANs (Part 3) - Day 18 - CCNA 200-301 Complete Course

Welcome to Jeremy’s IT Lab.

This is a free, complete course for the CCNA.

If you like these videos, please subscribe
to follow along with the series.

Also, please like and leave a comment, and
share the video to help spread this free series

of videos.

Thanks for your help.

This video will once again cover the topic
of VLANs..

Although we’ve already covered the most
important basics about VLANs, there are still

a few more things you should know about VLANs
for your CCNA.

This is going to be a long video again, so
let’s get right into it.

First off, here are the topics that will be
covered in this video.

First off, a little addition to the previous
video, I will show you how to use the concept

of a native VLAN on a router when using router
on a stick for inter-VLAN routing.

Next up, we will look at a few wireshark captures
to see the dot1q tag.

Wireshark is a great tool for network engineers,
so I plan to use it at various points in this

series to help you understand these topics.

After that we’ll look at the final method
of inter-VLAN routing, which is Layer 3 switching,

also known as multilayer switching.

I’ve always told you that switches are Layer
2 devices and don’t use IP addresses, however

many modern switches are actually Layer 3
capable as well, and I’ll talk about that

in today’s video.

Next up are two topics which have actually
been removed from the CCNA exam topics list.

DTP, the dynamic trunking protocol, and VTP,
VLAN trunking protocol.

I was planning to cover these in this video,
but due to the length of the video I’ll

reserve a separate video for them.

Although these have both been removed from
the exam topics list, I think it will probably

be important for you to understand these topics
at least at a basic level for your CCNA, and

you may actually see some questions about
them in your exam even though they have been

removed from the topics list.

However, I will give just a basic overview
of each, there is no need to go in depth.

Before getting started, I want to say make
sure that you stick around to the end of today’s

quiz, from now on I’ll be featuring one
BONUS question from Boson ExSim, Boson’s

set of practice exams for the CCNA.

Look forward to that.

If you want to get a copy of Boson ExSim for
yourself, by the way, follow the link in the

video description.

No other practice exams help you get ready
for the real exam like Boson ExSim, so if

you can I highly recommend getting and using
it to prepare for your exam.

So let’s move on to the first point, using
the Native VLAN feature on a router.

I said in the previous lecture video that
best practice is to set the native VLAN to

an unused VLAN, as the native VLAN feature
can cause some security issues.

I will talk more about network security later
in the course, by the way.

However, if you want to use the native VLAN
feature, let’s see how to use it on a router.

The native VLAN feature does have one benefit.

Because frames in the native VLAN aren’t
tagged, it’s more efficient, each frame

is smaller so it allows the device to send
more frames per second.

In the previous video, I set the native VLAN
to 1001 on SW1’s G0/0 interface, and SW2’s

G0/0 and G0/1 interfaces.

So, just for this demonstration let’s set
them back to a used VLAN, VLAN10 on all trunks.

There are 2 methods of configuring the native
VLAN on a router, let’s take a quick look

at both.

First up, you can use the command ENCAPSULATION
DOT1Q, followed by the vlan-id, followed by

NATIVE.

This tells the router that this subinterface
belongs to the native VLAN, and it will function

just like the native VLAN on a switch.

It will assume untagged frame belong to the
native VLAN, and frames sent in the native

VLAN will not be tagged.

The second option is to not use a subinterface at all, but just configure the IP address

for the native VLAN on the physical interface of the router.

The ENCAPSULATION DOT1Q command is not necessary in this case.

Okay, let’s look at each option.

First, I will configure the first option.

Here it is.

On the g0/0.10 interface, I configured ENCAPSULATION
DOT1Q 10 NATIVE.

Note that this is the complete topology from
the previous lecture video, so the IP address

is already configured.

The only change is that I added NATIVE to
the encapsulation dot1q command.

Let’s take this opportunity to look at a
wireshark capture to demonstrate the native

VLAN.

This PC in VLAN20 has an IP address of 192.168.1.65,
and this PC in VLAN10 has an IP address of

192.168.1.1.

I will use wireshark to monitor this connection
between R1 and SW2.

Wireshark will capture all frames on this
connection, in both directions, so we can

take a look at what traffic is passing through.

Let’s send that ping. We will first look
at the capture of the ICMP echo request message

as it goes from SW2 to R1.

It will be in VLAN20, and it’s being sent
to R1 for inter-VLAN routing.

Here’s the wireshark capture for the ICMP
echo request as it goes from SW2 to R1.

First off, you can see the source and destination
IP addresses here.

Now let’s look at the Ethernet header encapsulating
the IP packet.

Specifically, look here.

Type: 802.1Q virtual LAN, and notice the hexadecimal
8100 value here.

I said in the previous video that dot1q is
inserted after the source MAC address field,

and that is where the TYPE field usually goes.

This here is the ‘TPID’ field of the dot1q
tag.

Under it, these are the rest of the fields
of the 802.1Q tag.

First is the PCP, priority code point.

It has a value of 0, so no special priority
is given to this frame.

Under it is the DEI, drop eligible indicator.

Again, a value of 0, so it won’t be dropped
during times of network congestion.

Next is the most important field, the VLAN
ID, which is 20, as you would expect.

The PC that sent the ping is in VLAN 20, and
it’s not the native VLAN so that’s why

this frame is tagged.

Finally, under that is the normal TYPE field
of the Ethernet header, indicating that an

IPv4 packet is encapsulated.

It normally comes after the SOURCE MAC ADDRESS
field, but now the dot1q tag is between them.

Next let’s look at the ICMP echo request
going from R1 back to SW2.

It will now be in VLAN10, because the destination
is in VLAN10.

VLAN10 is configured as the native VLAN on
both R1 and SW2, so let’s see what’s different.

Here’s the exact same ICMP echo request,
the exact same layer 3 packet, as it is sent

from R1 to SW2.

What’s different?

It has been encapsulated with a new Ethernet
header, but this Ethernet header doesn’t

have a dot1q tag.

This is the native VLAN function at work.

Both R1 and SW2 understand that untagged frames
belong to VLAN10, so there is no need to tag

each frame with dot1q.

That ICMP echo request will continue to the
destination, untagged all the way because

VLAN10 is configured as the native VLAN on
all devices.

When this PC in VLAN10 sends the ICMP echo
reply, it will be untagged until it reaches

R1, which will then tag it in VLAN20, and
send it back to the PC that sent the request.

Now let’s take a quick look at the second
method of configuring the native VLAN on a

router, which is simply configuring the IP
address on the router’s physical interface,

no need for a subinterface or the encapsulation
dot1q command.

Here is how to configure it.

First, I used ‘NO INTERFACE G0/0.10’.

This deletes the subinterface.

Then, I entered interface configuration mode
from G0/0, and simply configured the appropriate

IP address on the interface.

To help you visualize it, here is the output
of SHOW RUNNING-CONFIG for G0/0 and its subinterfaces.

First off, these commands here on the physical
interface are there by default, I didn’t

configure them.

The physical interface is configured normally
with an IP address.

This will be used for the native VLAN, VLAN10.

The other subinterfaces are just like we configured
them in the previous video, with the encapsulation

dot1q command and their own IP address.

This will function just like the first option
we saw.

SW2 will send VLAN10 packets in untagged frames
to R1, and R1 will send them in untagged

frames also.

As I said before, it is recommended that you
just change the native VLAN to an unused VLAN

for security purposes, but if you want to
use the native VLAN, it’s important to know

how to do it on a router, so these are two methods you can use.

You might also need to know this for your
exam, by the way.

Here’s the network diagram once again.

We have one router, and two switches.

Or I should say, two Layer 2 switches.

This is the icon we’ve been using for regular
Layer 2 switches.

But let me introduce you to another type of
switch.

This is the icon I will use for what is called
a Layer 3 switch, also known as a multilayer

switch.

From now on I will use either term, Layer
3 switch or multilayer switch.

You should know both.

By the way, these are the official Cisco icons
for a layer 2 switch and a layer 3 switch,

but I think the ones I use in my videos look
cleaner and more modern.

First let’s review exactly what a multilayer
switch does.

A multilayer switch is capable of both switching
AND routing.

It is Layer 3 aware.

A regular layer 2 switch is NOT layer 3 aware,
it doesn’t think at all about IP addresses

or anything above Layer 2.

It only cares about Layer 2 information like
MAC addresses.

You can assign IP addresses to its interfaces
like a router.

Previously we haven’t assigned any IP addresses
to switches, only routers.

With a Layer 3 switch, you can configure ‘routed
ports’, which function like an interface

on a router.

Not just physical interfaces, but you can
also create virtual interfaces for each VLAN,

and assign IP addresses to those interfaces.

These are not separate physical
interfaces, but virtual interfaces in the

software of the switch that can be used to
route traffic at Layer 3.

You can configure routes, like static routes,
on a multilayer switch, just like a router.

Finally, it can be used for inter-VLAN routing.

So far, we have looked at two methods of inter-VLAN
routing.

The first one, in day 16’s video, was using
one connection for each VLAN between the router

and switch.

This works, but if you have many VLANs you
probably won’t have enough interfaces on

your router.

The second method was router on a stick, which
uses a single trunk connection which carries

traffic from all VLANs between the switch
and router for inter-VLAN routing.

This is efficient in terms of the number of
interfaces, just one, but in a busy network

all of the traffic going to the router and
back to the switch can cause network congestion.

So, in large networks, a multilayer switch
is the preferred method of inter-VLAN routing.

Let’s see how it works.

Here is the topology again, now let’s
replace SW2 with a multilayer switch.

There we go.

And now let’s make one more change.

I’ve replaced the trunk link between SW2
and R1 with a point-to-point Layer 3 link,

we will no longer run VLANs across this.

I’ll talk about this link later and assign
IP addresses to R1’s G0/0 interface and

SW2’s G0/1 interface. But for now
let’s focus on the inter-VLAN routing done

on SW2.

For review, when we used router on a stick
for inter-VLAN routing, traffic being routed

between VLANs was sent to R1 first, and then
sent back to SW2, and then forwarded to the

destination.

For example, if this PC in VLAN20 wants to
ping this PC in VLAN10, the traffic would

follow a path like this.

From the PC to SW2, from SW2 to R1, tagged
in VLAN20, from R1 to SW2, tagged in VLAN10,

from SW2 to SW1, tagged in VLAN10, and finally
to the destination.

However, SW2 is a multilayer switch.

It doesn’t have to send the traffic to R1
for inter-VLAN routing.

It can do that with something called ‘Switch
Virtual Interfaces’.

SVIs (or Switch Virtual Interfaces) are the virtual
interfaces you can assign IP addresses to

i n a multilayer switch.

Configure each PC to use the SVI (NOT the
router) as their gateway address.

When using router on a stick, the router was
used as the PC’s gateway.

This time, we will use the switch’s SVIs
instead.

To send traffic to different subnets/VLANs,
the PCs will send traffic to the switch, and

the switch will route the traffic.

These are the SVIs I configured on SW2.

These are the same IP addresses I configured
on R1 when doing router on a stick, the last

usable IP address in each subnet.

So, these are already configured on each PC
as their gateway addresses, so there’s no

need to change the PC configurations.

Now let’s take a look at the path the traffic
between these two PCs takes this time.

The frame arrives at SW2.

The destination is in the 192.168.1.0/26 subnet.

SW2 now has its own routing table, so it looks
up the destination in the routing table, and

sees that the destination is connected to
its VLAN10 SVI.

So, the traffic is now routed to VLAN10.

If SW2 doesn’t have the destination MAC
address in its MAC address table, it will

flood the frame to all VLAN10 interfaces.

But, let’s assume it has already learned
the MAC address, so it forwards it to SW1

over its trunk interface, tagged as VLAN10.

SW1 then forwards it to the destination.

Now, what if the hosts want to reach destinations
outside of the LAN?

For example, I’ve added a cloud connected
to R1 to represent the Internet.

Because SW2 is their default gateway, any
packets destined outside of their subnet will

be sent to SW2.

But our previous router on a stick configurations
for the connection between SW2 and R1 will

no longer work.

In addition to configuring virtual interfaces,
SVIs, on multilayer switches, we can also

configure their physical interfaces to operate
like a router interface, rather than

a switchport.

So, we can assign the subnet 192.168.1.192/30
for this point-to-point link between SW2 and

R1, with SW2’s G0/1 interface having an
IP address of 192.168.1.193, and R1’s G0/0

interface having an IP address of 192.168.1.194.

Then, we configure a default route on SW2
pointing toward R1, so all traffic destined

outside of the LAN will be sent to R1.

I already covered static routes, including
default routes, in previous videos, so I won’t

explain the concept in depth again, but I
will show you the configurations once more.

So, let’s do that, let’s get into the
configurations, starting first with the point-to-point

link between SW2 and R1, and then the SVIs
on SW2.

First off, remove R1’s router on a stick
configurations and configure that new IP address

on G0/0.

First off, I delete each subinterface with
this command, NO INTERFACE G0/0.10, .20, and .30.

Then, I use the command DEFAULT INTERFACE
G0/0, to reset G0/0 to it’s default settings.

After that, I used SHOW IP INTERFACE BRIEF
to check the interfaces.

Notice the status of the subinterfaces, it
says DELETED.

Although we have successfully deleted the
subinterfaces, they will remain here with

a ‘deleted’ status unless we reload the
router.

That’s no problem though, so I’ll just
leave them.

Then I simply enter interface configuration
mode for G0/0 and configure the new IP address,

with a /30 subnet mask.

I use SHOW IP INTERFACE BRIEF again, and you
can see that the new IP address has been successfully

configured.

Now let’s look at the switch’s side of
the point-to-point connection.

First, I reset the G0/1 interface to its default
setting with the DEFAULT INTERFACE command,

because it was configured as a trunk for router
on a stick because of the previous lab.

Next up is a very important command, one you
must not forget.

IP ROUTING.

This command enables Layer 3 routing on the
switch, it lets it build its own routing table

like a router.

If you forget this command, your inter-VLAN
routing will not work.

Next up is another important command, NO SWITCHPORT on the interface.

This is the command that changes the interface
from a Layer 2 switchport to a Layer 3 routed

port.

Now you will be able to assign an IP address
to it.

So, I assigned 192.168.1.193/30, and used
show IP interface brief, and as you can see

the IP address is assigned to it just like
a router interface.

Last up is the default route pointing to R1.

As I’ve already shown you in a previous
video, the command is IP ROUTE 0.0.0.0 0.0.0.0,

followed by the next hop, in this case 192.168.1.194,
which is R1.

I then used SHOW IP ROUTE to confirm, and
you can see that SW2 now has a routing table,

with a default route pointing to R1, and connected
and local routes for the routed interface

we configured.

And one additional command you can use to

confirm is SHOW INTERFACES STATUS, which I
showed in a previous video on Ethernet switching.

Notice that, in the VLAN column, instead of
a VLAN number G0/1 displays ‘ROUTED’.

Okay, now let’s move on to configure those
SVIs on SW2.

SVI configuration is very simple.

Here are the configurations for SW2.

Use the command INTERFACE VLAN10, for example,
to create an SVI for VLAN10 and configure

it.

Then assign an IP address, and use NO SHUTDOWN
to enable it.

SVIs are shutdown but default, so remember
to use the NO SHUTDOWN command to enable them.

I repeated the process for VLAN20 and VLAN30,
and that’s all there is to configuring SVIs,

very simple.

Now, just to demonstrate one problem you might
encounter, I created another SVI for a VLAN

that doesn’t exist on the switch, VLAN40,
and assigned an IP address, 40.40.40.40/24.

I also made sure to enable it with NO SHUTDOWN.

However, look at the SVI itself.

It is DOWN/DOWN.

Why is that?

Well, it's because the VLAN doesn’t exist
on the switch.

Let’s take a look at the conditions required
for an SVI to be UP/UP.

First, the VLAN must exist on the switch.

In this case, we haven’t created VLAN40
on the switch, so the SVI won’t become UP/UP.

When you assign an access port to a VLAN,
if the VLAN doesn’t yet exist the switch

will automatically create the VLAN.

However, if you create an SVI for a VLAN that
doesn’t exist yet, the switch WILL NOT automatically

create the VLAN.

Second, the switch must have at least one
access port in the VLAN in an up/up state,

and/or one trunk port that allows the VLAN
that is in an up/up state.

For example, in the topology we’re using
here, SW2 has hosts connected in VLAN10 and

VLAN20, so their SVIs can go up.

There are no connected hosts in VLAN30, however
it has a trunk port, G0/0, which allows VLAN30

over it, so VLAN30’s SVI is up as well.

Okay, next rule.

The VLAN must not be shutdown.

Note that this is NOT the SVI, but the VLAN
itself.

You can enter VLAN configuration mode, and
disable the VLAN with the SHUTDOWN command.

If you do this, the SVI for that VLAN can’t
become UP/UP.

Note that, I think you can’t do this command
in packet tracer, so you’ll need a real

Cisco switch if you want to try this one out.

Finally, if the SVI itself is shutdown, it
obviously won’t be up/up, so make sure to

use the NO SHUTDOWN command after you create
an SVI, because they are shutdown by default.

I used the SHOW IP ROUTE command again, and
you can see connected and local routes have

been added to the route table for the SVIs
we created, all shown as directly connected

to the SVI for each VLAN.

Okay, so our configurations are all done.

The next video will be a practice lab, so
you can get some hands-on practice doing these

configurations.

If you have trouble remembering the commands,
I highly recommend doing practice labs, and

doing them multiple times, until you feel
confident.

So, if one of our PCs wants to reach a destination
outside of the LAN, it will be sent to SW2,

which will send it to R1, which will take
care of it from there.

Note that we didn’t actually configure any
routes on R1 in this lab, I’m just focusing

on inter-VLAN routing at this point.

If one of our PCs wants to reach a destination
in the LAN, but in a different subnet and

VLAN, SW2 will do the inter-VLAN routing without
having to send the traffic to R1.

Okay, before moving on to the quiz let’s
review what we covered in today’s video.

I showed you two ways of configuring the native
VLAN on a router.

Usually, it’s best to just set the native
VLAN to an unused VLAN, but if you want to

use the native VLAN feature, you should know
how to configure it on a router.

We looked at some wireshark captures, both
a dot1q-tagged frame, and one that was untagged

because it was in the native VLAN.

Finally, I showed you the final method of
inter-VLAN routing, using a type of switch

I hadn’t talked about before, a Layer 3
switch, also known as a multilayer switch.

By configuring SVIs, switch virtual interfaces,
on a multilayer switch, you can route between

subnets and VLANs without having to send the traffic
to a router.

It’s like having a mini router within the
switch.

These last two topics, DTP and VTP, will be
left for the next lecture video.

Let’s move on to today’s quiz.

As I mentioned at the beginning of the video,
I’m happy to announce that, after my usual

quiz, a few simple questions to help you review
what we’ve learned, I will be featuring

one question from Boson’s ExSim, which is
a fantastic set of practice exams for the

CCNA.

I used Boson ExSim for my CCNA and CCNP, and
I really think they were what allowed me to

pass all of my exams on the first try.

If you want to pick up a copy of ExSim, check
the link in the description.

Let’s go on to question 1 of today’s quiz.

Which TWO answers are valid options to configure
the native VLAN on a router in a ROAS configuration?

(select two, each answer is a complete solution).

Instead of reading out each answer, I’ll
just let you take a look at each set of commands. Here we go.

A, B, C, and D. Pause the video to think about
your answer, remember there are two valid

options., so select two.

The answer is B and C. B uses the ENCAPSULATION
DOT1Q NATIVE command on the subinterface,

this is one option for configuring the native
VLAN on a router.

The other option is C, to simply configure
the IP address on the physical interface,

rather than the subinterface.

In that case, you do not need the ENCAPSULATION
DOT1Q command.

Okay, let’s go to question 2.

You create an SVI for VLAN225 on SW1, assign
an IP address, and enable it with no shutdown,

but the interface remains down/down.

Which TWO options might be causing this? (select
two) A, VLAN225 doesn’t exist on the switch.

B, you didn’t issue the SWITCHPORT MODE
TRUNK command on VLAN225’s SVI.

C, You didn’t issue the SWITCHPORT ACCESS
VLAN 225 command on VLAN225’s SVI.

Or D, No interfaces in VLAN225 are up/up.

Pause the video to think about your answer.

The answer is A and D. In order for an SVI to be up/up, the VLAN must exist
on the switch, and it must have either an

access interface in the VLAN that is up/up,
or a trunk interface that allows the VLAN

that is up/up.

You don’t need to issue the switchport mode
trunk or switchport access vlan commands.

Let’s go to question 3, which will be the
last quiz question before we take a look at

a sample question from Boson ExSim for CCNA.

Which command is used to configure a switch
interface as a routed port?

A, no switchport.

B, IP Address, followed by the IP address
and Subnet mask.

C, ip routing.

Or D, switchport mode route.

Pause the video to think about your answer.

The answer is A, no switchport.

This configures the interface as a routed
port, and allows you to configure an IP address

on the interface.

C, ip routing, is used to enable IP routing
on the switch, but it doesn’t set an individual

interface as a routed port.

Let's go on to today's Boson ExSim practice
question.

You issue the following commands on a Catalyst
2950 switch.

CONFIGURE TERMINAL.

INTERFACE FASTETHERNET 0/7.

SWITCHPORT TRUNK ENCAPSULATION DOT1Q.

SWITCHPORT MODE TRUNK.

SWITCHPORT TRUNK NATIVE VLAN 44.

Which of the following statements is true
regarding VLAN traffic when it is sent over

port FastEthernet0/7?

Select the best answer.

Okay, let's check each option.

A, VLAN 1 traffic will be untagged.

B, VLAN 44 traffic will be untagged.

C, all VLAN traffic will be tagged.

Or D, all VLAN traffic will be untagged.

Please pause the video to think about your
answer.

Okay, so I think the correct answer is B,
because you issued the SWITCHPORT TRUNK NATIVE

VLAN 44 command.

Traffic in the native VLAN will not be tagged
when it is sent over a trunk interface.

So, I think VLAN 44 traffic will be untagged.

Let's check.

Click 'show answer' down here.

And as you can see, B is in fact the correct
answer.

Let's check out Boson's explanation a little
bit.

Traffic from VLAN 44 will be untagged when
it is sent over port FastEthernet0/7.

VLAN 44 traffic is untagged because it has
been configured as the native VLAN by the

SWITCHPORT TRUNK NATIVE VLAN 44 command.

By default, the native VLAN is VLAN 1.

So, by default A would be the correct answer,
but we changed it to 44.

You can issue the SWITCHPORT TRUNK NATIVE
VLAN (vlan-id) command to change the native

VLAN.

Okay, here are explanations for why the incorrect
options are incorrect.

It also says you can issue the SHOW INTERFACES
TRUNK command to display the list of ports

that are configured for trunking, the native
VLAN for each port, and list of currently

allowed VLANs for each trunk port.

And here is an example, down here, after we
have changed the native VLAN to 44.

Okay, there are also references here, to Cisco's
official cert guide.

This is volume 1, chapter 8, about Ethernet
virtual LANs, VLANs.

And some Cisco documentation.

I will leave links to these in the description
of the video, so if you want some further

reading about VLAN trunks, dot1q, please check
those links in the description for further

reading.

Okay, so that's all for today's Boson ExSim
practice question.

If you want to get a copy of Boson ExSim,
and I highly recommend you do, they are fantastic

practice exams, please follow the link in
the video description.

As usual, there will be supplementary materials
for this video.

There will be a review flashcard deck to use
with the software ‘Anki’.

Download the deck from the link in the description.

There will also be a packet tracer practice
lab to help you practice the configurations

from this video.

That will be in a separate video.

Before finishing this video, I want to give
a shoutout to all of my JCNP-level channel

members.

Thank you to C Mohd, Johan, And then I’m
sorry, but the next person displays only as

Channel failed to load.

If this is you, please let me know and I will
try to ask YouTube to fix it.

Okay, continuing on, thank you to Mark, Aleksa,
Miguel, Yousif, Samil, Boson Software (the creators of ExSim), Sidi,

Magrathea, Devin, Charlsetta, Lito, Yonatan,
Mike, Aleksander, and Vance.

Sorry if I pronounced your name wrong, but
thank you so much for your support.

Thank you for watching.

Please subscribe to the channel, like the
video, leave a comment, and share the video

with anyone else studying for the CCNA.

If you want to leave a tip, check the links
in the description.

I'm also a Brave verified publisher and accept
BAT, or Basic Attention Token, tips via the

Brave browser.

That's all for now.