Router on a Stick Configuration – Juniper, Cisco, Vyatta
January 30, 2011 1 Comment
Layer 2 switch is a network device which provides network access for hosts connected to its ports. Hosts are grouped in to VLANs according to switch port configuration. If they are hosts belonging to different VLANs it is not connectivity between hosts (http://en.wikipedia.org/wiki/Virtual_LAN) so it must be a mechanism which provides connectivity – routing between hosts on different VLANs. Each VLAN should have assigned its own IP address space – subnet. Layer 2 switch can’t do routing between subnets and frames destinated outside of VLAN must be sent to device which is capable of routing between VLAN. This device is known as router and when it is connected with its only one interface to L2 switch this concept is called Router-on-a-Stick configuration. http://en.wikipedia.org/wiki/IEEE_802.1Q
Instead of transferring frames from particular VLAN on dedicated switch port it exists a method which allows to send frames from multiple VLANs through one port of switch. This switch port is called a trunk port and frames sent through the trunk port must carry information about VLAN they are coming from. The VLAN-ID information is placed in to 802.1 tag and a tag is added to original Ethernet frame right after source MAC address. VLAN-id field inside 802.1q tag is determined according to VLAN configured on switchport where a frame originally enters switch.
On opposite side of trunk there is a Router-on-a-Stick which needs to understand tagged 802.1q frames coming from trunk port of switch. Physical interface of router connected to switch is divided to multiple logical sub-interfaces. Each sub-interface is configured with IP subnet, VLAN-id and type of encapsulation (802.1q standard or proprietary Cisco ISL). Router’s job is routing between subnets and encapsulating frames with proper 802.1q tag according to VLAN-id configured on sub-interface.
The router port must be Fast Ethernet or Gigabit Ethernet port because it must be able to receive and send frames at the same time – working in duplex mode. Funny to say but Juniper shows speed 10M with half-duplex for interface fxp3 and Router-on-a-stick configuration is working.
The goal of this tutorial is to show Router-on-a-Stick configuration for different vendor products – Juniper, Cisco, Vyatta. I’m using LiSA Multilayer switch as layer 2 switch in this Lab for pure layer 2 switching – no layer 3 interfaces are configured on LiSA. The VLAN 100 and VLAN200 are created on LiSA and interface Ethernet 3 is a trunk port with only VLAN 100 and 200 allowed on this port. Host PC100 is connected to interface Ethernet0 with VLAN100 configured on this interface. VLAN 200 is configured on interface Ethernet 1 and it connects host PC200.
Router-on-a-Stick Juniper – click image to enlarge
There is Juniper on the picture doing intervlan routing between Vlan 100 and 200. I’m posting only one topology picture for all router-on-a-stick configurations but keep in mind Juniper should be replaced with particular type of router (Vyatta, Cisco) for following lab.
1. Linux Microcore host PC 100, PC 200 and LiSA configuration
LiSA and Microcore hosts configuration is quite common for all Labs so I’m posting it only once.
1.1 Microcore PC 100 host configuration
echo “ifconfig eth0 192.168.100.2 netmask 255.255.255.0″ >> /opt/bootlocal.sh
echo “route add default gw 192.168.100.1″ >> /opt/bootlocal.sh
echo “hostname PC100″ >> /opt/bootlocal.sh
/usr/bin/filetool.sh -b
sudo /opt/bootlocal.sh
1.2 Microcore PC 200 host configuration
echo “ifconfig eth1 192.168.200.2 netmask 255.255.255.0″ >> /opt/bootlocal.sh
echo “route add default gw 192.168.200.1″ >> /opt/bootlocal.sh
echo “hostname PC200″ >> /opt/bootlocal.sh
/usr/bin/filetool.sh -b
sudo /opt/bootlocal.sh
1.3 Linux Multilayer Switch – LiSA configuration
Configuration shouldn’t be a problem for people familiar with Cisco.
LiSA#show running-config
Building configuration…
Current configuration : 352 bytes
!
hostname LiSA
!
!
!
vlan 100
name Access100
!
vlan 200
name Access200
!
interface Ethernet 3
description Trunk to Router
switchport trunk allowed vlan 100,200
switchport mode trunk
!
!
interface Ethernet 0
description Link to PC 100
switchport access vlan 100
!
!
interface Ethernet 1
description Link to PC 200
switchport access vlan 200
!
end
2. Router-on-a-Stick – Juniper configuration
The configuration below is using Gigabit NIC e1000 (em interface). Ping between PC 100 and PC 200 is successful at the time of configuration but after reboot of Olive, em3 interface is stacked in administratively shutdown state regardless of configuration. I can’t find a solution to this issue but according to Olive Clue multiple VLANs should not be working for em interfaces.
For this reason I recommend to use NIC i82559er which is working flawlessly (fxp interface).
root@JUNOS4> show configuration
## Last commit: 2011-01-28 19:14:35 UTC by root
version 10.1R1.8;
system {
host-name JUNOS4;
root-authentication {
encrypted-password “$1$zjHC5DHn$p1x2.U8FZjdXBPY/qsVvu1″; ## SECRET-DATA
}
syslog {
user * {
any emergency;
}
file messages {
any notice;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
}
}
interfaces {
em3 {
vlan-tagging;
unit 100 {
vlan-id 100;
family inet {
address 192.168.100.1/24;
}
}
unit 200 {
vlan-id 200;
family inet {
address 192.168.200.1/24;
}
}
}
}
I’ve attached captured traffic between Juniper and LiSA during ping from PC 100 (192.168.100.2) to PC 200 (192.168.200.2). All frames seems to have correct 802.1 tags.
3. Router-on-a-Stick – Vyatta 6.1 Core configuration
Vyatta is open-sorce routing solution running on x86 hardware. Read more about Vyatta here. I created tutorial how to install Vyatta on Qemu image available here.
vyatta@vyatta:~$ show configuration
interfaces {
ethernet eth3 {
duplex auto
smp_affinity auto
speed auto
vif 100 {
address 192.168.100.1/24
}
vif 200 {
address 192.168.200.1/24
}
}
loopback lo {
}
}
system {
host-name VYATTA
login {
user root {
authentication {
encrypted-password ****************
plaintext-password ****************
}
level admin
}
user vyatta {
authentication {
encrypted-password ****************
}
level admin
}
}
ntp-server 0.vyatta.pool.ntp.org
package {
auto-sync 1
repository community {
components main
distribution stable
password ****************
url http://packages.vyatta.com/vyatta
username “”
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone GMT
}
4. Router-on-a-Stick – Cisco 3725 configuration
Cisco#show run
Building configuration…
Current configuration : 1017 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Cisco
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
ip cef
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
archive
log config
hidekeys
!
!
interface FastEthernet0/0
description Link to LiSA
no ip address
speed 100
full-duplex
!
interface FastEthernet0/0.100
description Sub-interface VLAN 100
encapsulation dot1Q 100
ip address 192.168.100.1 255.255.255.0
!
interface FastEthernet0/0.200
description Sub-interface VLAN 200
encapsulation dot1Q 200
ip address 192.168.200.1 255.255.255.0
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
line vty 0 4
!
!
end
End.
