VLAN management on Cisco ISR routers

: Last Updated: 13 February 2024

VLAN management is quite different on ISR routers than on Catalyst switches. VLAN can be used as 802.1q subinterfaces for routed interfaces or with a switch-like configuration on Ethernet Switch Modules (HWIC-4ESW for example).

Subinterface configuration (routed interfaces)

Layer 3 router interfaces cannot be configured in switch mode using "switchport" command on a Cisco ISR router. However, 802.1q trunks interconnexion is supported on these interfaces using the subinterface feature.

Virtual layer 3 interfaces are bound to the physical port using the interface <interface name>.<inderface id> command, <interface id> beeing the subinterface ID. For better configuration readability, the <interface id> is usually configured with the <vlan id> value. The encapsulation dot1Q <vlan id> maps the trafic flowing with the 802.1q vlan id (tagged) to the subinterface.

In the example below, FastEthernet0/0.20 is a subinterface bound to the FastEthernet0/0 physical interface. FastEthernet 0/0.20 is configured to process trafic flowing on vlan 20 in the 802.1q trunk connected to the FastEthernet 0/0 physical router interface.

interface FastEthernet0/0.20
  encapsulation dot1Q 20
  ip address 10.20.10.1 255.255.255.0

interface FastEthernet0/0.30
  encapsulation dot1Q 30
  ip address 10.30.10.1 255.255.255.0

VLAN database (ESW module)

If an EtherSwitch Service Module (HWIC-4ESW for example) has been installed on the ISR router, VLAN for that module can be configured using the vlan database in Packet Tracer 7.2. Port membership to the vlan is configured in the same way than on a Catalyst switch using the "switchport access vlan <vid>" commmand.

Router(config)#interface Vlan100
Router(config-if)#description mgmt
Router(config-if)#ip address 192.168.10.100 255.255.255.0

Router#vlan database 
% Warning: It is recommended to configure VLAN from config mode,
  as VLAN database mode is being deprecated. Please consult user
  documentation for configuring VTP/VLAN in config mode.

Router(vlan)#vlan 100
VLAN 100 added:
    Name: VLAN0100
Router(vlan)#
%LINK-5-CHANGED: Interface Vlan100, changed state to up

The show vlan-switch command displays the VLAN configured on the EtherSwitch Service Module of the ISR router.

Router#show vlan-switch

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    
100  VLAN0100                         active    
1002 fddi-default                     act/unsup 
1003 token-ring-default               act/unsup 
1004 fddinet-default                  act/unsup 
1005 trnet-default                    act/unsup 

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
100  enet  100100     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0   
1003 tr    101003     1500  -      -      -        -    -        0      0   
1004 fdnet 101004     1500  -      -      -        ieee -        0      0   
1005 trnet 101005     1500  -      -      -        ibm  -        0      0

Layer 3 configuration of a vlan interface is achieved using the interface vlan <vid> command in a same way than on any Cisco layer 3 switch. Vlan interfaces IP configuration and state (up, down, administratively down) can be reviewed using the show ip interface brief command. Don't forget do use the no shutdown command to enable an administratively down VLAN interface.

Router#show ip interface brief 
Interface              IP-Address      OK? Method Status                Protocol
 
GigabitEthernet0/0     unassigned      YES unset  administratively down down
 
GigabitEthernet0/1     unassigned      YES unset  administratively down down
 
GigabitEthernet0/2     unassigned      YES unset  administratively down down
 
Vlan1                  unassigned      YES unset  administratively down down
 
Vlan100                192.168.10.100  YES manual up                    down

Packet Tracer Blog