Как настроить vlan cisco роутер

VLANs allow logical network topologies to overlay the physical switched
infrastructure such that any arbitrary collection of LAN ports can be combined
into an autonomous user group or community of interest. The technology
logically segments the network into separate Layer 2 broadcast domains whereby
packets are switched between ports designated to be within the same VLAN. By
containing traffic originating on a particular LAN only to other LANs in the
same VLAN, switched virtual networks avoid wasting bandwidth, a drawback
inherent to traditional bridged and switched networks in which packets are
often forwarded to LANs with no need for them. Implementation of VLANs also
improves scalability, particularly in LAN environments that support broadcast-
or multicast-intensive protocols and applications that flood packets throughout
the network.

The figure below illustrates the difference between traditional
physical LAN segmentation and logical VLAN segmentation.

VLANs improve security by isolating groups. High-security users can be grouped into a VLAN, possibly on the same physical
segment, and no users outside that VLAN can communicate with them.

Just as switches isolate collision domains for attached hosts and only forward appropriate traffic out a particular port,
VLANs provide complete isolation between VLANs. A VLAN is a bridging domain, and all broadcast and multicast traffic is contained
within it.

The logical grouping of users allows an accounting group to make intensive use of a networked accounting system assigned to
a VLAN that contains just that accounting group and its servers. That group’s work will not affect other users. The VLAN configuration
improves general network performance by not slowing down other users sharing the network.

The logical grouping of users allows easier network management. It is not necessary to pull cables to move a user from one
network to another. Adds, moves, and changes are achieved by configuring a port into the appropriate VLAN.

SNMP support has been added to provide mib-2 interfaces sparse table support for Fast Ethernet subinterfaces. Monitor your
VLAN subinterface using the
show
vlans EXEC command. For more information on configuring SNMP on your Cisco network device or enabling an SNMP agent for remote
access, see the “Configuring SNMP Support” module in the
Cisco IOS Network Management Configuration Guide .

Communication between VLANs is accomplished through routing, and the traditional security and filtering functions of the router
can be used. Cisco IOS software provides network services such as security filtering, quality of service (QoS), and accounting
on a per-VLAN basis. As switched networks evolve to distributed VLANs, Cisco IOS software provides key inter-VLAN communications
and allows the network to scale.

Before Cisco IOS Release 12.2, Cisco IOS support for interfaces that have 802.1Q encapsulation configured is IP, IP multicast,
and IPX routing between respective VLANs represented as subinterfaces on a link. New functionality has been added in IEEE
802.1Q support for bridging on those interfaces and the capability to configure and use integrated routing and bridging (IRB).

The relaying function level, as displayed in the figure below, is the
lowest level in the architectural model described in the IEEE 802.1Q standard
and presents three types of rules:

• Ingress rules—Rules
  relevant to the classification of received frames belonging to a VLAN.

• Forwarding rules between
  ports—Rules decide whether to filter or forward the frame.

• Egress rules (output of
  frames from the switch)—Rules decide if the frame must be sent tagged or
  untagged.

Each physical port has a parameter called PVID. Every 802.1Q port is
assigned a PVID value that is of its native VLAN ID (default is VLAN 1). All
untagged frames are assigned to the LAN specified in the PVID parameter. When a
tagged frame is received by a port, the tag is respected. If the frame is
untagged, the value contained in the PVID is considered as a tag. Because the
frame is untagged and the PVID is tagged to allow the coexistence, as shown in
the figure below, on the same pieces of cable of VLAN-aware bridge/stations and
of VLAN-unaware bridges/stations. Consider, for example, the two stations
connected to the central trunk link in the lower part of the figure below. They
are VLAN-unaware and they will be associated to the VLAN C, because the PVIDs
of the VLAN-aware bridges are equal to VLAN C. Because the VLAN-unaware
stations will send only untagged frames, when the VLAN-aware bridge devices
receive these untagged frames they will assign them to VLAN C.

PVST+ provides support for 802.1Q trunks and the mapping of multiple spanning trees to the single spanning tree of 802.1Q
switches.

The PVST+ architecture distinguishes three types of regions:

• A PVST region

• A PVST+ region

• A MST region

Each region consists of a homogenous type of switch. A PVST region can be connected to a PVST+ region by connecting two ISL
ports. Similarly, a PVST+ region can be connected to an MST region by connecting two 802.1Q ports.

At the boundary between a PVST region and a PVST+ region the mapping of spanning trees is one-to-one. At the boundary between
a MST region and a PVST+ region, the ST in the MST region maps to one PVST in the PVST+ region. The one it maps to is called
the common spanning tree (CST). The default CST is the PVST of VLAN 1 (Native VLAN).

All PVSTs, except for the CST, are tunneled through the MST region. Tunneling means that bridge protocol data units (BPDUs)
are flooded through the MST region along the single spanning tree present in the MST region.

The BPDU transmission on the 802.1Q port of a PVST+ router will be implemented in compliance with the following rules:

• The CST BPDU (of VLAN 1, by default) is sent to the IEEE address.

• All the other BPDUs are sent to Shared Spanning Tree Protocol (SSTP)-Address and encapsulated with Logical Link Control-Subnetwork
  Access Protocol (LLC-SNAP) header.

• The BPDU of the CST and BPDU of the VLAN equal to the PVID of the 802.1Q trunk are sent untagged.

• All other BPDUs are sent tagged with the VLAN ID.

• The CST BPDU is also sent to the SSTP address.

• Each SSTP-addressed BPDU is also tailed by a Tag-Length-Value for the PVID checking.

The BPDU reception on the 802.1Q port of a PVST+ router will follow these rules:

• All untagged IEEE addressed BPDUs must be received on the PVID of the 802.1Q port.

• The IEEE addressed BPDUs whose VLAN ID matches the Native VLAN are processed by CST.

• All the other IEEE addressed BPDUs whose VLAN ID does not match the Native VLAN and whose port type is not of 802.1Q are processed
  by the spanning tree of that particular VLAN ID.

• The SSTP addressed BPDU whose VLAN ID is not equal to the TLV are dropped and the ports are blocked for inconsistency.

• All the other SSTP addressed BPDUs whose VLAN ID is not equal to the Native VLAN are processed by the spanning tree of that
  particular VLAN ID.

• The SSTP addressed BPDUs whose VLAN ID is equal to the Native VLAN are dropped. It is used for consistency checking.

IRB enables a user to route a given protocol between routed interfaces and bridge groups or route a given protocol between
the bridge groups. Integrated routing and bridging is supported on the following protocols:

• IP

• IPX

• AppleTalk

The Inter-Switch Link (ISL) protocol is used to interconnect two VLAN-capable Ethernet, Fast Ethernet, or Gigabit Ethernet
devices, such as the Catalyst 3000 or 5000 switches and Cisco 7500 routers. The ISL protocol is a packet-tagging protocol
that contains a standard Ethernet frame and the VLAN information associated with that frame. The packets on the ISL link contain
a standard Ethernet, FDDI, or Token Ring frame and the VLAN information associated with that frame. ISL is currently supported
only over Fast Ethernet links, but a single ISL link, or trunk, can carry different protocols from multiple VLANs.

Procedures for configuring ISL and Token Ring ISL (TRISL) features are provided in the Configuring Routing Between VLANs
with Inter-Switch Link Encapsulation section.

The IEEE 802.10 protocol provides connectivity between VLANs. Originally developed to address the growing need for security
within shared LAN/MAN environments, it incorporates authentication and encryption techniques to ensure data confidentiality
and integrity throughout the network. Additionally, by functioning at Layer 2, it is well suited to high-throughput, low-latency
switching environments. The IEEE 802.10 protocol can run over any LAN or HDLC serial interface.

Procedures for configuring routing between VLANs with IEEE 802.10 encapsulation are provided in the Configuring Routing Between
VLANs with IEEE 802.10 section.

The IEEE 802.1Q protocol is used to interconnect multiple switches and routers, and for defining VLAN topologies. Cisco currently
supports IEEE 802.1Q for Fast Ethernet and Gigabit Ethernet interfaces.

Note	Cisco does not support IEEE 802.1Q encapsulation for Ethernet interfaces.

Procedures for configuring routing between VLANs with IEEE 802.1Q encapsulation are provided in the Configuring Routing Between
VLANs with IEEE 802.1Q Encapsulation.

The ATM LAN Emulation (LANE) protocol provides a way for legacy LAN users to take advantage of ATM benefits without requiring
modifications to end-station hardware or software. LANE emulates a broadcast environment like IEEE 802.3 Ethernet on top of
an ATM network that is a point-to-point environment.

LANE makes ATM function like a LAN. LANE allows standard LAN drivers like NDIS and ODI to be used. The virtual LAN is transparent
to applications. Applications can use normal LAN functions without the underlying complexities of the ATM implementation.
For example, a station can send broadcasts and multicasts, even though ATM is defined as a point-to-point technology and does
not support any-to-any services.

To accomplish this, special low-level software is implemented on an ATM client workstation, called the LAN Emulation Client
(LEC). The client software communicates with a central control point called a LAN Emulation Server (LES). A broadcast and
unknown server (BUS) acts as a central point to distribute broadcasts and multicasts. The LAN Emulation Configuration Server
(LECS) holds a database of LECs and the ELANs they belong to. The database is maintained by a network administrator.

These protocols are described in detail in the
Cisco Internetwork Design Guide .

To improve the ATM LANE Simple Server Replication Protocol (SSRP), Cisco introduced the ATM LANE Fast Simple Server Replication
Protocol (FSSRP). FSSRP differs from LANE SSRP in that all configured LANE servers of an ELAN are always active. FSSRP-enabled
LANE clients have virtual circuits (VCs) established to a maximum of four LANE servers and BUSs at one time. If a single LANE
server goes down, the LANE client quickly switches over to the next LANE server and BUS, resulting in no data or LE ARP table
entry loss and no extraneous signalling.

The FSSRP feature improves upon SSRP such that LANE server and BUS switchover for LANE clients is immediate. With SSRP, a
LANE server would go down, and depending on the network load, it may have taken considerable time for the LANE client to come
back up joined to the correct LANE server and BUS. In addition to going down with SSRP, the LANE client would do the following:

• Clear out its data direct VCs

• Clear out its LE ARP entries

• Cause substantial signalling activity and data loss

FSSRP was designed to alleviate these problems with the LANE client. With FSSRP, each LANE client is simultaneously joined
to up to four LANE servers and BUSs. The concept of the master LANE server and BUS is maintained; the LANE client uses the
master LANE server when it needs LANE server BUS services. However, the difference between SSRP and FSSRP is that if and when
the master LANE server goes down, the LANE client is already connected to multiple backup LANE servers and BUSs. The LANE
client simply uses the next backup LANE server and BUS as the master LANE server and BUS.

The Cisco IOS supports full routing of several protocols over ISL and
ATM LANE VLANs. IP, Novell IPX, and AppleTalk routing are supported over IEEE
802.10 VLANs. Standard routing attributes such as network advertisements,
secondaries, and help addresses are applicable, and VLAN routing is fast
switched. The table below shows protocols supported for each VLAN encapsulation
format and corresponding Cisco IOS software releases in which support was
introduced.

VLAN translation refers to the ability of the Cisco IOS software to translate between different VLANs or between VLAN and
non-VLAN encapsulating interfaces at Layer 2. Translation is typically used for selective inter-VLAN switching of nonroutable
protocols and to extend a single VLAN topology across hybrid switching environments. It is also possible to bridge VLANs on
the main interface; the VLAN encapsulating header is preserved. Topology changes in one VLAN domain do not affect a different
VLAN.

• Each command you enter while you are in interface configuration mode with the interface range command is executed as it is entered. The commands are not batched together for execution after you exit interface configuration
  mode. If you exit interface configuration mode while the commands are being executed, some commands might not be executed
  on some interfaces in the range. Wait until the command prompt reappears before exiting interface configuration mode.

• The no interface range command is not supported. You must delete individual subinterfaces to delete a range.

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   interface
   range
   {{ethernet | fastethernet | gigabitethernet | atm } slot / interface . subinterface — {{ethernet | fastethernet | gigabitethernet | atm }slot / interface . subinterface }
4. 
   encapsulation
   dot1Q
   
   
   vlan-id
   

5. 
   no
   shutdown
   

6. 
   exit
   

7. 
   show
   running-config
   

8. 
   show
   interfaces
   

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# interface range fastethernet5/1.1 - fastethernet5/1.4 

Router(config-if)# encapsulation dot1Q 301

Router(config-if)# no shutdown

Router(config-if)# exit

Router# show running-config

Router# show interfaces

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   appletalk
   routing
   [eigrp router-number ]
4. 
   interface
   
   
   type
   slot
   
   
   /
   
   
   port
   
   
   .
   
   subinterface-number

5. 
   encapsulation
   isl
   
   
   vlan-identifier
   

6. 
   appletalk
   cable-range
   
   
   
   
   cable-range
   [network . node ]
7. 
   appletalk
   zone
   
   zone-name

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# appletalk routing

Router(config)# interface Fddi 1/0.100 

or 

            
              encapsulation sde 
             said

Router(config-if)#  encapsulation sde 100

Router(config-if)#  appletalk cable-range 100-100 100.2

Router(config-if)# appletalk zone 100 

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   vines
   routing
   [address ]
4. 
   interface
   
   
   type
   slot
   
   
   /
   
   
   port
   
   
   .
   
   
   subinterface-number
   

5. 
   encapsulation
   isl
   
   
   vlan-identifier
   

6. 
   vines
   metric
   [whole [fraction ]]

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# vines routing

Router(config)# interface fastethernet 1/0.1

Router(config-if)# encapsulation isl 200

Router(config-if)#vines metric 2

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. Router(config)# decnet [network —number ] routing [decnet-address ]
4. 
   interface
   
   
   type
   slot
   
   
   /
   
   
   port
   
   
   .
   
   subinterface-number

5. 
   encapsulation
   isl
   
   
   vlan-identifier
   

6. 
   decnet
   cost
   [cost-value ]

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# decnet routing 2.1

Router(config)# interface fastethernet 1/0.1

Router(config-if)# encapsulation isl 200

Router(config-if)# decnet cost 4

The Hot Standby Router Protocol (HSRP) provides fault tolerance and enhanced routing performance for IP networks. HSRP allows
Cisco IOS routers to monitor each other’s operational status and very quickly assume packet forwarding responsibility in the
event the current forwarding device in the HSRP group fails or is taken down for maintenance. The standby mechanism remains
transparent to the attached hosts and can be deployed on any LAN type. With multiple Hot Standby groups, routers can simultaneously
provide redundant backup and perform loadsharing across different IP subnets.

The figure below illustrates HSRP in use with ISL providing routing between several VLANs.

A separate HSRP group is configured for each VLAN subnet so that Cisco IOS router A can be the primary and forwarding router
for VLANs 10 and 20. At the same time, it acts as backup for VLANs 30 and 40. Conversely, Router B acts as the primary and
forwarding router for ISL VLANs 30 and 40, as well as the secondary and backup router for distributed VLAN subnets 10 and
20.

Running HSRP over ISL allows users to configure redundancy between multiple routers that are configured as front ends for
VLAN IP subnets. By configuring HSRP over ISLs, users can eliminate situations in which a single point of failure causes traffic
interruptions. This feature inherently provides some improvement in overall networking resilience by providing load balancing
and redundancy capabilities between subnets and VLANs.

To configure HSRP over ISLs between VLANs, you need to create the environment in which it will be used. Perform the tasks
described in the following sections in the order in which they appear.

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   interface
   
   
   type
   slot
   
   
   /
   
   
   port
   
   
   .
   
   subinterface-number

4. 
   encapsulation
   isl
   
   
   vlan-identifier
   

5. 
   ip
   address
   
   
   ip-address
   mask
   [secondary ]

6. Router(config-if)#
   standby [group-number ]
   ip [ip-address [secondary ]]

7. 
   standby
   [group-number ]
   timers
   hellotime
   holdtime

8. 
   standby
   [group-number ]
   priority
   priority

9. 
   standby
   [group-number ]
   preempt

10. 
    standby
    [group-number ]
    track
    type-number [interface-priority ]

11. 
    standby
    [group-number ]
    authentication
    string

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# interface FastEthernet 1/1.110

Router(config-if)#  encapsulation isl 110

Router(config-if)# ip address 10.1.1.2 255.255.255.0

Router(config-if)# standby 1 ip 10.1.1.101

Router(config-if)# standby 1 timers 10 10

Router(config-if)# standby 1 priority 105

Router(config-if)# standby 1 priority 105

Router(config-if)# standby 1 track 4 5

Router(config-if)# standby 1 authentication hsrpword7

What to do next

Note	For more information on HSRP, see the “Configuring HSRP” module in the Cisco IOS IP Application Services Configuration Guide .

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   ip
   routing
   

4. 
   interface
   
   
   type
   slot
   
   
   /
   
   
   port
   
   
   .
   
   
   subinterface-number
   

5. 
   encapsulation
   tr-isl
   trbrf-vlan
   
   
   vlanid
   
   
   
   
   bridge-num
   
   bridge-number

6. 
   ip
   address
   
   ip-address mask

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# ip routing

Router(config)# interface FastEthernet4/0.1

Router(config-if# encapsulation tr-isl trbrf-vlan 999 bridge-num 14

Router(config-if# ip address 10.5.5.1 255.255.255.0

The IPX Encapsulation for 802.10 VLAN feature provides configurable IPX (Novell-FDDI, SAP, SNAP) encapsulation over 802.10
VLAN on router FDDI interfaces to connect the Catalyst 5000 VLAN switch. This feature extends Novell NetWare routing capabilities
to include support for routing all standard IPX encapsulations for Ethernet frame types in VLAN configurations. Users with
Novell NetWare environments can now configure any one of the three IPX Ethernet encapsulations to be routed using Secure Data
Exchange (SDE) encapsulation across VLAN boundaries. IPX encapsulation options now supported for VLAN traffic include the
following:

• Novell-FDDI (IPX FDDI RAW to 802.10 on FDDI)

• SAP (IEEE 802.2 SAP to 802.10 on FDDI)

• SNAP (IEEE 802.2 SNAP to 802.10 on FDDI)

NetWare users can now configure consolidated VLAN routing over a single VLAN trunking FDDI interface. Not all IPX encapsulations
are currently supported for SDE VLAN. The IPX interior encapsulation support can be achieved by messaging the IPX header before
encapsulating in the SDE format. Fast switching will also support all IPX interior encapsulations on non-MCI platforms (for
example non-AGS+ and non-7000). With configurable Ethernet encapsulation protocols, users have the flexibility of using VLANs
regardless of their NetWare Ethernet encapsulation. Configuring Novell IPX encapsulations on a per-VLAN basis facilitates
migration between versions of Netware. NetWare traffic can now be routed across VLAN boundaries with standard encapsulation
options (arpa ,
sap , and
snap ) previously unavailable. Encapsulation types and corresponding framing types are described in the “Configuring Novell IPX
” module of the
Cisco IOS Novell IPX Configuration Guide .

Note	Only one type of IPX encapsulation can be configured per VLAN (subinterface). The IPX encapsulation used must be the same within any particular subnet; a single encapsulation must be used by all NetWare systems that belong to the same VLAN.

To configure Cisco IOS software on a router with connected VLANs to exchange different IPX framing protocols, perform the
steps described in the following task in the order in which they are appear.

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   ipx
   routing
   [node ]

4. 
   interface
   
   
   fddi
   slot
   
   
   /
   
   
   port
   
   
   .
   
   subinterface-number

5. 
   encapsulation
   sde
   
   
   vlan-identifier
   

6. 
   ipx
   network
   
   
   network
   
   
   encapsulation
   
   
   encapsulation-type
   

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# ipx routing

Router(config)# interface 2/0.1 

Router(config-if)# encapsulation isl 20

Router(config-if)# ipx network 20 encapsulation sap

The IPX Routing over ISL VLANs feature extends Novell NetWare routing capabilities to include support for routing all standard
IPX encapsulations for Ethernet frame types in VLAN configurations. Users with Novell NetWare environments can configure either
SAP or SNAP encapsulations to be routed using the TRISL encapsulation across VLAN boundaries. The SAP (Novell Ethernet_802.2)
IPX encapsulation is supported for VLAN traffic.

NetWare users can now configure consolidated VLAN routing over a single VLAN trunking interface. With configurable Ethernet
encapsulation protocols, users have the flexibility of using VLANs regardless of their NetWare Ethernet encapsulation. Configuring
Novell IPX encapsulations on a per-VLAN basis facilitates migration between versions of Netware. NetWare traffic can now be
routed across VLAN boundaries with standard encapsulation options (sap and
snap ) previously unavailable. Encapsulation types and corresponding framing types are described in the “Configuring Novell IPX
” module of the
Cisco IOS Novell IPX Configuration Guide .

Note	Only one type of IPX encapsulation can be configured per VLAN (subinterface). The IPX encapsulation used must be the same within any particular subnet: A single encapsulation must be used by all NetWare systems that belong to the same LANs.

To configure Cisco IOS software to exchange different IPX framing protocols on a router with connected VLANs, perform the
steps in the following task in the order in which they are appear.

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   ipx
   routing
   [node ]

4. 
   interface
   
   
   type
   slot
   
   
   /
   
   
   port
   
   
   .
   
   subinterface-number

5. 
   encapsulation
   tr-isl
   trbrf-vlan
   
   
   trbrf-vlan
   
   
   
   
   bridge-num
   
   bridge-num

6. 
   ipx
   network
   
   
   network
   
   
   encapsulation
   
   encapsulation-type
   

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# source-bridge ring-group 100

Router(config)# interface TokenRing 3/1

Router(config-if)#encapsulation tr-isl trbrf-vlan 999 bridge-num 14

Router(config-if)# ipx network 100 encapsulation sap

What to do next

Note

The default IPX encapsulation format for Cisco IOS routers is “novell-ether” (Novell Ethernet_802.3). If you are running Novell Netware 3.12 or 4.0, the new Novell default encapsulation format is Novell Ethernet_802.2 and you should configure the Cisco router with the IPX encapsulation format “sap.”

With the introduction of the VIP distributed ISL feature, ISL
encapsulated IP packets can be switched on Versatile Interface Processor (VIP)
controllers installed on Cisco 7500 series routers.

The second generation VIP2 provides distributed switching of IP
encapsulated in ISL in VLAN configurations. Where an aggregation route performs
inter-VLAN routing for multiple VLANs, traffic can be switched autonomously
on-card or between cards rather than through the central Route Switch Processor
(RSP). The figure below shows the VIP distributed architecture of the Cisco
7500 series router.

This distributed architecture allows incremental capacity increases
by installation of additional VIP cards. Using VIP cards for switching the
majority of IP VLAN traffic in multiprotocol environments substantially
increases routing performance for the other protocols because the RSP offloads
IP and can then be dedicated to switching the non-IP protocols.

VIP distributed switching offloads switching of ISL VLAN IP traffic
to the VIP card, removing involvement from the main CPU. Offloading ISL traffic
to the VIP card substantially improves networking performance. Because you can
install multiple VIP cards in a router, VLAN routing capacity is increased
linearly according to the number of VIP cards installed in the router.

To configure distributed switching on the VIP, you must first
configure the router for IP routing. Perform the tasks described below in the
order in which they appear.

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   ip
   routing
   

4. 
   interface
   
   
   type
   slot
   
   
   /
   
   
   port-adapter
   
   
   /
   
   
   port
   

5. 
   ip
   route-cache
   distributed
   

6. 
   encapsulation
   isl
   
   
   vlan-identifier
   
   
   
   
   

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# ip routing

Router(config)# interface FastEthernet1/0/0

Router(config-if)# ip route-cache distributed

Router(config-if)# encapsulation isl 1

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   xns
   routing
   [address ]
4. 
   interface
   
   
   type
   slot
   
   
   /
   
   
   port
   
   
   .
   
   subinterface-number

5. 
   encapsulation
   isl
   
   
   vlan-identifier
   

6. 
   xns
   network
   [number ]

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# xns routing 0123.4567.adcb

Router(config)# interface fastethernet 1/0.1

Router(config-if)# encapsulation isl 100

Router(config-if)# xns network 20

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   clns
   routing
   

4. 
   interface
   
   
   type
   slot
   
   
   /
   
   
   port
   
   
   .
   
   subinterface-number

5. 
   encapsulation
   isl
   
   
   vlan-identifier
   

6. 
   clns
   enable
   

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# clns routing

Router(config-if)# interface fastethernet 1/0.1

Router(config-if)# encapsulation isl 100 

Router(config-if)# clns enable

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   router
   isis
   [tag ]
4. 
   net
   
   
   network-entity-title
   

5. 
   interface
   
   
   type
   slot
   
   
   /
   
   
   port
   
   
   .
   
   subinterface-number

6. 
   encapsulation
   isl
   
   
   vlan-identifier
   

7. 
   clns
   router
   isis
   network
   [tag ]

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# isis routing test-proc2

Router(config)# net 49.0001.0002.aaaa.aaaa.aaaa.00

Router(config)# interface fastethernet 2.

Router(config-if)# encapsulation isl 101

Router(config-if)# clns router is-is network test-proc2

Configuring routing between VLANs with IEEE 802.1Q encapsulation assumes the presence of a single spanning tree and of an
explicit tagging scheme with one-level tagging.

You can configure routing between any number of VLANs in your network.

The IEEE 802.1Q standard is extremely restrictive to untagged frames. The standard provides only a per-port VLANs solution
for untagged frames. For example, assigning untagged frames to VLANs takes into consideration only the port from which they
have been received. Each port has a parameter called a permanent virtual identification
(Native VLAN) that specifies the VLAN assigned to receive untagged frames.

The main characteristics of the IEEE 802.1Q are that it assigns frames to VLANs by filtering and that the standard assumes
the presence of a single spanning tree and of an explicit tagging scheme with one-level tagging.

This section contains the configuration tasks for each protocol supported with IEEE 802.1Q encapsulation. The basic process
is the same, regardless of the protocol being routed. It involves the following tasks:

• Enabling the protocol on the router

• Enabling the protocol on the interface

• Defining the encapsulation format as IEEE 802.1Q

• Customizing the protocol according to the requirements for your environment

To configure IEEE 802.1Q on your network, perform the following tasks. One of the following tasks is required depending on
the protocol being used.

• Configuring AppleTalk Routing over IEEE 802.1Q (required)

• Configuring IP Routing over IEEE 802.1Q (required)

• Configuring IPX Routing over IEEE 802.1Q (required)

The following tasks are optional. Perform the following tasks to connect a network of hosts over a simple bridging-access
device to a remote access concentrator bridge between IEEE 802.1Q VLANs. The following sections contain configuration tasks
for the Integrated Routing and Bridging, Transparent Bridging, and PVST+ Between VLANs with IEEE 802.1Q Encapsulation:

• Configuring a VLAN for a Bridge Group with Default VLAN1 (optional)

• Configuring a VLAN for a Bridge Group as a Native VLAN (optional)

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   appletalk
   routing
   [eigrp
   router-number ]

4. 
   interface
   fastethernet
   
   
   slot
   
   
   /
   
   
   port
   
   
   .
   subinterface-number

5. 
   encapsulation
   dot1q
   
   
   vlan-identifier
   

6. 
   appletalk
   cable-range
   
   
   cable-range
   [network
   .
   node ]

7. 
   appletalk
   zone
   
   
   zone-name
   

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# appletalk routing 

Router(config)# interface fastethernet 4/1.00

Router(config-if)# encapsulation dot1q 100

Router(config-if)# appletalk cable-range 100-100 100.1

Router(config-if)# appletalk zone eng

What to do next

Note	For more information on configuring AppleTalk, see the “Configuring AppleTalk” module in the Cisco IOS AppleTalk Configuration Guide .

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. ip routing
4. 
   interface
   fastethernet
   
   
   slot
   
   
   /
   
   
   port
   
   
   .
   subinterface-number
5. 
   encapsulation
   dot1q
   vlanid
6. 
   ip
   address
   
   
   ip-address
   mask
   

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# ip routing

Router(config)# interface fastethernet 4/1.101

Router(config-if)# encapsulation dot1q 101

Router(config-if)# ip addr 10.0.0.11 255.0.0.0

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   ipx
   routing
   [node ]
4. 
   interface
   fastethernet
   
   
   slot
   
   
   /
   
   
   port
   
   
   .
   subinterface-number
5. 
   encapsulation
   dot1q
   vlanid
6. 
   ipx
   network
   
   
   network
   

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# ipx routing

Router(config)# interface fastethernet 4/1.102

Router(config-if)# encapsulation dot1q 102

Router(config-if)# ipx network 100

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   interface
   fastethernet
   
   
   slot
   
   
   /
   
   
   port
   
   
   .
   subinterface-number
4. 
   encapsulation
   dot1q
   vlanid
5. 
   bridge-group
   
   
   bridge-group
   

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# interface fastethernet 4/1.100

Router(config-subif)# encapsulation dot1q 1

Router(config-subif)# bridge-group 1

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   interface
   fastethernet
   
   
   slot
   
   
   /
   
   
   port
   
   
   .
   subinterface-number
4. 
   encapsulation
   dot1q
   
   
   vlanid
   
   
   native
   

5. 
   bridge-group
   
   
   bridge-group
   

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# interface fastethernet 4/1.100

Router(config-subif)# encapsulation dot1q 20 native

Router(config-subif)# bridge-group 1

What to do next

Note	If there is an explicitly defined native VLAN, VLAN1 will only be used to process CST.

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   interface
   
   
   type
   number
   

4. 
   dot1q
   tunneling
   ethertype
   
   
   ethertype
   

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# interface gigabitethernet 1/0/0

Router(config-if)# dot1q tunneling ethertype 0x9100

SUMMARY STEPS

1. 
   enable
   

2. 
   configure
   
   
   terminal
   

3. 
   interface
   
   
   type
   number
   
   
   .
   
   
   subinterface-number
   

4. 
   encapsulation
   dot1q
   
   
   vlan-id
   
   
   second-dot1q
   {any
   |
   vlan-id |
   vlan-id
   —
   vlan-id [,
   vlan-id
   —
   vlan-id ]}

5. 
   pppoe
   enable
   [group
   group-name ]

6. 
   exit
   

7. Repeat Step 3 to configure another subinterface.
8. Repeat Step 4 and Step 5 to specify the VLAN tags to be terminated on the subinterface.
9. 
   end
   

DETAILED STEPS

Router> enable

Router# configure terminal

Router(config)# interface gigabitethernet 1/0/0.1

Router(config-subif)# encapsulation dot1q 100 second-dot1q 200

Router(config-subif)# pppoe enable group vpn1

Router(config-subif)# exit

Router(config-if)# interface gigabitethernet 1/0/0.2

Router(config-subif)# encapsulation dot1q 100 second-dot1q 100-199,201-600

Router(config-subif)# pppoe enable group vpn1

Router(config-subif)# end

SUMMARY STEPS

1. 
   enable
   

2. 
   show
   running-config
   

3. 
   show
   vlans
   dot1q
   [internal | interface-type interface-number . subinterface-number [detail ] | outer-id [interface-type interface-number | second-dot1q [inner-id | any ]] [detail ]]

DETAILED STEPS

Router> enable

Router# show running-config
.
.
.
interface FastEthernet0/0.201
 encapsulation dot1Q 201
 ip address 10.7.7.5 255.255.255.252
!
interface FastEthernet0/0.401
 encapsulation dot1Q 401
 ip address 10.7.7.13 255.255.255.252
!
interface FastEthernet0/0.201999
 encapsulation dot1Q 201 second-dot1q any
 pppoe enable
!
interface FastEthernet0/0.2012001
 encapsulation dot1Q 201 second-dot1q 2001
 ip address 10.8.8.9 255.255.255.252
!
interface FastEthernet0/0.2012002
 encapsulation dot1Q 201 second-dot1q 2002
 ip address 10.8.8.13 255.255.255.252
!
interface FastEthernet0/0.4019999
 encapsulation dot1Q 401 second-dot1q 100-900,1001-2000
 pppoe enable
!
interface GigabitEthernet5/0.101
 encapsulation dot1Q 101
 ip address 10.7.7.1 255.255.255.252
!
interface GigabitEthernet5/0.301
 encapsulation dot1Q 301
 ip address 10.7.7.9 255.255.255.252
!
interface GigabitEthernet5/0.301999
 encapsulation dot1Q 301 second-dot1q any
 pppoe enable
!
interface GigabitEthernet5/0.1011001
 encapsulation dot1Q 101 second-dot1q 1001
 ip address 10.8.8.1 255.255.255.252
!
interface GigabitEthernet5/0.1011002
 encapsulation dot1Q 101 second-dot1q 1002
 ip address 10.8.8.5 255.255.255.252
!
interface GigabitEthernet5/0.1019999
 encapsulation dot1Q 101 second-dot1q 1-1000,1003-2000
 pppoe enable
.
.
.

Router# show running-config
.
.
.
interface FastEthernet1/0/0.201
 encapsulation dot1Q 201
 ip address 10.7.7.5 255.255.255.252
!
interface FastEthernet1/0/0.401
 encapsulation dot1Q 401
 ip address 10.7.7.13 255.255.255.252
!
interface FastEthernet1/0/0.201999
 encapsulation dot1Q 201 second-dot1q any
 pppoe enable
!
interface FastEthernet1/0/0.4019999
 encapsulation dot1Q 401 second-dot1q 100-900,1001-2000
 pppoe enable
!
interface GigabitEthernet5/0/0.101
 encapsulation dot1Q 101
 ip address 10.7.7.1 255.255.255.252
!
interface GigabitEthernet5/0/0.301
 encapsulation dot1Q 301
 ip address 10.7.7.9 255.255.255.252
!
interface GigabitEthernet5/0/0.301999
 encapsulation dot1Q 301 second-dot1q any
 pppoe enable
!
interface GigabitEthernet5/0/0.1019999
 encapsulation dot1Q 101 second-dot1q 1-1000,1003-2000
 pppoe enable
.
.
.

Router# show vlans dot1q
Total statistics for 802.1Q VLAN 1:
   441 packets, 85825 bytes input
   1028 packets, 69082 bytes output
Total statistics for 802.1Q VLAN 101:
   5173 packets, 510384 bytes input
   3042 packets, 369567 bytes output
Total statistics for 802.1Q VLAN 201:
   1012 packets, 119254 bytes input
   1018 packets, 120393 bytes output
Total statistics for 802.1Q VLAN 301:
   3163 packets, 265272 bytes input
   1011 packets, 120750 bytes output
Total statistics for 802.1Q VLAN 401:
   1012 packets, 119254 bytes input
   1010 packets, 119108 bytes output

The following is sample output from the show vlans command indicating a native VLAN and a bridged group:

Router# show vlans
Virtual LAN ID:  1 (IEEE 802.1Q Encapsulation)
   vLAN Trunk Interface:   FastEthernet1/0/2
 This is configured as native Vlan for the following interface(s) :
FastEthernet1/0/2
   Protocols Configured:   Address: Received:        Transmitted:
Virtual LAN ID:  100 (IEEE 802.1Q Encapsulation)
   vLAN Trunk Interface:   FastEthernet1/0/2.1
   Protocols Configured:   Address: Received:        Transmitted:
        Bridging        Bridge Group 1 0                   0

The following is sample output from the show vlans command that shows the traffic count on Fast Ethernet subinterfaces:

Router# show vlans
Virtual LAN ID:  2 (IEEE 802.1Q Encapsulation)
    vLAN Trunk Interface:   FastEthernet5/0.1
 
    Protocols Configured:   Address:              Received:        Transmitted:
           IP              172.16.0.3                    16               92129
 
Virtual LAN ID:  3 (IEEE 802.1Q Encapsulation)
 
    vLAN Trunk Interface:   Ethernet6/0/1.1
 
    Protocols Configured:   Address:              Received:        Transmitted:
           IP              172.20.0.3                  1558                1521
 
Virtual LAN ID:  4 (Inter Switch Link Encapsulation)
 
    vLAN Trunk Interface:   FastEthernet5/0.2     
 
    Protocols Configured:   Address:              Received:        Transmitted:
           IP              172.30.0.3                     0                   7

To configure routing of the Banyan VINES protocol over ISL trunks, you need to define ISL as the encapsulation type. This
example shows Banyan VINES configured to be routed over an ISL trunk:

vines routing
interface fastethernet 0.1
 encapsulation isl 100
 vines metric 2

To configure routing the DECnet protocol over ISL trunks, you need to define ISL as the encapsulation type. This example shows
DECnet configured to be routed over an ISL trunk:

decnet routing 2.1
interface fastethernet 1/0.1
 encapsulation isl 200
 decnet cost 4

The figure below shows IP routing with RIF between two TrBRF VLANs.

The following is the configuration for the router:

interface FastEthernet4/0.1
 ip address 10.5.5.1 255.255.255.0
 encapsulation tr-isl trbrf-vlan 999 bridge-num 14
 multiring trcrf-vlan 200 ring 100
 multiring all
!
 interface FastEthernet4/0.2
 ip address 10.4.4.1 255.255.255.0
 encapsulation tr-isl trbrf-vlan 998 bridge-num 13
 multiring trcrf-vlan 300 ring 101
 multiring all

The following is the configuration for the Catalyst 5000 switch with
the Token Ring switch module in slot 5. In this configuration, the Token Ring
port 102 is assigned with TrCRF VLAN 40 and the Token Ring port 103 is assigned
with TrCRF VLAN 50:

#vtp
set vtp domain trisl
set vtp mode server
set vtp v2 enable
#drip
set set tokenring reduction enable
set tokenring distrib-crf disable
#vlans
set vlan 999 name trbrf type trbrf bridge 0xe stp ieee
set vlan 200 name trcrf200 type trcrf parent 999 ring 0x64 mode srb
set vlan 40 name trcrf40 type trcrf parent 999 ring 0x66 mode srb
set vlan 998 name trbrf type trbrf bridge 0xd stp ieee
set vlan 300 name trcrf300 type trcrf parent 998 ring 0x65 mode srb
set vlan 50 name trcrf50 type trcrf parent 998 ring 0x67 mode srb
#add token port to trcrf 40
set vlan 40   5/1
#add token port to trcrf 50
set vlan 50   5/2
set trunk 1/2 on

The figure below shows IP routing between a TRISL VLAN and an
Ethernet ISL VLAN.

The following is the configuration for the router:

interface FastEthernet4/0.1
 ip address 10.5.5.1 255.255.255.0
 encapsulation tr-isl trbrf-vlan 999 bridge-num 14
 multiring trcrf-vlan 20 ring 100
 multiring all
!
interface FastEthernet4/0.2
 ip address 10.4.4.1 255.255.255.0
 encapsulation isl 12

The following example enables IPX routing on FDDI interfaces 0.2 and 0.3 with SDE. On FDDI interface 0.2, the encapsulation
type is SNAP. On FDDI interface 0.3, the encapsulation type is Novell’s FDDI_RAW.

ipx routing
interface fddi 0.2 enc sde 2
 ipx network f02 encapsulation snap
interface fddi 0.3 enc sde 3
 ipx network f03 encapsulation novell-fddi

The figure below shows routing with RIF between a TRISL VLAN and a
Token Ring interface.

The following is the configuration for the router:

source-bridge ring-group 100
!
interface TokenRing 3/1
 ip address 10.4.4.1 255.255.255.0
!
interface FastEthernet4/0.1
 ip address 10.5.5.1 255.255.255.0
 encapsulation tr-isl trbrf 999 bridge-num 14
 multiring trcrf-vlan 200 ring-group 100
 multiring all

The following is the configuration for the Catalyst 5000 switch with
the Token Ring switch module in slot 5. In this configuration, the Token Ring
port 1 is assigned to the TrCRF VLAN 40:

#vtp
set vtp domain trisl
set vtp mode server
set vtp v2 enable
#drip
set set tokenring reduction enable
set tokenring distrib-crf disable
#vlans
set vlan 999 name trbrf type trbrf bridge 0xe stp ieee
set vlan 200 name trcrf200 type trcrf parent 999 ring 0x64 mode srt
set vlan 40 name trcrf40 type trcrf parent 999 ring 0x1 mode srt
#add token port to trcrf 40
set vlan 40   5/1
set trunk 1/2 on

The figure below shows a topology in which Catalyst VLAN switches are
connected to routers forwarding traffic from a number of ISL VLANs. With the
VIP distributed ISL capability in the Cisco 7500 series router, each VIP card
can route ISL-encapsulated VLAN IP traffic. The inter-VLAN routing capacity is
increased linearly by the packet-forwarding capability of each VIP card.

In the figure above, the VIP cards forward the traffic between ISL
VLANs or any other routing interface. Traffic from any VLAN can be routed to
any of the other VLANs, regardless of which VIP card receives the traffic.

These commands show the configuration for each of the VLANs shown in
the figure above:

interface FastEthernet1/0/0
 ip address 10.1.1.1 255.255.255.0
 ip route-cache distributed
 full-duplex
interface FastEthernet1/0/0.1
 ip address 10.1.1.1 255.255.255.0
 encapsulation isl 1
interface FastEthernet1/0/0.2
 ip address 10.1.2.1 255.255.255.0
 encapsulation isl 2
interface FastEthernet1/0/0.3
 ip address 10.1.3.1 255.255.255.0
 encapsulation isl 3
interface FastEthernet1/1/0
 ip route-cache distributed
 full-duplex
interface FastEthernet1/1/0.1
 ip address 172.16.1.1 255.255.255.0
 encapsulation isl 4
interface Fast Ethernet 2/0/0
 ip address 10.1.1.1 255.255.255.0
 ip route-cache distributed
 full-duplex
interface FastEthernet2/0/0.5
 ip address 10.2.1.1 255.255.255.0
 encapsulation isl 5
interface FastEthernet2/1/0
 ip address 10.3.1.1 255.255.255.0
 ip route-cache distributed
 full-duplex
interface FastEthernet2/1/0.6
 ip address 10.4.6.1 255.255.255.0
 encapsulation isl 6
interface FastEthernet2/1/0.7
 ip address 10.4.7.1 255.255.255.0
 encapsulation isl 7

To configure routing of the XNS protocol over ISL trunks, you need to define ISL as the encapsulation type. This example shows
XNS configured to be routed over an ISL trunk:

xns routing 0123.4567.adcb
interface fastethernet 1/0.1
 encapsulation isl 100
 xns network 20

To configure routing of the CLNS protocol over ISL trunks, you need to define ISL as the encapsulation type. This example
shows CLNS configured to be routed over an ISL trunk:

clns routing 
interface fastethernet 1/0.1
 encapsulation isl 100
 clns enable

To configure IS-IS routing over ISL trunks, you need to define ISL as the encapsulation type. This example shows IS-IS configured
over an ISL trunk:

isis routing test-proc2
net 49.0001.0002.aaaa.aaaa.aaaa.00
interface fastethernet 2.0
 encapsulation isl 101
 clns router is-is test-proc2

This configuration example shows AppleTalk being routed on VLAN 100:

!
appletalk routing
!
interface fastethernet 4/1.100
  encapsulation dot1q 100
  appletalk cable-range 100-100 100.1
  appletalk zone eng
!

This configuration example shows IP being routed on VLAN 101:

!
ip routing
!
interface fastethernet 4/1.101
  encapsulation dot1q 101
  ip addr 10.0.0.11 255.0.0.0
!

This configuration example shows IPX being routed on VLAN 102:

!
ipx routing
!
interface fastethernet 4/1.102
  encapsulation dot1q 102
  ipx network 100
!

The following example configures VLAN 100 for bridge group 1 with a default VLAN1:

interface FastEthernet 4/1.100
encapsulation dot1q 1
bridge-group 1

The following example configures VLAN 20 for bridge group 1 as a native VLAN:

interface FastEthernet 4/1.100
encapsulation dot1q 20 native
bridge-group 1

The following example configures VLAN ISL or IEEE 802.10 routing:

ipx routing
appletalk routing
!
interface Ethernet 1
ip address 10.1.1.1 255.255.255.0
appletalk cable-range 1-1 1.1
appletalk zone 1
ipx network 10 encapsulation snap
!
router igrp 1
network 10.1.0.0
!
end
!
#Catalyst5000
!
set VLAN 110 2/1
set VLAN 120 2/2
!
set trunk 1/1 110,120
# if 802.1Q, set trunk 1/1 nonegotiate 110, 120
!
end
!
ipx routing
appletalk routing
!
interface FastEthernet 1/1.110
encapsulation isl 110
!if 802.1Q, encapsulation dot1Q 110
ip address 10.1.1.2 255.255.255.0
appletalk cable-range 1.1 1.2
appletalk zone 1
ipx network 110 encapsulation snap
!
interface FastEthernet 1/1.120
encapsulation isl 120
!if 802.1Q, encapsulation dot1Q 120
ip address 10.2.1.2 255.255.255.0
appletalk cable-range 2-2 2.2
appletalk zone 2
ipx network 120 encapsulation snap
!
router igrp 1
network 10.1.0.0
network 10.2.1.0.0
!
end
!
ipx routing
appletalk routing
!
interface Ethernet 1
ip address 10.2.1.3 255.255.255.0
appletalk cable-range 2-2 2.3
appletalk zone 2
ipx network 120 encapsulation snap
!
router igrp 1
network 10.2.0.0
!
end

The following examples configures IEEE 802.1Q bridging:

interface FastEthernet4/0
 no ip address
 no ip route-cache
 half-duplex
!
interface FastEthernet4/0.100
 encapsulation dot1Q 100
 no ip route-cache
 bridge-group 1
!
interface FastEthernet4/0.200
 encapsulation dot1Q 200 native
 no ip route-cache
 bridge-group 2
!
interface FastEthernet4/0.300
 encapsulation dot1Q 1
 no ip route-cache
 bridge-group 3
!
interface FastEthernet10/0
 no ip address
 no ip route-cache
 half-duplex
!
interface FastEthernet10/0.100
 encapsulation dot1Q 100
 no ip route-cache
 bridge-group 1
!
interface Ethernet11/3
 no ip address
 no ip route-cache
 bridge-group 2
!
interface Ethernet11/4
 no ip address
 no ip route-cache
 bridge-group 3
!
bridge 1 protocol ieee
bridge 2 protocol ieee
bridge 3 protocol ieee

The following examples configures IEEE 802.1Q integrated routing and bridging:

ip cef
appletalk routing
ipx routing 0060.2f27.5980
!
bridge irb
!
interface TokenRing3/1
 no ip address
 ring-speed 16
 bridge-group 2
!
interface FastEthernet4/0
 no ip address
 half-duplex
!
interface FastEthernet4/0.100
 encapsulation dot1Q 100
 bridge-group 1
!
interface FastEthernet4/0.200
 encapsulation dot1Q 200
 bridge-group 2
!
interface FastEthernet10/0
ip address 10.3.1.10 255.255.255.0
 half-duplex
 appletalk cable-range 200-200 200.10
 appletalk zone irb
 ipx network 200
!
interface Ethernet11/3
 no ip address
 bridge-group 1
!
interface BVI 1
 ip address 10.1.1.11 255.255.255.0
 appletalk cable-range 100-100 100.11
 appletalk zone bridging
 ipx network 100
!
router rip
 network 10.0.0.0
 network 10.3.0.0
!
bridge 1 protocol ieee
 bridge 1 route appletalk
 bridge 1 route ip
 bridge 1 route ipx
bridge 2 protocol ieee
!