Cisco Catalyst 3850 router VLAN bridge no routing

bridgeciscocisco-3850vlan

New to Cisco stuff so bear with me (only a little L2 Procurve experience). I have a development network connected to an Aruba/HPE managed switch feeding a trunk with tagged VLAN's to an internal network Cisco C2960. I am not in charge of the C2960, but it looks like the VLAN's appear to be sending and receiving correctly, based on some testing from a hypervisor server hanging off the C2960. Now, this C2960 has an trunk uplink to a C3850 router which should have the necessary VLAN's configured. From the C3850 is another trunk to yet another C2960, with the correct trunk settings for the VLAN's I want to haul from the development network to the second switch.

I can't do basic pings on the dev VLAN's from the second switch. Some people involved with setting up the C3850 said I would have to add an IP in the subnet of the VLAN at the Cisco router to make it bridge the VLAN's from the first to the second switch, but I don't want routing and setting a next hop seems bizarre. Ideally, I want to do no routing (more like a managed switch transparently forwarding VLAN's). Since the Cisco router is currently a core router, I can't ask to make the whole thing behave like a dumb switch.

Is there a proper way to transparently bridge the VLAN's between ports on the router without routing or needing an IP at the router, while preserving existing routing, so I can send traffic from the second C2960 to the Aruba switch?

Best Answer

That should be possible - provided that...

  • the same set (or at least a common subset) of VLAN IDs is used across the chain of switches
  • this same (sub)set of VLANs is configured/added on all the switches along the path
  • this same (sub)set of VLANs is "allowed" and "tagged" on all segments (the inter-switch links) along the path.
  • some very diligent attention is directed towards spanning tree interoperability between HP/Aruba and Cisco (the latter by default run Cisco's own PVST or RPVST, the former usually use the IEEE variants STP, RSTP or MST).
  • the admins of the said Cat2960s and Cat3850 are willing to add "your" set of VLANs to their device (which they might deny, because they might want to run their Cat3850 as a L3 device only)

The Cat3850 and the Cat2960s are definitely capable of what you intend to do, which is what VLANs, trunking and switching are all about. There is no technical reason why the Cat3850 should get any (additional) IP address(es) to bridge these VLANs. But - there may be operational guidelines preventing it.