Significance of unrouted vs. routed when referring to VLANs in Orion

I note in the traffic analysis of our network that VLANs are referred to both as having an 'unrouted' VLAN and a 'routed' VLAN.

I did see an earlier post on this at this URLL:

However, while I understand the explanation by skierjmh about the difference between a routed VLAN and an unrouted one, my question is slightly different.

For example, there is a VLAN on this network our Orion NPM server is looking at, let's call this VLAN 222.

VLAN 222 shows statistics as both 'unrouted' and 'routed' - this despite the fact that VLAN 222 does have an IP address assigned to it by our core Catalyst 6509-E switch. Also, the 'unrouted' VLAN traffic is *always* higher in volume than the 'routed' VLAN. (Btw, *ALL* of the VLANs on this 6509-E have IP addressed assigned to them on the core and *all* show statistics in Orion NPM for both 'unrouted' and 'routed'.)

Is the unrouted VLAN traffic on 222 more representative of the traffic being carried on that specific subnet? Or is the routed VLAN traffic more representative? Or are they both to be rolled up into one larger figure (routed 222 + unrouted 222 = total 222 traffic)?

Thanks for your time!

Find more posts tagged with

Accepted answers

All comments

Network_Guru

I have not investigated this fully but here are my thoughts on this:

Monitoring an L2 VLAN (unrouted) with NPM should show all VLAN222 traffic transiting the backplane on the 6509 (including intra-vlan traffic between ports in the same vlan.
Monitoring a L3 VLAN (routed) is like monitoring an interface on a router - it will show the traffic entering an exiting the VLAN to other VLANs.

johnlloyd_13

we experience constant high interface utilization on these 'unrouted' vlans.

is this a significant interface? and is it a good idea to delete these interfaces in Solarwinds?

it is taking up space in our top 10 orion page.

Nicki

We have also found this problem to be true.

We have had to eliminate the unrouted vlans from the threshold alerts because of the continous traffic reports above 100%.

We are now coming to the crossroads of eliminating the interfaces from monitoring for the reason of top 10 in monitoring and netflow are cluttered.

Still I am wondering if we could place these interfaces in and icmp state or at worst case scenario, an unmanaged state.

Or, is there a way to uncheck them as in configuring alerts.

jpr7311

I have to agree with Network_Guru here. I am working with somebody that is monitoring all vlans(routed and unrouted) and I have been researching the difference between the two. The unrouted vlans will have a similar amount of traffic but always just a little more than its cooresponding routed vlan. I am auditing their NPM interface monitoring and going to recommend removing the unrouted vlans since they are monitoring all cooresponding regular vlan as well.