Inter-VLAN routing

Why VLANs need a router

Each VLAN is its own broadcast domain and its own IP subnet. When PC A in VLAN 10 (10.10.10.0/24) wants to reach PC B in VLAN 20 (10.10.20.0/24), it sees that B is on a different subnet. So it sends the packet to its default gateway: the router address for its own subnet. A layer 2 switch never moves frames between VLANs on its own. Something that works at layer 3 (a router or a layer 3 switch) must route the packet into the other VLAN.

A simple plan with one subnet per VLAN and the gateway on .1:

Option 1: one router port per VLAN

The oldest way: connect one router interface to an access port in each VLAN. It works, but three VLANs need three router ports and three cables. With 20 VLANs it is impossible. You will mostly see it in old diagrams.

Option 2: router-on-a-stick

Router-on-a-stick (ROAS) uses a single physical link between the switch and the router, configured as a trunk. On the router you split the physical interface into subinterfaces, virtual interfaces such as g0/0.10, one per VLAN. Each subinterface is told which VLAN tag it handles and gets the gateway IP address of that VLAN.

R1(config)# interface gigabitEthernet 0/0
R1(config-if)# no shutdown
R1(config-if)# interface gigabitEthernet 0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 10.10.10.1 255.255.255.0
R1(config-subif)# interface gigabitEthernet 0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 10.10.20.1 255.255.255.0
R1(config-subif)# interface gigabitEthernet 0/0.99
R1(config-subif)# encapsulation dot1Q 99 native

SW1(config)# interface gigabitEthernet 0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 99

A packet from VLAN 10 to VLAN 20 travels up the trunk tagged 10, the router routes it, and it comes back down the same trunk tagged 20. This hairpin is why ROAS is cheap but limited: all inter-VLAN traffic shares one link, and the router is a single point of failure.

Option 3: a layer 3 switch with SVIs

A layer 3 switch (also called a multilayer switch) can route as well as switch, in hardware, at full speed. You give each VLAN a Switched Virtual Interface (SVI): a virtual interface named interface vlan 10 that acts as the gateway for that VLAN. Routing between SVIs is turned on with ip routing.

DSW1(config)# ip routing
DSW1(config)# interface vlan 10
DSW1(config-if)# ip address 10.10.10.1 255.255.255.0
DSW1(config-if)# no shutdown
DSW1(config-if)# interface vlan 20
DSW1(config-if)# ip address 10.10.20.1 255.255.255.0
DSW1(config-if)# no shutdown

An SVI comes up (up/up) only when the VLAN exists on the switch, at least one access or trunk port in that VLAN is up and forwarding, and the SVI itself is not shut down. If an SVI is stuck down, check those three things.

Routed ports

A port on a layer 3 switch can also behave like a router port. no switchport turns it into a routed port: it belongs to no VLAN and takes an IP address directly. Routed ports are used for links to a router, a firewall or another layer 3 switch.

DSW1(config)# interface gigabitEthernet 1/0/24
DSW1(config-if)# no switchport
DSW1(config-if)# ip address 10.0.0.1 255.255.255.252

Which option to choose

Common mistakes and how to fix them

• Forgetting ip routing on the layer 3 switch: the SVIs come up, but nothing is routed between them.
• Forgetting no shutdown on the router physical interface: every subinterface stays down.
• Wrong VLAN number in encapsulation dot1Q: the subinterface listens for the wrong tag.
• The switch port facing the router is left as an access port instead of a trunk.
• A PC with the wrong default gateway, for example the VLAN 10 PC pointing at 10.10.20.1.