Routing Between VLANs
Learn why inter-VLAN routing is required and configure router-on-a-stick and multilayer-switch routing with Cisco IOS verification and troubleshooting.
What Is Inter-VLAN Routing?
A VLAN is a logical Layer 2 network and broadcast domain. Devices assigned to different VLANs do not share the same Layer 2 broadcast domain, even when they connect to the same physical switch.
Inter-VLAN routing is the Layer 3 forwarding of traffic between different VLANs and their associated IP subnets. A Layer 3 device, such as a router or multilayer switch, is required because hosts in different IP subnets cannot communicate through Layer 2 switching alone.
Same-VLAN switching versus inter-VLAN routing
- Same VLAN: A switch forwards Ethernet frames between access ports in the same VLAN. The hosts are normally in the same IP subnet.
- Different VLANs: The source host sends the packet to its default gateway. A router or multilayer switch examines the destination IP address and forwards the packet into the destination VLAN.
A default gateway is the Layer 3 interface a host uses to reach remote IP subnets. Each VLAN normally has its own gateway address, and that gateway must belong to the VLAN's subnet.
VLAN and Subnet Design
Good inter-VLAN routing begins with a consistent relationship between the VLAN ID, switch port membership, and IP subnet.
- Each VLAN represents a separate Layer 2 broadcast domain.
- Each VLAN should normally use a separate, non-overlapping IP subnet.
- An access port is assigned to one endpoint VLAN.
- The gateway interface for a VLAN uses an address from that VLAN's subnet.
- Hosts in the VLAN use that gateway address as their default gateway.
| VLAN ID | VLAN name | Subnet | Gateway interface | Gateway address | Example host address |
|---|---|---|---|---|---|
| 10 | USERS | 192.168.10.0/24 | Router subinterface or SVI | 192.168.10.1 | 192.168.10.10 |
| 20 | SERVERS | 192.168.20.0/24 | Router subinterface or SVI | 192.168.20.1 | 192.168.20.10 |
For the table above, a host in VLAN 10 could use address 192.168.10.10, mask 255.255.255.0, and gateway 192.168.10.1. A host in VLAN 20 would use an address from 192.168.20.0/24 and gateway 192.168.20.1. Using overlapping subnets for separate VLANs creates ambiguous routing and should be avoided.
Inter-VLAN Routing Methods
| Method | Layer 3 device/interface model | Trunk required | Scalability | Typical use |
|---|---|---|---|---|
| Legacy routing | One physical router interface per VLAN | Usually no; each link carries one VLAN | Low; requires a physical interface for every VLAN | Small or older networks and teaching examples |
| Router-on-a-stick | One router interface with multiple 802.1Q subinterfaces | Yes, between the switch and router | Moderate; uses one physical router link but shares its capacity | Small networks, labs, and environments without a multilayer switch |
| Multilayer switch | One switched virtual interface, or SVI, per routed VLAN | Not for the local access ports; trunks may be used for switch uplinks | High; routing occurs within the switch | Enterprise campus networks and high-performance internal routing |
Legacy routing consumes a router port for every VLAN. Router-on-a-stick reduces port usage but concentrates traffic on one physical link and router interface. A multilayer switch generally provides the best performance and scalability for routing among local VLANs.
Trunks and IEEE 802.1Q Tagging
A trunk port carries traffic for multiple VLANs over one link. IEEE 802.1Q adds a VLAN tag to Ethernet frames crossing the trunk so the receiving device can identify the VLAN associated with each frame.
A router-on-a-stick link must be a trunk because one physical router interface carries traffic for several VLANs. Each router subinterface is associated with a VLAN ID through the encapsulation dot1Q command.
The native VLAN is the VLAN whose frames are normally sent untagged on an 802.1Q trunk. Both ends of a trunk should agree on the native VLAN. A mismatch can cause connectivity problems and security warnings. An allowed VLAN list restricts which VLANs may cross the trunk; every required VLAN must be included.
Configure and verify a switch trunk
interface gigabitEthernet0/24
switchport mode trunk
switchport trunk allowed vlan 10,20Verify the operational trunk state and VLAN carriage with:
show interfaces trunk
show interfaces gigabitEthernet0/24 switchportRouter-on-a-Stick Configuration
In a router-on-a-stick design, endpoint ports are access ports, while the switch port connected to the router is a trunk. The router has one physical interface and one logical subinterface for every routed VLAN.
Example topology and addressing
- PC-A is connected to a switch access port in VLAN 10.
- PC-B is connected to a switch access port in VLAN 20.
- The switch connects to router interface
GigabitEthernet0/0using a trunk. - VLAN 10 uses
192.168.10.0/24and gateway192.168.10.1. - VLAN 20 uses
192.168.20.0/24and gateway192.168.20.1. - PC-A uses
192.168.10.10/24with gateway192.168.10.1. - PC-B uses
192.168.20.10/24with gateway192.168.20.1.
1. Create VLANs and configure access ports
vlan 10
name USERS
vlan 20
name SERVERS
interface gigabitEthernet0/1
switchport mode access
switchport access vlan 10
interface gigabitEthernet0/2
switchport mode access
switchport access vlan 202. Configure the switch-to-router trunk
interface gigabitEthernet0/24
switchport mode trunk
switchport trunk allowed vlan 10,203. Configure router subinterfaces
A subinterface is a logical interface configured beneath a physical router interface. The subinterface number is a local label; the VLAN association comes from the dot1Q VLAN ID.
interface gigabitEthernet0/0
no shutdown
interface gigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface gigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0The physical interface must be enabled. The subinterfaces provide the default gateway addresses for their respective VLANs. The router receives a tagged frame, removes or processes the VLAN tag, routes the packet, and sends it toward the destination VLAN.
| Device | Interface | Purpose | VLAN association | IP address |
|---|---|---|---|---|
| Switch | GigabitEthernet0/1 | PC-A access port | 10 | None |
| Switch | GigabitEthernet0/2 | PC-B access port | 20 | None |
| Switch | GigabitEthernet0/24 | Trunk to router | 10, 20 | None |
| Router | GigabitEthernet0/0.10 | VLAN 10 gateway | 802.1Q VLAN 10 | 192.168.10.1/24 |
| Router | GigabitEthernet0/0.20 | VLAN 20 gateway | 802.1Q VLAN 20 | 192.168.20.1/24 |
4. Validate connectivity
- Confirm each host has the correct IP address, mask, and gateway.
- From PC-A, ping
192.168.10.1. - From PC-B, ping
192.168.20.1. - From PC-A, ping PC-B at
192.168.20.10. - Use traceroute if the end-to-end ping fails.
Gateway reachability should be tested before testing communication between VLANs. If a host cannot reach its own gateway, investigate local addressing, the access VLAN, and the gateway interface first.
Multilayer-Switch Inter-VLAN Routing
A multilayer switch performs both Layer 2 switching and Layer 3 routing. It uses an SVI, or switched virtual interface, as the Layer 3 interface for a VLAN. An SVI is commonly written as interface vlan 10.
A multilayer switch can replace an external router for routing among internal VLANs when the switch supports Layer 3 routing. Internal hosts use the matching SVI address as their default gateway.
Configure VLANs, access ports, and SVIs
vlan 10
name USERS
vlan 20
name SERVERS
interface gigabitEthernet0/1
switchport mode access
switchport access vlan 10
interface gigabitEthernet0/2
switchport mode access
switchport access vlan 20
ip routing
interface vlan 10
ip address 10.10.10.1 255.255.255.0
no shutdown
interface vlan 20
ip address 10.10.20.1 255.255.255.0
no shutdownThe global ip routing command enables IPv4 forwarding between the SVIs. Without it, the switch may have correctly addressed SVIs but still operate only as a Layer 2 switch for this purpose.
An SVI generally becomes operational only when the VLAN exists and has an active associated switch port, such as an active access port or a suitable trunk carrying that VLAN. Therefore, an SVI can show an address in the configuration while remaining down or line protocol down.
Routing beyond the multilayer switch
Routing between local SVIs does not automatically provide access to other networks. For an external router or upstream Layer 3 device, the multilayer switch commonly uses a routed uplink and a default route.
interface gigabitEthernet0/48
no switchport
ip address 10.255.255.2 255.255.255.252
no shutdown
ip route 0.0.0.0 0.0.0.0 10.255.255.1The exact upstream design depends on the network. A default route is appropriate when one upstream device is the next hop for destinations not present in the switch's routing table.
How a Packet Crosses VLANs
- The source host compares the destination IP address with its own subnet.
- If the destination is remote, the host sends the frame to its default gateway using the gateway's MAC address.
- The switch forwards the frame within the source VLAN. If the gateway is reached through a trunk, the frame carries an 802.1Q tag.
- The router subinterface or source SVI receives the packet and performs a Layer 3 route lookup.
- The Layer 3 device forwards the packet into the destination VLAN.
- The destination host receives the frame through its access port and processes the IP packet.
Verification Commands
Use verification commands to locate the first point where the expected configuration differs from the actual operational state.
show vlan brief
show interfaces trunk
show interfaces switchport
show ip interface brief
show ip route
show running-config interface gigabitEthernet0/24
show running-config interface gigabitEthernet0/0.10
show running-config interface vlan 10
ping <destination-ip>
traceroute <destination-ip>show vlan briefverifies VLAN existence and access-port membership.show interfaces trunkverifies trunk status and VLANs allowed or active on the trunk.show interfaces switchportdisplays detailed access or trunk mode information.show ip interface briefdisplays IP addresses and interface status.show ip routeconfirms connected routes, static routes, and other learned routes.pingtests reachability to a specific address.tracerouteshows Layer 3 hops and helps identify where forwarding stops.
Troubleshooting Inter-VLAN Routing
Recommended troubleshooting sequence
- Check the host IP address, subnet mask, and default gateway.
- Confirm the host's switch port is assigned to the expected VLAN.
- Confirm the VLAN exists and the relevant interface is up.
- For router-on-a-stick, verify that the uplink is trunking and carries the required VLAN.
- Verify every router subinterface has the correct dot1Q VLAN ID and gateway address.
- For a multilayer switch, verify that each SVI is up and that
ip routingis enabled. - Ping the local gateway before testing a remote VLAN host.
- Inspect the routing table and use traceroute to locate the failure.
- Check ACLs or other policies only after basic Layer 2 and Layer 3 settings are correct.
| Symptom | Likely cause | Verification command | Corrective action |
|---|---|---|---|
| Host cannot ping its own gateway | Wrong IP, mask, gateway, access VLAN, or down gateway interface | show vlan briefshow ip interface brief | Correct host addressing, port VLAN membership, or interface status. |
| One VLAN fails across a router-on-a-stick link | VLAN is absent from the allowed list, wrong dot1Q ID, or VLAN does not exist | show interfaces trunkshow vlan briefshow running-config interface gigabitEthernet0/0.20 | Add the VLAN to the trunk, create it, or correct the subinterface tag. |
| Uplink is not operating as a trunk | Switch port is in access mode or trunk parameters do not match | show interfaces trunkshow interfaces switchport | Configure the link as a trunk and verify both ends. |
| SVI has an address but is down | VLAN has no active member port, or the SVI is shut down | show ip interface briefshow vlan brief | Enable the SVI and provide an active access or trunk member for the VLAN. |
| Hosts reach gateways but not another VLAN | Incorrect remote gateway, bad SVI or subinterface address, disabled routing, or a policy block | show ip routeshow ip interface brief | Correct addressing, enable routing, and inspect ACLs or other policies. |
| SVIs are configured but VLANs cannot communicate | Multilayer switch is operating only at Layer 2 because IP routing is disabled | show running-config | include ip routing | Enter ip routing in global configuration mode. |
Common Design and Configuration Errors
- Incorrect default gateway: The gateway must be the Layer 3 interface in the host's own VLAN.
- Wrong address or subnet mask: The host may incorrectly classify a remote destination as local or local traffic as remote.
- Wrong access VLAN: A user port placed in VLAN 1 instead of VLAN 20 receives the wrong Layer 2 service.
- Non-trunk uplink: A router-on-a-stick connection cannot carry multiple VLANs as an access link.
- VLAN missing from the allowed list: Other VLANs may work while the omitted VLAN fails.
- Wrong subinterface tag: A VLAN 20 subinterface configured with
encapsulation dot1Q 30does not serve VLAN 20. - Physical router interface shut down: Subinterfaces depend on the physical interface being enabled.
- Inactive SVI: An SVI may be down when its VLAN has no active member port.
- IP routing disabled: SVIs alone do not enable routing on a multilayer switch.
- Overlapping VLAN subnets: Separate VLANs should use distinct IP networks so routing decisions are unambiguous.
- Native VLAN mismatch: Both trunk ends must agree about which VLAN is carried untagged.
Key Exam Notes
- Different VLANs are different Layer 2 broadcast domains.
- Different IP subnets require a Layer 3 device to communicate.
- Router-on-a-stick uses one physical interface and multiple 802.1Q subinterfaces.
- A trunk is required between the switch and router in a router-on-a-stick design.
- An SVI provides a multilayer switch's gateway interface for a VLAN.
ip routingenables IPv4 routing on a multilayer switch.- Test the local default gateway before testing an endpoint in another VLAN.
For related Cisco IOS practice, see Configure Router On A Stick and Configure Trunk Ports. For routing concepts beyond directly connected VLANs, see Configure OSPF.