VMware ESXi and vSphere Cluster Management

Inter-VLAN Routing: Router Interfaces, Router-on-a-Stick, and Layer 3 Switches

Learn why VLANs are isolated and how to configure inter-VLAN routing with router interfaces, router-on-a-stick subinterfaces, and multilayer switch SVIs.

Inter-VLAN routing is the Layer 3 forwarding of IP traffic between different VLANs. This lesson explains why VLANs are isolated, how default gateways and connected routes work, and how to configure three common Cisco designs: one router interface per VLAN, router-on-a-stick, and multilayer switching with switched virtual interfaces.

VLAN Isolation and the Need for Routing

A VLAN is a logical Layer 2 network segment. Each VLAN is also a separate broadcast domain: the group of devices that receive a Layer 2 broadcast. A broadcast sent in VLAN 10 does not normally reach devices in VLAN 20.

In a typical IPv4 design, each VLAN maps to a distinct IP subnet. IPv6 networks also use separate prefixes for different VLANs. For example:

VLAN 10 uses 192.168.10.0/24.
VLAN 20 uses 192.168.20.0/24.

Layer 2 switching forwards Ethernet frames within one VLAN. If the destination is in another IP subnet, the frame cannot be delivered by ordinary Layer 2 switching alone. A Layer 3 device, such as a router or multilayer switch, must examine the destination IP address and forward the packet between the subnets.

That function is called inter-VLAN routing. The Layer 3 device has an IP interface in each routed VLAN. Hosts use the address of that interface as their default gateway, the local Layer 3 address used to reach remote subnets.

Broadcasts remain inside their originating VLAN. Routed unicast traffic can cross a subnet boundary, but it does not carry the original Layer 2 frame across the boundary. The Layer 3 device removes the incoming frame, routes the IP packet, and builds a new Ethernet frame for the destination VLAN.

Default Gateways and Connected Routes

Suppose a host in VLAN 10 has address 192.168.10.10/24 and gateway 192.168.10.1. When it sends to 192.168.20.10, the host compares the destination with its own subnet. Because the destination is remote, it sends the frame to the MAC address of its default gateway rather than directly to the destination host.

The source host determines that the destination is outside its local subnet.
Using ARP for IPv4 or Neighbor Discovery for IPv6, it resolves the gateway's local link-layer address.
The switch forwards the frame within VLAN 10 to the gateway interface.
The router or multilayer switch removes the Layer 2 header and examines the IP packet.
The device selects the route for the destination VLAN, decrements the IPv4 TTL or IPv6 hop limit, and creates a new Layer 2 frame.
The switch delivers the new frame within VLAN 20 to the destination host.

The routing device needs an IP address in every subnet it routes. When an interface is configured with an address such as 192.168.10.1/24, the device installs a connected route for 192.168.10.0/24. A connected route exists because a local Layer 3 interface belongs to that network. The same happens for 192.168.20.0/24.

These local connected routes are enough for a router or multilayer switch to route between directly attached VLAN subnets. Routes to networks beyond the device may additionally require static or dynamic routing.

Example VLAN and Addressing Plan

VLAN ID	VLAN name	Subnet	Gateway interface	Gateway address	Example host address	Associated switch ports
10	USERS	192.168.10.0/24	Router subinterface or SVI	192.168.10.1	192.168.10.10	GigabitEthernet0/1
20	SERVERS	192.168.20.0/24	Router subinterface or SVI	192.168.20.1	192.168.20.10	GigabitEthernet0/2

PC-A in VLAN 10 should use 192.168.10.1 as its gateway. PC-B in VLAN 20 should use 192.168.20.1. A gateway from the wrong subnet will not provide correct local Layer 3 forwarding.

Inter-VLAN Routing Design Options

Method	Layer 3 device	Physical links required	VLAN transport method	Scalability	Advantages	Limitations	Typical use case
One router physical interface per VLAN	Router	One router interface and switch link per VLAN	Separate access links	Low	Simple concept; each VLAN has a dedicated physical connection	Many interfaces and cables; limited expansion; inefficient use of hardware	Older or very small designs
Router-on-a-stick	Router	One router physical interface and one switch uplink	802.1Q trunk with subinterfaces	Moderate	Uses one physical link for many VLANs; useful for labs and small networks	The trunk and router interface can become capacity or availability bottlenecks	Small networks, labs, and legacy router-based designs
Multilayer switch using SVIs	Layer 3 or multilayer switch	Endpoint access links; routed uplinks as needed	SVIs provide VLAN gateways; trunks may connect switches	High	Fast local routing, fewer external links, and centralized switching and routing	Requires a multilayer switch and correct IP routing configuration	Campus access and distribution networks

The one-interface-per-VLAN design becomes impractical as VLAN counts increase. Router-on-a-stick reduces cabling but concentrates traffic on one trunk. A multilayer switch usually provides better local performance and expansion for small to medium networks.

Legacy Routing with One Router Interface per VLAN

In the older design, each VLAN has a separate physical connection from the switch to the router. The switch-facing port is an access port in the appropriate VLAN, and the router interface connected to that port receives the gateway address for that subnet.

For example, a switch might connect a VLAN 10 access port to router GigabitEthernet0/0 and a VLAN 20 access port to router GigabitEthernet0/1. The router could use 192.168.10.1/24 on the first interface and 192.168.20.1/24 on the second.

Every host-facing switch port must be assigned to the correct access VLAN.
Every switch port connected to a router interface must also be assigned to that VLAN.
Each router interface must have an address in its VLAN subnet and must be enabled.

This design requires many physical router interfaces, additional cabling, and more switch ports. Router hardware may have unused capacity on each interface while the number of VLANs remains limited by available ports. It is therefore generally unsuitable when VLAN counts increase.

Router-on-a-Stick

Router-on-a-stick uses one physical router interface and one switch-to-router link to carry multiple VLANs. The link is an 802.1Q trunk. A trunk transports traffic for multiple VLANs, while an access port normally carries traffic for one assigned VLAN to an endpoint.

The router's physical interface has logical subinterfaces. Each subinterface is associated with one VLAN and one IP subnet. The router uses the VLAN tag to select the correct subinterface and gateway.

Two-VLAN topology

PC-A is connected to an access port in VLAN 10 and uses 192.168.10.10/24.
PC-B is connected to an access port in VLAN 20 and uses 192.168.20.10/24.
The switch connects to router GigabitEthernet0/0 through a trunk.
The router uses subinterfaces GigabitEthernet0/0.10 and GigabitEthernet0/0.20.

Configure the switch

vlan 10
 name USERS
vlan 20
 name SERVERS
interface gigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
interface gigabitEthernet0/2
 switchport mode access
 switchport access vlan 20
interface gigabitEthernet0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20

Use the correct interface names for the switch model. The endpoint ports must be access ports in the matching VLANs. The uplink must operate as a trunk and must allow every VLAN needed by the router subinterfaces.

Configure the router

interface gigabitEthernet0/0
 no ip address
 no shutdown
interface gigabitEthernet0/0.10
 encapsulation dot1q 10
 ip address 192.168.10.1 255.255.255.0
interface gigabitEthernet0/0.20
 encapsulation dot1q 20
 ip address 192.168.20.1 255.255.255.0

The physical interface must be enabled. Each subinterface needs the correct encapsulation dot1q VLAN ID and an address in that VLAN's subnet. The addresses become the connected gateways for the two networks.

Native VLAN behavior

The native VLAN is the VLAN whose frames may be sent without an 802.1Q tag, depending on platform configuration. If a native VLAN is configured or required, both ends of the trunk must agree about which VLAN is native. A mismatch can cause traffic to enter the wrong logical interface or generate warnings and security problems.

For predictable operation, explicitly document the native VLAN choice and keep the switch trunk configuration and router subinterface expectations consistent. Do not assume that an untagged frame belongs to the same VLAN on both devices unless the configuration confirms it.

The single trunk and the router's single physical interface are shared by all VLAN traffic. Their bandwidth, processing capacity, and availability can therefore become bottlenecks. Redundant designs may require additional links, routing platforms, or a multilayer switch.

Layer 3 Switch Inter-VLAN Routing

A Layer 3 switch, also called a multilayer switch, can perform ordinary Layer 2 switching and IP routing. Instead of creating router subinterfaces, the administrator creates an SVI, or switched virtual interface, for each VLAN.

An SVI is a logical Layer 3 interface associated with a VLAN. Its IP address is the default gateway for hosts in that VLAN. In a typical SVI design, physical endpoint interfaces remain Layer 2 access ports, and switch-to-switch links remain Layer 2 trunks where appropriate. A physical interface can alternatively be configured as a routed port for a Layer 3 uplink to another device.

Configure VLANs and SVIs

ip routing
vlan 10
vlan 20
interface vlan 10
 ip address 10.10.10.1 255.255.255.0
 no shutdown
interface vlan 20
 ip address 10.10.20.1 255.255.255.0
 no shutdown

ip routing enables IPv4 routing globally on platforms that require this feature. The switch installs connected routes for 10.10.10.0/24 and 10.10.20.0/24 when the SVIs are operational.

For an SVI to become operational, the VLAN must exist and, on applicable platforms, the VLAN generally needs an active associated Layer 2 port. A configured SVI with no active member port may remain down.

SVIs and router subinterfaces both provide one logical gateway per VLAN, but they are implemented differently. A router-on-a-stick subinterface depends on VLAN tags arriving over one physical trunk. An SVI is a virtual interface inside a multilayer switch, which can route locally without sending every inter-VLAN packet to an external router.

Verification and Traffic Testing

Verify the local path before testing a remote VLAN. First confirm that a host can reach its own default gateway. Then test the other VLAN and use a route-tracing tool to identify the Layer 3 hop.

Device type	Command	What it verifies	Expected indicators
Switch	`show vlan brief`	VLAN existence and access-port membership	Required VLANs exist; endpoint ports appear under the correct VLAN
Switch	`show interfaces trunk`	Trunk state and allowed VLANs	Uplink is trunking; required VLANs are allowed and active
Switch	`show interfaces switchport`	Detailed port mode and VLAN settings	Endpoint is access mode; uplink is trunk mode
Router or multilayer switch	`show ip interface brief`	Interface addressing and operational state	Required interfaces and SVIs are up/up with correct addresses
Router or multilayer switch	`show ip route`	Routing-table entries	Connected routes for all routed VLAN subnets are present
Router	`show running-config interface gigabitEthernet0/0.10`	Subinterface configuration	Correct dot1q ID and gateway address are configured
Multilayer switch	`show running-config interface vlan 10`	SVI configuration	Correct SVI address and enabled state are configured
Host	`ping <destination-ip>`	Basic reachability	Gateway and destination replies succeed
Host or router	`traceroute <destination-ip>` or `tracert <destination-ip>`	Layer 3 path	The gateway or routing device appears as a hop

ARP or IPv6 Neighbor Discovery also provides useful evidence. A host should resolve its gateway's local link-layer address before sending remote traffic. It resolves a destination host directly only when that destination is in the same local subnet. If the destination is remote, the first local neighbor is normally the default gateway.

Troubleshooting Common Failures

Symptom	Likely cause	Commands or checks	Corrective action
Host cannot ping its gateway	Wrong access VLAN, missing VLAN, down gateway interface, or incorrect host IP settings	`show vlan brief`; `show ip interface brief`; inspect host address, mask, and gateway	Create or activate the VLAN, correct port membership, enable the interface, or fix host addressing
Both gateways work, but VLANs cannot communicate with router-on-a-stick	Uplink is not trunking; required VLAN is not allowed; subinterface is missing, down, or uses the wrong VLAN ID	`show interfaces trunk`; `show running-config interface gigabitEthernet0/0.10`; `show ip route`	Configure the uplink as an 802.1Q trunk, allow both VLANs, and correct subinterfaces
SVIs have addresses but the multilayer switch does not route	Global IP routing is disabled, an SVI is down, or hosts use wrong gateways	`show ip route`; `show ip interface brief`; `show vlan brief`; inspect the global configuration	Enable `ip routing`, activate the VLAN and a member port, and correct host gateways
Only one VLAN works across the trunk	Allowed-VLAN filtering, VLAN ID mismatch, native VLAN mismatch, or missing encapsulation	`show interfaces trunk`; `show interfaces <interface> switchport`; review dot1q statements	Allow the required VLAN, match IDs, align native VLAN settings, and add correct encapsulation
Interface, subinterface, or SVI is down	Physical interface or VLAN interface is administratively down, the parent link is down, or the VLAN has no active port	`show ip interface brief`; inspect interface status and VLAN activity	Use `no shutdown`, restore the physical link, or activate the VLAN as appropriate
Routing appears correct but traffic is still blocked	ACL, firewall, or endpoint-security policy denies the traffic	Inspect ACL counters, firewall logs, host security settings, and policy rules	Permit the intended traffic according to the security policy; do not change routing unnecessarily

Practical Lab: Router-on-a-Stick

Use the two-VLAN plan to build a small lab. Place PC-A in VLAN 10 with address 192.168.10.10/24 and gateway 192.168.10.1. Place PC-B in VLAN 20 with address 192.168.20.10/24 and gateway 192.168.20.1.

Create VLANs 10 and 20 on the switch.
Assign the two endpoint ports as access ports in their respective VLANs.
Configure the switch-to-router port as a trunk allowing VLANs 10 and 20.
Enable the router's physical interface.
Create one router subinterface per VLAN with matching encapsulation dot1q IDs.
Assign the gateway address and subnet mask to each subinterface.
Ping each host's local gateway.
Ping PC-A from PC-B and run tracert 192.168.10.10 or traceroute 192.168.10.10.
If the remote test fails, verify the trunk, allowed VLAN list, subinterface IDs, connected routes, and host settings in that order.

Exam-Relevant Notes

A VLAN is a Layer 2 broadcast domain; it is not automatically a routed network.
Different VLANs normally use different IP subnets, and hosts need a gateway to reach another subnet.
Router-on-a-stick means one physical router interface with multiple 802.1Q-tagged subinterfaces.
Each router subinterface must use the VLAN's ID in its dot1q encapsulation statement.
An SVI is a virtual Layer 3 interface for a VLAN on a multilayer switch.
A multilayer switch normally requires ip routing before it routes between SVIs.
A connected route is installed because a local Layer 3 interface belongs to that network.
Test the host-to-gateway path before testing host-to-host communication across VLANs.
A trunk that is up can still fail to carry a VLAN if that VLAN is absent from the allowed list.
Routing success does not rule out an ACL, firewall, or endpoint-security block.

Summary

VLANs isolate Layer 2 broadcast domains. To communicate between VLAN subnets, hosts send packets to a default gateway, and a router or multilayer switch forwards those packets at Layer 3. A separate physical router interface per VLAN is easy to understand but does not scale well. Router-on-a-stick uses one trunk and multiple tagged subinterfaces. A multilayer switch uses SVIs and usually provides the most efficient design for local inter-VLAN routing. Successful deployment depends on matching VLAN membership, trunk settings, gateway addresses, subnet masks, interface state, and routing configuration.

Continue reviewing the routing between VLANs reference while practicing the verification commands in a lab.