Cisco CCNA Preparation · lesson 12 of 36 · 25 min
Why Inter-VLAN Routing?
VLANs segment a network at Layer 2 — devices in different VLANs cannot communicate directly, even if they share the same physical switch. Inter-VLAN routing uses a Layer 3 device (router or Layer 3 switch) to forward traffic between VLANs.
There are three methods: legacy (one physical interface per VLAN — wasteful), router-on-a-stick (one physical interface with subinterfaces), and Layer 3 switch SVIs (the modern enterprise approach).
Method 1 — Router-on-a-Stick
A single router physical interface is divided into logical subinterfaces, one per VLAN. The switch port connected to the router is configured as a trunk (carries all VLANs). Each subinterface is assigned an IP address that serves as the default gateway for that VLAN.
Configure router-on-a-stick for VLAN 10 and VLAN 20
Configure the switch trunk port interface Gi0/1 → switchport mode trunk — the port connecting to the router must carry all VLANs. Create subinterface for VLAN 10 interface GigabitEthernet0/0.10 — the .10 suffix is convention (matches VLAN ID). Set 802.1Q encapsulation for VLAN 10 encapsulation dot1Q 10 — tells the router to tag/untag frames for VLAN 10. Assign gateway IP for VLAN 10 ip address 192.168.10.1 255.255.255.0 — hosts in VLAN 10 use this as their default gateway.
- Repeat for VLAN 20
- interface Gi0/0.20 → encapsulation dot1Q 20 → ip address 192.168.20.1 255.255.255.0
- Bring up the physical interface
interface GigabitEthernet0/0 → no shutdown — subinterfaces inherit state from the physical interface. Native VLAN
The native VLAN on a trunk is untagged. If you use VLAN 1 as native, add encapsulation dot1Q 1 native on the subinterface. Best practice: change the native VLAN to an unused VLAN to prevent VLAN hopping attacks.
Method 2 — Layer 3 Switch SVIs
A Layer 3 switch (multilayer switch) can route between VLANs internally without an external router. A SVI (Switched Virtual Interface) is a virtual interface on the switch assigned an IP address for each VLAN — it acts as the default gateway for that VLAN.
This is the preferred method in enterprise networks: lower latency (routing happens in hardware on the switch ASIC), no external router needed, and scales easily.
SVI vs routed port
An SVI is a virtual interface for a VLAN. A routed port (no switchport) is a physical switch port configured to act like a router interface — used for uplinks to routers or WAN connections.
Comparison
Knowledge Check — 10 Questions
Inter-VLAN Routing
What is required on the switch port connected to a router-on-a-stick?
- Access mode for each VLAN
- Trunk mode to carry all VLANs
- Routed port (no switchport)
- Port channel
Answer: Trunk mode to carry all VLANs
The switch port connected to the router must be a trunk to carry tagged frames for all VLANs to the router subinterfaces.
What command assigns a subinterface to VLAN 10 using 802.1Q tagging?
- vlan 10
- switchport access vlan 10
- encapsulation dot1Q 10
- ip vlan 10
Answer: encapsulation dot1Q 10
encapsulation dot1Q [vlan-id] on a router subinterface tells the router to tag/untag frames for that VLAN.
What command must be entered on a Layer 3 switch before SVIs can route between VLANs?
- routing enable
- ip routing
- layer3 enable
- no switchport
Answer: ip routing
ip routing enables Layer 3 routing on a multilayer switch. Without it, SVIs exist but the switch will not route between them.
What is an SVI?
- A physical switch port configured as a router port
- A virtual interface on a Layer 3 switch that acts as the default gateway for a VLAN
- A subinterface on a router
- A spanning tree virtual interface
Answer: A virtual interface on a Layer 3 switch that acts as the default gateway for a VLAN
SVI (Switched Virtual Interface) is a virtual Layer 3 interface on a multilayer switch, one per VLAN, used for inter-VLAN routing and management.
Which inter-VLAN routing method is preferred in enterprise campus networks?
- Legacy (one physical interface per VLAN)
- Router-on-a-stick
- Layer 3 switch SVIs
- Bridging
Answer: Layer 3 switch SVIs
Layer 3 switch SVIs route in hardware (ASIC), providing high throughput and low latency. Router-on-a-stick creates a bottleneck on the single uplink.
In router-on-a-stick, the IP address assigned to a subinterface serves as the:
- Switch management IP
- Default gateway for hosts in that VLAN
- Trunk port IP
- DHCP server address
- Answer: Default gateway for hosts in that VLAN
Hosts in each VLAN are configured with the subinterface IP as their default gateway. Traffic destined for other VLANs is sent to this gateway.
What is a routed port on a Layer 3 switch?
- A port in trunk mode
- A physical switch port configured with no switchport — acts like a router interface
- An SVI for VLAN 1
- A port with PortFast enabled
Answer: A physical switch port configured with no switchport — acts like a router interface
no switchport removes Layer 2 switching from a physical port, turning it into a Layer 3 routed port. Used for uplinks to routers or WAN.
The command show ip _____ on a Layer 3 switch verifies that inter-VLAN routes have been installed.
Answer: route
show ip route displays the routing table. Connected routes for each SVI subnet should appear after ip routing is enabled and SVIs are up.
What is the main disadvantage of router-on-a-stick compared to Layer 3 switch SVIs?
- It requires more VLANs
- The single physical link between router and switch is a bandwidth bottleneck
- It does not support 802.1Q
- It requires a separate DHCP server
Answer: The single physical link between router and switch is a bandwidth bottleneck
All inter-VLAN traffic must traverse the single physical link to the router and back. Layer 3 switch SVIs route internally in hardware with no such bottleneck.
To verify a router-on-a-stick configuration, which command shows the subinterfaces and their IP addresses?
- show vlan brief
- show interfaces trunk
- show ip interface brief
- show mac address-table
Answer: show ip interface brief
show ip interface brief lists all interfaces including subinterfaces (e.g. Gi0/0.10, Gi0/0.20) with their IP addresses and status.
Previous lesson: EtherChannel (LACP) and Layer 2 discovery protocols (CDP, LLDP)
Back to Cisco CCNA Preparation
Next lesson: Switch configuration: hostname, passwords, SSH, banners, management IP, VTY lines