Cisco & Networking · Lesson 09
Inter-VLAN Routing
Learn how separate VLANs communicate through Layer 3 gateways, router-on-a-stick subinterfaces, or multilayer-switch SVIs while preserving the Layer 2 segmentation created by VLANs.
The goal is to route required traffic without destroying the segmentation that VLANs provide. Every successful design aligns access ports, trunks, gateways, routes, and endpoint addressing.
Lesson Snapshot
Learning objectives
Connect VLANs at Layer 3 with controlled routing
Explain why hosts in different VLANs need Layer 3 forwarding.
Distinguish router-on-a-stick, routed interfaces, and switch virtual interfaces.
Configure and verify inter-VLAN routing with an inspection-first workflow.
Understand how default gateways connect endpoint VLANs to Layer 3 forwarding.
Recognize common inter-VLAN routing failures involving trunks, subinterfaces, SVIs, and routing state.
Verify end-to-end traffic without changing unrelated Layer 2 configuration.
Core idea
VLAN boundaries stop Layer 2 traffic, not Layer 3 routing
A gateway can route between VLAN subnets while the VLANs remain separate broadcast domains. Segmentation and routing work together.
Competition warning
Do not "fix" routing by collapsing VLANs
Moving endpoints into one VLAN may restore connectivity while destroying the intended security boundary. Fix the Layer 3 path instead.
Core concepts
Six ideas behind inter-VLAN routing
Inter-VLAN routing
Layer 3 forwarding between separate VLAN broadcast domains. A switch alone cannot move ordinary traffic from VLAN 10 to VLAN 20 unless it has Layer 3 routing capability configured.
Default gateway
The Layer 3 address a host uses when the destination lies outside its local subnet.
Router-on-a-stick
A design where one physical router interface carries multiple VLANs through 802.1Q subinterfaces.
Subinterface
A logical router interface created under one physical interface and associated with a VLAN using 802.1Q encapsulation.
SVI
A Switch Virtual Interface such as interface vlan 10 that provides Layer 3 functionality for a VLAN on a multilayer switch.
Layer 3 switch
A switch capable of routing between VLANs while also performing normal Layer 2 switching.
Packet path
How traffic crosses from one VLAN to another
Host compares destination to its own subnet
If the destination is outside the local subnet, the host knows the traffic must leave the local Layer 2 domain.
Host sends the frame toward the default gateway
The destination IP remains the remote host, but the local Ethernet frame uses the gateway's MAC address.
Gateway receives the packet
The router or Layer 3 switch examines the destination IP and performs a routing-table lookup.
Layer 3 device selects the destination VLAN
The device chooses the connected or learned route that reaches the remote subnet.
A new Layer 2 frame is built
The Layer 3 device forwards the packet into the destination VLAN with local Layer 2 addressing appropriate for that segment.
Destination host receives the packet
The endpoint processes the frame and packet and sends replies through its own gateway when necessary.
Design choices
Three ways to provide Layer 3 forwarding
Router-on-a-stick
Layer 2
A trunk connects the switch to one router physical interface.
Layer 3
Router subinterfaces act as gateways for individual VLANs.
Strength
Simple and useful for small labs and learning.
Tradeoff
All inter-VLAN traffic shares one physical router link.
Multilayer switch with SVIs
Layer 2
Access ports and trunks remain on the switch.
Layer 3
SVIs provide gateway addresses and the switch routes internally when IP routing is enabled.
Strength
Efficient and common in campus-style designs.
Tradeoff
Requires a Layer 3 capable switch and correct routing configuration.
Physical routed interfaces
Layer 2
Each routed interface connects directly to one Layer 3 subnet.
Layer 3
Each physical interface holds its own IP address and route.
Strength
Conceptually simple.
Tradeoff
Consumes more physical interfaces and scales poorly for many VLANs.
Fictional gateway plan
Keep VLAN, subnet, and gateway aligned
| VLAN | Name | Subnet | Gateway |
|---|---|---|---|
| 10 | STAFF | 192.168.10.0/24 | 192.168.10.1 |
| 20 | STUDENTS | 192.168.20.0/24 | 192.168.20.1 |
| 30 | SERVERS | 192.168.30.0/24 | 192.168.30.1 |
| 99 | MANAGEMENT | 192.168.99.0/24 | 192.168.99.1 |
Router inspection
Read Layer 3 state before configuring
show ip interface briefIdentify the physical interface and any configured subinterfaces with their IPv4 addresses and state.
show running-config interface GigabitEthernet0/0Review the parent physical interface state and configuration.
show running-config interface GigabitEthernet0/0.10Review one router subinterface in detail.
show ip route connectedConfirm the router recognizes each VLAN subnet as a connected route.
show ip routeReview the complete Layer 3 forwarding table.
show arpReview local IPv4-to-MAC mappings learned on connected VLANs.
Switch inspection
Verify the Layer 2 path toward the gateway
show vlan briefVerify the VLANs exist and endpoint access ports belong to the intended VLANs.
show interfaces trunkVerify the router-facing switchport is trunking and carrying all required VLANs.
show interfaces <interface> switchportInspect the detailed operational state of the router-facing trunk.
show mac address-tableConfirm endpoint and gateway-side MAC learning is occurring in the expected VLANs.
show spanning-tree vlan <vlan-id>Check whether the VLAN is forwarding over the required Layer 2 path.
Router-on-a-stick
Build the trunk and subinterfaces deliberately
Prepare the switch trunk
configure terminalinterface GigabitEthernet0/24switchport mode trunkswitchport trunk allowed vlan 10,20,30,99endVerify
show interfaces trunkPrepare the router physical interface
configure terminalinterface GigabitEthernet0/0no shutdownendVerify
show ip interface briefCreate VLAN 10 subinterface
configure terminalinterface GigabitEthernet0/0.10encapsulation dot1Q 10ip address 192.168.10.1 255.255.255.0endVerify
show running-config interface GigabitEthernet0/0.10Create VLAN 20 subinterface
configure terminalinterface GigabitEthernet0/0.20encapsulation dot1Q 20ip address 192.168.20.1 255.255.255.0endVerify
show running-config interface GigabitEthernet0/0.20Adapt interface names to the device
Packet Tracer router models can use different interface names. Inspect the device first instead of copying GigabitEthernet0/0 blindly.
Subinterface rules
Every subinterface depends on the same Layer 2 path
Subinterface number is locally significant
The numeric suffix is often chosen to match the VLAN ID for readability, but the VLAN association is created by the encapsulation dot1Q command.
Each VLAN needs a unique Layer 3 subnet
Two subinterfaces should not use overlapping connected IPv4 networks.
The parent must be operational
If the physical router interface is administratively down, subinterfaces cannot carry normal traffic.
The switch link must trunk
The router cannot receive multiple VLANs correctly if the switch-facing interface is only an access port.
Allowed VLANs must include the routed VLAN
A perfectly configured router subinterface still fails if the trunk drops that VLAN.
Gateway addresses must match endpoint design
Hosts should use the subinterface address assigned to their own VLAN as the default gateway unless the scenario defines another valid design.
Native subinterface awareness
Use native VLAN configuration only when the design requires it
Native keyword
A router subinterface can be configured with encapsulation dot1Q <vlan-id> native when the authorized design intentionally uses that VLAN as native.
Both ends must agree
The router and switch trunk must interpret the native VLAN consistently.
Do not make a VLAN native casually
Native-VLAN changes affect how untagged frames are classified and can create mismatch problems.
Native is not required for every design
Most routed VLANs remain normally tagged. The native setting should exist only when the topology calls for it.
Multilayer switching
SVIs provide gateways inside the switch
SVI provides a VLAN gateway
interface vlan 10 can hold the Layer 3 address used by hosts in VLAN 10.
The VLAN must exist
The corresponding VLAN normally needs to exist and have an active Layer 2 presence for the SVI to become operational.
IP routing enables forwarding
On a multilayer switch, ip routing is commonly required before the switch will route between SVIs.
Access ports still matter
SVIs do not replace VLAN membership. Endpoints still need correct access VLAN assignments.
Trunks still matter
If VLANs extend to other switches, trunks must still carry the required VLANs.
SVIs can support management or user gateways
The purpose depends on the design. Do not assume every SVI is only for management.
SVI configuration
Route between VLANs on a Layer 3 capable switch
Create the VLANs
configure terminalvlan 10name STAFFvlan 20name STUDENTSendVerify
show vlan briefCreate the VLAN 10 SVI
configure terminalinterface vlan 10ip address 192.168.10.1 255.255.255.0no shutdownendVerify
show ip interface briefCreate the VLAN 20 SVI
configure terminalinterface vlan 20ip address 192.168.20.1 255.255.255.0no shutdownendVerify
show ip interface briefEnable Layer 3 forwarding
configure terminalip routingendVerify
show ip routeFeature support depends on switch model
Not every Packet Tracer switch supports Layer 3 routing or the same SVI behavior. Confirm the device model and available commands first.
Routing table
Connected routes prove the gateway owns the subnet
C 192.168.10.0/24 is directly connected, GigabitEthernet0/0.10The router recognizes VLAN 10's subnet as connected through subinterface .10.
C 192.168.20.0/24 is directly connected, GigabitEthernet0/0.20The router recognizes VLAN 20's subnet as connected through subinterface .20.
L 192.168.10.1/32 is directly connected, GigabitEthernet0/0.10The router has a local route for its own interface address.
C 192.168.30.0/24 is directly connected, Vlan30A multilayer switch recognizes VLAN 30 as connected through SVI Vlan30.
End-to-end troubleshooting
Trace from the source host all the way back
Source endpoint
Confirm IP address, subnet mask, default gateway, and access VLAN.
Source access switch
Confirm access VLAN, MAC learning, and trunk path toward the Layer 3 gateway.
Source gateway
Confirm the subinterface or SVI is up and uses the correct address and mask.
Routing decision
Confirm the Layer 3 device has a route to the destination subnet.
Destination VLAN
Confirm the destination VLAN is active and reachable from the Layer 3 device.
Destination endpoint
Confirm the destination host addressing, gateway, local policy, and application state.
Return path
Confirm the destination can route the response back to the source network.
Symptom mapping
Let the failure pattern choose the next check
Host can reach same-VLAN peers but cannot reach another VLAN
Default gateway, inter-VLAN routing state, ACLs, destination gateway, and return path.
Host cannot even ping its own gateway
Access VLAN, trunk carriage, gateway interface/SVI state, host subnet mask, physical link, ARP.
Only VLAN 20 cannot reach other VLANs
VLAN 20 gateway, subinterface/SVI, trunk allowance, endpoint gateway, route presence.
Router sees connected route for VLAN 10 but not VLAN 20
VLAN 20 subinterface/SVI configuration and operational state.
Host reaches gateway but cannot reach remote server
Routing table, ACL, destination subnet, return route, and service state.
Inter-VLAN ping works but application fails
Transport port, ACL policy, server process, firewall, DNS, or application configuration.
Common misconfigurations
Small errors can remove one VLAN or every VLAN
Wrong encapsulation VLAN ID
The router subinterface associates frames with the wrong VLAN or fails to communicate with the intended segment.
Wrong gateway IP
Hosts send remote traffic to an address that may not belong to the intended local subnet or gateway interface.
Parent router interface shutdown
All subinterfaces on that physical interface can fail together.
Missing VLAN on switch
The Layer 2 path for that VLAN may not exist even though the router subinterface is configured.
VLAN missing from trunk allowed list
Only that VLAN fails across the trunk while other VLANs may continue working.
ip routing disabled on multilayer switch
SVIs may exist but traffic is not forwarded between them as intended.
SVI line protocol down
The gateway for that VLAN may be unavailable despite having an IP address configured.
Overlapping subnet configuration
Layer 3 routing becomes ambiguous or invalid and connected route behavior can be incorrect.
ACL awareness
A working route does not guarantee permitted traffic
Routing and policy are separate
A route can exist while an ACL still blocks the traffic.
Successful gateway ping is not full proof
It confirms part of the path, not that inter-VLAN policy permits every required application.
Inspect before removing ACLs
If inter-VLAN traffic fails, determine whether the ACL is intentionally enforcing a scenario requirement.
Test the required service
After Layer 3 reachability works, verify the actual application or port the scenario requires.
Evidence-based reasoning
Diagnose Layer 3 without destroying Layer 2 design
VLAN 10 hosts can ping 192.168.10.1 but not 192.168.20.1
Weak response
Move VLAN 10 hosts into VLAN 20.
Better reasoning
The local gateway works. Inspect inter-VLAN routing, VLAN 20 gateway state, route table, trunk carriage, and policy.
Router subinterface G0/0.20 has IP 192.168.20.1/24, but VLAN 20 hosts cannot ping it
Weak response
Add a static route to 192.168.20.0/24.
Better reasoning
That network should already be directly connected. Check encapsulation dot1Q 20, parent interface, trunk allowance, VLAN existence, and host access VLAN.
A multilayer switch has SVIs for VLAN 10 and VLAN 20 but hosts cannot route between them
Weak response
Create a router-on-a-stick connection immediately.
Better reasoning
First verify the switch supports Layer 3 routing and whether ip routing is enabled.
VLAN 20 cannot reach VLAN 30, but VLAN 10 can
Weak response
The entire trunk must be broken.
Better reasoning
A selective failure points toward VLAN-specific trunk carriage, gateway state, ACLs, or addressing rather than total link failure.
Host can ping remote gateway but not remote server
Weak response
Inter-VLAN routing is completely broken.
Better reasoning
Routing reaches at least the remote gateway. Continue with server addressing, local firewall, ACL, service state, and return-path checks.
A gateway address ends in .254 instead of .1
Weak response
Change it because gateways should use .1.
Better reasoning
Gateway numbering is a design choice. Verify the scenario and endpoint configuration before changing a working address.
Unsafe shortcuts
Fixes that hide the real routing problem
Adding static routes for directly connected VLANs
Hides the real interface/subinterface problem and can create unnecessary routing confusion.
Changing endpoint VLANs to make routing work
Destroys the intended segmentation instead of fixing the Layer 3 path.
Removing ACLs because ping fails
Can erase required traffic policy before confirming whether routing or addressing is actually at fault.
Reconfiguring all subinterfaces at once
A single mistaken assumption can disconnect every routed VLAN on the shared link.
Enabling every SVI
Can activate unintended Layer 3 gateways or management paths.
Saving before testing return traffic
A one-way or partial routing failure can become persistent.
Practice scenarios
Choose the safest next Layer 3 check
VLAN 10 hosts can reach their gateway, but VLAN 20 hosts cannot reach theirs.
Treat it as VLAN-specific. Check VLAN 20 subinterface/SVI state, trunk carriage, access VLAN, and endpoint gateway.
The router has G0/0.10 and G0/0.20 configured, but show ip route lists only VLAN 10's subnet.
Inspect G0/0.20 operational state, encapsulation, IP configuration, and the parent interface.
A multilayer switch has Vlan10 and Vlan20 interfaces up but no inter-VLAN traffic.
Check whether ip routing is enabled and whether policy blocks the traffic.
VLAN 20 can ping VLAN 30's gateway but not the server itself.
Continue beyond routing: inspect server IP, mask, gateway, firewall, application service, and return path.
A teammate wants to add a static route to a directly connected VLAN.
Do not use a static route to hide a connected-interface problem. Fix the interface/subinterface or SVI state.
Management becomes unreachable after a trunk allowed-list change.
Check whether VLAN 99 was removed from the trunk. Restore only the required management path and verify before saving.
Verification
Prove the complete routed path
Endpoint VLAN
The source and destination ports belong to the intended VLANs.
Endpoint addressing
Each host uses an IP address, mask, and gateway appropriate for its VLAN.
Trunk
Every required VLAN reaches the Layer 3 gateway through the intended trunk path.
Gateway interface
The subinterface or SVI is operational and uses the correct address and prefix.
Routing table
The Layer 3 device has connected or learned routes for the required subnets.
Policy
ACLs and security rules allow required traffic and still block prohibited traffic.
Return path
The destination can send replies back to the source subnet.
Application
The actual required service works after basic Layer 3 reachability is confirmed.
Defensive lab
Build and troubleshoot fictional inter-VLAN routing
Build a fictional topology with one switch, one router, and four VLANs: 10 STAFF, 20 STUDENTS, 30 SERVERS, and 99 MANAGEMENT.
Configure endpoint-facing access ports and the router-facing trunk, but do not configure inter-VLAN routing yet.
Verify same-VLAN communication works while cross-VLAN communication fails as expected.
Configure router-on-a-stick subinterfaces for VLANs 10,20,30,99 using the fictional gateway plan.
Verify the router installs connected routes for all four VLAN subnets.
Test Staff-to-Server traffic and Management-to-router traffic end to end.
Introduce one fault such as wrong encapsulation VLAN ID, missing allowed VLAN, or wrong endpoint gateway.
Use layered evidence to identify the fault, correct only that issue, and verify both forward and return traffic.
Lesson checklist
Before moving on
I can explain why different VLANs need Layer 3 forwarding.
I understand how a default gateway participates in inter-VLAN communication.
I can distinguish router-on-a-stick from SVI-based routing.
I understand how 802.1Q subinterfaces map router logic to VLANs.
I know that a router-on-a-stick parent interface and switch trunk must both be operational.
I can verify connected routes for each routed VLAN.
I understand that multilayer switching typically requires ip routing for inter-VLAN forwarding.
I do not add static routes to hide directly connected VLAN problems.
I check ACLs separately from routing state.
I verify return traffic, not just one-way reachability.
I test the actual application after Layer 3 reachability works.
I document gateway addresses and VLAN-to-subnet mappings before saving.
Reflection
Check your reasoning
Question 1
Why does a host in VLAN 10 need a default gateway to reach VLAN 20?
Question 2
What role does encapsulation dot1Q play on a router subinterface?
Question 3
Why can a router subinterface look correctly addressed but still fail if the switch trunk is wrong?
Question 4
What is the difference between an SVI and an access port?
Question 5
Why should directly connected VLANs normally appear automatically in the routing table?
Question 6
What evidence would you collect when one VLAN routes correctly and another does not?
Carry this forward
Inter-VLAN routing succeeds only when Layer 2 and Layer 3 agree: access VLAN, trunk, gateway, route, endpoint addressing, and return path all have to describe the same network design.