Inter-VLAN routing in practice: router-on-a-stick, SVIs and troubleshooting

Why VLANs need a router

Each VLAN is its own broadcast domain and normally its own IP subnet, for example VLAN 10 Staff on 192.168.10.0/24 and VLAN 20 Students on 192.168.20.0/24. A switch will never forward a frame from one VLAN into another, so traffic between them must be routed. That is useful: the routing point is also where you apply security policy between groups.

When a staff PC (192.168.10.25) talks to a printer in VLAN 20 (192.168.20.40), the PC sees a remote subnet and sends the frame to its default gateway, 192.168.10.1. The router or Layer 3 switch looks up 192.168.20.0/24, finds it directly connected on the VLAN 20 interface, ARPs for the printer and sends a new frame into VLAN 20.

Router-on-a-stick

One router interface connects to a switch trunk and is split into sub-interfaces, one per VLAN. Each sub-interface is tagged with its VLAN ID and carries that VLAN's gateway address.

! Router
interface GigabitEthernet0/0
 no shutdown
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
 ip helper-address 192.168.99.10
! Switch port facing the router
interface GigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20

Traffic between VLANs crosses the trunk twice, in and out, so the one link and the router's CPU limit throughput. It suits small offices and labs.

Layer 3 switch with SVIs

A multilayer switch can route between its own VLANs. Each switched virtual interface (SVI) is the gateway for one VLAN, and routing happens in hardware at full speed.

ip routing
vlan 10
 name STAFF
vlan 20
 name STUDENTS
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
 no shutdown
interface Vlan20
 ip address 192.168.20.1 255.255.255.0
 ip helper-address 192.168.99.10
 no shutdown
! Uplink to the firewall as a routed port
interface GigabitEthernet1/0/48
 no switchport
 ip address 10.0.0.2 255.255.255.252
ip route 0.0.0.0 0.0.0.0 10.0.0.1

An SVI only comes up when the VLAN exists, the SVI is not shut down, and at least one port in that VLAN (an access port or a trunk carrying it) is up and forwarding. The ip helper-address line makes the gateway relay DHCP broadcasts to a central server, because routers do not forward broadcasts.

Controlling and troubleshooting

Routing between VLANs means everything can reach everything by default. Apply ACLs on the SVIs, or route sensitive VLANs through a firewall instead of the core switch, so that, for example, students cannot reach staff servers. For larger designs consider VRFs to keep groups completely separate.

1. Can the host ping its own gateway? If not, check the access port VLAN (show vlan brief), the host's IP settings and the SVI or sub-interface state (show ip interface brief).
2. Is the trunk carrying the VLAN? show interfaces trunk lists allowed and active VLANs; check the native VLAN matches on both ends.
3. Does the router know both subnets? show ip route connected should list each VLAN subnet.
4. Has ip routing been enabled on the Layer 3 switch?
5. Is an ACL or firewall rule blocking the traffic, or does the far host lack the right gateway?

Real-world example: a new CCTV VLAN was added to a school network; cameras got no addresses. The SVI showed "up/down". VLAN 60 had been created on the access switches but not on the core, so no port on the core was forwarding VLAN 60 and the SVI stayed down. Creating the VLAN on the core brought the SVI up, and DHCP relay began working at once.

Tip: keep a simple table of VLAN ID, name, subnet and gateway address for every site, and use the same gateway convention everywhere (for example, always .1).