The moment you create a second VLAN, you have broken something on purpose.
A device in VLAN 10 can no longer reach a device in VLAN 20. Not because a rule forbids it, and not because something is misconfigured — but because at Layer 2 there is simply no path between them. The switch treats them as if they were plugged into two separate, unconnected switches.
That isolation is the entire reason VLANs exist. So inter-VLAN routing is not a repair for a problem. It is a deliberate decision to allow some of that traffic back, under conditions you choose.
Why a Switch Cannot Do This Alone
A traditional switch operates at Layer 2 of the OSI model. It makes forwarding decisions based on MAC addresses, and it has no concept of IP addresses, subnets, or networks.
When a device in VLAN 10 wants to reach an IP address in a different subnet, it does not attempt to find that device by MAC address. It compares the destination against its own subnet mask, concludes the destination is remote, and sends the frame to its default gateway instead.
That gateway must be something capable of Layer 3 forwarding — a router, a Layer 3 switch, or a firewall. It receives the frame in one VLAN, examines the IP header, consults its routing table, and forwards the packet out into a different VLAN.
Three architectures accomplish this, and they emerged in that order historically.
Method One: One Router Interface Per VLAN
The original approach. The router has a separate physical interface for each VLAN, and each connects to a switch port assigned to that VLAN.
- Router interface Gi0/0 connects to a switch port in VLAN 10, with an IP address in that subnet.
- Router interface Gi0/1 connects to a switch port in VLAN 20.
- And so on, one interface and one cable per VLAN.
It works, it is easy to understand, and nobody builds it this way any more. The reason is arithmetic: ten VLANs require ten router interfaces and ten cables. Routers do not have ten interfaces, interfaces are expensive, and the cabling becomes absurd.
It is worth knowing because it clarifies what the other methods are doing — they are both ways of achieving the same result without the physical cost.
Method Two: Router-on-a-Stick
The classic solution, and still common in small networks and in certification exams.
A single physical link connects the router to the switch, configured as an 802.1Q trunk so it carries traffic for every VLAN. On the router, that one physical interface is divided into logical subinterfaces — one per VLAN — each tagged with the appropriate VLAN ID and given an IP address in the corresponding subnet.
The configuration follows a consistent pattern on Cisco equipment:
- Create a subinterface, conventionally numbered to match the VLAN:
interface GigabitEthernet0/0.10 - Specify the tagging:
encapsulation dot1Q 10 - Assign the gateway address:
ip address 192.168.10.1 255.255.255.0 - Repeat for each VLAN, and ensure the physical interface itself is enabled with
no shutdown
On the switch side, the port connecting to the router must be configured as a trunk, and the VLANs in question must be permitted across it.
What happens in practice: a frame from VLAN 10 arrives on the trunk carrying its tag. The router strips the tag, matches the subinterface, routes the packet, re-tags it for VLAN 20, and sends it back down the same physical link.
Which reveals the weakness. Every packet crossing between VLANs travels up the trunk and back down it. That single link carries the inter-VLAN traffic of the entire network in both directions, and it becomes the bottleneck as soon as traffic volumes grow. This is why router-on-a-stick suits small offices and struggles in larger environments.
Method Three: Layer 3 Switch With SVIs
The modern default, and what you will find in most business networks built in the past fifteen years.
A Layer 3 switch performs routing in hardware, using the same switching silicon that forwards frames at wire speed. Instead of sending traffic to an external router, the switch routes between VLANs itself.
It does this using switched virtual interfaces — logical Layer 3 interfaces, one per VLAN, that act as the default gateway for devices in that VLAN.
The configuration is refreshingly simple:
- Enable routing globally:
ip routing. This step is forgotten constantly, and nothing works without it. - Create the interface:
interface vlan 10 - Assign the address:
ip address 192.168.10.1 255.255.255.0 - Bring it up:
no shutdown - Repeat per VLAN.
The advantages are substantial: routing happens at hardware speed, there is no trunk bottleneck, no additional device to buy, and no extra failure point. The cost is that Layer 3 switches are more expensive than Layer 2 ones, and the feature set for advanced routing is generally narrower than a dedicated router provides.
Choosing Between Them
- Router-on-a-stick fits networks with a handful of VLANs, modest inter-VLAN traffic, and an existing router with spare capacity. It is also what you should learn first, because it makes tagging visible.
- Layer 3 switching fits anything larger, anywhere inter-VLAN traffic is significant, and any environment where latency matters.
- A firewall as the inter-VLAN gateway fits environments where every flow between segments must be inspected and logged. It is the slowest option and the most secure, and it is increasingly common in security-conscious designs.
Many real networks combine these. A Layer 3 switch handles routing between internal user VLANs, while traffic to and from sensitive segments — servers, guest, management — is forced through a firewall instead.
The Default Gateway Question
Every device needs to know where to send traffic destined for other networks, and this is where beginners most often come unstuck.
The rules that matter:
- Each VLAN needs its own gateway address, in its own subnet, configured on whichever device performs the routing.
- The gateway address must be inside the subnet assigned to that VLAN. A device in 192.168.10.0/24 cannot use 192.168.20.1 as a gateway.
- Every device in the VLAN must be configured with that address, whether manually or through DHCP.
- Only one device should own each gateway address, unless you are deliberately running a redundancy protocol such as HSRP or VRRP.
- The routing device itself needs a route to the internet, usually a default route pointing at the firewall or edge router.
A common symptom of getting this wrong: devices can reach others in their own VLAN perfectly, and nothing outside it. That pattern almost always points at the gateway.
Controlling What Is Allowed
Routing between all VLANs without restriction defeats much of the reason you created them. Once routing works, the next step is deciding what should actually be permitted.
Access control lists applied to the routing interfaces let you express rules such as:
- Guest VLAN may reach the internet, and nothing internal.
- User VLAN may reach specific server ports, not the entire server VLAN.
- Camera VLAN may reach the recording server only, and may not initiate anything else.
- Management VLAN is reachable only from a defined administrative subnet.
The design principle worth adopting is to permit what is needed and deny the rest, rather than denying known problems and permitting everything else. The second approach requires you to predict every threat in advance, which nobody can do.
When the Gateway Fails
A point that beginner guides skip: once you centralise inter-VLAN routing on one device, that device becomes a single point of failure for the entire network. If the Layer 3 switch performing your routing goes down, every VLAN becomes an island.
The standard answer is a first-hop redundancy protocol. Two routing devices share a virtual IP address that acts as the gateway for a VLAN. Clients are configured with the virtual address and know nothing about which physical device is actually serving it. If the active device fails, the standby takes over the virtual address within seconds, and clients never change their configuration.
The common implementations:
- HSRP — Cisco's protocol, widely deployed, with one active and one standby device per group.
- VRRP — the open standard equivalent, supported across vendors, useful in mixed environments.
- GLBP — Cisco's variant that allows several devices to share the forwarding load rather than leaving one idle.
Worth knowing even in a small network, because the failure mode without it is total. A single switch reboot during business hours is the moment most administrators discover they should have configured this.
Troubleshooting Checklist
When inter-VLAN routing does not work, check these in order. The fault is nearly always in the first four.
- Is routing enabled? On a Layer 3 switch, confirm
ip routingis present. This single omission accounts for an enormous share of failures. - Is the SVI or subinterface up? Verify both line protocol and administrative status.
- Is the VLAN allowed on the trunk between the switch and the routing device?
- Do the devices have the correct default gateway, and is it in their own subnet?
- Does the VLAN exist in the switch's VLAN database, not merely referenced in an interface configuration?
- Is at least one active port assigned to the VLAN? An SVI for a VLAN with no active member ports will stay down on many platforms.
- Is an access list blocking the traffic you are testing?
- Is a host firewall on the destination device dropping the traffic? Windows Firewall blocks inbound ping from other subnets by default, which produces hours of wasted investigation.
That last point deserves emphasis. Before concluding that your routing is broken, test with a device whose firewall you have verified, or test something other than ping.
The Principle Worth Remembering
Inter-VLAN routing is not about restoring connectivity that VLANs took away. It is about reintroducing connectivity selectively, on your terms, at a point where you can see it, filter it, and log it.
A network where every VLAN routes freely to every other VLAN has the administrative overhead of segmentation with none of the benefit. The value arrives when the routing device becomes a checkpoint rather than a bridge.
0 تعليقات