Inter-VLAN Routing: A Simple Guide for Beginners
VLANs divide a network into separate logical networks. However, devices in different VLANs cannot communicate directly at Layer 2.
Inter-VLAN Routing allows devices in different VLANs to communicate through a router or a Layer 3 switch.
In this guide, you will learn how Inter-VLAN Routing works and how to configure it using two common Cisco methods.
1. How Does Inter-VLAN Routing Work?
Imagine an office network with two VLANs:
| VLAN | Network | Default Gateway |
|---|---|---|
| VLAN 10 – DATA | 192.168.10.0/24 | 192.168.10.1 |
| VLAN 20 – VOICE | 192.168.20.0/24 | 192.168.20.1 |
If a computer in VLAN 10 needs to communicate with a device in VLAN 20, it sends the traffic to its default gateway. A router or Layer 3 switch then routes the traffic to the destination VLAN.
Inter-VLAN Routing is commonly used when employees need to access servers, printers, or applications located in different VLANs.
2. Common Inter-VLAN Routing Methods
There are two common ways to route traffic between VLANs.
Layer 3 Switch: Uses Switched Virtual Interfaces (SVIs) to provide a default gateway for each VLAN. This method is common in enterprise networks because it supports efficient routing within the LAN.
Router-on-a-Stick: Uses one physical router interface with multiple logical subinterfaces. A trunk link carries traffic for multiple VLANs between the switch and router.
Both methods allow communication between VLANs, provided routing and security settings are configured correctly.
3. Method One: Inter-VLAN Routing Using a Layer 3 Switch
In this example, we will configure VLAN 10 and VLAN 20 on a Layer 3 switch.
Note: The commands and interface names may vary depending on the Cisco device model and IOS version.
Step 1: Create the VLANs
enable
configure terminal
vlan 10
name DATA
exit
vlan 20
name VOICE
exitThese commands create VLAN 10 and VLAN 20.
Step 2: Configure the VLAN Gateways
interface vlan 10
ip address 192.168.10.1 255.255.255.0
no shutdown
exit
interface vlan 20
ip address 192.168.20.1 255.255.255.0
no shutdown
exit
ip routing
end
write memoryThe SVIs provide the default gateway for each VLAN, while ip routing enables Layer 3 routing on the switch.
Important: Configuring no shutdown does not guarantee that an SVI will become operational. The VLAN must exist, and the switch generally needs at least one active Layer 2 port assigned to that VLAN or an operational trunk carrying it. The exact behavior depends on the switch model and configuration.
Step 3: Assign the Access Ports
For example, connect PC-A to VLAN 10 and PC-B to VLAN 20.
configure terminal
interface fastEthernet 0/1
switchport mode access
switchport access vlan 10
no shutdown
exit
interface fastEthernet 0/2
switchport mode access
switchport access vlan 20
no shutdown
exit
end
write memoryNote: FastEthernet 0/1 and FastEthernet 0/2 are example interface names. Your switch may use different names, such as GigabitEthernet1/0/1.
Configure the PCs with these settings:
| Device | IP Address | Default Gateway |
|---|---|---|
| PC-A | 192.168.10.10/24 | 192.168.10.1 |
| PC-B | 192.168.20.10/24 | 192.168.20.1 |
The Layer 3 switch can now route traffic between the VLANs if the interfaces are operational and the configuration is correct.
4. Method Two: Router-on-a-Stick Configuration
Router-on-a-Stick uses one physical router interface to route traffic between multiple VLANs.
The switch connects to the router through a trunk port, and the router uses subinterfaces to provide a gateway for each VLAN.
We will use the same VLANs and IP addressing plan as the previous example.
Step 1: Create the VLANs and Configure the Switch Trunk Port
Assume GigabitEthernet0/1 connects the switch to the router.
enable
configure terminal
vlan 10
name DATA
exit
vlan 20
name VOICE
exit
interface gigabitEthernet 0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
no shutdown
exit
end
write memoryThe trunk allows VLAN 10 and VLAN 20 traffic to travel between the switch and router using IEEE 802.1Q VLAN tagging.
Note: The switch interface must support trunking. Some Cisco switch models may require additional trunk configuration, depending on the platform.
Step 2: Configure the Router Subinterfaces
Assume the router connects to the switch through GigabitEthernet0/0.
enable
configure terminal
interface gigabitEthernet 0/0
no shutdown
exit
interface gigabitEthernet 0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit
interface gigabitEthernet 0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit
end
write memoryEach subinterface is associated with a VLAN and provides its default gateway.
The physical router interface must be connected to the switch trunk and be operational. The switch trunk and router subinterfaces must use matching VLAN IDs.
Configure the PCs with the same IP addresses and default gateways shown in the previous example.
5. Verify the Configuration
After configuring either method, use these commands to check the network.
Check VLANs
show vlan briefDisplays VLANs and their access-port assignments.
Check Trunk Ports
show interfaces trunkDisplays operational trunk ports and the VLANs allowed on them.
Check Interface Status and IP Addresses
show ip interface briefUseful for checking router interfaces, subinterfaces, and SVIs.
For SVIs, confirm that the relevant interfaces are operational. An SVI that remains down may indicate an inactive VLAN or a lack of active Layer 2 ports carrying that VLAN.
Check the Routing Table
show ip routeDisplays routes known to the router or Layer 3 switch. Directly connected VLAN networks should appear when their Layer 3 interfaces are operational.
Test Connectivity
From PC-A, test its gateway:
ping 192.168.10.1Then test communication with PC-B:
ping 192.168.20.10If the configuration is correct and no security policy blocks the traffic, PC-A should be able to communicate with PC-B.
6. Common Inter-VLAN Routing Problems
If devices cannot communicate between VLANs, check the following:
- Incorrect VLAN assignment: Ensure each device is connected to the correct VLAN.
- Incorrect IP address or default gateway: Each device must use an appropriate IP address, subnet mask, and gateway for its subnet.
- Trunk problems: Confirm the trunk is operational and allows the required VLANs.
- SVI or subinterface problems: Check the interface status, IP address, and VLAN configuration.
- Routing disabled: Ensure
ip routingis enabled on the Layer 3 switch. - Inactive VLANs: Verify that the VLAN exists and has an active port or an operational trunk carrying it, as required by the platform.
- Security restrictions: Check firewall rules or Access Control Lists (ACLs) that may block traffic.
- Physical connectivity issues: Check cables, link status, and the connected interfaces.
Troubleshooting these items systematically can help identify whether the issue is related to Layer 2 switching, Layer 3 routing, or security configuration.
7. Frequently Asked Questions
Can Devices in Different VLANs Communicate Directly?
No. Devices in different IP networks generally need a router or Layer 3 switch to route traffic between them.
Does a Trunk Port Perform Inter-VLAN Routing?
No. A trunk carries traffic for multiple VLANs, while a Layer 3 device performs the routing.
Which Method Is Better: Router-on-a-Stick or a Layer 3 Switch?
Router-on-a-Stick is useful for small networks, labs, and environments where a router provides the required routing functions.
A Layer 3 switch is often preferred for enterprise LANs that need efficient routing between VLANs. The best choice depends on the network design, traffic requirements, and device capabilities.
Is Inter-VLAN Routing Secure?
Inter-VLAN Routing can be secure when appropriate firewall rules or ACLs control which VLANs can communicate.
Routing alone does not provide traffic isolation between VLANs once routing is permitted. For example, a company may allow employees to access application servers while restricting access to management devices and other sensitive networks.
Can I Use the Same VLAN IDs on a Router and a Switch?
Yes. In a Router-on-a-Stick configuration, the VLAN IDs configured on the switch trunk must match the VLAN IDs specified by the router subinterfaces through the encapsulation dot1Q command.
Conclusion
Inter-VLAN Routing allows devices in different VLANs to communicate through a router or Layer 3 switch.
The two common methods are Router-on-a-Stick, which uses router subinterfaces, and Layer 3 switching, which uses SVIs.
Understanding VLANs, default gateways, trunk links, interface status, and routing configuration will help you build and troubleshoot networks more effectively.
0 تعليقات