Inter-VLAN routing
Router-on-a-stick subinterfaces and Layer 3 switch SVIs, with the trunk and routing configuration each design needs.
The two designs
Hosts in different VLANs cannot exchange Layer 2 frames — a router must forward between the VLANs' subnets. Two designs deliver this: router-on-a-stick (a physical router with subinterfaces on one trunk) and the Layer 3 switch SVI (a virtual interface per VLAN inside the switch).
Router-on-a-stick versus SVIs
| Property | Router-on-a-stick | Layer 3 switch SVI |
|---|---|---|
| Gateway lives on | Router subinterfaces (.10, .20…) | interface vlan X on the switch |
| Uplink to router/L3 | Single trunk carrying all VLANs | Not needed for inter-VLAN — routing is internal |
| Performance | Hairpins traffic through one link | Routes at switching speed |
| Use | Small sites, existing router | Campus norm |
Router-on-a-stick
Route VLANs 10 and 20 over one trunk on G0/1 — Privileged EXEC → Interface + subinterface configuration
Cisco IOS / IOS XE router
configure terminal interface gigabitethernet0/1 no shutdown exit interface gigabitethernet0/1.10 encapsulation dot1q 10 ip address 192.168.10.1 255.255.255.0 exit interface gigabitethernet0/1.20 encapsulation dot1q 20 ip address 192.168.20.1 255.255.255.0 end
show ip interface brief show vlans ping 192.168.20.10
- Subinterfaces show up/up with their VLAN-tag dot1q binding.
- Inter-VLAN ping works once host gateways point at the subinterface IPs.
- The parent interface needs no IP itself — only
no shutdown.
Changes device configuration.
Layer 3 switch SVIs
Give VLANs 10 and 20 gateways on a Layer 3 switch — Privileged EXEC → Global + interface VLAN configuration
Cisco IOS / IOS XE switch
ip routingmust be enabled globally for SVI routing to work.
configure terminal ip routing interface vlan 10 ip address 192.168.10.1 255.255.255.0 exit interface vlan 20 ip address 192.168.20.1 255.255.255.0 end
show ip interface brief show ip route ping 192.168.20.10
- SVIs show up/up only when the VLAN exists AND at least one port forwards in it.
- Connected routes appear for both VLAN subnets.
- An SVI stays down/down if no active port carries that VLAN.
Changes device configuration.
- PC
- 192.168.10.10, gw 192.168.20.1
- The gateway must be inside the host's own subnet — 192.168.20.1 is in VLAN 20's subnet.
- The host computes the gateway as off-link and never ARPs for it → nothing forwards.
- Correct gateway: 192.168.10.1 (the VLAN 10 subinterface/SVI).
The default gateway always lives inside the host's own VLAN subnet.
Verification
Common mistakes
- Pointing host gateways at the wrong VLAN's gateway address.
- Forgetting
encapsulation dot1qon router subinterfaces — the subinterface won't bind to the VLAN. - Leaving the parent router interface shut down while configuring subinterfaces.
- Expecting an SVI up with no active port in that VLAN.
- Forgetting
ip routingon a Layer 3 switch — SVIs come up but nothing routes between them.
Observation: show ip interface brief lists both SVIs up/up; hosts still cannot cross VLANs.
ip routingdisabled on the L3 switch- Host gateway misconfigured
- Trunk upstream does not carry the VLAN
| Check | Indicates |
|---|---|
show ip protocols / show ip route | Inspect ip routing state directly — connected routes alone don't prove forwarding is on. |
| Host gateway setting | Gateway must equal the SVI IP of the host's own VLAN. |
show interfaces trunk to the upstream device | VLAN must be allowed and active end to end. |
Correction: Enable ip routing or fix the host gateway/VLAN path.
Inter-VLAN ping and application traffic succeed between the subnets.
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- Cisco — IP Addressing Services Command Reference — reviewed 2026-11-02
- Cisco — LAN Switching Command Reference — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.