2.2 Inter-VLAN Routing

Crossing the Layer 3 boundary. Master the configuration of Router-on-a-Stick (ROAS) architecture and high-speed Switch Virtual Interfaces (SVIs).

Core Architecture

The Layer 3 Boundary

Because VLANs isolate Broadcast Domains at Layer 2, a PC in VLAN 10 cannot talk to a server in VLAN 20, even if they are plugged into the exact same switch. A Layer 3 device (a router or multilayer switch) is absolutely required to route packets between these isolated networks.

Router-on-a-Stick (ROAS)

Uses a single physical router interface divided into multiple logical 'subinterfaces' to act as the default gateway for multiple VLANs. Traffic is sent over a single 802.1Q trunk link. Cost-effective for small offices, but creates a bandwidth bottleneck.

Layer 3 Switching (SVIs)

The modern enterprise standard. Uses a Multilayer Switch to route traffic internally using Switch Virtual Interfaces (SVIs). This is significantly faster than ROAS because routing occurs directly in the switch hardware (ASICs) rather than a software CPU.

IOS Command Reference

ROAS: Router Subinterfaces

! First, bring up the physical interface (Do NOT assign an IP here)

R1(config)# interface g0/0

R1(config-if)# no shutdown

R1(config-if)# exit

! Create the logical subinterface for VLAN 10

R1(config)# interface g0/0.10

! You MUST define the 802.1Q encapsulation before assigning an IP

R1(config-subif)# encapsulation dot1Q 10

R1(config-subif)# ip address 10.0.10.1 255.255.255.0

ROAS: Switch Trunk Configuration

! The switch port connected to the router MUST be a trunk

! Otherwise, the tagged subinterface frames will be dropped

SW1(config)# interface g0/1

SW1(config-if)# switchport mode trunk

Layer 3 Switching: SVI Configuration

! CRITICAL: You must enable global routing on a Layer 3 switch

L3SW(config)# ip routing

! Create the Switch Virtual Interface (SVI) for the VLAN

L3SW(config)# interface vlan 10

! Assign the Default Gateway IP for devices in this VLAN

L3SW(config-if)# ip address 10.0.10.1 255.255.255.0

L3SW(config-if)# no shutdown

CCNA Exam Gotchas

The 'IP Routing' Trap

In CCNA simulator labs (like Packet Tracer), if you configure SVIs perfectly on a Multilayer Switch but PCs still cannot ping across VLANs, you almost certainly forgot to type 'ip routing' in global configuration mode. Multilayer switches act as Layer 2 switches by default until this is enabled.

ROAS Encapsulation Order

When configuring a subinterface for ROAS, the router will reject your 'ip address' command if you have not defined the encapsulation first. You must tell it 'encapsulation dot1Q [vlan_id]' before assigning the IP.

Native VLAN Configuration

If you want the router to handle the Native VLAN in a ROAS setup, use the command 'encapsulation dot1Q [vlan_id] native' on that specific subinterface. Otherwise, untagged traffic will be dropped at the router.