LogoفارسیFA

Inter-VLAN Routing: Connecting VLANs with Router-on-a-Stick and SVIs

VLANs isolate broadcast domains from each other at Layer 2, but real applications still need devices in different VLANs to communicate, which requires routing between them at Layer 3. This article explains the legacy router-on-a-stick approach using subinterfaces, the modern and more scalable Switch Virtual Interface approach on Layer 3 switches, and the essential configuration and verification commands for both.

Inter-VLAN RoutingRouter on a StickSwitch Virtual Interface

~5 min read · Updated Sep 9, 2026

Why VLANs Need Help Communicating

VLANs, discussed earlier in this series, deliberately isolate broadcast domains from one another at Layer 2 — a device in VLAN 10 cannot exchange frames directly with a device in VLAN 20 through switching alone. But real applications frequently need exactly this kind of cross-VLAN communication, such as a user's PC in one VLAN needing to reach a file server in another. This requires a Layer 3 device to route traffic between the VLANs, a process called Inter-VLAN Routing.

Approach One: Router-on-a-Stick

The original approach to inter-VLAN routing connects a single router interface to a switch trunk link, discussed earlier in this series, and divides that one physical interface into multiple logical Subinterfaces, one per VLAN.

Router(config)# interface gigabitethernet 0/0
Router(config-if)# no shutdown
Router(config-if)# exit

Router(config)# interface gigabitethernet 0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config-subif)# exit

Router(config)# interface gigabitethernet 0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0

Each subinterface acts as if it were a separate physical interface for routing purposes, with encapsulation dot1Q 10 telling the router to expect and process 802.1Q-tagged frames, discussed earlier in this series, specifically for VLAN 10 on that logical subinterface, while VLAN 20's traffic is handled identically on its own subinterface.

-- Corresponding switch-side trunk configuration
Switch(config)# interface gigabitethernet 1/0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20

The name "router-on-a-stick" describes this topology visually: a single physical link (the "stick") connects the router to the switch, carrying all inter-VLAN traffic through that one connection.

The Bandwidth Limitation of Router-on-a-Stick

Every packet routed between VLANs must physically traverse the single trunk link twice — once entering the router from the source VLAN, once leaving toward the destination VLAN — since a router's subinterfaces do not have any direct connection to each other except through that shared physical link.

Traffic flow example:
PC in VLAN 10 → Switch → Trunk link → Router
Router routes the packet → Trunk link (again) → Switch → PC in VLAN 20

This means all inter-VLAN traffic is constrained
by the bandwidth of that single physical link,
becoming a bottleneck in networks with significant
inter-VLAN traffic volume

Approach Two: Switch Virtual Interfaces on a Layer 3 Switch

Modern networks typically solve this bottleneck using a Layer 3 Switch, a switch capable of performing IP routing internally using dedicated hardware, combined with Switch Virtual Interfaces (SVIs) — logical Layer 3 interfaces representing each VLAN directly on the switch itself, eliminating the need for an external router entirely.

Switch(config)# ip routing
-- this single command enables Layer 3 routing
-- capability on a switch that supports it

Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown

Switch(config)# interface vlan 20
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown

With SVIs configured and ip routing enabled, the switch routes traffic between VLANs entirely internally, at hardware-accelerated speed, without needing to send traffic out to an external device and back — eliminating the bottleneck that router-on-a-stick suffers from.

Comparing the Two Approaches

Router-on-a-Stick:
  - Uses a separate physical router
  - Bandwidth limited by the single trunk link
  - Simpler and cheaper for small networks with
    a router already present but no Layer 3 switch
  - Common in lab, home lab, and small-branch scenarios

Layer 3 Switch with SVIs:
  - Routing happens internally in switch hardware
  - No trunk-link bottleneck for inter-VLAN traffic
  - Requires a Layer 3-capable switch (more expensive)
  - Standard approach in enterprise campus networks

Virtually all modern enterprise network designs use Layer 3 switches with SVIs at the distribution or core layer specifically to avoid the router-on-a-stick bottleneck, reserving router-on-a-stick for smaller deployments, lab environments, or scenarios where a Layer 3 switch is genuinely unavailable.

Verifying Inter-VLAN Routing

Switch# show ip interface brief

Interface       IP-Address       Status    Protocol
Vlan10          192.168.10.1     up        up
Vlan20          192.168.20.1     up        up

Switch# show ip route
C    192.168.10.0/24 is directly connected, Vlan10
C    192.168.20.0/24 is directly connected, Vlan20

Once SVIs are configured with no shutdown and at least one active port exists in each corresponding VLAN, the routing table, discussed earlier in this series, automatically populates with a directly connected route for each VLAN's subnet, and the switch begins routing between them without any additional configuration.

A Common Troubleshooting Pitfall

An SVI remains administratively and operationally down if no active (up) physical port currently belongs to that VLAN — an SVI cannot come up for a VLAN that has no live member ports, even if it has been correctly configured with no shutdown and a valid IP address.

Switch# show interfaces vlan 30
Vlan30 is down, line protocol is down

-- Common cause: no port is currently in VLAN 30,
-- or every port assigned to VLAN 30 is
-- administratively shut down or physically disconnected

Why Inter-VLAN Routing Completes the Layer 2/Layer 3 Picture

Inter-VLAN routing is the essential bridge connecting the Layer 2 segmentation discussed earlier in this series with the Layer 3 routing concepts introduced even earlier — without it, VLANs would provide isolation but no controlled way for legitimately related devices to communicate. Understanding both configuration approaches, and knowing when each is the right architectural choice, is fundamental to designing any enterprise network with more than a single VLAN.

Written & researched by Dr. Shahin Siami

Related Articles

OSPF Fundamentals: Link-State Routing Explained

OSPF is the most widely deployed interior routing protocol in enterprise networks, using a fundamentally different approach than simply exchanging routing tables between neighbors. This article explains what a link-state protocol actually is, how OSPF routers become neighbors and build a shared topology database, how the cost metric determines the best path, and the essential commands for configuring and verifying single-area OSPF.

Continue

Network Address Translation: Sharing Public IP Addresses

The limited supply of public IPv4 addresses made it impossible for every device worldwide to have its own globally unique address, and Network Address Translation solved this by letting many private devices share a small number of public addresses. This article explains the three main NAT types, walks through configuring static NAT, dynamic NAT, and PAT on a Cisco router, and covers the essential commands for verifying active translations.

Continue

Access Control Lists: Filtering Traffic on Cisco Routers

Access Control Lists let a router or switch selectively permit or deny traffic based on source, destination, and protocol information, forming the foundation of basic network security and traffic filtering. This article explains how ACLs process traffic sequentially, covers the difference between standard and extended ACLs, walks through wildcard mask calculation, and explains critical placement rules that determine whether an ACL works as intended.

Continue

DHCP and DNS: Automatic Addressing and Name Resolution

Manually configuring an IP address on every device does not scale, and remembering numeric IP addresses for every service is impractical, which is why DHCP and DNS exist as essential supporting services in nearly every network. This article explains how DHCP automatically assigns IP addressing information, covers configuring a Cisco device as a DHCP server or relay agent, and explains how DNS resolves human-readable names into IP addresses.

Continue

EtherChannel: Combining Multiple Links Into One Logical Connection

Instead of choosing between redundancy and bandwidth, EtherChannel combines multiple physical links into a single logical connection that provides both simultaneously, without Spanning Tree blocking any of the links. This article explains how EtherChannel bundles ports together, compares the PAgP and LACP negotiation protocols used to form a bundle safely, and covers the essential configuration and verification commands.

Continue

Spanning Tree Protocol: Preventing Loops in Switched Networks

Redundant physical links between switches provide fault tolerance but create Layer 2 loops that can bring down an entire network within seconds. This article explains why loops are catastrophic in switched networks, how Spanning Tree Protocol elects a root bridge and blocks redundant paths to prevent them, and the essential commands for verifying STP operation on a Cisco switch.

Continue
Previous ArticleNext Article