LogoENEnglish

Inter-VLAN Routing: Connecting VLANs with Router-on-a-Stick and SVIs

VLANs isolate broadcast domains from each other at Layer 2, but real applications still need devices in different VLANs to communicate, which requires routing between them at Layer 3. This article explains the legacy router-on-a-stick approach using subinterfaces, the modern and more scalable Switch Virtual Interface approach on Layer 3 switches, and the essential configuration and verification commands for both.

Inter-VLAN RoutingRouter on a StickSwitch Virtual Interface

~5 دقیقه مطالعه · آخرین به‌روزرسانی ۱۸ شهریور ۱۴۰۵

Why VLANs Need Help Communicating

VLANs, discussed earlier in this series, deliberately isolate broadcast domains from one another at Layer 2 — a device in VLAN 10 cannot exchange frames directly with a device in VLAN 20 through switching alone. But real applications frequently need exactly this kind of cross-VLAN communication, such as a user's PC in one VLAN needing to reach a file server in another. This requires a Layer 3 device to route traffic between the VLANs, a process called Inter-VLAN Routing.

Approach One: Router-on-a-Stick

The original approach to inter-VLAN routing connects a single router interface to a switch trunk link, discussed earlier in this series, and divides that one physical interface into multiple logical Subinterfaces, one per VLAN.

Router(config)# interface gigabitethernet 0/0
Router(config-if)# no shutdown
Router(config-if)# exit

Router(config)# interface gigabitethernet 0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config-subif)# exit

Router(config)# interface gigabitethernet 0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0

Each subinterface acts as if it were a separate physical interface for routing purposes, with encapsulation dot1Q 10 telling the router to expect and process 802.1Q-tagged frames, discussed earlier in this series, specifically for VLAN 10 on that logical subinterface, while VLAN 20's traffic is handled identically on its own subinterface.

-- Corresponding switch-side trunk configuration
Switch(config)# interface gigabitethernet 1/0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20

The name "router-on-a-stick" describes this topology visually: a single physical link (the "stick") connects the router to the switch, carrying all inter-VLAN traffic through that one connection.

The Bandwidth Limitation of Router-on-a-Stick

Every packet routed between VLANs must physically traverse the single trunk link twice — once entering the router from the source VLAN, once leaving toward the destination VLAN — since a router's subinterfaces do not have any direct connection to each other except through that shared physical link.

Traffic flow example:
PC in VLAN 10 → Switch → Trunk link → Router
Router routes the packet → Trunk link (again) → Switch → PC in VLAN 20

This means all inter-VLAN traffic is constrained
by the bandwidth of that single physical link,
becoming a bottleneck in networks with significant
inter-VLAN traffic volume

Approach Two: Switch Virtual Interfaces on a Layer 3 Switch

Modern networks typically solve this bottleneck using a Layer 3 Switch, a switch capable of performing IP routing internally using dedicated hardware, combined with Switch Virtual Interfaces (SVIs) — logical Layer 3 interfaces representing each VLAN directly on the switch itself, eliminating the need for an external router entirely.

Switch(config)# ip routing
-- this single command enables Layer 3 routing
-- capability on a switch that supports it

Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown

Switch(config)# interface vlan 20
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown

With SVIs configured and ip routing enabled, the switch routes traffic between VLANs entirely internally, at hardware-accelerated speed, without needing to send traffic out to an external device and back — eliminating the bottleneck that router-on-a-stick suffers from.

Comparing the Two Approaches

Router-on-a-Stick:
  - Uses a separate physical router
  - Bandwidth limited by the single trunk link
  - Simpler and cheaper for small networks with
    a router already present but no Layer 3 switch
  - Common in lab, home lab, and small-branch scenarios

Layer 3 Switch with SVIs:
  - Routing happens internally in switch hardware
  - No trunk-link bottleneck for inter-VLAN traffic
  - Requires a Layer 3-capable switch (more expensive)
  - Standard approach in enterprise campus networks

Virtually all modern enterprise network designs use Layer 3 switches with SVIs at the distribution or core layer specifically to avoid the router-on-a-stick bottleneck, reserving router-on-a-stick for smaller deployments, lab environments, or scenarios where a Layer 3 switch is genuinely unavailable.

Verifying Inter-VLAN Routing

Switch# show ip interface brief

Interface       IP-Address       Status    Protocol
Vlan10          192.168.10.1     up        up
Vlan20          192.168.20.1     up        up

Switch# show ip route
C    192.168.10.0/24 is directly connected, Vlan10
C    192.168.20.0/24 is directly connected, Vlan20

Once SVIs are configured with no shutdown and at least one active port exists in each corresponding VLAN, the routing table, discussed earlier in this series, automatically populates with a directly connected route for each VLAN's subnet, and the switch begins routing between them without any additional configuration.

A Common Troubleshooting Pitfall

An SVI remains administratively and operationally down if no active (up) physical port currently belongs to that VLAN — an SVI cannot come up for a VLAN that has no live member ports, even if it has been correctly configured with no shutdown and a valid IP address.

Switch# show interfaces vlan 30
Vlan30 is down, line protocol is down

-- Common cause: no port is currently in VLAN 30,
-- or every port assigned to VLAN 30 is
-- administratively shut down or physically disconnected

Why Inter-VLAN Routing Completes the Layer 2/Layer 3 Picture

Inter-VLAN routing is the essential bridge connecting the Layer 2 segmentation discussed earlier in this series with the Layer 3 routing concepts introduced even earlier — without it, VLANs would provide isolation but no controlled way for legitimately related devices to communicate. Understanding both configuration approaches, and knowing when each is the right architectural choice, is fundamental to designing any enterprise network with more than a single VLAN.

نوشته و پژوهش‌شده توسط دکتر شاهین صیامی

مقالات مرتبط

Systematic Network Troubleshooting: A Methodology Tying Everything Together

Every protocol and technology covered throughout this series is only useful if a problem involving it can actually be diagnosed and fixed efficiently under real-world pressure. This article presents a systematic troubleshooting methodology built around the OSI layers, walks through applying it to a realistic connectivity problem, and shows how the specific verification commands covered throughout this entire series fit into a structured diagnostic process.

ادامه

NETCONF, YANG, and Python: Programmatic Network Configuration at Scale

The REST APIs and JSON/YAML formats covered earlier in this series represent one approach to network automation, but NETCONF and YANG provide a more structured, standards-based alternative purpose-built for network device configuration. This article explains what distinguishes NETCONF from a simple REST API, covers how YANG models define exactly what configuration data looks like, and walks through using Python to programmatically interact with network devices.

ادامه

IPsec VPN Fundamentals: Securing Traffic Across Untrusted Networks

Connecting two sites across the public internet exposes traffic to interception unless it is properly encrypted, and IPsec provides the standard framework for building secure, authenticated tunnels between sites. This article explains the two-phase IKE negotiation process, covers the distinction between AH and ESP protocols, walks through configuring a basic site-to-site IPsec VPN, and covers essential verification commands.

ادامه

MPLS Fundamentals: Label Switching Explained

Traditional IP routing requires every router along a path to perform a full routing table lookup on every packet, but MPLS takes a fundamentally different approach by making that forwarding decision once and attaching a simple label that every subsequent router can use instead. This article explains the core label-switching concept, walks through how the Label Distribution Protocol builds the label forwarding tables that make this possible, and covers the practical benefits MPLS provides in real provider networks.

ادامه

BGP Route Reflectors and Confederations: Scaling iBGP Beyond Full Mesh

The iBGP full-mesh requirement, briefly mentioned earlier in this series, becomes a serious scaling problem as an autonomous system grows, requiring a number of sessions that increases quadratically with router count. This article explains exactly why full mesh does not scale, walks through how route reflectors solve this by relaxing BGP's normal route-propagation rules, and covers confederations as an alternative approach that divides a single AS into smaller sub-autonomous systems.

ادامه

OSPF Area Types Deep Dive: Stub, Totally Stubby, and NSSA

Multi-area OSPF, covered earlier in this series, already reduces database size by separating a network into areas, but OSPF offers further specialized area types that reduce routing table size even more aggressively by filtering out unnecessary external routes entirely. This article explains the LSA types that must be suppressed to create each specialized area type, walks through configuring stub, totally stubby, and not-so-stubby areas, and covers the specific trade-offs each design choice involves.

ادامه
مقاله‌ی قبلیمقاله‌ی بعدی