# Inter-VLAN routing

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/inter-vlan-routing

## Quick definition

Inter-VLAN routing allows devices on different VLANs to talk to each other. VLANs split a network into separate sections, so a computer on one VLAN cannot automatically reach a computer on another VLAN. Inter-VLAN routing uses a router or a Layer 3 switch to bridge these separated networks, just like how a post office forwards mail between different neighborhoods.

## Simple meaning

Think of a large office building with several departments: Sales, Engineering, and HR. Each department occupies its own floor and has its own internal phone system. People on the Sales floor can call each other easily, but they cannot call someone on the Engineering floor unless they use a special operator who connects the two floor phone systems. This operator is like Inter-VLAN routing. 

 In computer networking, a VLAN (Virtual Local Area Network) is like one of those department floors. It groups devices together logically, even if they are physically spread across different locations. Devices on the same VLAN can communicate directly because they share the same broadcast domain. But devices on different VLANs have their traffic isolated from one another. This isolation is useful for security and traffic management, but sometimes you need devices in different VLANs to exchange data-for example, a printer in the Engineering VLAN needs to be accessible from a Sales computer. 

 Inter-VLAN routing solves this by enabling a router or a Layer 3 switch to forward traffic between VLANs. The router acts like a mail sorting center that reads the destination address (IP address) on each packet and decides which VLAN it belongs to. It then sends the packet to the correct VLAN, just as a postal worker sorts letters by zip code. 

 Without Inter-VLAN routing, each VLAN would be a completely separate network with no connection to the others, which would break most modern applications that require cross-department communication. This technology is fundamental for building scalable, secure, and functional enterprise networks. It balances the need for traffic isolation with the need for controlled inter-department communication.

## Technical definition

Inter-VLAN routing refers to the process by which a Layer 3 network device (such as a router or a multilayer switch) forwards IP packets from one VLAN to another. VLANs operate at Layer 2 of the OSI model, creating separate broadcast domains by tagging Ethernet frames with VLAN identifiers (802.1Q tags). By default, devices in different VLANs cannot communicate because they are isolated at Layer 2-they do not share a common broadcast domain. 

 To enable communication between VLANs, a Layer 3 interface must exist that is configured to route traffic among the VLANs. There are three primary methods of implementing Inter-VLAN routing: legacy router-on-a-stick, multilayer switching (SVI-based routing), and routed interfaces on Layer 3 switches. 

 In the router-on-a-stick model, a single physical router port is configured as a trunk port connecting to a switch. Multiple subinterfaces are created on that port, each tied to a specific VLAN. The router receives tagged frames from the switch, strips the VLAN tag, performs a Layer 3 routing decision based on the destination IP address, and then re-encapsulates the packet with a new VLAN tag for the destination VLAN. This method is simple but can become a bottleneck because all traffic between VLANs must pass through a single link and router interface. 

 More commonly in modern networks, Inter-VLAN routing is achieved using a multilayer switch (also called a Layer 3 switch). The switch has both Layer 2 and Layer 3 capabilities. An administrator creates a Switched Virtual Interface (SVI) for each VLAN-essentially a virtual interface that represents the VLAN itself. The switch assigns an IP address to each SVI, and the switch performs routing between the SVIs internally using its hardware ASICs. This method is extremely fast because the routing lookup and packet forwarding happen in hardware, without needing to send traffic out to an external router. 

 Another approach is to use routed ports on a Layer 3 switch, where specific switch ports are configured as Layer 3 interfaces (no switchport mode). Each port is assigned an IP address and treated like a router interface. This is useful for connecting to other routers or to server farms, but it consumes more physical ports than an SVI-based approach. 

 The underlying protocol for forwarding packets between VLANs is standard IP routing. VLANs are mapped to IP subnets-each VLAN corresponds to a unique IP subnet. For example, VLAN 10 might be 192.168.10.0/24, VLAN 20 might be 192.168.20.0/24. When a device in VLAN 10 sends a packet to a device in VLAN 20, the packet is forwarded to the default gateway (the IP address of the SVI for VLAN 10). The router/switch then checks its routing table, finds the destination network corresponding to VLAN 20, and forwards the packet out through the SVI for VLAN 20. 

 Key standards involved include IEEE 802.1Q for VLAN tagging, ARP for address resolution, and common routing protocols like static routes, OSPF, or EIGRP if dynamic routing is used. In exam scenarios, particularly for CCNA and Network+, candidates must understand how to configure SVIs, set up router-on-a-stick with subinterfaces, and verify connectivity using commands such as "show vlan", "show ip route", and "show interfaces trunk". Inter-VLAN routing is also critical for implementing security policies, as Access Control Lists (ACLs) can be applied to SVIs or subinterfaces to filter traffic between VLANs. 

 Troubleshooting Inter-VLAN routing involves checking that the trunk ports are properly configured, that the VLANs exist and are active, that the SVI or subinterface has the correct IP address, and that the routing table contains the necessary routes. A common issue is that native VLAN mismatch on a trunk causes traffic to be misdirected or dropped. Also, if the SVI is down (VLAN inactive), the gateway becomes unreachable for that VLAN. 

Inter-VLAN routing is a fundamental networking concept that bridges the gap between Layer 2 segmentation and Layer 3 connectivity. It enables efficient traffic management, improves security by isolating sensitive areas, and ensures that networks can scale without becoming flat broadcast domains.

## Real-life example

Imagine a large hotel with three separate towers: the Main Tower for guests, the Service Tower for staff, and the Conference Tower for events. Each tower has its own internal phone system, and phones within the same tower can call each other directly without any help. However, if a guest in the Main Tower wants to call the front desk in the Service Tower to request extra towels, the call cannot go directly because the two phone systems are separate. 

 To solve this, the hotel installs a central telephone operator switchboard. When the guest dials the front desk number, the call is first sent to the switchboard. The switchboard recognizes that the call is destined for the Service Tower, so it forwards the call to the correct line. The switchboard also makes sure that staff in the Service Tower can call guests back by routing the return call. The switchboard is handling inter-tower routing, just as a router handles inter-VLAN routing in a computer network. 

 In this analogy, each hotel tower represents a VLAN. The internal phones represent devices on that VLAN. The phone numbers are like IP addresses-each tower has its own numbering plan (like 10.x.x.x, 20.x.x.x). The switchboard is the router or Layer 3 switch that knows the phone numbers for each tower and forwards calls appropriately. The trunk lines connecting the towers to the switchboard are like trunk ports carrying multiple VLAN tags. 

 If the switchboard becomes overloaded or fails, calls between towers stop working completely-similar to a router failure breaking inter-VLAN communication. The hotel might also implement rules at the switchboard: for example, allowing guest calls to housekeeping but blocking outgoing international calls from the service phones. This is analogous to ACLs applied to SVIs for security. 

 The hotel scenario shows why Inter-VLAN routing is essential: it keeps different departments logically separate (for security and noise reduction) while still allowing essential communication. Without the switchboard, each tower would be an island, and hotel operations would grind to a halt. Similarly, in a business network, departments like Finance R&D need isolation but must still share resources like printers, email servers, and databases-Inter-VLAN routing makes this possible. 

 The mapping is direct: VLAN = department tower, router = telephone switchboard, IP subnet = area code, trunk port = multi-line cable, ACL = call filtering policy. This analogy helps learners grasp why Inter-VLAN routing is not just a technical requirement but a practical necessity for any medium-to-large network.

## Why it matters

Inter-VLAN routing matters because it is the mechanism that allows scalable, secure, and efficient network design. In any organization with more than a handful of devices, network administrators need to segment traffic into VLANs for reasons such as security, performance, and manageability. But VLANs create isolated islands of communication. Without Inter-VLAN routing, users in different departments would not be able to access shared services like email servers, databases, printers, or the internet. 

 In practice, Inter-VLAN routing enables you to enforce policies between segments. For example, you might want the HR VLAN to access the payroll server but block the Guest VLAN from reaching internal resources. This is achieved by applying ACLs on the SVI or router interface that performs the routing. Inter-VLAN routing allows you to manage broadcast traffic: each VLAN contains its own broadcast domain, so a broadcast storm in one VLAN does not affect others. This isolation is critical for network stability. 

 For IT professionals, understanding Inter-VLAN routing is essential for network design, troubleshooting, and certification exams. Configuring a router-on-a-stick or a Layer 3 switch is a common task in entry-level network roles. Misconfigurations, such as forgetting to activate the VLAN or setting the wrong default gateway, are frequent causes of connectivity issues. Knowing how to set up and verify Inter-VLAN routing will directly improve your ability to design resilient networks. 

 From a career perspective, this knowledge is highly transferable. Cloud platforms like AWS and Azure use virtual networks and subnets that conceptually behave like VLANs, and routing between those subnets is analogous to Inter-VLAN routing. Therefore, grasping this concept helps not only in on-premise networking but also in cloud networking and hybrid environments. 

 Ultimately, Inter-VLAN routing is not just a technical curiosity-it is the backbone of modern network segmentation. It balances the trade-off between security isolation and necessary connectivity, making it a cornerstone of every network engineer's skill set.

## Why it matters in exams

Inter-VLAN routing is a heavily tested topic across multiple certification exams, especially the Cisco Certified Network Associate (CCNA) and CompTIA Network+. In CCNA, it is a core objective under the "Network Access" and "IP Connectivity" domains. Candidates must configure and verify Legacy Inter-VLAN routing, Router-on-a-Stick, and Multilayer switching (SVI). You can expect simulation questions where you are given a topology and asked to configure trunk ports, create SVIs, assign IP addresses, and verify end-to-end connectivity using ping and traceroute. Troubleshooting scenarios are also common, such as when ping between two VLANs fails and you must identify misconfigured trunk allowed VLAN lists, native VLAN mismatches, or missing VLAN database entries. 

 In CompTIA Network+, Inter-VLAN routing appears under the domain of network implementation and troubleshooting. The exam focuses on understanding the concept, the role of a router or Layer 3 switch, and common configuration issues. You may be asked to interpret a network diagram and determine why two hosts cannot communicate, knowing they are on different VLANs. The exam also tests your knowledge of trunking (802.1Q) and the difference between router-on-a-stick and using a Layer 3 switch. 

 For CompTIA Security+, Inter-VLAN routing is relevant in the context of network segmentation and security. You might be asked how to isolate sensitive systems using VLANs and still allow controlled access-this ties into the Security+ domain of secure network architecture. The exam may present a scenario where VLAN hopping is a risk and ask how to mitigate it, which involves proper configuration of trunk ports and disabling DTP. 

 In Microsoft Azure (AZ-104), you won't directly configure VLANs, but the concept of virtual network peering and subnets is analogous. Understanding Inter-VLAN routing helps you grasp how Azure routes traffic between subnets and how Network Security Groups (NSGs) act as ACLs. Similarly, for AWS Solutions Architect (SAA) and Google ACE, routing between VPC subnets is a fundamental concept that maps directly to Inter-VLAN routing. 

 Question types can be multiple-choice ("What is required for devices on different VLANs to communicate?") or performance-based ("Configure router-on-a-stick given these IP subnets"). You may also see drag-and-drop ordering steps for configuration. The key exam traps include forgetting that the VLAN must exist and be active, misconfiguring the native VLAN on a trunk, and assuming that a Layer 2 switch alone can route between VLANs (it cannot). 

 For the most part, the CCNA exam provides the deepest coverage of Inter-VLAN routing. However, Network+ also expects you to know the theory and common issues. Therefore, as a learner, you should be comfortable with both the configuration syntax and the conceptual understanding, as you will be tested on both across different exams.

## How it appears in exam questions

Inter-VLAN routing appears in exam questions in several distinct patterns. The most common is the scenario-based question: "A company has two VLANs, VLAN 10 (Sales) and VLAN 20 (Engineering). Users in VLAN 10 cannot ping the server in VLAN 20. The switch is a Layer 2 switch connected to a router. What is the most likely cause?" The answer options might involve incorrect default gateway, missing VLAN on the trunk, or wrong subnet mask. 

 Another pattern is the configuration question. For example: "Given a router with one interface connected to a switch trunk, configure router-on-a-stick to support VLAN 10 (192.168.10.1/24) and VLAN 20 (192.168.20.1/24)." You would need to know the subinterface commands: interface g0/0.10, encapsulation dot1Q 10, ip address 192.168.10.1 255.255.255.0. Then repeat for VLAN 20. 

 Troubleshooting questions often present show command output. For instance: "Given the output of show interfaces trunk, you see that VLAN 20 is not in the allowed VLAN list on one side of the trunk. What is the impact?" The correct answer is that devices in VLAN 20 cannot communicate across the trunk, so Inter-VLAN routing would be broken for that VLAN. 

 Another variant involves Layer 3 switching: "A network administrator configures SVIs on a multilayer switch. Hosts in VLAN 10 can ping the SVI interface, but cannot ping hosts in VLAN 20. The SVI for VLAN 20 is up/up. What could be the problem?" Possible answers include no ip routing enabled, ACL blocking traffic, or SVI for VLAN 20 not having an IP address in the correct subnet. 

 You may also see drag-and-drop ordering: "Order the steps to configure Inter-VLAN routing on a multilayer switch: create VLANs, assign switch ports to VLANs, enable IP routing, create SVI, assign IP address to SVI, bring SVI up." 

some questions test conceptual understanding: "Which device is required to route traffic between VLANs?" The distractors might include a hub, a bridge, a Layer 2 switch, and a router. The correct answer is a router (or a Layer 3 switch, but that is a router-like device). Multiple-choice questions may also ask about the number of broadcast domains before and after Inter-VLAN routing-the number remains the same because VLANs still isolate broadcast domains, but routing allows unicast traffic across them.

## Example scenario

You work for a small company that has two departments: Sales and Research. The company has one switch that is Layer 2 only and one router. The network administrator has already created VLAN 10 for Sales and VLAN 20 for Research. Four computers are in Sales and four in Research. All computers are connected to the switch. The switch port connected to the router is configured as a trunk carrying both VLANs. 

 You are asked to configure Inter-VLAN routing so that the Sales team can communicate with the Research team. On the router, you need to configure a subinterface for each VLAN on the single physical interface that connects to the switch. You create interface GigabitEthernet0/0.10 with encapsulation dot1Q 10 and IP address 192.168.10.1/24. Then you create interface GigabitEthernet0/0.20 with encapsulation dot1Q 20 and IP address 192.168.20.1/24. The router now acts as the default gateway for both VLANs. 

 You then go to a computer in Sales with IP 192.168.10.101 and set its default gateway to 192.168.10.1. On a Research computer with IP 192.168.20.101, you set its default gateway to 192.168.20.1. You open a command prompt on the Sales computer and type ping 192.168.20.101. The ping succeeds. This confirms Inter-VLAN routing is working. 

 However, the next day, users report that they cannot ping across VLANs anymore. You check the trunk and see that the switch port is no longer trunking-someone accidentally set it to access mode. You reconfigure the port as a trunk, and connectivity is restored. This simple scenario illustrates both configuration and troubleshooting of Inter-VLAN routing, exactly the type of scenario you might encounter in a CCNA or Network+ exam.

## Fundamentals of Inter-VLAN Routing

Inter-VLAN routing is the process of forwarding traffic between different VLANs. VLANs logically segment a switched network into isolated broadcast domains, but devices in separate VLANs cannot communicate without a Layer 3 device. Inter-VLAN routing provides the necessary routing functionality to allow hosts in VLAN 10 to reach hosts in VLAN 20. This is a core concept for the CCNA, Network+, and other networking exams because it bridges switching and routing.

The traditional method uses a router with multiple physical interfaces, each connected to a different VLAN switch port. For example, a router interface connecting to an access port in VLAN 10 is assigned an IP address in VLAN 10's subnet. This method works but scales poorly because each VLAN requires a separate router interface and switch port. Router-on-a-stick (ROAS) improves this by using a single router interface trunked to a switch, with subinterfaces each mapped to a specific VLAN. The router's physical interface is in trunking mode, and each subinterface is configured with an encapsulation dot1q VLAN ID command. ROAS is common in small-to-medium networks and is heavily tested on the CCNA exam.

Modern networks use multilayer switches that integrate routing and switching. A multilayer switch can route between VLANs using switched virtual interfaces (SVIs). An SVI is a virtual Layer 3 interface created for a specific VLAN. The switch has an IP address in each VLAN's subnet, and traffic between VLANs is routed internally at wire speed. This method is more efficient than ROAS and is the standard in enterprise networks. Understanding the differences between these three approaches is vital for the CCNA and Network+. The AWS SAA exam does not test this directly, but the concept of segmentation and routing between segments appears in VPC routing and subnet design.

The key takeaway is that inter-VLAN routing requires a Layer 3 device and a routing table. The device must have an interface in each VLAN (real or virtual) and must know the path to the destination subnet. VLANs are Layer 2 concepts, while routing is Layer 3. Inter-VLAN routing is the intersection of these two layers. For exam purposes, remember that hosts use their default gateway (the router or SVI address) to reach other subnets. The default gateway must be in the same VLAN and subnet as the host. Also remember that trunk ports carry multiple VLANs, while access ports carry a single VLAN. Misconfiguration of trunking, encapsulation, or IP addresses causes inter-VLAN routing failures.

## Cost and Performance Considerations in Inter-VLAN Routing

The cost of implementing inter-VLAN routing varies significantly based on the method chosen. The traditional router-on-a-stick method is inexpensive in terms of hardware because it uses an existing router and a single physical port, but it introduces a performance bottleneck. All traffic between VLANs must pass through the single router interface, which has limited bandwidth (typically 1 Gbps) and adds latency due to the routing process. In a network with heavy inter-VLAN traffic, this can lead to congestion and packet loss. The cost here is not just monetary but also performance. Exams like the CCNA and Network+ test your ability to identify when ROAS is insufficient and when a multilayer switch is needed.

Multilayer switches are more expensive upfront but provide wire-speed routing between VLANs. The switch's hardware ASICs can route packets at the same speed as Layer 2 switching, often 10 Gbps or higher. The cost per port is lower than adding multiple router interfaces, and the performance is superior. For example, a Cisco Catalyst 3650 with IP Services license can route between hundreds of VLANs without performance degradation. The trade-off is that multilayer switches require advanced configuration and licensing, which adds to the total cost of ownership.

Another cost factor is the operational overhead. ROAS requires careful VLAN mapping on subinterfaces and trunk configuration. If you have a large number of VLANs, the router's CPU must process each packet, and the subinterface configuration becomes complex. Multilayer switches simplify management by using SVIs defined per VLAN, but they require a deeper understanding of routing protocols, VLAN interfaces, and switch virtual interfaces. The security-plus exam may reference segmentation costs in terms of security policy complexity.

For cloud environments like AWS and Azure, inter-VLAN routing is translated into VPC routing. There is no physical hardware cost, but there are data transfer costs between subnets and availability zones. Understanding these cost trade-offs helps architects design efficient networks. The AZ-104 exam tests VNet peering and routing, which is analogous to inter-VLAN routing in on-premises networks. The key is to match the method to the scale of traffic. Small networks can tolerate ROAS; medium to large networks should use multilayer switching or Layer 3 routing in the cloud.

## Routing States and Protocols for Inter-VLAN Routing

Inter-VLAN routing relies on the router or multilayer switch maintaining routing information. The routing table can be populated with directly connected networks (SVI subnets), static routes, or dynamic routing protocols like OSPF or EIGRP. For the CCNA exam, you must understand the routing states such as 'directly connected', 'static', and 'dynamic'. When an SVI is created and assigned an IP address, the router immediately adds the subnet to its routing table as a directly connected route. This route is preferred over static or dynamic routes because of its administrative distance (0).

For dynamic routing, protocols exchange routing information with neighboring routers. For example, OSPF can be configured on SVIs to advertise VLAN subnets to other Layer 3 devices. The routing protocol must be running on the SVI interface, and the interface must be in an 'up/up' state. If the SVI is administratively down or the VLAN is inactive, the route is removed. This is a common troubleshooting issue: a missing SVI causes the route to disappear, breaking inter-VLAN connectivity.

The Network+ exam emphasizes the concept of routing tables and how routers decide the best path. In inter-VLAN routing, the router must have an entry for each VLAN subnet. If a VLAN subnet is missing from the routing table, traffic cannot be forwarded. This could happen if the VLAN is removed from the switch or if the SVI is not created. For ROAS, the subinterface must be in 'up/up' state, which depends on both the physical interface being up and the trunk being established. If the subinterface is in a 'down/down' state due to a mismatched VLAN encapsulation, routing fails.

Routing protocols also influence the 'convergence' state. When a link fails, the routing protocol must recalculate paths. For inter-VLAN routing, a failure of an SVI means that VLAN becomes unreachable. Understanding how OSPF neighbor states (Down, Init, 2Way, ExStart, Exchange, Loading, Full) or EIGRP neighbor states affect inter-VLAN routing is tested. The security-plus exam may consider routing states in the context of network segmentation and access control. The key is to recognize that routing states are not just Layer 3 concepts but directly impact VLAN-to-VLAN communication.

## Security Measures in Inter-VLAN Routing

Inter-VLAN routing inherently creates a security risk because it allows traffic between formerly isolated segments. Without proper controls, an attacker in VLAN 10 can initiate connections to VLAN 20, bypassing security boundaries. The security-plus exam emphasizes the need for access control lists (ACLs) and VLAN ACLs (VACLs) to filter inter-VLAN traffic. For example, an ACL applied to the SVI in VLAN 10 can permit only specific traffic (e.g., HTTP to a web server) and deny everything else. This is a critical exam scenario: you have a requirement to allow only specific protocols between VLANs, so you configure an ACL on the router or multilayer switch.

Another security measure is private VLANs (PVLANs) which restrict traffic within a VLAN. For inter-VLAN routing, PVLANs can isolate hosts in the same VLAN from each other while still allowing them to reach a gateway. This adds an extra layer of segmentation. The AZ-104 exam covers network security groups (NSGs) and Azure Firewall, which are analogous to ACLs for cloud inter-subnet routing.

DHCP snooping and dynamic ARP inspection (DAI) can protect against man-in-the-middle attacks on the VLAN network. If an attacker spoofs the default gateway's MAC address, inter-VLAN traffic can be intercepted. DAI validates ARP packets to prevent this. The CCNA exam tests these security features in the context of VLAN security. Also, port security can prevent unauthorized devices from accessing a VLAN, reducing the attack surface for inter-VLAN routing exploits.

802.1X authentication ensures that only authenticated devices can access the VLAN, and subsequently the inter-VLAN routing path. When combined with dynamic VLAN assignment, the network can place users in specific VLANs based on their credentials. This is tested in the security-plus and CCNA exams. Finally, encryption of inter-VLAN traffic using IPsec or MACsec is recommended for sensitive data. MACsec works at Layer 2 and can encrypt traffic between switches, while IPsec encrypts the routed traffic. Understanding when to use each is part of the security-plus domain. The exam clue is always: segmentation requires security controls at the routing point.

## Common mistakes

- **Mistake:** Using a Layer 2 switch without a router to route between VLANs
  - Why it is wrong: A Layer 2 switch operates only at the data link layer and cannot make Layer 3 routing decisions. It can only forward frames within the same broadcast domain, not between different VLANs.
  - Fix: Use a router or a Layer 3 switch. On a Layer 3 switch, you must enable IP routing and configure SVIs for each VLAN.
- **Mistake:** Forgetting to create the VLAN on the switch before assigning ports
  - Why it is wrong: If the VLAN does not exist in the switch's VLAN database, the switch cannot assign ports to it, and traffic will not be correctly forwarded. The SVI will also remain down until the VLAN is created.
  - Fix: First create the VLAN using the 'vlan <number>' command in global configuration mode, then assign switch ports to it.
- **Mistake:** Placing the wrong encapsulation command on a router subinterface
  - Why it is wrong: Each subinterface must be configured with 'encapsulation dot1Q <vlan id>'. Using the wrong VLAN ID will cause the router to tag frames incorrectly, and switches or endpoints will drop them.
  - Fix: Double-check that the encapsulation command matches the VLAN ID for which the subinterface is intended. For example, 'encapsulation dot1Q 10' for VLAN 10.
- **Mistake:** Setting the same IP subnet on two different VLANs
  - Why it is wrong: Each VLAN must be a separate subnet. If two VLANs share the same subnet, the routing table will have duplicate entries, and packets may be misdirected. This violates the fundamental design principle of one subnet per VLAN.
  - Fix: Assign a unique IP subnet to each VLAN, ensuring no overlap. For example, VLAN 10 uses 192.168.10.0/24, VLAN 20 uses 192.168.20.0/24.
- **Mistake:** Not enabling IP routing on a Layer 3 switch
  - Why it is wrong: By default, a Layer 3 switch operates as a Layer 2 device. Without the 'ip routing' command, it will not perform routing between SVIs, even if the SVIs are configured with IP addresses.
  - Fix: Enter global configuration mode and issue the command 'ip routing'. This enables the switch's routing engine.
- **Mistake:** Using a switch port in access mode instead of trunk mode for the router link
  - Why it is wrong: An access port can carry only one VLAN. If the link to the router is an access port, only that single VLAN's traffic will reach the router, breaking communication for other VLANs.
  - Fix: Configure the port connecting to the router as a trunk port using 'switchport mode trunk'. Optionally, specify the allowed VLAN list.
- **Mistake:** Ignoring native VLAN mismatch on trunk
  - Why it is wrong: If the native VLAN is different on the two ends of a trunk, the switch and router will not agree on which VLAN's untagged traffic belongs to. This can cause traffic to be misdirected or dropped.
  - Fix: Ensure both ends of the trunk are configured with the same native VLAN. Typically, it is best to leave the native VLAN as VLAN 1 or change it consistently.

## Exam trap

{"trap":"A question states: 'You have a Layer 2 switch and a router. Host A on VLAN 10 cannot reach Host B on VLAN 20. The router is connected to the switch via a single cable. You verify that both hosts can ping their respective default gateways. What is the issue?' The trap answer is that you need a Layer 3 switch. However, the real issue is often that the switch port connecting to the router is not configured as a trunk.","why_learners_choose_it":"Learners see 'Layer 2 switch' and 'router' and think that a Layer 3 switch is required for Inter-VLAN routing. They forget that router-on-a-stick works perfectly with a Layer 2 switch, as long as the link is a trunk.","how_to_avoid_it":"Remember that a Layer 2 switch plus a router can perform Inter-VLAN routing via router-on-a-stick. Always check the configuration of the link between the switch and router. If the switch port is in access mode or not trunking, traffic from all VLANs except the access VLAN will be dropped."}

## Commonly confused with

- **Inter-VLAN routing vs Routing between subnets:** Routing between subnets is the general process of forwarding packets between different IP networks, often on the same physical network. Inter-VLAN routing is a specific implementation where each VLAN is mapped to a distinct subnet, and the routing is done at the VLAN boundary. However, routing between subnets can occur without VLANs (e.g., two different physical networks connected by a router). (Example: Two separate Ethernet cables connected to two different router interfaces is routing between subnets, but it is not Inter-VLAN routing because there are no VLAN tags.)
- **Inter-VLAN routing vs VLAN trunking:** VLAN trunking is the method of carrying multiple VLANs over a single link using 802.1Q tagging. It is a necessary component for Inter-VLAN routing (to carry traffic between the switch and router), but it is not the routing itself. Trunking is Layer 2, routing is Layer 3. (Example: A trunk port on a switch sends frames from VLAN 10 and VLAN 20 to a router. The router then performs Inter-VLAN routing by deciding to forward a packet from VLAN 10 to VLAN 20.)
- **Inter-VLAN routing vs Switched Virtual Interface (SVI):** An SVI is a virtual Layer 3 interface on a multilayer switch that represents a VLAN. It is a tool used to implement Inter-VLAN routing. The SVI itself is not the routing process, but the interface through which the routing occurs. Similar to a router interface. (Example: You create interface vlan 10 and assign it IP 192.168.10.1. That is an SVI. It allows the switch to route packets sent to that IP to other SVIs or networks.)
- **Inter-VLAN routing vs Port-based VLAN:** A port-based VLAN is a method of assigning a VLAN to a specific switch port. This is how you group devices into VLANs. Inter-VLAN routing then allows those groups to communicate. They are complementary: you first assign ports to VLANs, then you set up routing between those VLANs. (Example: You assign port 1-5 to VLAN 10 and ports 6-10 to VLAN 20 (port-based VLAN). Then you configure Inter-VLAN routing so devices on port 1 can talk to devices on port 6.)
- **Inter-VLAN routing vs Layer 2 switching:** Layer 2 switching forwards frames based on MAC addresses within the same VLAN. It cannot route between VLANs. Inter-VLAN routing requires Layer 3 functionality. A pure Layer 2 switch cannot perform Inter-VLAN routing. (Example: A Layer 2 switch can forward traffic from a PC in VLAN 10 to a printer also in VLAN 10. But if the printer is in VLAN 20, the switch cannot forward the frame; it must rely on a router for Inter-VLAN routing.)

## Step-by-step breakdown

1. **Design the VLAN and IP subnet scheme** — Before configuring anything, plan which VLANs you need and assign a unique IP subnet to each. For instance, VLAN 10 (Sales) uses network 192.168.10.0/24, VLAN 20 (Engineering) uses 192.168.20.0/24. This mapping is critical because the routing device will use the destination IP address to determine the destination VLAN.
2. **Create VLANs on the switch** — On the switch, enter global configuration mode and create each VLAN using the command 'vlan <vlan-id>'. For example, 'vlan 10' and 'vlan 20'. This adds the VLANs to the switch's VLAN database, making them available for assignment to ports. Without this step, the switch does not know about the VLAN.
3. **Assign switch ports to VLANs** — For each device, configure the switch port as an access port in the appropriate VLAN. For example, 'interface f0/1, switchport mode access, switchport access vlan 10'. This places the device connected to that port into VLAN 10. Devices in the same VLAN can now communicate at Layer 2.
4. **Configure trunk port between switch and router** — Identify the port that connects the switch to the router (or Layer 3 switch). Configure it as a trunk: 'interface g0/1, switchport mode trunk, switchport trunk allowed vlan 10,20'. This allows the link to carry traffic for multiple VLANs using 802.1Q tagging. Optionally, set the native VLAN to the same value on both ends to avoid mismatches.
5. **Configure subinterfaces on the router (router-on-a-stick)** — On the router, access the physical interface connected to the switch. Create a subinterface for each VLAN: 'interface g0/0.10', then 'encapsulation dot1Q 10' and 'ip address 192.168.10.1 255.255.255.0'. Repeat for VLAN 20. This creates a logical gateway for each VLAN on the router. The encapsulation command tells the router to tag outbound frames with the VLAN ID and expects tagged inbound frames.
6. **Enable IP routing (if using a multilayerswitch)** — If you are using a multilayer switch instead of a separate router, you must enable IP routing with the command 'ip routing' in global configuration mode. By default, a switch only operates at Layer 2. This command activates the Layer 3 routing engine.
7. **Create SVIs on the multilayer switch** — On a multilayer switch, create a switched virtual interface for each VLAN: 'interface vlan 10', 'ip address 192.168.10.1 255.255.255.0', 'no shutdown'. Do the same for VLAN 20. These SVIs serve as the default gateways for each VLAN. The switch will route packets between SVIs internally, using hardware ASICs for speed.
8. **Verify connectivity** — Use commands like 'show ip interface brief' to verify the SVIs or subinterfaces are up. Use 'show vlan' to confirm VLAN membership. Ping from a host in VLAN 10 to a host in VLAN 20. If successful, Inter-VLAN routing is functioning. If not, use 'traceroute' and 'show ip route' to isolate the failure point. Check trunk status with 'show interfaces trunk'.

## Practical mini-lesson

In a real-world network, Inter-VLAN routing is rarely as simple as a single router and a single switch. You will encounter hierarchical networks with redundant paths, multiple distribution switches, and core routers. Understanding how to scale Inter-VLAN routing is crucial for network engineers. Let's explore a practical scenario. 

 Suppose you have a campus network with three buildings. Each building has several department VLANs. You have a collapsed core architecture: two multilayer switches in the core, each connected to distribution switches in each building. The core switches perform Inter-VLAN routing for the entire campus. They run a routing protocol like OSPF to share routes between each other and to the upstream router for internet access. 

 In this environment, you must ensure that the SVIs for the same VLAN exist on only one core switch to avoid routing loops, or you can use an FHRP (First Hop Redundancy Protocol) like HSRP or VRRP to provide redundancy. For example, VLAN 10's SVI could be active on core-switch-1, while VLAN 20's SVI could be active on core-switch-2. The switches can still route traffic between VLANs because they know the routes through OSPF. 

 What can go wrong in such a design? One common issue is that the trunks between the distribution switches and core switches are not carrying all required VLANs. For instance, if VLAN 10 is not allowed on the trunk from distribution to core-switch-2, then traffic from building A's VLAN 10 trying to reach a device in building C's VLAN 20 might be blackholed. Regularly verifying trunk allowed VLAN lists with 'show interfaces trunk' is a good practice. 

 Another practical consideration is security. Once Inter-VLAN routing is enabled, you can apply ACLs to SVIs to restrict traffic between VLANs. For example, you might want to allow only HTTP and SQL traffic from the web server VLAN to the database VLAN, and block everything else. You did this by creating an extended ACL and applying it to the SVI interface in the inbound direction. 

 Professionals also need to monitor performance. If the router or switch CPU is high, it could be due to a large volume of packets being slow-pathed by software instead of being switched by hardware. This often happens if you have ACLs or policy-based routing that forces software processing. In such cases, using hardware-based ACEs (Access Control Entries) and keeping ACLs efficient is recommended. 

 Finally, when migrating from a router-on-a-stick to a Layer 3 switch, you must reassign the IP gateway addresses from the router subinterfaces to the new SVIs. This often requires a coordinated maintenance window because you are changing the default gateway for all devices. Proper planning and testing are essential to avoid network downtime. 

Inter-VLAN routing in practice requires attention to design redundancy, trunk management, security policies, and performance optimization. These are the skills that separate a certified technician from a senior network engineer.

## Commands

```
interface GigabitEthernet0/0.10 
 encapsulation dot1Q 10 
 ip address 192.168.10.1 255.255.255.0
```
Configures a router-on-a-stick subinterface for VLAN 10 with an IP address for inter-VLAN routing.

*Exam note: CCNA tests the 'encapsulation dot1Q' command under subinterfaces. Missing this leads to VLAN mismatch and routing failure.*

```
interface vlan 10 
 ip address 192.168.10.1 255.255.255.0 
 no shutdown
```
Creates a switched virtual interface (SVI) on a multilayer switch for VLAN 10 and assigns an IP address.

*Exam note: CCNA expects you to know that SVIs are the modern method for inter-VLAN routing. The 'no shutdown' is often forgotten in labs.*

```
ip route 192.168.20.0 255.255.255.0 192.168.10.2
```
Creates a static route to VLAN 20's subnet via the next-hop IP (typically the other router's SVI or interface).

*Exam note: Network+ and CCNA test static route syntax. This is used when the router does not have a direct connection to VLAN 20.*

```
router ospf 1 
 network 192.168.10.0 0.0.0.255 area 0
```
Enables OSPF on the VLAN 10 interface to advertise its subnet to other routers for inter-VLAN routing.

*Exam note: CCNA and Network+ test OSPF configuration. Using wildcard mask and area 0 is mandatory for backbone area.*

```
access-list 100 permit tcp 192.168.10.0 0.0.0.255 host 192.168.20.100 eq 443
```
An extended ACL that permits HTTPS traffic from VLAN 10 to a specific host in VLAN 20.

*Exam note: Security-plus and CCNA: ACLs are used to control inter-VLAN traffic. The correct syntax and protocol numbers are tested.*

```
interface GigabitEthernet0/1 
 switchport trunk allowed vlan 10,20,30
```
Configured on the switch port connected to the router for ROAS, allowing only VLANs 10, 20, and 30 on the trunk.

*Exam note: CCNA: Trunk pruning is tested to ensure only necessary VLANs traverse the trunk, improving security and reducing broadcast traffic.*

```
vlan 10 
 name Engineering
```
Creates VLAN 10 with a descriptive name on the switch.

*Exam note: Basic VLAN creation is tested in CCNA and Network+. Without VLAN creation, SVIs and trunking fail.*

## Troubleshooting clues

- **Missing default gateway on host** — symptom: Host cannot reach other VLANs but can ping its own default gateway IP.. The host is configured with an incorrect or missing default gateway. The gateway must be the IP of the router or SVI in the host's VLAN. (Exam clue: Exams often give a scenario where a host can ping within VLAN but not outside. Check the gateway configuration first.)
- **SVI in down/down state** — symptom: The VLAN interface shows 'administratively down' or 'down/down' in show interfaces.. The SVI is not created or the VLAN is not present in the VLAN database. Alternatively, the switch must have at least one port in the VLAN active. (Exam clue: CCNA expects you to know that an SVI is down if the VLAN does not exist or no access/trunk port is assigned to it.)
- **Trunk port not allowed for VLAN** — symptom: Router-on-a-stick: traffic from VLAN 10 cannot be routed, even though subinterface is correct.. The switch trunk port may have a 'allowed vlan' list that excludes VLAN 10. Use 'switchport trunk allowed vlan add 10' to include it. (Exam clue: Network+ and CCNA: trunk misconfiguration is a classic exam trap. Always check the allowed vlan list.)
- **Encapsulation dot1Q mismatch** — symptom: Router subinterface shows 'down/down' or 'line protocol down'.. The subinterface is missing the 'encapsulation dot1Q' command or the VLAN ID is incorrect. The router and switch must agree on the VLAN tag. (Exam clue: CCNA: The most common ROAS troubleshooting is missing encapsulation. The command must be exactly 'encapsulation dot1Q <vlan-id>'.)
- **IP address overlap** — symptom: Host in VLAN 10 can reach VLAN 20 but not other subnets, or routing table shows inconsistent routes.. The same subnet is configured on two different interfaces. For example, the SVI for VLAN 10 and another SVI have overlapping IPs. (Exam clue: Security-plus and Network+ test subnet overlap. It causes routing loops or black holes.)
- **ACL blocking traffic** — symptom: Inter-VLAN traffic is failing intermittently or for specific services.. An ACL applied to the SVI or router interface is denying traffic. Use 'show access-lists' to see hits. (Exam clue: CCNA: Look for 'deny ip any any' or missing 'permit' entries. The ACL must be applied with 'ip access-group' command.)
- **Routing protocol neighbor not established** — symptom: Dynamic routes between switches/routers not appearing. 'show ip ospf neighbor' shows no neighbors.. The OSPF hello timers, area ID, or network statement on the SVI might be misconfigured. Ensure the interface is not passive unless intended. (Exam clue: CCNA: Check the 'network' command under OSPF. The wildcard mask must match the interface IP.)
- **VLAN pruning causing no connectivity** — symptom: Some VLANs work, some don't across trunk links.. VTP pruning or manual 'allowed vlan' list is blocking certain VLANs on the trunk that carries inter-VLAN traffic. (Exam clue: Network+ and CCNA: Trunk allowed vlan list is a common exam trick. Always verify with 'show interfaces trunk'.)

## Memory tip

Remember: VLANs separate at Layer 2, routing connects at Layer 3. You can't route without a router or a Layer 3 switch.

## FAQ

**Do I need a Layer 3 switch for Inter-VLAN routing?**

No, you can use a router with router-on-a-stick and a Layer 2 switch. However, a Layer 3 switch is faster and more scalable for larger networks.

**What is the difference between router-on-a-stick and SVI?**

Router-on-a-stick uses a router with subinterfaces on a single trunk link. SVI uses a multilayer switch with virtual interfaces for each VLAN, performing routing in hardware.

**Can Inter-VLAN routing be done wirelessly?**

Inter-VLAN routing is a Layer 3 function; it can route traffic from any source to any destination, including wireless clients assigned to different VLANs via a wireless controller.

**Why do I need a trunk port for Inter-VLAN routing?**

A trunk port can carry multiple VLANs over a single link, which is necessary to send traffic from all VLANs to the router or Layer 3 switch for routing.

**What happens if I forget to enable IP routing on a Layer 3 switch?**

The SVIs will exist, but the switch will not route between them. Ping from a host to its default gateway will work, but ping to another VLAN's host will fail.

**How many VLANs can I route between?**

Theoretically, up to 4094 VLANs (due to 802.1Q limitations), but practical limits depend on the router or switch's resources and the network design.

**Does Inter-VLAN routing create security risks?**

It allows traffic between VLANs, which could bypass isolation if not controlled. You should apply ACLs on the routing device to enforce security policies.

## Summary

Inter-VLAN routing is the essential process that allows devices in different VLANs to communicate with one another. While VLANs create logical separation for security and performance, Inter-VLAN routing bridges those separations at Layer 3, enabling necessary communication across departments and functions. The concept is implemented using either a router (via router-on-a-stick with subinterfaces and trunk ports) or a multilayer switch (using SVIs and hardware routing). 

 Understanding Inter-VLAN routing is critical for both certification exams and real-world network administration. It appears heavily in CCNA and Network+ exams, where you must configure, verify, and troubleshoot the setup. Common mistakes include failing to create VLANs, misconfiguring trunk ports, forgetting to enable IP routing on a Layer 3 switch, and assigning overlapping subnets. Mastery of this concept directly improves your ability to design secure, scalable networks and to pass your certification exams. 

 The key takeaway is that Inter-VLAN routing is about more than just connectivity-it is about controlled connectivity. By applying ACLs and using proper planning, you can create a network that is both segmented and functional. Whether you are working on a small office network or a multi-campus enterprise, Inter-VLAN routing is a tool you will use daily.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/inter-vlan-routing