13 Inter-VLAN Routing · CCNA

Exam topics covered

2.1.c Configure and verify VLANs spanning multiple switches: InterVLAN connectivity 1.1.a/1.1.b Role and function of routers and Layer 2/Layer 3 switches (as applied to inter-VLAN routing)

3.1 Interpret the components of a routing table (connected and local routes created by inter-VLAN interfaces)

Foundation. In Chapter 12 you built VLANs and saw that hosts in different VLANs cannot talk to each other: each VLAN is its own broadcast domain and IP subnet, and only a Layer 3 device can forward packets between subnets. This chapter shows the three ways to provide that routing on Cisco gear: router on a stick with 802.1Q subinterfaces, a Layer 3 switch with switched virtual interfaces (SVIs), and Layer 3 switch routed ports. For each, you will see the design, the configuration, the verification output and the mistakes that commonly break it.

13.1 The Problem and the Three Solutions

A host decides whether a destination is local by comparing the destination IP address with its own address and mask. If the destination is in another subnet, the host sends the frame to its default gateway's MAC address, and the gateway routes the packet. So the requirements for inter-VLAN routing are simple: a Layer 3 interface with an IP address in every VLAN, and hosts that use that address as their default gateway. What varies is where those Layer 3 interfaces live.

A. Router on a stick B. Layer 3 switch SVIs C. Routed port

Figure 13-1 Three ways to provide Layer 3 interfaces for VLANs.

13.2 Router on a Stick (ROAS)

With router on a stick, a single router Ethernet interface connects to a switch trunk. The router divides the physical interface into logical subinterfaces, one per VLAN, each with its own IP address. The command encapsulation dot1Q vlan-id ties a subinterface to a VLAN: frames that arrive tagged with that VLAN ID are processed by that subinterface, and packets routed out of it are tagged with that VLAN ID. The name "on a stick" comes from the single link: traffic between VLANs goes up the trunk to the router and back down the same trunk.

Figure 13-2 Router on a stick: one physical link, one subinterface per VLAN.

13.2.1 Configuring the router

Create each subinterface with interface g0/0.n . The subinterface number is only a local label; by convention it matches the VLAN ID, but the encapsulation dot1Q command is what actually binds the VLAN. The encapsulation command must come before ip address ; IOS refuses an IP address on a subinterface that has no encapsulation. Finally, remember that the physical interface must be up: subinterfaces inherit its state, and a router interface is shut down by default.

R1(config)# interface gigabitethernet0/0
R1(config-if)# no ip address
R1(config-if)# no shutdown ! physical interface must be up
R1(config-if)# interface gigabitethernet0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 10.1.10.1 255.255.255.0
R1(config-subif)# interface gigabitethernet0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 10.1.20.1 255.255.255.0
R1(config-subif)# interface gigabitethernet0/0.99
R1(config-subif)# encapsulation dot1Q 99 native ! untagged frames belong here
R1(config-subif)# ip address 10.1.99.1 255.255.255.0

The switch side is an ordinary trunk, configured exactly as in Chapter 12: switchport mode trunk , switchport trunk native vlan 99 and an allowed list that includes every routed VLAN. Routers do not speak DTP, so the switch port must be statically set to trunk.

13.2.2 The native VLAN on a router

The switch sends native VLAN frames untagged, so the router must know which subinterface receives untagged frames. There are two ways to do this:

Add the native keyword: encapsulation dot1Q 99 native on the subinterface, as above. Put the native VLAN's IP address on the physical interface ( interface g0/0 , ip address 10.1.99.1 255.255.255.0 ) and create no subinterface for it. Untagged frames are processed by the physical interface.

Either way, the router's native VLAN must match the switch trunk's native VLAN; otherwise untagged frames are not routed. If the native VLAN carries no user traffic (the recommended design), you may not need a router interface in it at all.

Exam alert

Watch for exhibits where a subinterface number and its encapsulation dot1Q VLAN do not match, for example interface g0/0.20 with encapsulation dot1Q 30 . The router uses the encapsulation VLAN, not the subinterface number. Also check that each subinterface's IP address is in the right subnet for that VLAN and that hosts use it as their default gateway.

13.2.3 Verifying ROAS

Start with show ip interface brief (Figure 13-3): every subinterface should be up/up with the expected address. Then check the routing table (Figure 13-4): each subinterface should contribute a connected ( C ) route for its subnet and a local ( L ) /32 host route for its own address. All terminal output in this chapter is illustrative of Cisco IOS 15.x / IOS XE.

R1 — console

R1# show ip interface brief

Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 unassigned YES manual up up
GigabitEthernet0/0.10 10.1.10.1 YES manual up up
GigabitEthernet0/0.20 10.1.20.1 YES manual up up
GigabitEthernet0/0.99 10.1.99.1 YES manual up up

GigabitEthernet0/1 unassigned YES unset administratively down down

Figure 13-3 Subinterfaces appear as separate interfaces with their own addresses and states.

R1# show ip route connected

10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C 10.1.10.0/24 is directly connected, GigabitEthernet0/0.10
L 10.1.10.1/32 is directly connected, GigabitEthernet0/0.10
C 10.1.20.0/24 is directly connected, GigabitEthernet0/0.20
L 10.1.20.1/32 is directly connected, GigabitEthernet0/0.20
C 10.1.99.0/24 is directly connected, GigabitEthernet0/0.99
L 10.1.99.1/32 is directly connected, GigabitEthernet0/0.99

R1# show vlans

Virtual LAN ID: 10 (IEEE 802.1Q Encapsulation)
vLAN Trunk Interface: GigabitEthernet0/0.10
Protocols Configured: Address: Received: Transmitted:
IP 10.1.10.1 1532 1104

... VLAN 20 and native VLAN 99 entries follow ...

Figure 13-4 Connected and local routes for each VLAN subnet; show vlans confirms the VLAN-to-subinterface mapping.

ROAS is cheap and simple, but it has clear limits. All inter-VLAN traffic shares one physical link, and it crosses that link twice (up to the router and back down), so a 1-Gbps trunk gives at most about 1 Gbps of inter-VLAN throughput in total. The router is also a single point of failure, and software-based routers forward more slowly than switch hardware. ROAS is a good fit for a branch office or lab; larger sites use Layer 3 switches.

13.3 Packet Walk-Through Between VLANs

Understanding exactly what happens to a packet between VLANs is the key to troubleshooting it. Figure 13-5 follows a ping from PC1 (VLAN 10, 10.1.10.11) to PC4 (VLAN 20, 10.1.20.14) through the ROAS topology of Figure 13-2.

R1
SW1
PC1 PC4 1

1 Untagged frame to R1's MAC, in VLAN 10 (access port)
2 SW1 tags it VID 10 on the trunk; R1 receives it on G0/0.10
3 R1 routes: 10.1.20.0/24 is connected via G0/0.20
4 R1 sends new frame tagged VID 20 to PC4's MAC
5 SW1 removes the tag, forwards out Gi0/7 (VLAN 20)

Figure 13-5 A packet from VLAN 10 to VLAN 20 crosses the trunk twice: tagged 10 going up, tagged 20 coming down.

1. PC1 decides the destination is remote. 10.1.20.14 is not in 10.1.10.0/24, so PC1 must send to its gateway, 10.1.10.1. If it has no ARP entry for the gateway, it broadcasts an ARP request in VLAN 10; SW1 floods it out of VLAN 10 ports and the trunk (tagged 10), and R1 answers from G0/0.10.
2. PC1 sends the frame. Destination MAC = R1's G0/0 MAC, source MAC = PC1, destination IP = 10.1.20.14. SW1 receives it untagged on access port Gi0/2 (VLAN 10), looks up R1's MAC in the VLAN 10 MAC table, and sends it out the trunk with an 802.1Q tag of 10.
3. R1 routes the packet. The tag of 10 delivers the frame to G0/0.10. R1 strips the Layer 2 header, decrements the TTL, finds the connected route 10.1.20.0/24 via G0/0.20, and ARPs (in VLAN 20) for 10.1.20.14 if necessary.
4. R1 sends a new frame. Destination MAC = PC4, source MAC = R1's G0/0 MAC (all subinterfaces share the physical MAC), tagged with VLAN 20.
5. SW1 delivers it. The switch looks up PC4's MAC in the VLAN 20 table, removes the tag and forwards the frame untagged out of Gi0/7. The reply follows the same path in reverse.

13.4 Layer 3 Switches and SVIs

A Layer 3 switch (multilayer switch) is a switch that can also route, in hardware, at wire speed. Instead of sending inter-VLAN traffic out to a router, it routes between its own VLANs internally. The Layer 3 interface for each VLAN is a switched virtual interface (SVI), created with interface vlan vlan-id . The SVI's IP address is the default gateway for hosts in that VLAN. With no trunk bottleneck and no external router to fail, SVIs on distribution or core switches are the standard campus design.

Every Cisco switch can have SVIs, even a Layer 2 switch, which uses an SVI (typically in a management VLAN) for its own IP address for SSH and SNMP. The difference on a Layer 3 switch is that it can route between SVIs once you enable IP routing with the global command ip routing , which is disabled by default on many models.

L3
R1 (WAN edge)
Gi1/0/24 routed port 10.0.0.2/30
R1 G0/1 10.0.0.1/30

Dsw1

ip routing
interface vlan 10 → 10.1.10.1/24
interface vlan 20 → 10.1.20.1/24
interface vlan 30 → 10.1.30.1/24
VLAN 10 (Gi1/0/2) VLAN 20 (Gi1/0/7) VLAN 30 (Gi1/0/12)

Figure 13-6 A Layer 3 switch with SVIs as gateways for three VLANs and a routed port uplink to the WAN router.

13.4.1 Configuring SVIs

DSW1(config)# ip routing ! enable IPv4 routing
DSW1(config)# vlan 10,20,30 ! the VLANs must exist
DSW1(config-vlan)# exit
DSW1(config)# interface vlan 10
DSW1(config-if)# description Gateway for SALES
DSW1(config-if)# ip address 10.1.10.1 255.255.255.0
DSW1(config-if)# no shutdown
DSW1(config-if)# interface vlan 20
DSW1(config-if)# ip address 10.1.20.1 255.255.255.0
DSW1(config-if)# no shutdown
DSW1(config-if)# interface vlan 30
DSW1(config-if)# ip address 10.1.30.1 255.255.255.0
DSW1(config-if)# no shutdown

13.4.2 When is an SVI up?

An SVI is a virtual interface, so its state depends on the VLAN rather than on a cable. An SVI is up/up only when all of the following are true:

The VLAN exists in the switch's VLAN database (created locally or learned through VTP) and is not shut down.

The SVI itself is not administratively shut down. (New SVIs are often shut down by default, so no shutdown is important.)

At least one Layer 2 port in that VLAN is up and in the STP forwarding state: an access port in the VLAN, or a trunk that carries the VLAN. This is called the autostate feature.

DSW1 — console

DSW1# show interfaces vlan 10

Vlan10 is up, line protocol is up, Autostate Enabled

Hardware is Ethernet SVI, address is 0c1a.2b3c.4d41 (bia 0c1a.2b3c.4d41)

Description: Gateway for SALES
Internet address is 10.1.10.1/24
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not supported
ARP type: ARPA, ARP Timeout 04:00:00

... output truncated ...

DSW1# show ip interface brief | include Vlan|1/0/24

Vlan10 10.1.10.1 YES NVRAM up up
Vlan20 10.1.20.1 YES NVRAM up up
Vlan30 10.1.30.1 YES NVRAM up down
GigabitEthernet1/0/24 10.0.0.2 YES NVRAM up up

Figure 13-7 VLAN 10's SVI is up/up; VLAN 30's SVI is up/down because no port in VLAN 30 is up.

In Figure 13-7, Vlan30 shows up/down : the SVI is enabled, but no port in VLAN 30 is active (perhaps the only VLAN 30 host is unplugged, or the VLAN is missing from the uplink trunk). If the VLAN itself did not exist, the SVI would likewise be down. An SVI that shows administratively down simply needs no shutdown .

13.5 Routed Ports on Layer 3 Switches

By default every Layer 3 switch port is a Layer 2 switchport. The interface command no switchport converts it into a routed port: a pure Layer 3 interface, exactly like a router interface. A routed port belongs to no VLAN, does not run STP, does not trunk, and takes an IP address directly. Routed ports are ideal for point-to-point links between a Layer 3 switch and a router (as in Figure 13-6) or between Layer 3 switches in a routed core, where they avoid unnecessary VLANs and spanning tree. (EtherChannels can also be made Layer 3 in the same way, as Chapter 17 explains.)

DSW1(config)# interface gigabitethernet1/0/24
DSW1(config-if)# description Routed link to R1 G0/1
DSW1(config-if)# no switchport ! convert to a Layer 3 port
DSW1(config-if)# ip address 10.0.0.2 255.255.255.252
DSW1(config-if)# no shutdown
DSW1(config-if)# exit
DSW1(config)# ip route 0.0.0.0 0.0.0.0 10.0.0.1 ! default route toward R1

Note the order: ip address is rejected on a switchport, so no switchport must come first. Entering switchport again reverts the port to Layer 2 and removes its IP configuration. R1 will need routes back to the VLAN subnets (static routes or a routing protocol such as OSPF, Chapters 20–22).

DSW1 — console

DSW1# show interfaces g1/0/24 switchport

Name: Gi1/0/24

Switchport: Disabled

DSW1# show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area ... codes truncated ...

Gateway of last resort is 10.0.0.1 to network 0.0.0.0
S* 0.0.0.0/0 [1/0] via 10.0.0.1
10.0.0.0/8 is variably subnetted, 8 subnets, 3 masks
C 10.0.0.0/30 is directly connected, GigabitEthernet1/0/24
L 10.0.0.2/32 is directly connected, GigabitEthernet1/0/24
C 10.1.10.0/24 is directly connected, Vlan10
L 10.1.10.1/32 is directly connected, Vlan10
C 10.1.20.0/24 is directly connected, Vlan20
L 10.1.20.1/32 is directly connected, Vlan20
C 10.1.30.0/24 is directly connected, Vlan30
L 10.1.30.1/32 is directly connected, Vlan30

Figure 13-8 A routed port (Switchport: Disabled) and the Layer 3 switch's routing table with SVIs, the routed port and a default route.

Know which command does what on a Layer 3 switch: ip routing (global) enables routing between interfaces; interface vlan x creates an SVI; no switchport creates a routed port. If an exhibit shows SVIs up/up with correct addresses but hosts in different VLANs still cannot communicate, look for a missing ip routing . Connected routes appear only for interfaces that are up/up.

13.6 Comparing the Options

Table 13-1 Inter-VLAN routing options compared

Serves VLANs? Yes, many over one link Yes, one SVI per VLAN No; a single subnet, no VLAN

when...

13.7 Troubleshooting Inter-VLAN Routing

When hosts in one VLAN cannot reach another VLAN, first confirm the host can ping its own default gateway. If it cannot, the problem is in the Layer 2 path or the gateway interface; if it can, the problem is routing or the destination side. Table 13-2 lists the most common faults.

Table 13-2 Common inter-VLAN routing problems

Roas

Wrong VLAN in encapsulation dot1Q ;
VLAN not allowed on switch trunk
show vlans , show interfaces
trunk
SVI up/down VLAN missing, or no active port in the

Vlan

Figure 13-9 shows a typical ROAS fault. Hosts in VLAN 20 cannot reach their gateway,

although the subinterface is up/up. Comparing the router and switch reveals the mismatch.

R1 and SW1 — console

R1# show running-config interface g0/0.20
interface GigabitEthernet0/0.20
encapsulation dot1Q 30
ip address 10.1.20.1 255.255.255.0
SW1# show interfaces trunk | begin allowed on

Port Vlans allowed on trunk

Gi0/1 10,20,99

... VLAN 30 is not allowed, and hosts in 10.1.20.0/24 are in VLAN 20 ...

R1(config)# interface g0/0.20
R1(config-subif)# encapsulation dot1Q 20 ! fix: match the host VLAN
PC4> ping 10.1.20.1

Reply from 10.1.20.1: bytes=32 time=1ms TTL=255

Figure 13-9 Subinterface G0/0.20 was bound to VLAN 30 by mistake; correcting the encapsulation restores the gateway.

LAB Route between VLANs with ROAS and with a Layer 3 switch

Goal: Restore connectivity between VLAN 10 and VLAN 20 from the Chapter 12 lab, first with router on a stick, then by moving the gateways to a Layer 3 switch.

G0/0.10 10.1.10.1, G0/0.20 10.1.20.1
G0/0 — Gi0/24 trunk
SW1 SW2
Gi0/1 trunk, native 99

Pc1 vlan 10

10.1.10.11 GW .1

Pc4 vlan 20

10.1.20.14 GW .1

Figure 13-10 Lab topology: the Chapter 12 network plus R1 on a trunk to SW1. Steps (part 1, ROAS):

1. Set the default gateways: PC1 = 10.1.10.1, PC4 = 10.1.20.1.
2. On SW1, configure Gi0/24 as a static trunk: switchport mode trunk , switchport trunk native vlan 99 , switchport trunk allowed vlan 10,20,99 and no shutdown (it was parked and shut in Chapter 12).
3. On R1, run no shutdown on G0/0, then create G0/0.10 ( encapsulation dot1Q 10 , 10.1.10.1/24), G0/0.20 ( encapsulation dot1Q 20 , 10.1.20.1/24) and G0/0.99 ( encapsulation dot1Q 99 native , 10.1.99.1/24).
4. Verify with show ip interface brief and show ip route connected on R1, and show interfaces trunk on SW1.

Steps (part 2, SVIs): If SW1 is a Layer 3 switch, shut down G0/0 on R1, then on SW1 enter ip routing , and create interface vlan 10 (10.1.10.1/24) and interface vlan 20 (10.1.20.1/24), each with no shutdown . The hosts' gateways do not change. Verify:

PC1 — command prompt

C:\> tracert -d 10.1.20.14

Tracing route to 10.1.20.14 over a maximum of 30 hops
1 1 ms <1 ms <1 ms 10.1.10.1
2 1 ms 1 ms 1 ms 10.1.20.14

Trace complete.

Figure 13-11 One routed hop (the VLAN 10 gateway) separates PC1 from PC4.

Expected results: PC1 can ping PC4, and tracert shows exactly one hop, the gateway, in both parts of the lab. In part 2, show ip route on SW1 lists C routes for 10.1.10.0/24 via Vlan10 and 10.1.20.0/24 via Vlan20.

1. Which command associates a router subinterface with VLAN 30?

A. switchport access vlan 30
B. encapsulation dot1Q 30
C. vlan 30
D. interface vlan 30

2. An engineer configures interface g0/0.50 with encapsulation dot1Q 15 . Frames tagged with which VLAN are processed by this subinterface?

A. 50
B. 15
C. 1
D. Both 15 and 50

3. Which two methods let a ROAS router handle untagged native VLAN frames? (Choose two.)

A. Configure encapsulation dot1Q 99 native on a subinterface.
B. Configure switchport trunk native vlan 99 on the router.
C. Configure the native VLAN's IP address on the physical interface.
D. Configure ip routing .
E. Configure no switchport on the physical interface.

4. All subinterfaces on R1's G0/0 show administratively down. What is the most likely cause?

A. The switch trunk native VLAN mismatches.
B. The physical interface G0/0 is shut down.
C. ip routing is disabled.
D. The subinterfaces have no IP addresses.

5. Which global command must be enabled for a Layer 3 switch to route between its SVIs?

A. ip routing
B. ip cef
C. no switchport
D. router-on-a-stick

6. An SVI for VLAN 40 is configured with an IP address and no shutdown but shows up/down. Which two conditions could cause this? (Choose two.)

A. VLAN 40 does not exist on the switch.
B. No port in VLAN 40 is up and forwarding.
C. ip routing is disabled.
D. The SVI has a /30 mask.
E. CDP is disabled.

7. Which command converts a Layer 3 switch port into a routed port?

A. switchport mode routed
B. no switchport
C. ip routing
D. switchport nonegotiate

8. In the ROAS packet walk, which values change when R1 routes a packet from VLAN 10 to

Vlan 20?

A. Source and destination IP addresses
B. Destination IP address only
C. Source/destination MAC addresses and the VLAN tag
D. Nothing; the switch forwards the frame unchanged

9. What is a key disadvantage of router on a stick compared with Layer 3 switch SVIs?

A. It cannot route more than two VLANs.
B. All inter-VLAN traffic shares one link and crosses it twice.
C. It requires ISL.
D. It cannot use a native VLAN.

10. The switch port connected to a ROAS router is configured as dynamic auto . What happens?

A. It becomes a trunk through DTP negotiation with the router.
B. It stays an access port, because routers do not send DTP.
C. It becomes a routed port.
D. It err-disables.

11. Which routes does IOS add to the routing table for an up/up SVI with address 10.1.30.1/24?

A. C 10.1.30.0/24 and L 10.1.30.1/32
B. S 10.1.30.0/24 only
C. C 10.1.30.1/32 only
D. L 10.1.30.0/24 and C 10.1.30.1/32

12. Which two statements about routed ports are true? (Choose two.)

A. They are assigned to VLAN 1.
B. They do not participate in STP.
C. They accept an IP address directly.
D. They carry multiple VLANs as a trunk.
E. They require interface vlan configuration.

Answers

1. B. encapsulation dot1Q 30 binds the subinterface to VLAN 30. interface vlan 30 creates an SVI on a switch.
2. B. The encapsulation VLAN controls the mapping; the subinterface number is only a label.
3. A and C. Use the native keyword or put the native VLAN address on the physical interface. Routers have no switchport commands.
4. B. Subinterfaces inherit the physical interface's state, and router interfaces are shut down by default.
5. A. ip routing enables IPv4 routing between Layer 3 interfaces.
6. A and B. SVI autostate needs the VLAN to exist and at least one active forwarding port in it. ip routing does not affect SVI state.
7. B. no switchport makes the port Layer 3; there is no "mode routed".
8. C. The router rewrites the Layer 2 header (MACs and tag); IP addresses are unchanged end to end.
9. B. One physical link carries all inter-VLAN traffic up and back down, and the router is a single point of failure.
10. B. Auto waits for a DTP request that a router never sends. Configure switchport mode trunk .
11. A. A connected route for the subnet and a local /32 host route for the interface address.
12. B and C. Routed ports are pure Layer 3: no VLAN, no STP, no trunking, and an IP address directly on the port.