ExamFinch.com My Study

Study guide

2.8 Inter-VLAN Routing — Deep Dive

Practice this exam

Cisco Certified Network Associate CCNA

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the CCNA 200-301 Exam Domains and Weights Study Strategies and Tips

2 Chapter 1: Network Fundamentals (20%)

1.1 Network Components 1.2 Network Topology Architectures 1.3 Physical Interfaces and Cabling 1.4 TCP vs. UDP 1.5 IPv4 Addressing and Subnetting 1.6 IPv6 Addressing and Prefix 1.7 Wireless Principles 1.8 Virtualization Fundamentals 1.9 Switching Concepts 1.10 OSI and TCP/IP Reference Models 1.11 Verifying IP Parameters on Client Operating Systems

3 Chapter 2: Network Access (20%)

2.1 VLANs — Configuration and Verification 2.2 Trunking and 802.1Q 2.3 Layer 2 Discovery Protocols (CDP and LLDP) 2.4 EtherChannel (Link Aggregation) 2.5 Spanning Tree Protocol (STP) and RSTP 2.6 Wireless Architectures and AP Modes 2.7 Network Access Troubleshooting 2.8 Inter-VLAN Routing — Deep Dive

4 Chapter 3: IP Connectivity (25%)

3.1 Routing Table Components 3.2 Router Forwarding Decisions 3.3 IPv4 and IPv6 Static Routing 3.4 Single-Area OSPFv2 — Concepts 3.5 Single-Area OSPFv2 — Configuration 3.6 First Hop Redundancy Protocols (FHRP) 3.7 Troubleshooting IP Connectivity 3.8 OSPF Troubleshooting Scenarios

5 Chapter 4: IP Services (10%)

4.1 NAT (Network Address Translation) 4.2 DHCP and DNS 4.3 NTP, SNMP, and Syslog 4.4 QoS Fundamentals 4.5 TFTP/FTP and Remote Access 4.6 IP Services — Comprehensive Review

6 Chapter 5: Security Fundamentals (15%)

5.1 Key Security Concepts 5.2 Device Access Control and Password Policies 5.3 VPN Fundamentals 5.4 Access Control Lists (ACLs) 5.5 Layer 2 Security Features 5.6 Network Security Best Practices and Hardening 5.7 Threat Mitigation and Incident Response

7 Chapter 6: Automation and Programmability (10%)

6.1 Impact of Automation on Network Management 6.2 Controller-Based and Software-Defined Architectures 6.3 AI and Machine Learning in Network Operations 6.4 REST-Based APIs 6.5 Configuration Management Tools 6.6 JSON-Encoded Data 6.7 Automation and Programmability — Comprehensive Review

2.8 Inter-VLAN Routing — Deep Dive

Key Takeaways Explain This Topic AI

Hosts in different VLANs need a Layer 3 device to communicate; the three methods are legacy (one router interface per VLAN), router-on-a-stick, and Layer 3 switch SVIs.

Router-on-a-stick uses one trunked router interface with 802.1Q sub-interfaces, each tagged via encapsulation dot1Q and holding the VLAN's gateway IP.

Layer 3 switches use Switch Virtual Interfaces (SVIs) and require the global ip routing command before any inter-VLAN routing works.

Each VLAN's gateway IP (sub-interface or SVI) is what hosts set as their default gateway.

An SVI shows up/down until at least one access/trunk port carrying that VLAN is up; verify routing with show ip route and show ip interface brief.

Last updated: June 2026

Why Inter-VLAN Routing Is Needed

A VLAN is a separate broadcast domain and a separate IP subnet, so by design a host in VLAN 10 (10.0.10.0/24) cannot reach a host in VLAN 20 (10.0.20.0/24) without a Layer 3 hop. Inter-VLAN routing provides that hop. The CCNA expects you to compare three methods and configure two of them (router-on-a-stick and Layer 3 SVIs).

  • Method How it works Scalability
  • Legacy (router per VLAN) One physical router interface per VLAN Poor — runs out of ports

Router-on-a-stick (ROAS) One trunked router interface, sub-interface per VLAN Moderate; one link is a bottleneck

Layer 3 switch (SVIs) Routing done in switch ASIC via SVIs Best — line-rate, preferred today

The legacy method is obsolete because it wastes physical interfaces. Modern designs use a Layer 3 switch because routing happens in hardware at wire speed.

Router-on-a-Stick (ROAS)

ROAS carries every VLAN over a single trunk to a router, which routes between sub-interfaces . Each sub-interface is tagged for one VLAN and holds that VLAN's gateway IP: Router(config)# interface gi0/0.10

  • Router(config-subif)# encapsulation dot1Q 10
  • Router(config-subif)# ip address 10.0.10.1 255.255.255.0
  • Router(config)# interface gi0/0.20
  • Router(config-subif)# encapsulation dot1Q 20
  • Router(config-subif)# ip address 10.0.20.1 255.255.255.0

The matching switch port must be a trunk ( switchport mode trunk ). The exam's #1 ROAS trap is forgetting encapsulation dot1Q or mismatching the VLAN number — without it, the sub-interface cannot receive that VLAN's tagged frames. The native VLAN sub-interface uses encapsulation dot1Q <vlan> native .

Layer 3 Switch with SVIs

A Switch Virtual Interface (SVI) is a virtual Layer 3 interface tied to a VLAN; its IP becomes the gateway for that VLAN. Configuration has a step everyone forgets — the global ip routing command, without which the switch stays Layer 2 even though SVIs have IPs : Switch(config)# ip routing

  • Switch(config)# interface vlan 10
  • Switch(config-if)# ip address 10.0.10.1 255.255.255.0
  • Switch(config)# interface vlan 20
  • Switch(config-if)# ip address 10.0.20.1 255.255.255.0

You may also create a routed port with no switchport then ip address — used for the uplink to a core router, not for VLAN gateways. SVIs are the preferred answer whenever the question mentions a multilayer/Layer 3 switch.

SVI State Logic and Verification

An SVI's line state follows specific rules the exam tests:

  • SVI state Meaning Cause
  • up/up Operational VLAN exists and a port in it is up
  • up/down VLAN exists, no active port All VLAN ports down/shut, or VLAN not created
  • administratively down Manually shut shutdown on the SVI

So an SVI for VLAN 20 shows up/down when no access or trunk port carrying VLAN 20 is in the up/up state — bring up a port in that VLAN to fix it. After configuration, verify with:

show ip route — confirms the VLAN subnets appear as directly connected (C) routes; if they are missing, ip routing is off.

show ip interface brief — confirms each SVI's IP and up/up status.

show vlan brief — confirms the VLAN exists and has ports.

If hosts have correct gateways but still cannot route, the usual culprits in order are: ip routing not enabled, an SVI in up/down, the host's default gateway not matching the SVI IP, or a trunk that does not carry the VLAN to the Layer 3 device.

End-to-End Worked Example

Picture VLAN 10 (10.0.10.0/24) and VLAN 20 (10.0.20.0/24) on a Layer 3 switch. PC-A is 10.0.10.5 with gateway 10.0.10.1; PC-B is 10.0.20.5 with gateway 10.0.20.1. For them to ping each other, every one of these must be true: ip routing is enabled; SVI VLAN 10 has IP 10.0.10.1 and is up/up; SVI VLAN 20 has IP 10.0.20.1 and is up/up; PC-A's access port is in VLAN 10 and PC-B's in VLAN 20; and each PC's default gateway exactly matches its SVI IP. show ip route should list both subnets as directly connected (C).

If PC-A can ping its own gateway 10.0.10.1 but not PC-B, routing is the suspect — confirm ip routing and that VLAN 20's SVI is up/up.

Router-on-a-Stick vs SVI Trade-offs

Both methods route between VLANs, but they differ in performance and use case:

  • Factor Router-on-a-stick Layer 3 switch SVI
  • Forwarding Software, on one router Hardware ASIC, line rate
  • Bottleneck The single trunk link None practically
  • Gateway config Sub-interface per VLAN SVI per VLAN
  • Best for Small sites, lab, legacy Modern campus LANs

ROAS funnels every inter-VLAN packet through one physical link, so a busy network saturates it; the SVI approach routes in the switch fabric and scales far better, which is why it is the default modern answer.

Inter-VLAN Routing Exam Traps

The highest-frequency mistakes: forgetting the global ip routing on a Layer 3 switch (SVIs have IPs but nothing routes); on ROAS, omitting encapsulation dot1Q or using the wrong VLAN number on a sub-interface, so that VLAN's tagged frames are dropped; mismatching the host default gateway to a non-existent or wrong SVI/sub-interface IP; and leaving the switch-to-router link as an access port when ROAS demands a trunk . Also remember an SVI stays up/down until a port in its VLAN is up — creating the SVI is not enough.

Verifying with show ip route , show ip interface brief , and show vlan brief in that order resolves nearly every inter-VLAN routing scenario the exam presents.