Inter-VLAN Routing — SVI & Router-on-a-Stick

Switch Virtual Interface (SVI) – inter-VLAN routing

A Switch Virtual Interface (SVI) is a logical Layer 3 interface on a Cisco Layer 3 switch, giving a VLAN an IP address so the switch can act as the default gateway for devices in that VLAN. Primary use: inter-VLAN routing – communication between VLANs without an external router. Every VLAN that must be routed needs one SVI with an IP address.

Example: VLAN 10 (10.10.10.0/24) + VLAN 20 (10.10.20.0/24)

Enable IP routing:

ip routing

Create the SVIs:

interface vlan 10
 ip address 10.10.10.1 255.255.255.0
 no shutdown

interface vlan 20
 ip address 10.10.20.1 255.255.255.0
 no shutdown

Configure access ports:

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10

How the traffic works: a PC in VLAN 10 uses 10.10.10.1 as default gateway, a PC in VLAN 20 uses 10.10.20.1 – the switch routes internally between the SVIs.

Verification: show vlan brief, show interfaces trunk, show mac address-table, show ip interface brief.

CCNA rule: inter-VLAN routing on a L3 switch = SVI + ip routing

SVI on a Layer 2 switch

What it CAN do: management IP (SSH/telnet, web GUI, SNMP, syslog, NTP, NetFlow), and features that require a management SVI (DHCP snooping, DAI, IP source guard, config backups). The switch’s own gateway:

ip default-gateway 192.168.1.1

– used only for the switch’s own management traffic, never for user traffic.

Function on an L2 switch	Possible?
Inter-VLAN routing	❌
Route between subnets	❌
Replace a router	❌
Use `ip routing`	❌

CCNA-correct wording: a Layer 2 switch can have an SVI with an IP for management and control, but only a Layer 3 switch can use SVIs for inter-VLAN routing.

Classic trap: “I gave the switch an IP on VLAN 1 – why can’t the PCs route?” Because the SVI is only for the switch itself; there is no Layer 3 routing.

Router-on-a-stick (ROAS)

Inter-VLAN routing where one physical router interface is split into subinterfaces, one per VLAN, using 802.1Q tagging. The switch does L2, the router does L3.

The switch port toward the router is a trunk
The router interface is split into subinterfaces
Each subinterface gets a VLAN ID and an IP (default gateway for the VLAN)
The router routes between the VLANs

Pros: cheap (no L3 switch), simple to learn, central routing (ACLs/NAT/policies in one place), easy to add VLANs. Cons: single point of failure, one-port bottleneck, not scalable, extra latency. Used in small offices, temporary setups, labs/training; in production it is usually replaced by L3 switching (SVI).

Switch:

vlan 10
vlan 20
interface g0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20

Router:

interface g0/0
 no shutdown

interface g0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0

interface g0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

encapsulation dot1Q tells the router which VLAN the subinterface belongs to. Typical faults: missing no shutdown on the physical interface, bad trunk config, wrong VLAN ID in the encapsulation, native VLAN mismatch.

Exam one-liner: ROAS uses one physical router interface with subinterfaces to route between VLANs via 802.1Q.

Tagged ccna, routing, vlan