Inter-VLAN Routing: Router on a Stick, SVIs and IRB Interfaces

Inter-VLAN routing is the job of moving packets between hosts in different VLANs, which a switch alone cannot do because each VLAN is a separate broadcast domain and a separate IP subnet. Something has to act as the default gateway for each VLAN and route between them: a router with one interface per VLAN, a router or firewall on a single trunk with one subinterface per VLAN ("router on a stick"), or a Layer 3 switch with a virtual routed interface per VLAN.

Most campus networks today use the third option, because the switch already sees every VLAN and can route between them at line rate. The other two still have their place, especially when traffic between VLANs must pass a firewall. This page explains what happens to a packet on its way between VLANs, compares the three designs, gives the configuration for each on Cisco IOS and Junos, and lists the checks and the faults that come up most often. Why VLANs exist, and how ports carry them, is covered in the VLAN reference on 802.1Q segmentation and the page on choosing access or trunk mode per port. This page belongs to the routing hub on FoundryNet.

01 /What happens to a packet that crosses VLANs?

Take a PC at 198.51.100.25 in VLAN 20 sending to a file server at 203.0.113.40 in VLAN 30. The PC compares the destination with its own address and mask, sees a different subnet, and sends the packet to its default gateway, 198.51.100.1. To do that it needs the gateway's MAC address, which it learns with an ARP request, the address resolution exchange defined in RFC 826, the Ethernet Address Resolution Protocol. The frame it sends carries the gateway's MAC address as destination and the server's IP address as destination.

The gateway, whichever device it is, receives the frame in VLAN 20, strips the Layer 2 header, looks up 203.0.113.40 in its routing table and finds a directly connected route for 203.0.113.0/24 on its VLAN 30 interface. It decrements the TTL, ARPs for the server's MAC address in VLAN 30 if it does not already have it, builds a new Ethernet header with its own VLAN 30 MAC as source and the server's MAC as destination, and sends the frame into VLAN 30. If that frame crosses a trunk on the way, it carries an 802.1Q tag for VLAN 30, as defined in the IEEE 802.1Q bridging standard. The reply makes the same trip in reverse, with the server using 203.0.113.1 as its gateway.

IPv6 follows the same path with different discovery. Hosts learn their gateway from Router Advertisements sent by the routed VLAN interface, usually as that interface's link-local address, and resolve the next hop with Neighbor Discovery instead of ARP. On Cisco IOS, IPv6 routing between VLANs needs ipv6 unicast-routing in addition to an IPv6 address on each VLAN interface, and a VLAN interface without an IPv6 address sends no advertisements, so its hosts never learn a gateway at all.

Two facts fall out of that walk. Every VLAN needs exactly one gateway address that its hosts point at, and the device holding those addresses must see every VLAN it routes between, either on separate ports or on a trunk.

02 /Three ways to route between VLANs

The router-on-a-stick design hits its limit on bandwidth: a packet from VLAN 20 to VLAN 30 crosses the trunk twice, once in each direction, so a 1 Gbit/s trunk carries at most about 1 Gbit/s of routed traffic in each direction combined with everything else. A Layer 3 switch routes in the same ASIC that switches, which is why it became the default; the hardware side of that is explained in the Layer 2 versus Layer 3 switch comparison.

03 /How to configure inter-VLAN routing on a Layer 3 switch

The steps below route between VLAN 20 (198.51.100.0/24) and VLAN 30 (203.0.113.0/24) on one switch, with the switch as gateway for both.

1. Create the VLANs and put the access ports in them, and allow both VLANs on any trunk toward other switches that carry them.
2. Turn on IP routing. On many Cisco Catalyst switches routing is off by default and the switch acts as a host; ip routing enables it.
3. Create one routed VLAN interface per VLAN with the gateway address for that subnet.
4. Point the hosts at the gateway, usually through DHCP. If the DHCP server sits in another VLAN, add a DHCP relay (Cisco ip helper-address) on each client VLAN interface.
5. Add filtering if not every VLAN may reach every other: access lists on the routed interfaces, or move the gateway to a firewall for the VLANs that need inspection.
6. Add gateway redundancy if two switches share the role, with a first-hop redundancy protocol.
7. Verify with the checks further down before moving users.

On Cisco IOS:

ip routing
!
vlan 20
 name users
vlan 30
 name servers
!
interface Vlan20
 description gateway for users
 ip address 198.51.100.1 255.255.255.0
 ip helper-address 203.0.113.10
 no shutdown
!
interface Vlan30
 description gateway for servers
 ip address 203.0.113.1 255.255.255.0
 no shutdown

On Junos with the ELS configuration style the routed interface is called an IRB interface. Juniper's Junos integrated routing and bridging guide describes the pieces: a logical unit on the irb interface carries the IP address, and the VLAN is bound to it with l3-interface. The same guide notes that only one IRB logical interface can be configured per VLAN.

set vlans users vlan-id 20
set vlans users l3-interface irb.20
set vlans servers vlan-id 30
set vlans servers l3-interface irb.30
set interfaces irb unit 20 family inet address 198.51.100.1/24
set interfaces irb unit 30 family inet address 203.0.113.1/24
set interfaces ge-0/0/5 unit 0 family ethernet-switching interface-mode access
set interfaces ge-0/0/5 unit 0 family ethernet-switching vlan members users

The unit number does not have to match the VLAN ID, but matching them saves a lot of confusion later.

04 /How to configure router on a stick

When the gateway is a router or firewall on one trunk, each VLAN gets a subinterface with an 802.1Q encapsulation matching the VLAN ID. On Cisco IOS:

interface GigabitEthernet0/0
 no ip address
 no shutdown
!
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 198.51.100.1 255.255.255.0
!
interface GigabitEthernet0/0.30
 encapsulation dot1Q 30
 ip address 203.0.113.1 255.255.255.0

The switch port facing the router must be a trunk allowing VLANs 20 and 30. If the trunk has an untagged native VLAN that the router also needs to route, the router subinterface for it uses encapsulation dot1Q <id> native; otherwise keep the native VLAN unused on that link. A firewall in this position gets the same structure under its own syntax, and becomes the single place where policy between VLANs is enforced.

05 /How do you check inter-VLAN routing works?

Work outward from the gateway. On the switch, show ip interface brief should list each Vlan interface as up/up. A VLAN interface that is up/down usually means no port in that VLAN is up and forwarding: Cisco's autostate keeps an SVI down until at least one access or trunk port in the VLAN is active, and Juniper's IRB interfaces behave similarly. show ip route connected should show a connected route for each subnet.

From a host, ping the host's own gateway first, then the gateway of the other VLAN, then the remote host. A traceroute from 198.51.100.25 to 203.0.113.40 should show exactly one hop, the gateway, before the destination. On the switch, show ip arp (or show arp on Junos) should hold entries for both hosts, each learned on the matching VLAN interface. If the ping to the gateway works but the remote host does not answer, check the remote host's default gateway and its own firewall before anything else; that is where most "routing" faults turn out to live.

06 /Common mistakes with inter-VLAN routing

• Routing never turned on. SVIs with addresses on a Catalyst that still has no ip routing answer pings to themselves but route nothing.
• SVI down because the VLAN is empty. No active port in the VLAN, or the VLAN missing from the trunk's allowed list, keeps the gateway down. Check the trunk with show interfaces trunk.
• Wrong default gateway on hosts. A static address configured with the old router's address, or a DHCP scope with the wrong option 3, sends traffic nowhere. Same-VLAN traffic still works, which makes it look like a routing fault.
• Duplicate gateways. The old router and the new switch both holding 198.51.100.1 produces ARP flapping and intermittent loss. Remove one before adding the other, or use a first-hop redundancy protocol deliberately.
• Asymmetric paths through a firewall. If the switch routes VLAN 20 to VLAN 30 directly but the firewall sees only the replies, stateful inspection drops them. Route the pair either entirely through the firewall or entirely on the switch.
• Access lists in the wrong direction. On an SVI, in means traffic arriving from that VLAN's hosts. Most filters belong inbound on the source VLAN's interface.
• MTU mismatch. A routed interface with a smaller MTU than the hosts expect breaks large transfers while pings succeed.

07 /Redundant gateways and where to route

A single Layer 3 switch as the gateway for every VLAN is a single point of failure. The usual fix is a pair of distribution switches sharing a virtual gateway address per VLAN through VRRP or a vendor equivalent, described on the VRRP and VSRP first-hop redundancy page. Larger designs push routing down to the access layer so each closet switch routes its own VLANs and connects upward over routed links, removing spanning tree from the uplinks entirely. Either way, the routed VLAN interfaces are part of the routing domain: their connected subnets are advertised into the IGP so the rest of the network, up to the core router that ties sites together, can reach them. For VLANs with users on them, add the edge protections too, from port security on the access ports to DHCP snooping, because the gateway is only as trustworthy as the Layer 2 segment beneath it.