Inter-VLAN Routing: Router-on-a-Stick vs Layer 3 Switch SVIs

VLANs are separate broadcast domains, and separate broadcast domains are separate IP subnets, so traffic between them has to be routed at Layer 3. Two designs do that job. Router-on-a-stick puts one dot1Q subinterface per VLAN on a single router interface facing a trunk. A Layer 3 switch instead creates a switched virtual interface (SVI) for each VLAN and routes between them in its own hardware, which requires the global ip routing command. Both give hosts a gateway address inside their own subnet; they differ in throughput and in how much of the network one failure takes down.

The need for a Layer 3 gateway

A switch forwards frames only within a VLAN. A host in VLAN 10 that wants to reach 10.1.20.50 compares the destination against its own address and mask, concludes the destination is off-subnet, and sends the frame to its default gateway’s MAC address. If no device owns an IP address in 10.1.10.0/24 and is willing to forward, the conversation stops there. Inter-VLAN routing is the act of giving every VLAN a gateway address on a device that will forward between those gateways. That single address is also a single point of failure, which is the problem first hop redundancy protocols exist to solve.

Router-on-a-stick

The name describes the cabling: one physical link (the stick) carries every VLAN as tagged traffic to a router. The switch side of that link must be a real 802.1Q trunk that permits each VLAN you intend to route. The router side is divided into logical subinterfaces, one per VLAN.

SW1(config)# interface GigabitEthernet1/0/1
SW1(config-if)# switchport trunk encapsulation dot1q
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20,30

R1(config)# interface GigabitEthernet0/0
R1(config-if)# no shutdown
R1(config-if)# interface GigabitEthernet0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 10.1.10.1 255.255.255.0
R1(config-subif)# interface GigabitEthernet0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 10.1.20.1 255.255.255.0

Four mechanics decide whether this works.

The subinterface number is a label, the encapsulation value is the VLAN. Matching them (Gi0/0.10 carrying VLAN 10) is a convention that makes the configuration readable. What actually associates the subinterface with a VLAN is encapsulation dot1Q 10. Without that command the subinterface holds an address but never receives tagged frames.

Addressing lives on the subinterfaces. Each subinterface takes an address inside the subnet of the VLAN it serves, and that address is what hosts in the VLAN configure as their default gateway. The parent physical interface normally carries no IP address of its own.

Line state is inherited from the parent. Subinterfaces do not have to be enabled one at a time; they follow the physical interface. The physical interface, though, is shut down by default on a router, so no shutdown on the parent is mandatory. A configuration that looks flawless but shows every subinterface as administratively down almost always has an un-enabled parent, and show ip interface brief is where you see it:

R1# show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0     unassigned      YES unset  administratively down down
GigabitEthernet0/0.10  10.1.10.1       YES manual administratively down down
GigabitEthernet0/0.20  10.1.20.1       YES manual administratively down down

Untagged traffic needs the native keyword. Frames in the trunk’s native VLAN arrive without a tag. To route them, add native to the encapsulation command on the subinterface that serves that VLAN: encapsulation dot1Q 1 native. Leaving it off means untagged frames land on the parent interface, which usually has no address and drops them. Keep the native VLAN identical on both ends of the link, as covered in native VLAN mismatches.

No routing protocol is involved. Each subinterface produces a connected route, and connected routes are all the router needs to forward between them. Likewise, ip routing is not something you enter on a router; routers route by default.

Layer 3 switch SVIs

A multilayer switch does the same job without a separate router. Create the VLAN, create an interface whose number is the VLAN ID, address it, and enable routing globally:

SW1(config)# ip routing
SW1(config)# vlan 20
SW1(config-vlan)# name ENGINEERING
SW1(config-vlan)# exit
SW1(config)# interface vlan 20
SW1(config-if)# ip address 10.1.20.1 255.255.255.0
SW1(config-if)# no shutdown

interface vlan 20 is the only syntax that builds an SVI. There is no svi command, and a subinterface on a physical switch port is not an SVI.

Two behaviors trip people up. First, omitting ip routing leaves you with SVIs that are up and pingable from inside their own VLANs but that will not forward between each other, because the switch is still acting purely as a Layer 2 device. Symptoms are precise: hosts reach their gateway and nothing beyond it. Adding a static route does not fix this, because the problem is that forwarding is disabled, not that a path is missing.

Second, an SVI’s line protocol depends on the VLAN having somewhere to send traffic. The SVI stays down until the VLAN exists in the switch’s VLAN database, is not shut down, and has at least one port that is up and in the spanning-tree forwarding state, whether an access port or a trunk that permits the VLAN. A brand-new VLAN whose cabling has not been pulled produces an SVI that reads down/down no matter how many times you enter no shutdown, and it comes up on its own the moment the first device connects.

Design comparison

	Router-on-a-stick	Layer 3 switch SVIs
Gateway object	Subinterface per VLAN	interface vlan <id> per VLAN
VLAN association	encapsulation dot1Q <id>	The interface number is the VLAN ID
Enabling forwarding	Automatic on a router	ip routing in global config
Forwarding path	Software or router hardware, out and back over one trunk	Switch ASIC hardware, port to port
Bandwidth ceiling	The single trunk carries every inter-VLAN flow twice	Backplane capacity, no shared hairpin
Failure domain	One cable or one router outage stops all inter-VLAN traffic	Failure is contained to the affected VLANs or ports
Typical use	Small sites, branch routers, lab work	Campus distribution and access layers

The two advantages that matter are hardware forwarding and the removal of the hairpin: with SVIs, a frame from VLAN 10 to VLAN 20 never leaves the switch. Claims that SVIs work without the VLAN existing, that they route without ip routing, or that they raise a per-port VLAN limit are all false. If you are choosing between platforms, Layer 3 switch versus router covers the wider trade-offs.

Verification

show ip interface brief confirms addressing and line state on both designs. show ip route should list a connected (C) and local (L) entry for every VLAN subnet you expect to route. On the switch side, show interfaces trunk proves the uplink is trunking and permits the right VLANs. To confirm that hosts are actually landing in a VLAN, show mac address-table vlan 20 lists the MAC addresses learned in that VLAN alongside the ports they were learned on; show vlan id 20 lists port membership rather than learned addresses, and show interfaces vlan 20 describes the SVI itself.

How the 200-301 exam tests this

• Configuration syntax discrimination. You are shown four command forms for creating a per-VLAN logical interface and must pick the right one for the platform in the stem. On a router it is interface GigabitEthernet0/0.10; on a Layer 3 switch it is interface vlan 20. Distractors invent syntax such as a subinterface keyword or a VLAN argument appended to a physical interface.
• One symptom, one fix. A scenario gives you working trunks, correct encapsulation, correct addresses, and total failure. The output then shows administratively down parent and children, and the answer is a single no shutdown on the physical interface, not on each subinterface.
• Gateway reachable, peers unreachable. On a Layer 3 switch with two healthy SVIs, hosts ping their own gateway but not the other VLAN. That precise pattern means ip routing is missing.
• Genuine versus invented benefits. Multi-select items mix true SVI advantages (hardware forwarding, no shared trunk bottleneck) with plausible-sounding falsehoods about VLAN databases or routing commands being unnecessary.

The syntax items fall quickly once you have typed both configurations yourself, and practice exams cover the recognition side that lab time leaves out.

Quick reference

• Inter-VLAN routing needs a Layer 3 gateway address per VLAN, because each VLAN is its own subnet.
• Router-on-a-stick: switch port trunking, one subinterface per VLAN, encapsulation dot1Q <id>, address on each subinterface.
• Add native to the encapsulation command on the subinterface that handles untagged frames.
• Subinterfaces inherit line state from the parent; enable the parent with no shutdown.
• Layer 3 switch: interface vlan <id> plus an address, and ip routing globally or nothing is forwarded.
• An SVI stays down until its VLAN exists, is not shut down, and has an up, forwarding port.
• Routers do not need ip routing; Layer 3 switches do.
• Verify with show ip interface brief, show ip route, show interfaces trunk, and show mac address-table vlan <id>.