Inter-VLAN Routing

What you will be able to do

• Explain why devices in different VLANs require routing to communicate.
• Describe how trunking and 802.1Q tagging carry multiple VLANs between devices.
• Identify the purpose of router subinterfaces in a router-on-a-stick design.
• Explain how native VLAN and allowed VLAN settings affect trunk traffic.

01

Why Routing Is Needed

A VLAN separates a Layer 2 network into a distinct logical segment. Devices assigned to different VLANs therefore belong to different broadcast areas.

A standard Layer 2 device does not provide communication between ports assigned to different VLANs. Traffic between those VLANs must reach a router, which can make a Layer 3 forwarding decision.

Inter-VLAN routing is the process of routing traffic between separate VLANs. It connects those Layer 2 segments while preserving their VLAN separation.

For example, imagine two groups connected to VLAN 10 and VLAN 20. A device in VLAN 10 cannot send directly through Layer 2 to a device in VLAN 20; the traffic must pass through routing.

02

The Trunk Link

A trunk carries traffic from multiple VLANs across one point-to-point link between two devices. This allows one physical connection to transport traffic for several logical networks.

A trunk port supports multiple VLANs through IEEE 802.1Q traffic. Frames can carry VLAN tags that identify the VLAN associated with each frame.

Consider a switch connected to a router by one cable. Instead of using a separate cable for every VLAN, the trunk carries the traffic for all selected VLANs over that shared link.

A trunk differs from an access connection because it represents multiple VLANs rather than one VLAN. The router must still receive enough VLAN information to handle each network separately.

03

Virtual Interfaces on the Router

A VLAN subinterface is a virtual Cisco IOS interface attached to a VLAN ID on a routed physical interface. It gives one physical router connection several logical Layer 3 interfaces.

In a router-on-a-stick design, the router uses one subinterface for each VLAN. Each subinterface contains the Layer 3 gateway information for its associated VLAN.

Suppose the physical router interface connects to a trunk. One virtual interface can represent VLAN 10, while another represents VLAN 20. Traffic arriving for either VLAN reaches the matching logical interface.

The physical link is shared, but the subinterfaces keep the VLAN roles distinct. This arrangement lets the router process traffic between the VLANs through their separate Layer 3 gateway interfaces.

04

Following Traffic Between VLANs

A device in one VLAN sends traffic toward its Layer 3 gateway when the destination belongs to another VLAN. The gateway is provided by the router subinterface associated with the source VLAN.

The trunk carries that traffic between the switch and router. The VLAN identity allows the router to select the corresponding subinterface for processing.

The router then routes the traffic toward the destination VLAN through that VLAN’s subinterface. The return path uses the same general relationship in the opposite direction.

The important relationship is this: the switch preserves VLAN membership at Layer 2, the trunk transports multiple VLANs. the router performs the Layer 3 movement between them.

05

Native VLAN and Untagged Traffic

IEEE 802.1Q trunking sends one VLAN without a tag. That VLAN is called the native VLAN, and it carries untagged traffic when the port operates in trunking mode.

Both sides of the trunk must use the same native VLAN. A mismatch means the two devices do not interpret untagged traffic as belonging to the same VLAN.

For instance, if one side treats VLAN 10 as native while the other treats VLAN 20 as native, untagged traffic receives different VLAN meanings on the two sides.

A Cisco sample uses VLAN 1 as the default native VLAN on both the router and Catalyst switch. The broader rule is that the native VLAN setting must agree across the trunk.

06

Choosing VLANs for a Trunk

A trunk port is initially a member of every VLAN known to VTP. This gives the trunk potential membership across the VLANs available in that VTP environment.

An allowed VLAN list can narrow that membership for one individual trunk port. The list determines which VLANs that specific trunk may carry.

The allowed list is local to its associated trunk port. Changing it does not automatically change the allowed VLANs on other trunk ports.

For example, a trunk could be permitted to carry VLANs 10 and 20 while excluding VLAN 30. Another trunk can have a different list because each port is evaluated separately.

07

VLAN Existence and Forwarding

An allowed VLAN list cannot create a VLAN. A trunk port cannot join a VLAN unless VTP knows that VLAN and the VLAN is enabled.

This creates two conditions for forwarding: the VLAN must be available through VTP, and the trunk’s allowed list must include it.

If an enabled VTP-learned VLAN is excluded from the allowed list, that trunk forwards no traffic for the VLAN. The VLAN may exist, but that particular link will not carry it.

When troubleshooting a router-on-a-stick link, compare the VLANs required by the router subinterfaces with the VLANs available and permitted on the trunk.

08

Putting the Design Together

A working inter-VLAN design connects three roles. VLANs provide separate Layer 2 segments, the trunk transports their traffic, and router subinterfaces provide Layer 3 gateways.

The VLAN identifiers must correspond across the design. A subinterface represents a particular VLAN, while the trunk must be able to carry that VLAN toward the router.

The native VLAN requires special attention because its traffic is untagged. Both trunk sides must agree about which VLAN has that role.

The allowed VLAN list adds another boundary. Even when a VLAN is enabled and known through VTP, excluding it from the relevant trunk stops that trunk from forwarding its traffic.

09

Recap Before Practice and Prove

Inter-VLAN routing lets a router move traffic between separate VLANs. A standard Layer 2 device alone cannot provide that communication.

A trunk carries multiple VLANs across one link using IEEE 802.1Q traffic. One VLAN is sent without a tag as the native VLAN, so both trunk sides must match.

Router-on-a-stick uses one virtual subinterface per VLAN. Each subinterface supplies Layer 3 gateway information for its VLAN.

A trunk’s allowed VLAN list controls that individual port. The VLAN must also be known through VTP and enabled before the trunk can carry it.

In Practice and Prove, trace the VLAN path, identify the matching subinterface, and check native VLAN and allowed-list requirements.