Routing between VLANs

Why does a working trunk not connect the two subnets?

A VLAN is a Layer 2 Ethernet forwarding group. A subnet is an IP address range. Here we assign one /24 subnet to each VLAN. The switch keeps their local frames separate, including broadcasts. An 802.1Q trunk extends those groups over one cable; it does not turn one group into the other.

A Layer 2 switch does not route traffic from VLAN 10 into VLAN 20. A Layer 3 device (router, firewall or multilayer switch) has to route between the subnets, and each VLAN gets its own gateway address.

The default gateway is the local router address the host uses when no more specific route matches. The employee is 192.168.10.25/24, gateway 192.168.10.1. The other host is 192.168.20.50/24, gateway 192.168.20.1. The goal is a permitted test from the employee to that host, not unrestricted guest access to employee systems.

The source host sends its Ethernet frame to its gateway's MAC address, while the IP packet stays addressed to the destination host. Routing creates a new outgoing frame in the destination VLAN; it does not simply relabel the incoming frame and flood it everywhere.

Design 1: router-on-a-stick

Situation: employee 192.168.10.25 sends to guest device 192.168.20.50. One router link is a trunk, with a subinterface (and gateway) per VLAN.

Router-on-a-stick means one physical router interface carries the VLANs to and from the switch. A subinterface is a logical interface under that physical port. Gi0/0.10 names a subinterface; the command encapsulation dot1Q 10, not the suffix .10, selects its VLAN. Matching the suffix to the VLAN is a useful naming convention.

Before forwarding, the employee uses ARP (Address Resolution Protocol) to find the VLAN 10 gateway's local MAC address. R1 reads the IP destination and selects its connected VLAN 20 route. It resolves the destination host's MAC in VLAN 20, then sends a new frame. IPv4 TTL (Time to Live) decreases at this router hop; the two IP addresses stay the same in this lab, which uses no NAT.

Router subinterfaces can share the physical interface's MAC address. The essential distinction is the frame's forwarding context and destination MAC, not an assumption that every subinterface must have a different MAC.

Build the switch side first

Use isolated Cisco IOS or IOS XE devices supporting these features. Begin in global configuration mode. In this example SW1 Gi1/0/23 connects R1 Gi0/0, and the two hosts connect to Gi1/0/1 and Gi1/0/3.

Give the router one gateway in each subnet

The parent Gi0/0 must be enabled and physically connected. The gateway addresses belong to the subinterfaces, not to the parent in this design. The .99 native subinterface has no user gateway address: it matches the switch's untagged-native classification and is not a third user subnet.

Design 2: multilayer switch with SVIs

A multilayer switch supports both Ethernet switching and IP routing. It routes internally using Switch Virtual Interfaces (SVIs), one per VLAN, so the illustrated traffic does not need an external router link. Hardware, licensing and platform forwarding capacity determine what it supports; this is not a claim that every switch can route.

interface Vlan10 selects an SVI, a logical Layer 3 interface for VLAN 10. It is not an access port and does not move a host into VLAN 10. Retain the VLAN 10 and 20 access-port membership shown above when using this alternative design. The R1 uplink is not required for routing between these locally attached hosts.

Verify the gateway, route and host separately

For router-on-a-stick, use show ip interface brief to check Gi0/0 and its subinterfaces, and show interfaces trunk on SW1 to check that VLANs 10 and 20 are allowed, active and forwarding. For the SVI design, check Vlan10 and Vlan20 are up/up and ip routing is enabled.

R1#show ip route connected
C    192.168.10.0/24 is directly connected, GigabitEthernet0/0.10
L    192.168.10.1/32 is directly connected, GigabitEthernet0/0.10
C    192.168.20.0/24 is directly connected, GigabitEthernet0/0.20
L    192.168.20.1/32 is directly connected, GigabitEthernet0/0.20

Short lab: break one forwarding requirement

1. Choose one design and establish the healthy baseline. Each host should first reach its own gateway. Then test the permitted inter-VLAN path. Use the numeric IPs so a name-resolution failure does not confuse the routing test.
2. For router-on-a-stick, remove VLAN 20 only from the isolated SW1 uplink using switchport trunk allowed vlan remove 20. The router parent can stay up while VLAN 20 data cannot cross. Compare the trunk list with the router's interface status; up/up alone does not test each VLAN.
3. Restore the intended list using switchport trunk allowed vlan add 20 on that uplink. The add form retains VLANs 10 and 99. Verify the forwarding list and repeat both gateway and host tests.
4. If you chose the SVI design instead, deliberately shut only Vlan20 in the isolated lab. Observe its interface state and connected route. Recover with no shutdown under interface Vlan20, confirm normal autostate requirements, and retest. Do not apply both alternative faults at once.

Router-on-a-stick makes a small lab easy to understand, but its VLANs share an uplink and router forwarding capacity. An SVI design avoids that external hop for local routing, while adding a need for routing-capable switch hardware and deliberate policy. Neither design automatically enforces an employee/guest boundary once routes exist.

For the complete switch-port configuration and verification, use the inter-VLAN routing lab.

Either way, VLANs separate traffic but routing reconnects it: use access-control lists (ACLs) or firewall rules to decide what's allowed between them.

Cisco reference

Cisco: inter-VLAN routing using an external router. Configuration assumes IPv4 routing on a supported platform with no NAT or blocking lab policy. Outputs are documentation-based examples, not measurements from physical devices.

Cisco: interface characteristics and SVI autostate

Check the routing decision