Inter-VLAN Routing Explained
Learn how inter-VLAN routing works — router-on-a-stick vs Layer-3 switch SVIs — with a real config example and interview Q&A.
Expected Interview Answer
Inter-VLAN routing is the process of forwarding traffic between two different VLANs, which is required because VLANs are isolated broadcast domains at Layer 2 — it is typically done with a router-on-a-stick (a single trunk link into a router with sub-interfaces per VLAN) or, more commonly today, a Layer-3 switch with switch virtual interfaces (SVIs).
Because each VLAN is its own broadcast domain, a device in VLAN 10 cannot reach a device in VLAN 20 through switching alone — something has to route between the two IP subnets that map to those VLANs. In the router-on-a-stick design, one physical trunk link connects a switch to a router, and the router creates a logical sub-interface per VLAN (e.g., eth0.10, eth0.20), each configured with the IP address that acts as the default gateway for that VLAN’s subnet; traffic between VLANs enters the router tagged with the source VLAN, gets routed, and leaves tagged with the destination VLAN. The more scalable modern approach uses a Layer-3 switch, which creates a switch virtual interface (SVI) per VLAN directly on the switch and routes between them in hardware at line rate, avoiding the trunk-link bottleneck of router-on-a-stick. Either way, each VLAN maps to its own IP subnet, and the routing device’s interface for that VLAN becomes the default gateway for hosts in it — access control lists (ACLs) are commonly applied at this routing point to enforce which VLANs are allowed to reach each other.
- Enables controlled communication between otherwise isolated VLANs
- SVIs on a Layer-3 switch route at line rate without a trunk bottleneck
- ACLs at the routing point enforce which VLANs can reach each other
- Keeps VLAN-per-subnet design clean and scalable
AI Mentor Explanation
Inter-VLAN routing is like a tournament liaison officer standing between two separately wristbanded seating zones, checking each request to pass a message from the VIP zone to the media zone and only allowing it through the officer’s desk rather than letting fans shout directly across zones. The officer’s desk is the only path between the two colored zones, just as a router or Layer-3 switch is the only path between two VLANs. Without that officer, a VIP fan physically cannot get a message to someone in the media zone even if they are only a few meters apart. This gatekeeping is exactly what inter-VLAN routing does between isolated broadcast domains.
Step-by-Step Explanation
Step 1
Assign a subnet per VLAN
Each VLAN is mapped to its own IP subnet (e.g., VLAN 10 = 192.168.10.0/24).
Step 2
Configure gateways
A router sub-interface or a Layer-3 switch SVI is configured with the gateway IP for each VLAN's subnet.
Step 3
Trunk or hardware routing
Router-on-a-stick routes over a single tagged trunk link; a Layer-3 switch routes internally at line rate via SVIs.
Step 4
Apply policy
ACLs at the routing point permit or deny which VLANs are allowed to reach each other.
What Interviewer Expects
- Explains why VLANs need a routing device to communicate at all
- Can describe both router-on-a-stick and Layer-3 switch/SVI approaches
- Knows each VLAN maps to its own IP subnet with its own gateway
- Mentions ACLs as the natural policy enforcement point between VLANs
Common Mistakes
- Thinking a plain Layer-2 switch can route between VLANs on its own
- Confusing router-on-a-stick with a Layer-3 switch's SVI approach
- Forgetting each VLAN needs its own subnet and gateway address
- Not mentioning the trunk-link bottleneck risk of router-on-a-stick at scale
Best Answer (HR Friendly)
“Inter-VLAN routing is how two separate virtual networks that normally cannot talk to each other are allowed to exchange traffic, using a router or a smart Layer-3 switch as the go-between. It is like putting a security desk between two separately badged office floors — the desk decides what is allowed through, so the floors stay isolated by default but can still cooperate when needed.”
Code Example
# Router side: create a tagged sub-interface per VLAN on one trunk link
sudo ip link add link eth0 name eth0.10 type vlan id 10
sudo ip addr add 192.168.10.1/24 dev eth0.10
sudo ip link set eth0.10 up
sudo ip link add link eth0 name eth0.20 type vlan id 20
sudo ip addr add 192.168.20.1/24 dev eth0.20
sudo ip link set eth0.20 up
# Enable IP forwarding so the router actually routes between the two subnets
sudo sysctl -w net.ipv4.ip_forward=1Follow-up Questions
- How does a Layer-3 switch's SVI differ from router-on-a-stick?
- What is the bottleneck risk of router-on-a-stick at high traffic volumes?
- How would you use ACLs to restrict which VLANs can reach a sensitive subnet?
- What happens if two VLANs are mistakenly assigned overlapping subnets?
MCQ Practice
1. Why is a routing device required between two VLANs?
VLANs isolate traffic at Layer 2, so only a router or Layer-3 switch can forward traffic between them.
2. What does an SVI (switch virtual interface) provide?
An SVI is a logical, per-VLAN Layer-3 interface on a switch, used to route between VLANs at line rate.
3. In router-on-a-stick, how many physical links connect the router to the switch?
Router-on-a-stick uses a single trunk link with tagged sub-interfaces for each VLAN.
Flash Cards
What is inter-VLAN routing? — Forwarding traffic between two different VLANs via a router or Layer-3 switch.
Router-on-a-stick? — A single trunk link into a router with a tagged sub-interface per VLAN.
What is an SVI? — A switch virtual interface — a per-VLAN routed interface on a Layer-3 switch.
Why use ACLs at the routing point? — To control exactly which VLANs are permitted to reach each other.