{"id":169394,"date":"2026-06-21T21:12:01","date_gmt":"2026-06-21T18:12:01","guid":{"rendered":"https:\/\/computingforgeeks.com\/?p=169394"},"modified":"2026-06-21T21:12:01","modified_gmt":"2026-06-21T18:12:01","slug":"cisco-layer3-switch-inter-vlan-svi","status":"publish","type":"post","link":"https:\/\/computingforgeeks.com\/cisco-layer3-switch-inter-vlan-svi\/","title":{"rendered":"Configure Inter-VLAN Routing with a Layer 3 Switch (SVI)"},"content":{"rendered":"

Router-on-a-stick gets inter-VLAN routing working, but it routes in software and squeezes every packet between VLANs through one trunk cable. A Layer 3 switch does the same job in hardware, on the same box the VLANs already live on, with nothing to hairpin. The gateways move off an external router and onto the switch itself as switched virtual interfaces, and the bottleneck disappears.<\/p>\n\n

This guide configures inter-VLAN routing on a Layer 3 switch with SVIs, end to end on Cisco IOS: enabling IP routing, building one SVI gateway per VLAN, and verifying that traffic routes between VLANs through the switch. Every command and all output come from a real lab. It is the production answer to the design in the router-on-a-stick<\/a> guide, so if you have not seen that yet, the comparison at the end will make more sense after you have.<\/p>\n\n

Verified June 2026 on a Cisco IOS 15.2 Layer 3 switch with hosts in two VLANs.<\/em><\/p>\n\n

Why a Layer 3 switch beats router-on-a-stick<\/h2>\n\n

In router-on-a-stick, a separate router holds the VLAN gateways on subinterfaces, and all inter-VLAN traffic travels up the trunk to that router and back down. One link carries it all, and a software router does the work. A Layer 3 switch already has every VLAN terminated on its ports, so it can route between them internally, in the switching hardware, at line rate. No external router, no trunk to hairpin over, far more throughput. The trade-off is cost: a Layer 3 switch is pricier than a plain router plus a Layer 2 switch, which is why both designs still have a place.<\/p>\n\n\n

\"Layer<\/figure>\n\n\n

The lab is deliberately small: one Layer 3 switch and two hosts, one per VLAN. Notice there is no router in the picture at all.<\/p>\n\n

\n
Device<\/th>Interface<\/th>Address<\/th>Role<\/th><\/tr><\/thead>
SW1<\/td>Vlan10 (SVI)<\/td>10.10.10.1\/24<\/td>VLAN 10 gateway<\/td><\/tr>\n
SW1<\/td>Vlan20 (SVI)<\/td>10.20.20.1\/24<\/td>VLAN 20 gateway<\/td><\/tr>\n
SW1<\/td>Gi0\/1<\/td>access VLAN 10<\/td>Port to Host10<\/td><\/tr>\n
SW1<\/td>Gi0\/2<\/td>access VLAN 20<\/td>Port to Host20<\/td><\/tr>\n
Host10<\/td>Gi0\/0<\/td>10.10.10.10\/24<\/td>VLAN 10, gateway 10.10.10.1<\/td><\/tr>\n
Host20<\/td>Gi0\/0<\/td>10.20.20.20\/24<\/td>VLAN 20, gateway 10.20.20.1<\/td><\/tr>\n<\/tbody><\/table><\/figure>\n\n

The two hosts are routers acting as end devices, each with an address and a default route to its SVI. Here is the lab running in GNS3:<\/p>\n\n\n

\"GNS3<\/figure>\n\n\n

The full switch and host configs are in the companion lab repo<\/a> if you want to load them directly.<\/p>\n\n

Step 1: Enable IP routing<\/h2>\n\n

This is the step everyone forgets. A multilayer switch ships with routing turned off, so it behaves as a pure Layer 2 device until you tell it otherwise. One global command flips it on:<\/p>\n\n\n

configure terminal\nip routing<\/code><\/pre>\n\n\n
Without ip routing<\/code>, you can build SVIs all day and the switch still will not forward a single packet between them. If inter-VLAN routing is not working and the config looks right, this is the first thing to check.<\/p>\n\n
Step 2: Create the VLANs and access ports<\/h2>\n\n
The Layer 2 design is unchanged from any switched network. Create the VLANs<\/a>, then put each host port in its VLAN as an access port:<\/p>\n\n\n
vlan 10\n name SALES\nvlan 20\n name ENGINEERING\ninterface GigabitEthernet0\/1\n switchport mode access\n switchport access vlan 10\ninterface GigabitEthernet0\/2\n switchport mode access\n switchport access vlan 20<\/code><\/pre>\n\n\n
In a real network the access switches connect to this Layer 3 switch over 802.1Q trunks<\/a> carrying every VLAN. The switch terminates those VLANs on its SVIs, which is the next step.<\/p>\n\n
Step 3: Create the SVIs<\/h2>\n\n
An SVI is a virtual Layer 3 interface tied to a VLAN, and its IP address becomes the default gateway for every host in that VLAN. Create one per routed VLAN:<\/p>\n\n\n
interface Vlan10\n ip address 10.10.10.1 255.255.255.0\n no shutdown\ninterface Vlan20\n ip address 10.20.20.1 255.255.255.0\n no shutdown<\/code><\/pre>\n\n\n
One behaviour catches people out. An SVI’s line protocol comes up only when its VLAN has at least one member port that is up and in the spanning-tree forwarding state (this is autostate). A freshly built SVI with no connected host ports in its VLAN, or one whose only port is STP-blocked, will sit in the down state even though the configuration is correct. Connect a host, or bring up a forwarding port in that VLAN, and the SVI comes up. With Host10 and Host20 plugged into Gi0\/1 and Gi0\/2, both SVIs are up.<\/p>\n\n
Step 4: Verify the routing<\/h2>\n\n
The proof that this is now a router is the routing table. Each VLAN subnet should appear as a connected route out its SVI:<\/p>\n\n\n
\"SW1<\/figure>\n\n\n
Both subnets show as C<\/code> (connected) out Vlan10 and Vlan20. Because each is directly attached, the switch routes between them with no protocol or static route needed. For a fuller breakdown of these codes, see the guide on reading the routing table<\/a>. To confirm the SVI itself, look at the interface:<\/p>\n\n\n
\"SW1<\/figure>\n\n\n
Vlan10 is up with line protocol up, the hardware type is Ethernet SVI, and the address is the gateway you configured. The VLAN brief confirms Host10 sits in SALES (VLAN 10) and Host20 in ENGINEERING (VLAN 20).<\/p>\n\n
Step 5: Verify traffic crosses VLANs<\/h2>\n\n
A clean routing table is necessary but not sufficient. The real test is a host in one VLAN reaching a host in another, with a traceroute to show the path:<\/p>\n\n\n
\"Host10<\/figure>\n\n\n
The ping from Host10 in VLAN 10 to Host20 in VLAN 20 succeeds at 100 percent, and the traceroute shows a single hop before the destination: 10.10.10.1, the Vlan10 SVI. That first hop is the switch itself doing the routing. Compare that with router-on-a-stick, where the same first hop would be a separate router reached over a trunk. Here, the gateway and the router are the same device.<\/p>\n\n
Router-on-a-stick versus a Layer 3 switch<\/h2>\n\n
Both designs solve the same problem, so the choice comes down to scale, throughput, and what hardware you already own:<\/p>\n\n
\n
Factor<\/th>Router-on-a-stick<\/th>Layer 3 switch (SVIs)<\/th><\/tr><\/thead>
Routing done by<\/td>External router, in software<\/td>The switch, in hardware (ASICs)<\/td><\/tr>\n
Gateway lives on<\/td>Router subinterfaces<\/td>SVIs on the switch<\/td><\/tr>\n
Inter-VLAN path<\/td>Up and back over one trunk<\/td>Internal to the switch<\/td><\/tr>\n
Throughput<\/td>Limited by the single trunk<\/td>Line rate, no shared bottleneck<\/td><\/tr>\n
Best for<\/td>Few VLANs, labs, small sites<\/td>Many VLANs, production, heavy east-west traffic<\/td><\/tr>\n
Cost<\/td>Cheap (router + L2 switch)<\/td>Higher (multilayer switch)<\/td><\/tr>\n<\/tbody><\/table><\/figure>\n\n
The rule of thumb: reach for router-on-a-stick when you have a handful of VLANs and a spare router, and move the gateways onto a Layer 3 switch the moment VLAN count or inter-VLAN traffic grows. The commands you just ran are the ones production networks actually use.<\/p>\n\n
Test yourself on Layer 3 switch routing<\/h2>\n\n
Eight questions on SVIs, enabling routing, and the difference from router-on-a-stick. Each answer is doc-checked or verified on the lab above.<\/p>\n\n
Loading quiz...<\/div><\/div>\n\n
Drill the commands and concepts with the flashcard deck, and grab the same cards as an Anki deck for review on your phone:<\/p>\n\n
Loading flashcards...<\/div><\/div>\n\n
With both inter-VLAN routing methods under your belt, the switching and routing halves of the CCNA finally connect: VLANs segment the hosts, and either a router or a Layer 3 switch ties them back together. The next building block is keeping that gateway available when a device fails, which is where first-hop redundancy comes in. For the full sequence, follow the CCNA 200-301 study roadmap<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"
Router-on-a-stick gets inter-VLAN routing working, but it routes in software and squeezes every packet between VLANs through one trunk cable. A Layer 3 switch does the same job in hardware, on the same box the VLANs already live on, with nothing to hairpin. The gateways move off an external router and onto the switch itself … Read more<\/a><\/p>\n","protected":false},"author":3,"featured_media":169395,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[299,55],"tags":[524,525],"cfg_series":[39888],"class_list":["post-169394","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-how-to","category-networking","tag-ccna","tag-cisco","cfg_series-ccna-200-301"],"_links":{"self":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/169394","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/comments?post=169394"}],"version-history":[{"count":1,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/169394\/revisions"}],"predecessor-version":[{"id":169399,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/posts\/169394\/revisions\/169399"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/media\/169395"}],"wp:attachment":[{"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/media?parent=169394"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/categories?post=169394"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/tags?post=169394"},{"taxonomy":"cfg_series","embeddable":true,"href":"https:\/\/computingforgeeks.com\/wp-json\/wp\/v2\/cfg_series?post=169394"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}