Why inter-VLAN routing is needed
A VLAN boundary acts exactly like a router interface boundary — traffic cannot cross from one VLAN to another without passing through a Layer 3 device. A PC in VLAN 10 (192.168.10.0/24) cannot reach a server in VLAN 20 (192.168.20.0/24) by switching alone, just as a device in 192.168.10.0/24 cannot reach 192.168.20.0/24 without routing.
The options for providing inter-VLAN routing: connect a physical router to the switch, use router-on-a-stick sub-interfaces, or configure Switched Virtual Interfaces (SVIs) on a Layer 3 switch. Each option moves IP routing into the path between VLANs.
Router-on-a-stick (ROAS)
Router-on-a-stick uses a single physical link between a router and a switch, configured as a trunk, with logical sub-interfaces on the router — one per VLAN. Each sub-interface gets an IP address that becomes the default gateway for that VLAN.
Configuration on the router: create sub-interfaces on the physical interface (e.g., `interface GigabitEthernet0/0.10`), set the encapsulation to 802.1Q with the VLAN ID (`encapsulation dot1q 10`), and assign an IP address. The physical interface must be `no shutdown` and have no IP address itself — the sub-interfaces carry all traffic.
On the switch: configure the port connecting to the router as a trunk (`switchport mode trunk`). Traffic from each VLAN arrives tagged at the router, the sub-interface strips the tag and routes the packet, then re-tags it with the destination VLAN tag before sending back to the switch.
The limitation of ROAS: all inter-VLAN traffic passes through a single physical link, which becomes a bottleneck. For small networks this is fine; large networks need Layer 3 switching.
Layer 3 switch SVIs
A Switched Virtual Interface (SVI) is a virtual Layer 3 interface on a Layer 3 switch, associated with a VLAN. You create an SVI with `interface vlan <id>` and assign it an IP address — this IP becomes the default gateway for devices in that VLAN.
When a frame arrives at a Layer 3 switch from VLAN 10 destined for VLAN 20, the switch routes it internally between the two SVIs without sending traffic out any physical interface. This happens in hardware at wire speed — much faster than routing through an external router.
For SVIs to route traffic, the Layer 3 switch needs `ip routing` enabled globally. Without this command, the SVIs can have IP addresses for management purposes but cannot route between VLANs.
The SVI approach is the preferred method for large campus networks. The distribution layer Layer 3 switches handle all inter-VLAN routing for the access layer switches connected to them, keeping inter-VLAN traffic off the uplinks to the core.
Legacy inter-VLAN routing
The oldest approach: one physical router interface per VLAN, each interface in the same subnet as the VLAN it serves. A router with 4 VLANs needs 4 physical interfaces — one for each VLAN's subnet. This is wasteful of router interfaces and physical cabling.
Legacy inter-VLAN routing is rarely used today and is only tested conceptually on CCNA. It's useful to understand because it shows why router-on-a-stick was developed as an improvement (single physical link, logical sub-interfaces per VLAN).