Inter-Vlan Routing

Virtual LANs (VLANs) offer a method of dividing one physical network into multiple broadcast domains. Through VLAN we can get a sort of security like different VLAN members can not communicate with each other by default and we can do so if we allowed them to communicate and here we reduce broadcast domain. VLAN needs when we want to divide our clients so that it can not communicate with each other, one of the method is to connect them with separate switch so it will not communicate while in case of same switch all ports are member of VLAN 1 by default and members in same VLAN can communicate with each other but its not the healthy one solution so CISCO made life easy by describing the concept of VLAN where we can group our clients, so logically it will shows like they are connected to different switch and physically will be connected to same switch, now at times we want to communicate between these different VLAN’s so we can accomplish this task through three different methods namely Router on a Stick, Switch Virtual Interface (SVI) and Multi-Layer Switch (MLS). Here I am going to explain about the two methods.

1. Multi-Layer Switch (MLS)

Following steps should be taken in order to communicate between different VLAN’s. I took 3560 Cisco catalyst switch, two pc’s.

A): Take Cisco Catalyst 3560 switch and connect two pc to it, in my case I connect one pc to Fast Ethernet 0/1 and Fast Ethernet 0/2.

B): Create two VLAN namely VLAN-2 and VLAN-3.

ML-Switch (config) #vlan 2
ML-Switch (config-vlan) #
ML-Switch (config) #vlan 3
ML-Switch (config-vlan) #

C): NOTE: If we assign IP address now and later we make the interface member of VLAN so it will not allowed us to do so, the correct way is to assign the interface to the correct VLAN and then assign IP address to that interface and also assign addresses to the PC also.

ML-Switch (config-if) #interface fastethernet 0/1
ML-Switch (config-if) #switchport mode access
ML-Switch (config-if) #switchport access vlan 2

ML-Switch (config-if) #interface fastethernet 0/2
ML-Switch (config-if) #switchport mode access
ML-Switch (config-if) #switchport access vlan 3

The following command will tell the switch that you are no more switchport, now we can assign ip address to it.

ML-Switch (config-if) #interface fastethernet 0/1
ML-Switch (config-if) #no switchport
ML-Switch (config-if) #ip address 10.1.1.2 255.0.0.0
ML-Switch (config-if) #no shutdown


ML-Switch (config-if) #interface fastethernet 0/2
ML-Switch (config-if) #no switchport
ML-Switch (config-if) #ip address 20.1.1.2 255.0.0.0
ML-Switch (config-if) #no shutdown

Now to enable routing on the switch we have the following command.

ML-Switch (config-if) # ip routing

Make sure to give the switch interfaces addresses as a gateway on your pc’s, Now to check the communication between these two different VLAN,

PC_1 > ping 20.1.1.1
Pinging 20.1.1.1 with 32 bytes of data:

Reply from 20.1.1.1: bytes=32 time=62ms TTL=127
Reply from 20.1.1.1: bytes=32 time=62ms TTL=127
Reply from 20.1.1.1: bytes=32 time=62ms TTL=127
Reply from 20.1.1.1: bytes=32 time=62ms TTL=127

Ping statistics for 20.1.1.1:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 62ms, Maximum = 62ms, Average = 62ms


2. Router on a Stick

In this method we will need a router and switch (can be layer-2 switch) and two pc.

A): Connect router fastethernet 0/0 to switch fastethernet 0/1, PC-1 to switch fastethernet 0/2 and PC-2 to switch fastethernet 0/3.

B): Create two VLAN on switch and assign the interface to that VLAN.

Switch (config) #vlan 2
Switch (config-vlan) #
Switch (config) #vlan 3
Switch (config-vlan) #
Switch (config-if) #interface fastethernet 0/2
Switch (config-if) #switchport mode access
Switch (config-if) #switchport access vlan 2

Switch (config-if) #interface fastethernet 0/3
Switch (config-if) #switchport mode access
Switch (config-if) #switchport access vlan 3

C): Assign IP address on PC and Router fastethernet (I will be defining two sub-interfaces on router).

PC-1 IP address: 10.1.1.1
PC-2 IP address: 20.1.1.1

Router (config) #interface fastEthernet 0/0
Router (config-if) #no shutdown
Router (config-if) #exit

We will be defining trunk link between switch and router as multiple VLAN information will be moving through this link and for trunk link we have to define encapsulation, in this case we have layer-2 (2950) switch where we have only dot1q encapsulation available. And also remember to assign the sub-interface addresses as a gateway on your PC.

Note: If we trying to assign IP address on sub-interface on router before identifying to which VLAN it is associated and without assigning encapsulation you will get an error like

“% configuring IP routing on a LAN sub-interface is only allowed if that
Sub-interface is already configured as part of an IEEE 802.10, IEEE 802.1Q,
or ISL VLAN”.

Router (config) #interface fastEthernet 0/0.2
Router (config-subif) #encapsulation dot1Q 2
Router (config-subif) #ip address 10.1.1.2 255.0.0.0
Router (config-subif) #no shutdown


Router (config) #interface fastEthernet 0/0.3
Router (config-subif) #encapsulation dot1Q 3
Router (config-subif) #ip address 20.1.1.2 255.0.0.0
Router (config-subif) #no shutdown

Now to communicate between these two different VLAN’s we have to configure trunk link so configuration on switch are as:

Switch (config-if) #switchport mode trunk
Switch (config-if) #switchport trunk allowed vlan 2, 3

Now check the communication

PC-2>ping 10.1.1.1

Pinging 10.1.1.1 with 32 bytes of data:

Reply from 10.1.1.1: bytes=32 time=188ms TTL=127
Reply from 10.1.1.1: bytes=32 time=125ms TTL=127
Reply from 10.1.1.1: bytes=32 time=124ms TTL=127
Reply from 10.1.1.1: bytes=32 time=121ms TTL=127

Ping statistics for 10.1.1.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 121ms, Maximum = 188ms, Average = 139ms


I hope it will be informative for you.

Thank You for Reading