Multilayer Switch Inter-VLAN Routing
Multilayer Switch Inter-VLAN Routing is a method of inter-VLAN routing in which a different
kind of switch known as a multilayer switch is used to perform routing functions. A
multilayer switch is a hybrid device that combines the functions of a switch with a router,
which enables it to operate on both Layer 2 (L2) and Layer 3 (L3) of the OSI model, hence
the name multilayer. Unlike the router-on-a-stick inter-VLAN routing method, a multilayer
switch inter-VLAN routing does not require a dedicated router—everything happens inside
the switch. Multilayer switches perform all VLAN routing functions on the network, thereby
replacing the need for dedicated routers or trunk links.
To enable a multilayer switch to perform routing functions, logical (virtual) interfaces known
as Switch Virtual Interface (SVI) are used, one for each VLAN. SVI, also known as the
VLAN interface, is a virtual-routed interface that connects a VLAN on the device to the
Layer 3 routing engine within the same device. It can be configured with multiple IP
addresses that correspond to the VLANs on the switch. Each SVI is configured for different
subnets corresponding to their assigned VLAN to facilitate logical routing.
When the multilayer switch receives a packet in a VLAN intended at the Layer 2 switch, the
multilayer switch performs routing. Let’s take a look at the diagram shown in Figure 3.0
below:
1
Figure 3.0 Multilayer switch inter-VLAN routing
If Host A in VLAN 10, wants to send a message to Host B in VLAN 20, the steps it would
take are as follows:
1. Host A sends its unicast traffic to the directly connected L2 switch.
2. L2 switch tags the unicast traffic as originating on VLAN 10 and forwards it to the L3
switch via the trunk link.
3. The L3 switch removes the VLAN tag and forwards the unicast traffic internally to the
VLAN 10 virtual interface.
4. The L3 switch internally routes the unicast traffic to its VLAN 20 virtual interface and
then retags the traffic, which it then forwards back to the L2 switch via the trunk link.
5. L2 switch removes the VLAN tag of the unicast frame and forwards the frame directly
to Host B on port fa0/3.
2
To configure multi-layer switch inter-VLAN routing on a Cisco device, in accordance with
the diagram shown in Figure 3.0 above, use the IP addresses shown in Table 3.0 and
follow the steps below:
Device Interface VLAN ID IP Address Subnet Mask Default Gateway
Fa0/0 N/A [Link] [Link] [Link]
L3 Switch SVI 10 VLAN 10 [Link] [Link] N/A
SVI 20 VLAN 20 [Link] [Link] N/A
Host A NIC VLAN 10 [Link] [Link] [Link]
Host B NIC VLAN 20 [Link] [Link] [Link]
Table 3.0 IP address detail for Figure 3.0
Step 1: Create VLANs (VLANs 10 and 20) on the L2 switch
Description Command
Enter global configuration mode L2-Switch# conf t
Create VLAN 10 L2-Switch(config)# vlan 10
Give a name to VLAN 10 L2-Switch(config-vlan)# name Admin-dept
Create VLAN 20 L2-Switch(config-vlan)# vlan 20
Give a name to VLAN 20 L2-Switch(config-vlan)# name Finance-dept
3
Description Command
Exit the VLAN config mode L2-Switch(config-vlan)# exit
Check if the VLANs were created L2-Switch#show vlan brief
Step 2: Assign the VLANs to the L2 switch ports
Description Command
Enter global configuration mode L2-Switch# conf t
Enter interface config. mode for fa0/2 L2-Switch(config)# interface fa0/2
L2-Switch(config-if)#switchport mode
Set the port to access mode
access
L2-Switch(config-if)#switchport access
Assign VLAN 10 to interface fa0/2
vlan 10
Exit the interface L2-Switch(config-if)# exit
Enter interface configuration for fa0/3 L2-Switch(config)# interface fa0/3
L2-Switch(config-if)#switchport mode
Set the port to access mode
access
Assign VLAN 20 to interface fa0/3 L2-Switch(config-if)#switchport access
4
Description Command
vlan 20
Exit the interface L2-Switch(config-if)# exit
Enter interface configuration for fa0/1 L2-Switch(config)# interface fa0/1
Set the encapsulation type to 802.1Q L2-Switch(config-if)# switchport trunk
on the interface encapsulation dot1q
L2-Switch(config-if)# switchport mode
Set the port to trunk mode
trunk
Exit the interface L2-Switch(config-if)# exit
L2-Switch# copy running-config startup-
Save all configuration
config
Step 3: Enable L3 routing and create VLANs (VLANs 10 and 20) on the L3 switch
Description Command
Enter global configuration mode L2-Switch#conf t
Enable L3 routing L3-Switch(config) # ip routing
Create VLAN 10 L3-Switch(config)#vlan 10
5
Description Command
L3-Switch(config-vlan)# name Admin-
Give a name to VLAN 10
dept
Create VLAN 20 L3-Switch(config-vlan)# vlan 20
L3-Switch(config-vlan)# name Finance-
Give a name to VLAN 20
dept
Exit the VLAN config mode L3-Switch(config-vlan)# exit
Enter interface configuration for
L3-Switch(config)# interface fa0/1
fa0/1
Set the encapsulation type to L3-Switch(config-if)# switchport trunk
802.1Q on the interface encapsulation dot1q
L3-Switch(config-if)#switchport mode
Set the port to trunk mode
trunk
Exit the interface L3-Switch(config-if)# exit
L3-Switch)# copy running-config startup-
Save all configuration
config
Step 4: Configure Switch VLAN Interfaces (SVI)
6
Description Command
Enter global configuration mode L3-Switch# conf t
Create a virtual interface for VLAN 10 and
L3-Switch(config)# interface vlan10
enter interface configuration mode.
L3-Switch(config-if)# ip address
Configure a static route to reach VLAN 10
[Link] [Link]
Activate interface L3-Switch(config-if)# no shut
Exit the interface L3-Switch(config-if)# exit
Create a virtual interface for VLAN 20 and
L3-Switch(config)# interface vlan20
enter interface configuration mode
L3-Switch(config-if)# ip address
Configure a static route to reach VLAN 20
[Link] [Link]
Activate interface L3-Switch(config-if)# no shut
Exit the interface L3-Switch(config-if)# exit
Step 5: Configure a routed port for connecting to the firewall on the L3 switch
7
Description Command
Enter global configuration mode L3-Switch# conf t
Enter interface configuration for fa0/0 L3-Switch(config)# interface fa0/0
L3-Switch(config-if)# description to Internet
Interface description
Firewall
Creates an L3 port on the switch’s
physical port
L3-Switch(config-if)# no switchport
L3-Switch(config-if)# ip address [Link]
Configure IP address
[Link]
Configure default route towards the L3-Switch(config)# ip route [Link] [Link]
firewall [Link]
Exit the interface L3-Switch(config-if)# exit
L3-Switch)# copy running-config startup-
Save all configuration
config
Again, a ping between Host A and Host B will be successful because the two VLANs are now interconnected through the
multi-layer switch. Multilayer switch inter-VLAN routing is faster and more scalable than any other inter-VLAN routing
implementation. This is because routers are limited by the number of available physical interfaces or ports, as well as the
amounts of traffic that can be accommodated on the trunk link at one time. However, a multilayer switch does not totally
replace the functionality of a router, as routers support a wide range of other supplementary features and capabilities. The
table below is a comparison of the various inter-VLAN routing methods discussed.
8
walk you through a clear, repeatable test plan for the diagram you posted (Host A in VLAN
10, Host B in VLAN 20, L2 switch, L3 multilayer switch doing routing with SVIs, and an
uplink (Fa0/0) to a firewall). I’ll show exact commands to run on each device, explain what
each step proves, what a successful result looks like, and quick troubleshooting pointers.
Assumptions (please confirm if different):
Host A: [Link]/24, GW [Link] (VLAN 10)
Host B: [Link]/24, GW [Link] (VLAN 20)
L3 switch SVI: Vlan 10 -> [Link]/24, Vlan 20 -> [Link]/24
L3 switch Fa0/0 -> firewall: [Link]/30, firewall [Link]/30
L2 Fa0/2 -> Host A, Fa0/3 -> Host B, Fa0/1 trunk to L3 Fa0/1
Quick pre-test checklist
1. Console/SSH access to L2 and L3 switches and the firewall.
2. Host access (or ability to open terminal/command prompt).
3. Cables powered and plugged as diagram (Host A -> Fa0/2, Host B -> Fa0/3, trunk
Fa0/1↔Fa0/1).
4. Save a copy of current configs (backup) before changes.
Step 1 — Verify VLAN & port basics on L2 (catch config typos)
Why: ensures access ports are in expected VLANs and trunk exists.
Run on L2:
L2-Switch# show vlan brief
L2-Switch# show interfaces status
L2-Switch# show interfaces trunk
L2-Switch# show running-config interface fa0/1
9
Expect:
VLAN 10 = Admin-dept, VLAN 20 = Finance-dept.
Fa0/2 access VLAN 10, Fa0/3 access VLAN 20.
Fa0/1 is trunk and allows VLANs 10 & 20.
If fail: wrong VLAN assignment on port — correct with interface fa0/2 → switchport
access vlan 10.
Step 2 — Verify trunk connectivity between L2 and L3
Why: trunk must carry VLAN tags to the L3 MLS.
On both switches:
L2-Switch# show interfaces trunk
L3-Switch# show interfaces trunk
Expect: trunk state up, VLANs 10 & 20 listed as allowed and active.
If fail: check switchport mode trunk on both ends; if switchport trunk encapsulation dot1q
errors, omit it (some models only support dot1q by default).
Step 3 — Verify L3 routing enabled and SVIs present
Why: SVIs are the gateways for each VLAN — they must be configured and up.
On L3:
L3-Switch# show running-config | section ^ip routing|^interface Vlan
L3-Switch# show ip interface brief | include Vlan
L3-Switch# show ip route
Commands to create SVIs (if not present):
L3-Switch(config)# ip routing
L3-Switch(config)# interface vlan 10
10
L3-Switch(config-if)# ip address [Link] [Link]
L3-Switch(config-if)# no shutdown
L3-Switch(config)# interface vlan 20
L3-Switch(config-if)# ip address [Link] [Link]
L3-Switch(config-if)# no shutdown
Expect: show ip interface brief shows Vlan10 and Vlan20 up/up with their IPs.
If fail: SVI often goes down if no active switchport in that VLAN exists — ensure at least
one access port in that VLAN is up.
Step 4 — Validate host addressing & host → gateway
Why: prove hosts are correctly configured and can reach their virtual gateway.
On Host A (Windows):
ipconfig /all
ping [Link]
On Host B (Windows):
ipconfig /all
ping [Link]
(Linux/macOS use ip addr + ping -c 3)
Expect: successful ping replies to their respective gateways.
If fail: check physical port, VLAN assignment on L2, host IP/netmask, and no shutdown on
SVI.
Step 5 — Inter-VLAN ping: Host A → Host B (the main test)
Why: confirms the MLS is routing between VLANs.
11
From Host A:
ping [Link]
traceroute [Link] # or tracert on Windows
Expect: pings succeed; traceroute shows a single hop via the MLS (the gateway SVI).
If fail: confirm ip routing is enabled on L3 (show running-config | include ip routing), ensure
both SVIs are up, confirm no ACLs on the SVIs blocking traffic.
Also test reverse (Host B → Host A).
Step 6 — Verify ARP, MAC tables, and routing entries on switches
Why: ensure L2 learned MACs and L3 has ARP to forward correctly.
On L3:
L3-Switch# show ip arp
L3-Switch# show ip route
On L2:
L2-Switch# show mac address-table vlan 10
L2-Switch# show mac address-table vlan 20
Expect: ARP entries for host IPs, MAC table showing each host’s MAC under the correct
VLAN/port.
Step 7 — Test uplink & default route to firewall / Internet
Why: confirm uplink (Fa0/0) and firewall routing/NAT.
On L3:
L3-Switch# show running-config interface fa0/0
L3-Switch# ping [Link] # firewall
L3-Switch# traceroute [Link] source [Link]
12
From a Host:
ping [Link]
traceroute [Link]
Expect: L3 can reach firewall. Hosts should reach firewall and Internet if firewall
policies/NAT allow it.
If fail: check default route on L3: ip route [Link] [Link] [Link]. Also ensure firewall has
a route back to [Link]/24 and [Link]/24 (via [Link]) or a covering default
that points to the L3.
Step 9 — Performance / deeper checks (optional)
show ip cef (confirm CEF for hardware fast-path forwarding)
show platform hardware throughput (model dependent)
Use iperf between hosts for throughput tests (if allowed).
Save configuration
After verified:
L2-Switch# copy running-config startup-config
L3-Switch# copy running-config startup-config
13