Inter-VLAN Routing (Multiple VLANs on
Single Switch)
To enable communication between VLANs 10 and 20 on a single switch,
you need to configure Inter-VLAN Routing. While some Layer 2 switches
support VLANs but don't route between them, most Layer 3 switches
support routing between VLANs directly.
If you're using a Layer 3 switch, the process is simpler because the switch
itself can route traffic between VLANs. However, on a regular Layer 2
switch, you would need to use an external router to route the traffic
between VLANs.
Here's a detailed example for both scenarios:
Scenario 1: Layer 3 Switch (Using Inter-VLAN
Routing)
Step 1: Define VLANs on the switch First, configure the VLANs on
the switch.
Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name VLAN10
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name VLAN20
Switch(config-vlan)# exit
Step 2: Assign VLANs to the ports
Now assign VLAN 10 and VLAN 20 to specific ports. For example, you
want ports Fa0/1 and Fa0/2 to be in VLAN 10, and Fa0/3 and Fa0/4 to be
in VLAN 20.
Switch(config)# interface range fa0/1 - 2
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# exit
Switch(config)# interface range fa0/3 - 4
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# exit
Step 3: Enable Routing on the Switch
Now, enable routing on the switch so it can route between VLANs 10 and
20. This is done by enabling IP routing on the switch.
Switch(config)# ip routing
Step 4: Assign IP addresses to VLAN interfaces (SVIs)
Each VLAN will need a Switched Virtual Interface (SVI) with an IP address
for routing purposes. This allows the switch to route traffic between
VLANs.
Switch(config)# interface vlan 10
Switch(config-if)# ip address [Link] [Link]
Switch(config-if)# no shutdown
Switch(config-if)# exit
Switch(config)# interface vlan 20
Switch(config-if)# ip address [Link] [Link]
Switch(config-if)# no shutdown
Switch(config-if)# exit
Step 5: Verify Routing Between VLANs
You should now be able to ping between devices in VLAN 10 and VLAN 20,
as long as the devices use the SVI IP address as their gateway.
For example, from a device in VLAN 10, the gateway IP would be
[Link], and from a device in VLAN 20, the gateway would be
[Link].
Switch# ping [Link]
If the ping is successful, routing between VLANs 10 and 20 is working.
Scenario 2: Layer 2 Switch (Using Router for
Inter-VLAN Routing)
If you're using a Layer 2 switch, you'll need a Router-on-a-Stick
configuration. This method uses a single physical interface on the router
and subinterfaces for each VLAN.
Step 1: Define VLANs on the switch
Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name VLAN10
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name VLAN20
Switch(config-vlan)# exit
Step 2: Assign VLANs to the ports
Assign the ports as you did earlier, keeping the same VLAN assignments.
Switch(config)# interface range fa0/1 - 2
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# exit
Switch(config)# interface range fa0/3 - 4
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# exit
Step 3: Configure a Trunk Port to the Router
Create a trunk port between the switch and router to allow the routing of
multiple VLANs.
Switch(config)# interface fa0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20
Switch(config-if)# exit
Step 4: Configure Router Subinterfaces for Each VLAN
On the router, you'll need to create subinterfaces for each VLAN. For
example:
Router# configure terminal
Router(config)# interface gig0/1.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address [Link] [Link]
Router(config-subif)# exit
Router(config)# interface gig0/1.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address [Link] [Link]
Router(config-subif)# exit
In this example, the router is connected to the switch on interface
GigabitEthernet 0/1, and we're creating subinterfaces for VLANs 10 and
20.
Step 5: Set the Default Gateway on End Devices
Make sure the devices in VLAN 10 have their default gateway set to
[Link] and the devices in VLAN 20 have their default gateway set
to [Link].
Step 6: Verify Connectivity
From a device in VLAN 10, ping a device in VLAN 20 to ensure the routing
is working properly.
Device in VLAN 10# ping [Link]
If everything is configured correctly, the devices in VLAN 10 should be
able to communicate with devices in VLAN 20.
Summary
• Layer 3 Switch: Enable IP routing, configure SVIs for each VLAN,
and the switch will route traffic between the VLANs.
• Layer 2 Switch with Router: Configure trunking between the switch
and router, set up subinterfaces on the router for each VLAN, and
ensure end devices use the router as their default gateway for
Inter-VLAN communication.
Inter-VLAN Routing (Multiple VLANs on
different Switches)
To enable communication between VLANs 10, 20 on SW1 and VLANs 30,
40 on SW2, where:
• VLAN 10 can communicate only with VLAN 30 and vice versa,
• VLAN 20 can communicate only with VLAN 40 and vice versa,
We will configure Inter-VLAN Routing using either a Layer 3 switch (which
performs routing directly) or a Router-on-a-Stick configuration. We will
use Access Control Lists (ACLs) to restrict communication between the
VLANs, ensuring the specific restrictions are in place.
Scenario 1: Layer 3 Switch Configuration (SW1 is a Layer 3 Switch)
In this setup, SW1 will handle routing between VLANs using SVIs
(Switched Virtual Interfaces). SW2 is a Layer 2 switch, passing the VLANs
over a trunk link. We will also configure ACLs to restrict the traffic
between VLANs according to the requirements.
1. Configure VLANs on SW1 and SW2
On SW1 (Create VLANs 10 and 20):
SW1# configure terminal
SW1(config)# vlan 10
SW1(config-vlan)# name VLAN10
SW1(config-vlan)# exit
SW1(config)# vlan 20
SW1(config-vlan)# name VLAN20
SW1(config-vlan)# exit
On SW2 (Create VLANs 30 and 40):
SW2# configure terminal
SW2(config)# vlan 30
SW2(config-vlan)# name VLAN30
SW2(config-vlan)# exit
SW2(config)# vlan 40
SW2(config-vlan)# name VLAN40
SW2(config-vlan)# exit
2. Assign Ports to VLANs on SW1 and SW2
On SW1 (Assign Ports to VLANs 10 and 20):
SW1(config)# interface range fa0/1 - 2
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 10
SW1(config-if-range)# exit
SW1(config)# interface range fa0/3 - 4
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 20
SW1(config-if-range)# exit
On SW2 (Assign Ports to VLANs 30 and 40):
SW2(config)# interface range fa0/1 - 2
SW2(config-if-range)# switchport mode access
SW2(config-if-range)# switchport access vlan 30
SW2(config-if-range)# exit
SW2(config)# interface range fa0/3 - 4
SW2(config-if-range)# switchport mode access
SW2(config-if-range)# switchport access vlan 40
SW2(config-if-range)# exit
3. Configure Trunk Port Between SW1 and SW2
Since VLANs 10, 20, 30, and 40 need to communicate across the
switches, configure a trunk link between SW1 and SW2.
On SW1 (Set Trunk Port):
SW1(config)# interface fa0/24
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20,30,40
SW1(config-if)# exit
On SW2 (Set Trunk Port):
SW2(config)# interface fa0/24
SW2(config-if)# switchport mode trunk
SW2(config-if)# switchport trunk allowed vlan 10,20,30,40
SW2(config-if)# exit
4. Enable IP Routing on SW1 (Layer 3 Switch)
Now, enable IP routing on SW1 and configure SVIs for routing between
the VLANs. This allows communication between VLANs.
On SW1 (Enable IP Routing and Configure SVIs):
SW1(config)# ip routing
SW1(config)# interface vlan 10
SW1(config-if)# ip address [Link] [Link]
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# interface vlan 20
SW1(config-if)# ip address [Link] [Link]
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# interface vlan 30
SW1(config-if)# ip address [Link] [Link]
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# interface vlan 40
SW1(config-if)# ip address [Link] [Link]
SW1(config-if)# no shutdown
SW1(config-if)# exit
5. Create and Apply ACLs to Restrict Communication Between VLANs
We need to restrict the communication between the VLANs as follows:
• VLAN 10 can only communicate with VLAN 30.
• VLAN 20 can only communicate with VLAN 40.
On SW1 (Create and Apply ACLs for VLAN 10 and VLAN 30):
• Allow communication between VLAN 10 and VLAN 30:
SW1(config)# ip access-list extended VLAN10-30-ACL
SW1(config-ext-nacl)# permit ip [Link] [Link] [Link]
[Link]
SW1(config-ext-nacl)# permit ip [Link] [Link] [Link]
[Link]
SW1(config-ext-nacl)# deny ip any any
SW1(config-ext-nacl)# exit
• Apply the ACL to VLAN 10 and VLAN 30 interfaces:
SW1(config)# interface vlan 10
SW1(config-if)# ip access-group VLAN10-30-ACL in
SW1(config-if)# exit
SW1(config)# interface vlan 30
SW1(config-if)# ip access-group VLAN10-30-ACL in
SW1(config-if)# exit
On SW1 (Create and Apply ACLs for VLAN 20 and VLAN 40):
• Allow communication between VLAN 20 and VLAN 40:
SW1(config)# ip access-list extended VLAN20-40-ACL
SW1(config-ext-nacl)# permit ip [Link] [Link] [Link]
[Link]
SW1(config-ext-nacl)# permit ip [Link] [Link] [Link]
[Link]
SW1(config-ext-nacl)# deny ip any any
SW1(config-ext-nacl)# exit
• Apply the ACL to VLAN 20 and VLAN 40 interfaces:
SW1(config)# interface vlan 20
SW1(config-if)# ip access-group VLAN20-40-ACL in
SW1(config-if)# exit
SW1(config)# interface vlan 40
SW1(config-if)# ip access-group VLAN20-40-ACL in
SW1(config-if)# exit
6. Configure Default Gateways on End Devices
• Devices in VLAN 10 should have their default gateway set to
[Link].
• Devices in VLAN 20 should have their default gateway set to
[Link].
• Devices in VLAN 30 should have their default gateway set to
[Link].
• Devices in VLAN 40 should have their default gateway set to
[Link].
7. Verify Connectivity
Test connectivity to verify that:
• Devices in VLAN 10 can communicate with VLAN 30, but not with
VLAN 20 or VLAN 40.
• Devices in VLAN 30 can communicate with VLAN 10, but not with
VLAN 20 or VLAN 40.
• Devices in VLAN 20 can communicate with VLAN 40, but not with
VLAN 10 or VLAN 30.
• Devices in VLAN 40 can communicate with VLAN 20, but not with
VLAN 10 or VLAN 30.
Use ping tests to verify the above restrictions.
Scenario 2: Router-on-a-Stick Configuration
If you are using a router-on-a-stick configuration, the steps would be
similar, but the router would perform the routing between VLANs instead
of the Layer 3 switch (SW1).
Steps:
1. Configure VLANs and assign ports as shown above on SW1 and
SW2.
2. Configure trunk link between SW1 and SW2 (same as above).
3. On the router, configure subinterfaces for VLANs 10, 20, 30, and
40.
4. Apply ACLs on the router to restrict the communication between
VLANs.
The router configuration for subinterfaces would look like this:
Router(config)# interface gig0/1.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address [Link] [Link]
Router(config-subif)# exit
Router(config)# interface gig0/1.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address [Link] [Link]
Router(config-subif)# exit
Router(config)# interface gig0/1.30
Router(config-subif)# encapsulation dot1Q 30
Router(config-subif)# ip address [Link] [Link]
Router(config-subif)# exit
Router(config)# interface gig0/1.40
Router(config-subif)# encapsulation dot1Q 40
Router(config-subif)# ip address [Link] [Link]
Router(config-subif)# exit
Then, apply ACLs to restrict traffic between VLANs.
Summary
• Layer 3 Switch (SW1): Configure SVIs and enable IP routing for
Inter-VLAN routing. Apply ACLs to restrict communication between
VLANs 10 and 30, and VLANs 20 and 40.
• Router-on-a-Stick: Use subinterfaces on the router for routing and
ACLs to restrict communication between VLANs.
This setup ensures that the VLAN pairs are restricted to only communicate
with each other, and no communication occurs between the other VLANs.