Inter-VLAN routing: three methods, and how to choose
VLANs are separate broadcast domains, so a layer 2 switch will not move traffic between them. Something operating at layer 3 has to. Your options are a router port per VLAN (obsolete), a router on a stick over one trunk (small sites), or a layer 3 switch with an SVI per VLAN (everywhere else). The last one wins almost every time it is available.
The interesting question is not how each method works — all three are straightforward — but why you would pick one. That comes down to three things: how much inter-VLAN traffic you expect, what hardware is already on site, and what happens when the device fails.
The methods
Legacy — one router port per VLAN
How: Each VLAN gets its own physical router interface and its own switch access port.
Strengths: Conceptually simple. Full bandwidth per VLAN, no trunk to share.
Costs: Burns a router port and a switch port per VLAN. Four VLANs need four of each. Does not scale past a handful.
Use when: Effectively obsolete. Worth knowing because CCNA contrasts it with ROAS.
Router on a stick
How: One router interface, one 802.1Q trunk, one tagged sub-interface per VLAN.
Strengths: One cable, one port, any number of VLANs. Cheap when a router is already on site.
Costs: Every inter-VLAN packet crosses the trunk twice, halving usable throughput. Software forwarding. Single point of failure.
Use when: Small branch with one router and one access switch, and no layer 3 switch.
Layer 3 switch with SVIs
How: A switched virtual interface per VLAN on the switch itself, routed in hardware by the ASIC.
Strengths: Line-rate forwarding, no trunk bottleneck, scales to hundreds of VLANs. Stackable for redundancy.
Costs: Needs a layer 3 capable switch, which costs more than a layer 2 one.
Use when: The default for any campus, and for any branch that already has a layer 3 switch.
Routed ports on a layer 3 switch
How: A switch port taken out of switching entirely with no switchport, given an IP directly.
Strengths: Behaves like a router interface. Ideal for point-to-point uplinks between layer 3 devices.
Costs: One subnet per port — not a way to serve VLANs full of users.
Use when: Switch-to-switch or switch-to-router links in a routed campus core.
The bottleneck nobody mentions
With router on a stick, a packet from VLAN 10 to VLAN 20 travels up the trunk to the router and back down it to the switch. Same cable, twice. A 1 Gbps trunk therefore delivers roughly 500 Mbps of usable inter-VLAN throughput, and that is before you account for the router forwarding in software rather than silicon.
An SVI has no equivalent penalty. The frame arrives on an access port, the switching ASIC rewrites the layer 2 header and sends it out another access port, and it never leaves the chassis. On a modern switch that happens at line rate on every port simultaneously. This one difference is why campus networks stopped using routers for internal VLAN traffic a long time ago.
Configuring SVIs
Short, with one line people forget:
SW1(config)# ip routing ← without this, nothing routes
SW1(config)# vlan 10
SW1(config-vlan)# name STAFF
SW1(config)# interface vlan 10
SW1(config-if)# ip address 192.168.10.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config)# interface vlan 20
SW1(config-if)# ip address 192.168.20.1 255.255.255.0
SW1(config-if)# no shutdown
! Everything not local goes to the edge router
SW1(config)# ip route 0.0.0.0 0.0.0.0 203.0.113.1ip routing is the whole trick. A layer 3 switch does not route by default; it is a layer 2 switch that happens to be capable. Omit that command and your SVIs will come up, show correct addresses, ping from the switch itself — and refuse to forward a single packet between VLANs. It is comfortably the most common fault in this configuration.
Why an SVI sits down
An SVI is a virtual interface, so it has no cable to tell it whether it should be up. The rule is: the VLAN must exist in the VLAN database, and at least one port in that VLAN must be up — either an access port with something plugged in, or a trunk carrying the VLAN.
SW1# show ip interface brief | include Vlan
Vlan10 192.168.10.1 YES manual up up ← ports active
Vlan20 192.168.20.1 YES manual up down ← VLAN exists, no live port
Vlan30 192.168.30.1 YES manual administratively down downVlan20 showing up/down on a lab switch with nothing plugged in is correct behaviour, not a misconfiguration. Vlan30 needs no shutdown.
Choosing, in one paragraph
If you have a layer 3 switch, use SVIs — there is essentially no argument for anything else on internal traffic. If you do not, and the site is one switch and one router with modest inter-VLAN traffic, use router on a stick; it is cheap and it works. Use routed ports for links between layer 3 devices, not for user VLANs. And never use a physical router interface per VLAN outside an exam question, because you will run out of ports before you run out of VLANs.
Frequently asked
What is inter-VLAN routing?
Inter-VLAN routing is the process of forwarding traffic between VLANs. A VLAN is a separate broadcast domain and normally a separate IP subnet, and a switch operating at layer 2 will not move frames between them, so a layer 3 device has to. That device can be a router with one interface per VLAN, a router using 802.1Q sub-interfaces over a single trunk, or — most commonly today — a layer 3 switch with a switched virtual interface for each VLAN.
What is the difference between router on a stick and SVI?
Router on a stick puts the routing on an external router reached over a trunk, so every inter-VLAN packet leaves the switch, is routed in the router's software, and comes back — crossing the same link twice. An SVI puts the routing inside a layer 3 switch, where the forwarding ASIC handles it at line rate and the traffic never leaves the switch. SVIs are faster, remove the trunk bottleneck and remove a single point of failure; the trade-off is that they require a layer 3 capable switch.
How do I configure an SVI for inter-VLAN routing?
Create the VLAN, then create a matching interface vlan and give it the gateway address for that subnet. Crucially you must also enable routing globally with ip routing, because a layer 3 switch does not route by default and this omission is the single most common reason a correctly addressed SVI configuration does not work. The SVI stays down until at least one access port in that VLAN is up, which is normal behaviour rather than a fault.
Why is my SVI showing down/down?
An SVI comes up only when the VLAN exists in the VLAN database and at least one physical port in that VLAN is up, or a trunk carrying it is up. So a newly created interface vlan 20 with no active ports in VLAN 20 will sit down, which is expected. Check that the VLAN exists with show vlan brief, that a port is assigned and connected, and that the SVI has not been left administratively shut — interface vlan does not come up automatically without no shutdown on some platforms.
Do I still need a router if I have a layer 3 switch?
For routing between internal VLANs, no — the layer 3 switch does that better than a router would. You still need a router or firewall at the edge, because layer 3 switches generally lack WAN interfaces, NAT, VPN termination and the deeper security features an internet edge requires. The common design is a layer 3 switch handling all internal inter-VLAN traffic, with a default route pointing at the edge device for anything leaving the site.
Inter-VLAN routing spans the Network Access and IP Connectivity domains of CCNA 200-301. Related: router on a stick, configured step by step, trunk port vs access port, VLANs explained and administrative distance.