3.1.3. Inter-VLAN Connectivity

Devices in different VLANs require Layer 3 routing to communicate. Three options:

One subnet per VLAN. Each VLAN is its own broadcast domain, so it gets its own IP subnet. Two hosts given the same subnet but placed in different VLANs cannot talk even with a router present: each treats the other as local and ARPs for it directly instead of using a gateway, and that ARP broadcast never leaves its own VLAN.

Router on a Stick Configuration:

Router(config)# interface GigabitEthernet0/0.10
Router(config-subif)# encapsulation dot1q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config-subif)# exit
Router(config)# interface GigabitEthernet0/0.20
Router(config-subif)# encapsulation dot1q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0

The switch port facing the router must be an 802.1Q trunk carrying every routed VLAN. A VLAN missing from that trunk's allowed list never reaches its subinterface, so its hosts cannot reach their gateway while the other VLANs work normally.

Layer 3 Switch SVI Configuration:

Switch(config)# ip routing
Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit
Switch(config)# interface vlan 20
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown

Verification:

Switch# show vlan brief
Switch# show interfaces trunk
Switch# show interfaces GigabitEthernet0/1 switchport