Inter-VLAN Routing Concepts and Configuration

In modern enterprise networks, physical topology is no longer the bottleneck for local network design. Logical segmentation using Virtual Local Area Networks (VLANs) has become the standard mechanism to enforce security boundaries, reduce broadcast storms, and optimize broadcast domain performance. This guide explores the engineering foundations of connecting LANs, logical network segmentation, and the technical configurations required to implement Inter-VLAN routing using Cisco IOS architectures.

1. Connecting Devices and Network Topology Layers

Connecting modern Local Area Networks (LANs) requires a layered model of hardware systems. These systems are grouped according to the specific layers of the Open Systems Interconnection (OSI) reference model in which they operate.

text

+-----------------------+---------------------------------------+
|   OSI Layer Model     |         Connecting Network Device     |
+-----------------------+---------------------------------------+
|  Layer 3 (Network)    |  Routers / Layer 3 Switches           |
+-----------------------+---------------------------------------+
|  Layer 2 (Data Link)  |  Bridges / Layer 2 Switches           |
+-----------------------+---------------------------------------+
|  Layer 1 (Physical)   |  Repeaters / Passive & Active Hubs    |
+-----------------------+---------------------------------------+

Layer 1: Physical Layer Devices

At the physical layer, electrical signals degrade over distance due to attenuation. To extend transmission ranges, Layer 1 devices are introduced:

Repeaters: A repeater is a regenerator, not an amplifier. It receives a weak signal, reconstructs the square-wave digital pattern, and transmits a clean, full-strength signal. Repeaters have no filtering capabilities and forward every frame received.
Hubs: A hub is essentially a multi-port repeater.
- Passive Hubs: Simply act as connection points, splitting electrical signals without regenerating them.
- Active Hubs: Regenerate signals in the same manner as repeaters.

Layer 2: Data Link Layer Devices

Devices at Layer 2 manage frame delivery based on physical Media Access Control (MAC) addresses.

Bridges: A bridge maintains a dynamic filtering table to make forwarding decisions. Crucially, a bridge does not alter the source or destination MAC addresses inside the Ethernet frame.
Learning Bridges: These devices dynamically build their lookup tables by inspecting the Source MAC field of incoming frames on each interface.
Layer 2 Switches: High-density multi-port bridges that forward frames using specialized hardware called Application-Specific Integrated Circuits (ASICs).

Loop Problems and Spanning Tree Protocol (STP)

When redundant links are installed between bridges or switches to prevent network failures, Layer 2 loops can develop. Because Layer 2 frames do not have a Time-to-Live (TTL) field like Layer 3 packets do, broadcast loops can circulate indefinitely, consuming all available bandwidth in a "broadcast storm."

To prevent this, the IEEE 802.1D Spanning Tree Protocol (STP) dynamically calculates a loop-free logical path. STP treats the bridged network as a graph $G = (V, E)$ where $V$ is the set of switches and $E$ is the set of active link paths. The algorithm designates a "Root Bridge" and calculates the shortest path from each switch to the root based on link costs:

$\text{Path Cost} = \sum_{i=1}^{k} \text{Cost}(e_i)$

Where:

$e_i$ represents the individual egress links along the path.
The default port cost is inversely proportional to bandwidth (e.g., $10\text{ Gbps} = 2$ , $1\text{ Gbps} = 4$ , $100\text{ Mbps} = 19$ ).

text

    [Root Bridge (Switch A)]
         /           \
   Cost=19           Cost=19
       /               \
[Switch B]-----------[Switch C]
             Cost=19
        (Port Blocked by STP)

By placing redundant ports into a blocking state, loops are broken while maintaining physical redundancy.

2. Backbone Networks

A backbone network connects multiple independent LANs without requiring any terminal station to attach directly to the backbone itself. Instead, the stations remain members of their respective local subnets, and the backbone facilitates inter-network traffic.

Bus Backbone

In a bus backbone topology, the connecting infrastructure is arranged linearly. Often using coaxial cabling or central trunk routing, it links switches/bridges using a shared bus architecture.

Star Backbone

In a star backbone configuration, the central hub of the network is a high-speed switch. The local switches or routers of each individual subnet connect directly back to this central core switch:

text

                     +------------------------+
                     |  Central L2/L3 Switch  | (Star Core)
                     +-----------+------------+
                     /           |            \
                    /            |             \
         +---------+----+  +-----+----+  +-----+----+
         | Local Switch |  | Local Switch|  | Local Switch|
         +-------+------+  +-----+----+  +-----+----+
                 |               |               |
             [ LAN 1 ]       [ LAN 2 ]       [ LAN 3 ]

3. Virtual Local Area Networks (VLANs) Fundamentals

A Virtual Local Area Network (VLAN) is a logical local area network configured via administrative software rather than physical rewiring.

text

      Physical Topology                     Logical VLAN Structure
      =================                     ======================
      +---------------+                     +--------------------+
      |  L2 Switch    |                     | VLAN 10 (SALES)    |
      +-+---+---+---+--+                     |  - Host A          |
        |   |   |   |                       |  - Host B          |
       [A] [B] [C] [D]                      +--------------------+
                                            +--------------------+
      (All hosts connected                  | VLAN 20 (IT)       |
       to the same switch)                  |  - Host C          |
                                            |  - Host D          |
                                            +--------------------+

Key Properties of VLANs

Broadcast Isolation: A VLAN represents an independent broadcast domain. Frames containing broadcast destination addresses (such as FF:FF:FF:FF:FF:FF) are forwarded only to ports belonging to the same VLAN.
Subnet Mapping: In standard IP network design, there is a $1:1$ relationship between a logical VLAN and an IP subnet:

$\text{VLAN}_x \iff \text{Subnet}_x$

Security Boundary: Nodes on different VLANs cannot communicate at Layer 2, even if they are physically patched into adjacent ports on the same switch chassis.

Access vs. Trunk Ports

Switch interfaces are classified by how they handle VLAN tagging:

Access Port: Belongs to exactly one VLAN. Traffic passing through an access port is untagged. These interfaces connect to end-user devices (PCs, printers, servers) which are unaware of VLAN headers.
Trunk Port: Designed to carry traffic for multiple VLANs simultaneously. Trunk links are used between switches, or between a switch and a router.

IEEE 802.1Q Frame Tagging

To distinguish which VLAN a frame belongs to when crossing a trunk link, switches insert an 802.1Q tag directly into the standard Ethernet frame header:

text

Original Ethernet Frame:
+-----------+-----------+-----------+---------+-----+
| Dest MAC  | Src MAC   | Type/Len  | Payload | FCS |
+-----------+-----------+-----------+---------+-----+
 
802.1Q Tagged Frame:
+-----------+-----------+-----------+-------------+-----------+---------+-----+
| Dest MAC  | Src MAC   | 802.1Q Tag| Tag Control | Type/Len  | Payload | FCS |
|  (6B)     |  (6B)     | TPID (2B) | Info (TCI)  |  (2B)     |         |     |
+-----------+-----------+-----------+-------------+-----------+---------+-----+
                                      \
                                    VLAN ID (12 bits) => 4096 possible VLANs

The VLAN Identifier (VID) field is 12 bits long, allowing for:

$2^{12} - 2 = 4094 \text{ usable logical subnets}$

(VLAN 0 and VLAN 4095 are reserved).

4. Cisco IOS Configuration for VLANs

Configuring segmentation on a Cisco catalyst switch requires creating the logical VLAN entity and assigning physical interfaces to it.

Step 1: Create the VLANs

Enter global configuration mode and define the logical VLAN numbers and names:

text

Switch>enable
Switch#configure terminal
Switch(config)#vlan 10
Switch(config-vlan)#name SALES
Switch(config-vlan)#exit
Switch(config)#vlan 20
Switch(config-vlan)#name IT
Switch(config-vlan)#exit

Step 2: Assign Access Ports to VLANs

Assign interfaces FastEthernet 0/1 and 0/2 to VLAN 10, and interfaces FastEthernet 0/3 and 0/4 to VLAN 20:

text

Switch(config)#interface FastEthernet 0/1
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#exit
 
Switch(config)#interface FastEthernet 0/2
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#exit
 
Switch(config)#interface FastEthernet 0/3
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 20
Switch(config-if)#exit
 
Switch(config)#interface FastEthernet 0/4
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 20
Switch(config-if)#exit

Optimization Tip: You can streamline this using the interface range macro to configure multiple ports simultaneously:

text

Switch(config)#interface range fa0/1 - 2
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 10
Switch(config-if-range)#exit

Step 3: Configure the Switch Trunk Link

To carry traffic for both VLAN 10 and VLAN 20 to an upstream router or switch, configure interface FastEthernet 0/5 as a trunk:

text

Switch(config)#interface FastEthernet 0/5
Switch(config-if)#switchport mode trunk
Switch(config-if)#exit

5. Inter-VLAN Routing and Router-on-a-Stick (ROAS)

Because hosts on different VLANs reside in separate broadcast domains and IP subnets, they cannot communicate directly at Layer 2. To pass packets between VLANs, a Layer 3 routing engine must bridge the subnets.

Router-on-a-Stick (ROAS) Architecture

In a Router-on-a-Stick topology, a single physical interface on a router connects to an 802.1Q trunk port on a Layer 2 switch. The router physical interface is divided into logical subinterfaces, each assigned to a corresponding VLAN gateway.

text

                   +-----------------------+
                   |        Router         |
                   |  (Default Gateways)   |
                   +-----------+-----------+
                               | Subinterfaces:
                               | fa0/0.10 (IP: 192.168.1.1)
                               | fa0/0.20 (IP: 192.168.2.1)
                               |
                       (Physical Trunk Link)
                               |
                               | (fa0/5)
                   +-----------+-----------+
                   |    Layer 2 Switch     |
                   +-----+-----------+-----+
                         |           |
               Access    |           | Access
               (VLAN 10) |           | (VLAN 20)
                         |           |
                   +-----+---+   +---+-----+
                   | PC1     |   | PC3     |
                   | (SALES) |   | (IT)    |
                   +---------+   +---------+

Network IP Plan

To implement this topology, we assign IP addresses and default gateways to the end devices:

text

+------+---------+------------------+-----------------+-------------------+
| Host |  VLAN   |    IP Address    |   Subnet Mask   |  Default Gateway  |
+------+---------+------------------+-----------------+-------------------+
| PC1  | VLAN 10 | 192.168.1.10     | 255.255.255.0   | 192.168.1.1       |
| PC2  | VLAN 10 | 192.168.1.20     | 255.255.255.0   | 192.168.1.1       |
| PC3  | VLAN 20 | 192.168.2.10     | 255.255.255.0   | 192.168.2.1       |
| PC4  | VLAN 20 | 192.168.2.20     | 255.255.255.0   | 192.168.2.1       |
+------+---------+------------------+-----------------+-------------------+

Router Configuration Commands

We must first enable the base physical interface without assigning it an IP address. Then, we create and configure the subinterfaces:

text

Router>enable
Router#configure terminal
 
! Bring up the physical link
Router(config)#interface FastEthernet 0/0
Router(config-if)#no shutdown
Router(config-if)#exit
 
! Configure subinterface for VLAN 10 (SALES)
Router(config)#interface FastEthernet 0/0.10
Router(config-subif)#description Gateway for SALES VLAN 10
Router(config-subif)#encapsulation dot1Q 10
Router(config-subif)#ip address 192.168.1.1 255.255.255.0
Router(config-subif)#exit
 
! Configure subinterface for VLAN 20 (IT)
Router(config)#interface FastEthernet 0/0.20
Router(config-subif)#description Gateway for IT VLAN 20
Router(config-subif)#encapsulation dot1Q 20
Router(config-subif)#ip address 192.168.2.1 255.255.255.0
Router(config-subif)#exit

Flow of an Inter-VLAN Frame

PC1 (VLAN 10, IP 192.168.1.10) wants to send a packet to PC3 (VLAN 20, IP 192.168.2.10).
PC1 determines the destination IP is on a different subnet. It looks up its default gateway IP (192.168.1.1) and sends an ARP request to resolve its MAC address.
The router's subinterface fa0/0.10 answers the ARP request with its virtual MAC address.
PC1 transmits an Ethernet frame with:
- Source MAC: PC1
- Destination MAC: Router's fa0/0.10 interface MAC
- Source IP: 192.168.1.10
- Destination IP: 192.168.2.10
The L2 switch receives the untagged frame on port fa0/1. Recognizing that the port is assigned to VLAN 10, the switch tags the frame with 802.1Q tag: 10 and forwards it out the trunk link on port fa0/5 to the router.
The router receives the tagged frame on its physical interface and routes it to the matching logical subinterface: .

Summary

Layer Segmented Devices: Network components operate at specific logical layers: repeaters and hubs at Layer 1 (Physical); bridges and switches at Layer 2 (Data Link); and routers and layer 3 switches at Layer 3 (Network).
Logical Boundaries: VLANs establish independent broadcast domains. This separation isolates local broadcasts, controls subnets, and blocks Layer 2 frames from crossing network sections without authorization.
IEEE 802.1Q Trunking: Standardizes frame tagging on multi-VLAN connections. Trunk links allow switches to pass frames across shared links while preserving their source VLAN tags.
Router-on-a-Stick: Utilizes logical router subinterfaces configured on a single physical link to perform Inter-VLAN routing, removing the need for a dedicated physical router port per subnet.

Assessed progress

Inter-VLAN Routing Concepts and Configuration

Inter-VLAN Routing Concepts and Configuration

1. Connecting Devices and Network Topology Layers

Layer 1: Physical Layer Devices

Layer 2: Data Link Layer Devices

Loop Problems and Spanning Tree Protocol (STP)

2. Backbone Networks

Bus Backbone

Star Backbone

3. Virtual Local Area Networks (VLANs) Fundamentals

Key Properties of VLANs

Access vs. Trunk Ports

IEEE 802.1Q Frame Tagging

4. Cisco IOS Configuration for VLANs

Step 1: Create the VLANs

Step 2: Assign Access Ports to VLANs

Step 3: Configure the Switch Trunk Link

5. Inter-VLAN Routing and Router-on-a-Stick (ROAS)

Router-on-a-Stick (ROAS) Architecture

Network IP Plan

Router Configuration Commands

Flow of an Inter-VLAN Frame

Summary

Key Concepts

VLAN Segmentation

Access vs. Trunk Ports

Router-on-a-Stick (ROAS)

Spanning Tree Protocol (STP)

Layer 3 Switching

Quick Check

Computer Networks

Computer Networks