Troubleshoot Inter-VLAN Routing with SVIs

1. The Need for Inter-VLAN Routing

By design, VLANs create separate broadcast domains. This is excellent for security, organization, and performance, as it contains broadcast traffic and isolates groups of users. However, it also means that a host in VLAN 10 cannot communicate with a host in VLAN 20 without assistance. To enable this communication, we need a Layer 3 device—a router—to forward packets between the different IP subnets associated with each VLAN.

There are a few ways to achieve this:

1. Legacy Method (External Router, Multiple Interfaces): Using a separate physical router interface for each VLAN. This is highly inefficient and does not scale.
2. Router-on-a-Stick (RoaS): A more common method where a single router interface is connected to a switch via a trunk link. The router uses subinterfaces, one for each VLAN, to route traffic.
3. Multilayer Switch with SVIs: The most common and efficient method in modern networks. The routing logic is built directly into the switch, providing high-speed forwarding between VLANs without needing an external router.

This image clearly contrasts the SVI approach (left) with the Router-on-a-Stick approach (right). Notice how the Layer 3 switch (DS1) handles routing internally, while the Layer 2 switch (DS2) must forward traffic to an external router (R3).

To solidify this foundational concept, the following short video provides an excellent overview.

2. Understanding Switched Virtual Interfaces (SVIs)

An SVI is a logical, virtual Layer 3 interface that represents a VLAN on a multilayer switch. Think of it as the default gateway for all devices within that specific VLAN. Instead of having a physical router, a multilayer switch contains a "virtual router" in its software that uses these SVIs as its interfaces.

To function, a multilayer switch needs two key things:

1. Global IP Routing Enabled: The switch must be explicitly told to act as a router.
2. An SVI for Each VLAN: You need to create and configure a Layer 3 interface for each VLAN that requires routing.

The video below explains this concept perfectly and introduces the commands to bring an SVI to life.

Basic SVI Configuration Steps

Here is the fundamental configuration sequence to create an SVI on a multilayer switch (e.g., for VLAN 10):

1. Enable IP Routing Globally: This is a one-time command that turns on the switch's Layer 3 capabilities.

   Switch(config)# ip routing
   

2. Create the SVI: Enter the interface configuration mode for the VLAN.

   Switch(config)# interface vlan 10
   

3. Assign an IP Address: This IP will be the default gateway for hosts in VLAN 10.

   Switch(config-if)# ip address 10.1.10.1 255.255.255.0
   

4. Enable the Interface:

   Switch(config-if)# no shutdown
   

You would repeat steps 2-4 for every VLAN that needs to participate in routing.

3. A Systematic Approach to Troubleshooting Inter-VLAN Routing

As a solutions engineer, you know the importance of a structured troubleshooting methodology. When inter-VLAN routing fails, the issue could be at Layer 2, Layer 3, or on the end-host itself. The key is to test systematically, from the bottom up.

The following Cisco document provides an excellent, concise troubleshooting framework.

Let's integrate this methodology with a practical demonstration. The following video is a masterclass in verifying and troubleshooting an inter-VLAN routing setup.

Troubleshooting Checklist

Based on the resources above, here is a consolidated checklist for troubleshooting SVI-based inter-VLAN routing:

Step 1: Verify End-Host Configuration

• Is the IP address and subnet mask correct?
• Most importantly, is the default gateway set to the IP address of the correct SVI?

Step 2: Verify Layer 2 Foundation

• Can the host ping its default gateway (the SVI)? If not, the problem is likely at Layer 2.
• Is the host's switchport assigned to the correct VLAN?
  • show vlan brief
• If traffic crosses to another switch, are the trunk links configured correctly and allowing the necessary VLANs?
  • show interfaces trunk

Step 3: Verify Layer 3 SVI Configuration

• Is global IP routing enabled on the multilayer switch?
  • show ip route (If it says "Default gateway is not set", ip routing might be missing).
• Does the SVI for the VLAN exist and have the correct IP address?
  • show ip interface brief
• Is the SVI in an up/up state?
  • show ip interface brief
  • show interface vlan <id>

The Classic "SVI is down/down" Problem

A very common CCNP-level issue is finding an SVI in a down/down or up/down state even after using no shutdown.

An SVI's line protocol state is tied to the Layer 2 status of its corresponding VLAN. For an SVI to come up, the VLAN must be active on the switch. This means the VLAN must:

1. Exist in the VLAN database (show vlan brief).
2. Be active on at least one Layer 2 port on the switch. This could be either:
   • An access port assigned to that VLAN which is in an up/up state.
   • A trunk port that is up/up and is allowing that VLAN.

If a VLAN has no active ports associated with it, the switch considers it dormant, and the corresponding SVI will not come up.

Step 4: Verify End-to-End Connectivity

• From Host A (VLAN A), can you ping the SVI for VLAN B? This tests routing on the switch.
• From Host A (VLAN A), can you ping Host B (VLAN B)? If this fails but the step above succeeded, the problem is likely with Host B's configuration (e.g., wrong gateway, firewall) or the return path.

This quick reference table summarizes common issues and actions.

Interface              IP-Address      OK? Method Status                Protocol
Vlan10                 192.168.10.1    YES manual up                    up
Vlan20                 192.168.20.1    YES manual administratively down down

Switch(config)# interface vlan 20
Switch(config-if)# no shutdown

Conclusion

In this lesson, we demystified inter-VLAN routing by focusing on its modern implementation with Switched Virtual Interfaces. We established that an SVI on a multilayer switch acts as a default gateway, enabling seamless communication between what would otherwise be isolated Layer 2 domains.

Key Takeaways:

• Inter-VLAN routing is necessary to allow communication between hosts on different VLANs.
• SVIs on a multilayer switch are the preferred, high-performance method for this.
• A successful configuration requires enabling ip routing globally and creating an SVI with an IP address for each VLAN.
• Troubleshooting must be systematic: verify the end-host, then the Layer 2 foundation, and finally the Layer 3 SVI configuration.
• A common pitfall is an SVI remaining down because its associated VLAN is not active on any switch port.

Preview of the Next Lesson:

We've focused on configuring VLANs and SVIs on a single switch. In a larger network, manually creating the same VLANs on every switch is tedious and error-prone. In our next lesson, we will analyze VTP operation (server, client, transparent modes) and configure VTP pruning, exploring how Cisco's VLAN Trunking Protocol can automate VLAN database management across an enterprise network.