Inter-VLAN Routing With Router-on-a-Stick vs SVI

Efficiently segmenting network traffic often involves Virtual Local Area Networks (VLANs). However, once traffic is isolated into VLANs, there's a need…

Efficiently segmenting network traffic often involves Virtual Local Area Networks (VLANs). However, once traffic is isolated into VLANs, there's a need for devices in different VLANs to communicate. This inter-VLAN routing can be achieved through several methods, with Router-on-a-Stick (RoaS) and Switched Virtual Interfaces (SVIs) being two primary architectural patterns. Understanding the technical nuances, advantages, and limitations of each is crucial for designing robust and scalable campus networks.

This article details the configuration and operational considerations for both RoaS and SVI-based inter-VLAN routing, including practical command-line examples for common network operating systems, typical use cases, and performance implications.

Router-on-a-Stick (RoaS) Inter-VLAN Routing

Router-on-a-Stick is an inter-VLAN routing method where a single physical interface on a router is configured with multiple logical sub-interfaces. Each sub-interface is assigned an IP address for a specific VLAN and is configured to understand traffic tagged with that VLAN's ID using IEEE 802.1Q encapsulation. This single physical link connects to a trunk port on a Layer 2 switch, allowing all VLAN traffic to traverse to the router.

Configuration Example: Cisco IOS RoaS

Consider a scenario with VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24), where a Cisco Catalyst 2960 switch connects to a Cisco ISR 4331 router.

Switch Configuration (Catalyst 2960 - L2 Switch)

The switch needs a trunk port connecting to the router. Assume Gi0/1 is the uplink.


interface GigabitEthernet0/1
  description UPLINK_TO_ROUTER_R1
  switchport trunk encapsulation dot1q
  switchport mode trunk
  switchport trunk allowed vlan 10,20
  no shutdown
!
vlan 10
  name DATA_VLAN10
!
vlan 20
  name VOICE_VLAN20
!

Note: switchport trunk encapsulation dot1q is explicit on some older or higher-end platforms, but implied on others like the 2960 for 802.1Q. It's good practice to include it if available.

Router Configuration (Cisco ISR 4331)

The router's physical interface (e.g., Gi0/0/0) connects to the switch's trunk port. Sub-interfaces are created for each VLAN.


interface GigabitEthernet0/0/0
  no ip address
  no shutdown
!
interface GigabitEthernet0/0/0.10
  description INTER-VLAN_ROUTING_FOR_VLAN10
  encapsulation dot1Q 10
  ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0/0.20
  description INTER-VLAN_ROUTING_FOR_VLAN20
  encapsulation dot1Q 20
  ip address 192.168.20.1 255.255.255.0
!

Here, encapsulation dot1Q 10 tells the router this sub-interface handles traffic tagged with VLAN ID 10. The IP address 192.168.10.1 serves as the default gateway for devices in VLAN 10.

Advantages and Limitations of RoaS

  • Cost-Effective: Requires only a Layer 2 switch and a router, making it suitable for smaller networks or branch offices with limited budgets.
  • Simplicity: Conceptually straightforward for a few VLANs.
  • Performance Bottleneck: All inter-VLAN traffic must traverse the single physical link to the router. This can become a bottleneck as network traffic scales. A 1 Gbps link would cap the aggregate inter-VLAN throughput at 1 Gbps (bi-directional), regardless of the router's internal routing capabilities.
  • Latency: Packet forwarding through a general-purpose router often involves more software processing overhead compared to hardware-based Layer 3 switching, potentially increasing latency.
  • Single Point of Failure: The router itself and the single trunk link are critical failure points. Redundancy is complex to implement for this specific routing function alone.

Switched Virtual Interfaces (SVIs) Inter-VLAN Routing

Switched Virtual Interfaces (SVIs), also known as VLAN interfaces, are logical Layer 3 interfaces on a Layer 3 switch. An SVI is created for each VLAN that requires Layer 3 routing services. Unlike RoaS, where routing happens on an external router, with SVIs, the Layer 3 switch performs routing internally, often leveraging specialized ASICs for line-rate forwarding.

Configuration Example: Cisco IOS SVI

Using the same VLANs 10 and 20, but now with a Cisco Catalyst 3850 (Layer 3 switch).

Layer 3 Switch Configuration (Catalyst 3850)

First, ensure IP routing is enabled, then create the VLANs and their corresponding SVIs.


ip routing
!
vlan 10
  name DATA_VLAN10
!
vlan 20
  name VOICE_VLAN20
!
interface Vlan10
  description SVI_FOR_VLAN10
  ip address 192.168.10.1 255.255.255.0
  no shutdown
!
interface Vlan20
  description SVI_FOR_VLAN20
  ip address 192.168.20.1 255.255.255.0
  no shutdown
!
interface GigabitEthernet1/0/1
  description ACCESS_PORT_FOR_VLAN10_HOSTS
  switchport mode access
  switchport access vlan 10
  no shutdown
!
interface GigabitEthernet1/0/2
  description ACCESS_PORT_FOR_VLAN20_HOSTS
  switchport mode access
  switchport access vlan 20
  no shutdown
!

The Layer 3 switch automatically routes traffic between active SVIs. Physical ports assigned to VLAN 10 can communicate with ports assigned to VLAN 20, with the 3850 handling the routing internally.

Advantages and Limitations of SVIs

  • High Performance: Inter-VLAN routing occurs in hardware (ASICs) at wire speed, minimizing latency and maximizing throughput. Ideal for data centers and large campus networks.
  • Scalability: Easily handles a large number of VLANs and high inter-VLAN traffic volumes without bottlenecking.
  • Reduced Latency: Routing decisions are made locally on the switch, without needing to traverse an external link or device.
  • Redundancy: Can be integrated with First Hop Redundancy Protocols (FHRPs) like HSRP (Hot Standby Router Protocol) or VRRP (Virtual Router Redundancy Protocol) for high availability, allowing multiple Layer 3 switches to share a common virtual gateway IP address.
  • Cost: Layer 3 switches are generally more expensive than Layer 2 switches and dedicated routers.
  • Complexity: Initial configuration can be slightly more involved than basic RoaS, especially when implementing FHRPs or advanced routing features.

First Hop Redundancy Protocols (FHRPs) with SVIs

For critical networks, simply having an SVI isn't enough. If the Layer 3 switch fails, all inter-VLAN routing stops. FHRPs address this by allowing multiple Layer 3 switches to present a single virtual gateway IP address to end devices.

HSRP Configuration Example (Cisco IOS)

On two Catalyst 3850 switches, SW1 (primary) and SW2 (secondary), for VLAN 10:


! On SW1 (Active Router)
interface Vlan10
  ip address 192.168.10.2 255.255.255.0
  standby 10 ip 192.168.10.1    <-- Virtual IP address
  standby 10 priority 150      <-- Higher priority for primary
  standby 10 preempt           <-- Allow primary to reclaim active role
  no shutdown
!
! On SW2 (Standby Router)
interface Vlan10
  ip address 192.168.10.3 255.255.255.0
  standby 10 ip 192.168.10.1    <-- Virtual IP address
  standby 10 priority 100      <-- Lower priority for secondary (default)
  no shutdown
!

End devices in VLAN 10 would be configured with 192.168.10.1 as their default gateway. If SW1 fails, SW2 takes over the 192.168.10.1 address transparently.

RoaS vs. SVI: A Comparison

Feature Router-on-a-Stick (RoaS) Switched Virtual Interface (SVI)
Device Type L2 Switch + Router L3 Switch
Performance Limited by single trunk link bandwidth (e.g., 1 Gbps or 10 Gbps). Router CPU overhead. Line-rate, hardware-based forwarding. High throughput.
Latency Higher, due to router software processing. Lower, hardware-based, local to switch.
Scalability Poor for many VLANs or high inter-VLAN traffic. Excellent for many VLANs and high traffic.
Cost Generally lower (L2 switch + cheaper router). Generally higher (L3 switch).
Complexity Simple for basic deployments. Slightly more complex with FHRPs, but robust.
Redundancy Difficult/complex to make highly redundant for inter-VLAN path. Easily achieved with FHRPs (HSRP, VRRP, GLBP).
Typical Use Case Small branches, labs, very low inter-VLAN traffic. Campus networks, data centers, enterprise environments.

Common Pitfalls and Troubleshooting

  • Incorrect VLAN Tagging/Encapsulation:
    • On RoaS, ensure the router sub-interface encapsulation dot1Q <VLAN_ID> matches the VLAN ID.
    • On the switch, verify the trunk port switchport trunk encapsulation dot1q (if applicable) and switchport mode trunk are configured correctly, and the necessary VLANs are allowed (switchport trunk allowed vlan ...).
    • For access ports, ensure switchport mode access and switchport access vlan <VLAN_ID> are correctly set.
  • IP Addressing Conflicts or Misconfigurations:
    • Each SVI or router sub-interface must have a unique IP address within its subnet.
    • Default gateways for end devices must point to the correct SVI or sub-interface IP address for their VLAN.
    • Verify subnet masks are consistent across the network.
  • Routing Not Enabled:
    • For SVIs, ensure ip routing is enabled globally on the Layer 3 switch.
    • If using static routes or dynamic routing protocols, ensure they are correctly configured to advertise connected SVI/sub-interface subnets.
  • Spanning Tree Protocol (STP) Issues:
    • Ensure STP is not blocking the trunk link to the router (RoaS) or inter-switch links (SVI with FHRPs). Use show spanning-tree vlan <VLAN_ID>.
  • FHRP Misconfiguration:
    • When using HSRP/VRRP, ensure all switches in the group use the same group number and virtual IP.
    • Verify priorities and preemption settings. Use show standby brief or show vrrp brief.
  • Port Security/ACLs:
    • Temporarily disable port security or ACLs during initial troubleshooting to rule them out as sources of connectivity problems.

Back to the knowledge base · Ask the AI assistant