Why two VLANs need routing to communicate
A VLAN is a Layer 2 broadcast domain. Traffic can be switched directly among hosts in the same VLAN, but a frame is not bridged from one VLAN into another. If two endpoints belong to different VLANs and IP subnets, the packet must pass through a Layer 3 device.
Inter-VLAN routing is the routing function that connects those subnets. It may be provided by a traditional router, a multilayer switch, a firewall, or another Layer 3 platform, but the principle remains the same: each VLAN has a gateway and routing moves packets between the associated prefixes.
The default gateway for each VLAN
Hosts compare a destination address with their own prefix. When the destination is outside the local subnet, the host sends the packet to its configured default gateway. That gateway address must be reachable inside the host's VLAN and belong to the same IP prefix.
A typical design may use VLAN 10 with 10.10.10.0/24 and gateway 10.10.10.1, while VLAN 20 uses 10.10.20.0/24 and gateway 10.10.20.1. The Layer 3 device owns or presents those gateway addresses and routes between the connected networks.
Router-on-a-stick and 802.1Q subinterfaces
With router-on-a-stick, one physical router interface is connected to a switch using an 802.1Q trunk. The router creates logical subinterfaces, and each subinterface is associated with one VLAN and one IP gateway.
This is simple and useful for labs or smaller networks, but every inter-VLAN flow shares the same physical router link. The design can therefore become a bandwidth or availability bottleneck as traffic grows.
Switched Virtual Interfaces on a Layer 3 switch
A multilayer switch can create a Switched Virtual Interface (SVI) for a VLAN. The SVI provides a Layer 3 interface and can act as the VLAN's default gateway while the switch routes packets internally at high speed.
This design is common in campus and enterprise networks because switching and routing can occur on the same platform. The SVI still depends on the VLAN being operational at Layer 2 and on the switch having Layer 3 routing enabled and a valid path toward remote destinations.
Routed ports and links toward other routers
Not every switch interface has to remain a Layer 2 access or trunk port. Multilayer platforms can support routed ports that behave as Layer 3 interfaces without belonging to a VLAN.
Routed links are useful between distribution/core devices or between a multilayer switch and another router. They reduce Layer 2 scope and create explicit IP adjacencies that can use static routing or dynamic routing protocols once the broader routing cluster is introduced.
DHCP relay between VLANs
DHCP discovery begins with local broadcast behavior, and broadcasts do not cross a routed VLAN boundary by themselves. If the DHCP server is in another subnet, the gateway can act as a DHCP relay, forwarding the client's request toward the server while identifying the client network.
This lets one centralized DHCP service support many VLANs. Troubleshooting must therefore check both the client VLAN and the relay configuration when hosts in one segment fail to obtain addresses while other segments work normally.
ACLs and policy between VLANs
Once traffic crosses a Layer 3 boundary, the network has a natural policy point. ACLs or firewall rules can allow only the flows that are required between user, server, guest, management, voice, or IoT VLANs.
This is one reason VLAN segmentation is useful for security architecture, but do not assume that merely placing devices in different VLANs is sufficient. The policy on the routing device must enforce the intended access model.
Gateway redundancy and FHRP
If one physical SVI or router is the only gateway for a large VLAN, its failure can isolate the hosts even when the Layer 2 network remains available. First Hop Redundancy Protocols can present a shared virtual gateway address across multiple devices and move active responsibility when a participating device fails.
VRRP and HSRP are covered later in the routing cluster. Their operation also depends on Layer 2 reachability, ARP or Neighbor Discovery, interface tracking, and valid upstream paths from the newly active gateway.
Troubleshooting inter-VLAN routing
Start at the host: verify IP address, prefix, and default gateway. Confirm the host can reach the gateway in its own VLAN. Then verify the VLAN exists, the access port is correct, and every required trunk carries the VLAN. With an SVI, check that the interface is actually operational; with router-on-a-stick, verify the subinterface and VLAN tag.
If the gateway responds but the remote destination does not, inspect the routing table, policy, firewall behavior, and return path. A packet capture on both sides of the Layer 3 boundary can help determine whether traffic never arrives, is filtered, or leaves correctly but receives no response.
Example: users, servers, and guests
Imagine three VLANs: users on 10.10.10.0/24, servers on 10.10.20.0/24, and guests on 10.10.30.0/24. A Layer 3 switch can create one SVI in each prefix and act as the gateway. Policy can then allow users to reach selected server services, block guests from internal networks, and keep management traffic separate.
The objective is not merely to make pings succeed across VLANs. The objective is to create a clear Layer 3 control point where reachability, security, redundancy, and troubleshooting can be managed deliberately.