VLANs isolate traffic by design — so how do they talk? Route between them with a router-on-a-stick or, better, a Layer 3 switch using SVIs.
Why: VLANs are separate Layer-3 networks, so traffic between them must be routed — a switch alone cannot do it. When: any time hosts in different VLANs need to reach each other (Sales printing to an Eng printer). Where: the two classic methods are router-on-a-stick (one router link, subinterfaces) and a Layer 3 switch with SVIs.
VLAN 10 (192.168.10.0/24) ----\
[ ROUTER or L3 SWITCH ] <- routes between
VLAN 20 (192.168.20.0/24) ----/
Each VLAN is its own subnet with its own gateway. The router owns a
gateway address in each VLAN and forwards traffic between them.Why: with only one physical link to the router, you split it into subinterfaces — one per VLAN — each tagging with 802.1Q and holding that VLAN’s gateway IP. When: use this when you have a router and a single trunk to the switch. Where: the switch port to the router must be a trunk carrying those VLANs.
R1(config)# interface Gig0/0.10 ! subinterface for VLAN 10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0 ! VLAN 10 gateway
R1(config)# interface Gig0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0 ! VLAN 20 gateway
! Hosts use .1 as their default gateway; the router forwards between VLANs.Why: in production, a Layer 3 switch routes between VLANs at wire speed using Switched Virtual Interfaces (SVIs) — one virtual interface per VLAN — which is faster and cleaner than router-on-a-stick. When: use SVIs whenever the switch supports Layer 3. Where: enable ip routing first, then give each VLAN an SVI with its gateway address.
L3SW(config)# ip routing ! enable routing on the switch
L3SW(config)# interface vlan 10
L3SW(config-if)# ip address 192.168.10.1 255.255.255.0 ! SVI = VLAN 10 gateway
L3SW(config-if)# no shutdown
L3SW(config)# interface vlan 20
L3SW(config-if)# ip address 192.168.20.1 255.255.255.0
L3SW(config-if)# no shutdown
! Routing between VLAN 10 and 20 now happens in hardware on the switch.