Routing between VLANs
VLANs keep groups of devices apart on one switch, so a PC in VLAN 10 cannot reach a printer in VLAN 20 on its own. Follow one print job as it is tagged up a trunk to a router on a stick, routed, checked by an ACL and sent back down tagged for the other VLAN; then see how a layer 3 switch does the same job inside itself.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01A PC in VLAN 10 and a printer in VLAN 20 are plugged into the same switch. Why can't the PC's frames reach the printer directly?
Each VLAN is its own LAN and its own subnet. Getting from one to the other means going through a router (or a layer 3 switch) acting as each VLAN's gateway.
02On the trunk between the switch and the router on a stick, how does the router know which VLAN a frame belongs to?
The tag (TPID 0x8100 plus a 12-bit VLAN ID) tells the router which subinterface the frame arrived on. Access ports to the PC and printer carry no tag.
03The packet leaves the router for the printer. What has changed compared with the frame the PC sent?
Routing builds a new frame: from the router's MAC to the printer's MAC, tagged for VLAN 20. The IP addresses travel unchanged; TTL drops by one at the router.
04What is an SVI on a layer 3 switch?
With one SVI per VLAN (here 192.168.10.1 and 192.168.20.1) the switch routes in its own hardware at line rate, so no trip up a trunk to an outside router is needed.
05Why is the router (or layer 3 switch) a good place for an ACL between VLANs?
VLANs isolate by default; the routing point is the one doorway between them. Rules there can permit some traffic (printing on TCP 9100) and deny the rest.
Glossary
- VLAN
- Virtual LAN: a group of switch ports that act as their own separate LAN, with their own subnet, even though they share one switch.
- Access port
- A switch port in a single VLAN. Frames on it carry no VLAN tag, so the device plugged in does not need to know VLANs exist.
- Trunk
- A link that carries frames for several VLANs, each marked with an 802.1Q tag saying which VLAN it belongs to.
- 802.1Q tag
- Four bytes added after the source MAC address: 0x8100, then a priority and a 12-bit VLAN ID (1 to 4094).
- Router on a stick
- A router joined to a switch by one trunk port, with one subinterface per VLAN, each acting as that VLAN's default gateway.
- Subinterface
- A virtual slice of one physical router port, tied to one VLAN tag and given its own IP address.
- SVI
- Switch virtual interface: a layer 3 switch's routed interface for one VLAN, holding that VLAN's gateway address.
- ACL
- Access control list: an ordered list of permit and deny rules a router or layer 3 switch checks for each packet; first match wins.
Notes and sources
- Addresses are examples: 192.168.10.0/24 and 192.168.20.0/24 are private ranges (RFC 1918); MAC addresses are documentation values (RFC 7042, 00:00:5e:00:53:xx).
- The PC already knows the gateway’s MAC and the router already knows the printer’s from earlier ARP exchanges, so ARP is not shown.
- Both subinterfaces use the router port’s single MAC address, as most routers do. A VLAN ID can be 1 to 4094; 0 and 4095 are reserved (IEEE 802.1Q).
- A trunk can carry one VLAN untagged, the native VLAN (often VLAN 1). VLANs 10 and 20 are not native here, so their frames are tagged.
- IEEE 802.1Q: Bridges and Bridged Networks
- RFC 1812: Requirements for IP Version 4 Routers
- RFC 1122: Requirements for Internet Hosts
- RFC 1918: Address Allocation for Private Internets
- RFC 7042: IANA Considerations for IEEE 802 Parameters (documentation MACs)
- IANA service name and port number registry (TCP 9100)
Quiz Unlocks after the last step.