inter-vlan routing on a layer 3 switch, explained

why your vlans can't talk to each other (and why that's a good thing, until you need them to)

you segment your network into vlans for good reasons. keep the cameras away from the laptops, keep the guest wifi away from the servers, keep the accounting subnet away from whatever intern just installed a sketchy chrome extension. that's the whole point of vlans, they're isolated broadcast domains. but the moment you actually need two vlans to talk, like your workstation vlan needs to hit a printer sitting in the iot vlan, you hit a wall. different subnets, no path between them, dead on arrival. this is where inter-vlan routing comes in, and understanding how it actually works is the difference between a network you designed on purpose and one that's held together with hope.

the old way: router-on-a-stick

for a long time the answer was "router-on-a-stick." you'd run a single trunk link from your switch to a router, the router would have a subinterface for every vlan, and it would route between them. it worked, but it had a hard ceiling, every packet crossing vlans had to leave the switch, hit the router, get processed in software, and come back. on a busy network that link becomes a bottleneck fast, and now you've got a single point of failure sitting between all your subnets.

the modern way: svis on a layer 3 switch

a layer 3 switch skips the middleman. instead of sending traffic out to an external router, the switch itself has routing hardware built in, specifically an asic that does routing at wire speed instead of in software. to use it, you create a switch virtual interface, or svi, for each vlan. an svi is just a virtual interface that represents that vlan's gateway. vlan 10 gets an svi with an ip like 10.10.10.1, vlan 20 gets one like 10.20.20.1. every device in vlan 10 points to 10.10.10.1 as its default gateway, every device in vlan 20 points to its own svi, and the switch handles the rest.

once you enable ip routing on the switch and give each vlan its own svi, the switch knows how to move traffic between those subnets directly, in hardware, without ever leaving the box. that's the entire trick. no external router, no trunk bottleneck, no extra hop.

what the pieces actually do

break it down into three parts so it's not just magic:

the vlan is the layer 2 segment, a group of ports that share a broadcast domain. devices in vlan 10 can talk to each other freely because they're on the same subnet and the same broadcast domain.

the svi is the layer 3 gateway for that vlan. it's the ip address every device in that vlan sends traffic to when the destination isn't local. think of it as the router interface that used to live on a separate box, now living inside the switch itself.

the routing table is what the switch consults once traffic hits an svi. if the destination is another vlan the switch already knows about, it routes it directly. if the destination is out on the internet somewhere, the switch needs a default route, a catch-all entry that says "if you don't know where this goes, send it to the wan gateway." without that default route, your internal vlans can talk to each other beautifully and still have zero internet access, which is a fun troubleshooting session if you don't know what you're looking for.

why this matters for defenders

this isn't just a networking trivia fact, it's directly tied to your segmentation strategy. inter-vlan routing is a door. every svi you create is a door between two segments that were previously isolated. if you set one up carelessly, without access control lists filtering what's allowed to cross, you've just undone all the isolation benefits vlans gave you in the first place. that cheap ip camera in your iot vlan can now reach your file server if nothing's stopping it at layer 3, because the switch will happily route it there.

the fix is to pair every svi with an acl or a firewall rule that defines exactly what's allowed to cross between vlans. default deny, then explicitly permit only the traffic that has a real reason to move between segments. if your printer vlan needs to reach print clients on port 9100, permit that and nothing else. audit your svi configs the same way you'd audit firewall rules, because that's functionally what they are now.

the takeaway

inter-vlan routing on a layer 3 switch replaces the old router-on-a-stick setup by routing traffic in hardware through per-vlan svis, which is faster and simpler. but speed isn't security. every svi you stand up is a new path between segments you built for isolation, so check your acls, confirm your default route only sends what should leave the network, and don't assume "it's on a different vlan" means "it's actually isolated." go check your switch configs, you might be surprised what's allowed to talk to what.