layer 3 switch routing between vlans with SVIs

the one command that turns your switch into a router

if you've ever set up router-on-a-stick, you know the pain. one physical interface, a bunch of subinterfaces, dot1q tags everywhere, and every single packet crossing vlans has to leave the switch, hit the router, get routed, and come back. it works, but it's slow and it's a single point of failure sitting on a stick made of one ethernet cable.

a layer 3 switch fixes this by doing the routing itself, in hardware, using something called an SVI, a switch virtual interface. no external router required. this post breaks down how that works and, more importantly, how to make sure you're not accidentally routing traffic somewhere it shouldn't go.

the command everyone forgets

by default, a layer 3 switch behaves like a giant layer 2 switch. it can have a hundred vlans configured and still refuse to route a single packet between them until you flip this on:

ip routing

that's it. that's the whole command. no arguments, nothing fancy. but without it, your SVIs will sit there fully configured, with ip addresses and everything, and traffic still won't move between vlans. it's the classic "why isn't this working" moment for anyone learning this the first time. write it on a sticky note.

building the svi

once routing is enabled globally, each vlan gets its own virtual interface that acts as the default gateway for every device in that vlan:

interface vlan 10
 ip address 10.10.10.1 255.255.255.0
 no shutdown

break this down: interface vlan 10 creates the logical interface tied to vlan 10's traffic. the ip address line gives it a gateway address that lives on that subnet. no shutdown actually brings it up, because cisco loves shipping things in a disabled state by default. repeat this for every vlan that needs to talk to another vlan, and each one becomes its own little routed interface, all inside the same physical box.

pcs just point at the svi

on the client side, nothing weird happens. every device in vlan 10 sets its default gateway to 10.10.10.1, same as it would with any router. the device has no idea it's talking to a switch instead of a dedicated router. that's kind of the point. the routing happens in the switch's application specific integrated circuit, meaning it's done in hardware at wire speed, not software, so you're not bottlenecked by cpu cycles the way you can be with router-on-a-stick.

why this matters for defense, not just speed

here's where this stops being a ccna trivia question and starts being a security issue. inter-vlan routing is exactly how segmentation either works or quietly fails. a lot of networks get vlans set up correctly for organizational reasons, guest wifi here, finance over there, iot devices in their own little box, but nobody audits what's actually allowed to route between them.

ip routing being enabled globally means every vlan with an SVI can potentially reach every other vlan with an SVI, unless you're doing something to stop it. that "something" is access control lists applied to the SVI itself, not just to a router upstream. if your finance vlan and your guest vlan both have SVIs on the same layer 3 switch and there's no ACL between them, your segmentation is decorative, not functional.

go check your own switches. run show ip interface brief and see which vlans have SVIs configured. then ask yourself honestly whether every one of those SVIs needs to route to every other one. if the answer is no, and it usually is, lock it down:

interface vlan 10
 ip access-group VLAN10-RESTRICT in

build the ACL to explicitly permit what's needed and deny the rest, then log the denies so you actually know what's getting blocked and can catch misconfigurations or lateral movement attempts early.

the takeaway

SVIs and ip routing are what let a layer 3 switch replace router-on-a-stick and route at line rate instead of choking on a single trunk link. that's the performance story. the security story is that enabling routing between vlans without controlling it is how "segmented" networks turn into one flat network wearing a costume. know which vlans on your gear can talk to each other, put ACLs on the SVIs that shouldn't be wide open, and don't assume vlan boundaries mean anything until you've actually tested them.