A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
VLANs segment by design. But users in Sales still need to reach the file server in Engineering's VLAN, and everyone needs internet access. That means crossing the VLAN boundary — which requires Layer 3. This lesson explains the mechanics before the next section gets into configuration.
VLANs are separate broadcast domains. A host in VLAN 10 can ARP for another host in VLAN 10 and get a response — same broadcast domain. But a host in VLAN 10 ARPing for a host in VLAN 20 gets nothing, because the ARP request never reaches VLAN 20. The broadcast domain boundary is impermeable at Layer 2.
To cross the boundary, traffic must go to a Layer 3 device — a router or Layer 3 switch — that has interfaces (physical or logical) in both VLANs. The device receives the packet on one VLAN, checks its routing table, and forwards it out the other VLAN.
| Approach | Implementation | Pros | Cons |
|---|---|---|---|
| Router-on-a-stick | One physical router port, multiple subinterfaces | Simple, works with any router | Single point of failure, bandwidth bottleneck |
| Layer 3 switching (SVIs) | Switch virtual interfaces on the L3 switch | High performance, no extra device | Requires L3-capable switch |
| Routed ports | One L3 port per VLAN on a router | Simple per-VLAN config | Wastes physical ports, doesn't scale |
Router-on-a-stick was the standard for decades but is now mostly a training exercise. Real networks use Layer 3 switches for inter-VLAN routing and reserve routers for WAN and internet edge. The exam tests both.
The default gateway requirement is the most common point of failure. Every host needs a gateway in its own VLAN. If the Sales VLAN gateway is 10.10.10.1 and a host has a misconfigured gateway of 10.10.20.1 (Engineering's gateway), the host's traffic never leaves the VLAN — it ARPs for an address that isn't in its subnet, gets no response, and drops.
When a host in VLAN 10 sends to a host in VLAN 20: the host determines the destination is in a different subnet (based on subnet mask), so it ARPs for its default gateway. The frame goes to the gateway, which is the L3 interface on the router or switch. The router strips the frame header, reads the IP packet, looks up the destination in its routing table, finds the VLAN 20 connected route, and forwards the packet out the VLAN 20 interface with a new frame header.
Notice the source IP stays the same, but the source MAC changes at each hop. This is normal Layer 3 behavior — MAC is local to the link, IP is end-to-end.
Inter-VLAN routing is where the Layer 2 world meets Layer 3. Section 9 dives into actual configuration. For now, understand the requirement: every VLAN boundary crossing needs a Layer 3 device.
Next lesson: diagnosing VLAN and trunk problems, the practical skills for keeping everything working.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.