LESSON PURPOSE

Build a practical understanding of how devices in different VLANs communicate through Layer 3 routing, then use CDP and LLDP to discover directly connected devices, verify connections, and support troubleshooting and network documentation.

Lesson Overview

VLANs create separate Layer 2 broadcast domains, so communication between VLANs requires Layer 3 routing. Inter-VLAN routing can be provided by router subinterfaces using 802.1Q or by a multilayer switch using switched virtual interfaces (SVIs). CDP and LLDP complement this by identifying directly connected neighbors and reporting useful details such as device identity, local/remote interfaces, capabilities, platform, and management addressing.


Learning Objectives

• Explain why hosts in different VLANs require Layer 3 routing and a correct default gateway.

• Compare router-on-a-stick and multilayer-switch/SVI methods for inter-VLAN routing.

• Configure and verify 802.1Q router subinterfaces for multiple VLANs.

• Configure and verify SVIs and IP routing on a multilayer switch.

• Trace the packet path between hosts located in different VLANs.

• Use VLAN, trunk, interface, routing-table, and ping outputs to verify inter-VLAN connectivity.

• Troubleshoot missing VLANs, incorrect access VLANs, trunk/allowed-VLAN issues, down SVIs, wrong gateways, and missing routing.

• Explain the purpose of CDP and LLDP and distinguish Cisco-proprietary CDP from standards-based LLDP.

• Enable, disable, and verify CDP/LLDP and interpret neighbor information using show commands.

• Use CDP and LLDP to validate network documentation, confirm adjacent-device links, and support troubleshooting.


Learning Outcomes

By the end of this lesson, a CCNA candidate should be able to explain why devices in different VLANs need Layer 3 forwarding, configure and verify router-on-a-stick, configure and verify switch virtual interfaces (SVIs) on a multilayer switch, interpret routing and ARP information, use CDP and LLDP to discover directly connected neighbors, compare the protocols, and troubleshoot common configuration failures.

CCNA ALIGNMENT

Cisco 200-301 CCNA v2.0 includes switch-to-switch and switch-to-router infrastructure connectivity, Layer 2 802.1Q trunks, switch virtual interfaces (SVIs), and validation of network documentation using CDP and LLDP. This lesson uses inter-VLAN routing to connect those switching and Layer 3 concepts in a practical workflow.


1. Inter-VLAN Routing Fundamentals

1.1 Why VLANs Cannot Route by Themselves

A VLAN is a Layer 2 broadcast domain. A Layer 2 switch can forward Ethernet frames between ports in the same VLAN by using its MAC address table, but it does not route an IP packet from one IP subnet to another unless the device also provides Layer 3 routing functionality. If PC-A is in VLAN 10 / 192.168.10.0/24 and PC-B is in VLAN 20 / 192.168.20.0/24, the hosts recognize that the destination is outside their local subnet and send the traffic to a default gateway.


Inter-VLAN routing is the Layer 3 process that forwards traffic between those VLAN interfaces. The gateway can be implemented on a router using 802.1Q sub interfaces or on a multilayer switch using SVIs. In either design, the gateway owns one Layer 3 IP address in each VLAN and makes a routing decision between the connected networks.

Pasted content image

Figure 1 - A Layer 3 gateway provides routing between independent Layer 2 VLANs.


Core exam idea

Same VLAN = Layer 2 switching. Different VLANs/subnets = Layer 3 routing through the configured default gateway.


1.2 The Default Gateway Decision

When a host wants to send an IPv4 packet, it compares the destination IP address with its own address and subnet mask. If the destination is local, the host resolves the destination host MAC address and sends directly. If the destination is remote, the host resolves the MAC address of its default gateway and sends the Ethernet frame to the gateway while keeping the remote IP address as the Layer 3 destination.

Item

PC-A sending to PC-B in another VLAN

PC-A IP

192.168.10.10/24

Destination IP

192.168.20.10/24

Default gateway

192.168.10.1

Destination MAC in first Ethernet frame

MAC address of the VLAN 10 gateway, not the MAC address of PC-B

What the router/L3 switch changes

Layer 2 header is rebuilt for the outgoing VLAN; the IP source/destination remain PC-A and PC-B, apart from normal TTL/checksum updates.


1.3 ARP and Inter-VLAN Routing

ARP resolves IPv4 addresses to MAC addresses on the local Layer 2 segment. PC-A does not ARP for a remote host such as 192.168.20.10 when its subnet is 192.168.10.0/24. Instead, PC-A ARPs for the gateway 192.168.10.1. After the gateway routes the packet into VLAN 20, the gateway may ARP for 192.168.20.10 if it does not already know the destination MAC.


Useful verification commands

PC-A> arp -a

 

DIST-SW1# show ip arp

DIST-SW1# show mac address-table

DIST-SW1# show ip route


2. Inter-VLAN Packet Flow - Step by Step

2.1 Example Addressing

Device / interface

VLAN

IPv4 address

Role

PC-A

10

192.168.10.10/24

Source host

Vlan10 gateway

10

192.168.10.1/24

Default gateway for VLAN 10

Vlan20 gateway

20

192.168.20.1/24

Default gateway for VLAN 20

PC-B

20

192.168.20.10/24

Destination host


2.2 Packet from VLAN 10 to VLAN 20

1. PC-A determines that 192.168.20.10 is outside its local /24 network, so it chooses default gateway 192.168.10.1.

2. PC-A uses ARP to learn the VLAN 10 gateway MAC address if it is not already cached.

3. PC-A sends an Ethernet frame to the gateway MAC. The IP packet inside still has source 192.168.10.10 and destination 192.168.20.10.

4. The router or multilayer switch removes the incoming Layer 2 header, decrements TTL, checks its routing table, and selects the directly connected 192.168.20.0/24 network.

5. The gateway resolves PC-B with ARP if necessary, builds a new Ethernet frame appropriate for VLAN 20, and forwards the packet.

6. PC-B receives the packet. The return traffic follows the same Layer 3 process in reverse using default gateway 192.168.20.1.

Important distinction

Routers route IP packets. Ethernet MAC addresses are link-local and are rewritten at every Layer 3 hop. The IP source and destination normally remain end-to-end; the Layer 2 source/destination MAC addresses change across the routed boundary.


2.3 What Must Be Correct for Inter-VLAN Routing to Work?

VLANs exist and access ports belong to the intended VLANs.

802.1Q trunks carry the required VLANs between access and Layer 3 devices.

The gateway interface/subinterface for each VLAN is up/up and has the correct IP address/mask.

Hosts use the correct IP address, subnet mask, and default gateway.

Layer 3 routing is enabled where required (for a multilayer switch, ip routing).

No ACL, port-security, DHCP snooping, firewall, or other policy intentionally blocks the traffic.


3. Router-on-a-Stick (ROAS)

3.1 Design Concept

Router-on-a-Stick uses one physical router interface connected to a Layer 2 switch trunk. The physical interface is divided into logical subinterfaces. Each sub interface is associated with a VLAN by an 802.1Q encapsulation statement and receives an IP address that acts as the default gateway for that VLAN.

Pasted content image

Figure 3 - Router-on-a-Stick uses one trunk and one router sub interface per routed VLAN.


Mental model

The switch trunk transports multiple VLANs to the router. The router sees those VLANs as different logical Layer 3 subinterfaces even though they share one physical link.


3.2 Router Configuration

enable

configure terminal

hostname R1

!

interface GigabitEthernet0/0

description 802.1Q-TRUNK-TO-SW1

no shutdown

!

interface GigabitEthernet0/0.10

description VLAN10-USERS-GATEWAY

encapsulation dot1Q 10

ip address 192.168.10.1 255.255.255.0

!

interface GigabitEthernet0/0.20

description VLAN20-SERVERS-GATEWAY

encapsulation dot1Q 20

ip address 192.168.20.1 255.255.255.0

!

end

The physical router interface is enabled with no shutdown but normally does not need an IPv4 address for the ROAS VLANs. Each subinterface receives both the VLAN tag mapping and the Layer 3 address. A common mistake is to configure the IP address but omit encapsulation dot1Q, or to use the wrong VLAN ID.


3.3 Switch Configuration for ROAS

enable

configure terminal

hostname SW1

!

vlan 10

name USERS

vlan 20

name SERVERS

!

interface GigabitEthernet1/0/1

description PC-A

switchport mode access

switchport access vlan 10

spanning-tree portfast

!

interface GigabitEthernet1/0/2

description PC-B

switchport mode access

switchport access vlan 20

spanning-tree portfast

!

interface GigabitEthernet1/0/24

description TRUNK-TO-R1

switchport mode trunk

switchport trunk allowed vlan 10,20

!

end

The router-facing switch port must be a trunk so both VLAN 10 and VLAN 20 can reach the corresponding router subinterfaces. The access interfaces remain untagged endpoint-facing ports in their respective VLANs.


4. Verify and Troubleshoot Router-on-a-Stick

4.1 Router Verification

show ip interface brief

show running-config interface GigabitEthernet0/0

show running-config interface GigabitEthernet0/0.10

show running-config interface GigabitEthernet0/0.20

show interfaces GigabitEthernet0/0.10

show ip route

show ip arp


What to verify

Expected result

Physical interface

Up/up; no shutdown configured.

G0/0.10

Up/up; dot1Q 10; 192.168.10.1/24.

G0/0.20

Up/up; dot1Q 20; 192.168.20.1/24.

Routing table

Connected routes for 192.168.10.0/24 and 192.168.20.0/24.

ARP table

Host MAC/IP mappings appear after traffic is generated.


4.2 Switch Verification

show vlan brief

show interfaces trunk

show interfaces GigabitEthernet1/0/24 switchport

show mac address-table

show running-config interface GigabitEthernet1/0/24


4.3 Common ROAS Failures

Symptom

Likely cause

What to check

Same-VLAN communication works; cross-VLAN fails

Router sub interface or gateway issue

Sub interface VLAN ID, IP/mask, interface state, host default gateway.

One VLAN works; another fails

VLAN omitted or tag mismatch

Allowed VLAN list, VLAN existence, encapsulation dot1Q number.

Both VLANs fail through router

Physical/trunk failure

Router physical interface state, switch trunk state, cabling.

Host can ping gateway but not remote VLAN

Routing/policy or destination-side issue

Connected routes, destination gateway, ACLs, ARP.

Sub interface is down/down

Parent physical interface down

Check cable, switch port, no shutdown on physical interface.

 

Troubleshooting order

Start with physical/interface state, then VLAN/trunk state, then Layer 3 interfaces/routes, then ARP and host addressing. This reduces guesswork.


5. Inter-VLAN Routing with a Layer 3 Switch

5.1 What Is an SVI?

An SVI (Switch Virtual Interface) is a logical Layer 3 interface associated with a VLAN. On a multilayer switch, the SVI can own the default-gateway address for that VLAN. With ip routing enabled, the switch routes between its active SVIs and other Layer 3 interfaces using the routing table.


Pasted content image

Figure 5 - A multilayer switch routes between VLAN 10 and VLAN 20 through SVIs.


5.2 Layer 3 Switch Configuration

enable

configure terminal

hostname DIST-SW1

!

vlan 10

name USERS

vlan 20

name SERVERS

!

interface Vlan10

description USERS-DEFAULT-GATEWAY

ip address 192.168.10.1 255.255.255.0

no shutdown

!

interface Vlan20

description SERVERS-DEFAULT-GATEWAY

ip address 192.168.20.1 255.255.255.0

no shutdown

!

ip routing

end

The VLANs must exist. The SVI line protocol also depends on VLAN activity on many Cisco platforms: at least one Layer 2 port in that VLAN generally needs to be operational and participating, directly or through a trunk, for the SVI to become fully up/up. The command ip routing enables IPv4 forwarding between Layer 3 interfaces on switches that support it.


5.3 Access-Switch Uplink

interface GigabitEthernet1/0/24

description TRUNK-TO-DIST-SW1

switchport mode trunk

switchport trunk allowed vlan 10,20

Common mistake

Creating interface Vlan10 and assigning an IP address does not automatically create VLAN 10 in every design. Verify the VLAN exists with show vlan brief and that it is carried across the necessary trunks.


6. Verify and Troubleshoot SVI Routing

6.1 Core Verification Commands

show ip interface brief

show vlan brief

show interfaces trunk

show ip route

show ip arp

show mac address-table

show interfaces Vlan10

show interfaces Vlan20

show running-config | section interface Vlan

The routing table should contain connected routes for both VLAN subnets. If Vlan10 and Vlan20 are up/up and ip routing is enabled, a packet between those connected networks can be routed locally by the multilayer switch, subject to policy and host configuration.

Problem

Likely cause

Verification

SVI administratively down

shutdown configured

show ip interface brief; interface VlanX; no shutdown

SVI up/down or down/down

VLAN not active / no active Layer 2 member path

show vlan brief; show interfaces trunk; STP state

Gateway ping works from switch, not host

Host/access-port issue

Host IP/mask/GW; show interfaces switchport; MAC table

Host can reach own gateway, not other VLAN

ip routing missing or policy issue

show run | include ip routing; show ip route; ACL review

Only one access switch affected

Trunk/allowed VLAN mismatch

show interfaces trunk on both ends


6.2 Routed Port versus SVI

An SVI represents a VLAN and can serve many Layer 2 ports in that VLAN. A routed physical port is converted from Layer 2 switchport behavior to Layer 3 behavior (commonly with no switchport) and receives an IP address directly. For inter-VLAN default gateways, SVIs are usually the relevant design; routed ports are common for point-to-point links between Layer 3 devices.

Example routed uplink on a multilayer switch

interface GigabitEthernet1/0/48

no switchport

ip address 10.255.0.1 255.255.255.252

no shutdown


7. Router-on-a-Stick vs Layer 3 Switch SVIs

Feature

Router-on-a-Stick

Layer 3 Switch SVI

Layer 3 device

External router

Multilayer switch

VLAN handoff

802.1Q trunk to router

VLANs terminate as local SVIs

Gateway interface

Router sub interface

interface Vlan X

Routing enablement

Routers route by default

Often requires ip routing on multilayer switch

Traffic path

VLAN traffic traverses trunk to router and back

Routing can occur inside the switch fabric

Typical use

Smaller labs/branches; teaching 802.1Q sub interfaces

Campus/distribution and scalable enterprise designs

Failure domain

Single trunk/router link is critical

Depends on switch/redundancy design

CCNA questions often ask you to identify the method from configuration or topology. A router sub interface with encapsulation dot1Q strongly indicates Router-on-a-Stick. interface Vlan10 plus ip routing on a multilayer switch indicates SVI-based routing.

Exam pattern

If hosts in different VLANs can reach their own gateways but cannot reach each other, look for Layer 3 forwarding issues. If hosts cannot even reach the local gateway, start closer to the host: IP settings, access port, VLAN, trunk, and gateway interface state.


7.1 Gateway Addressing Rules

The gateway IP must belong to the same subnet as the hosts in that VLAN and must be unique. For VLAN 10 192.168.10.0/24, 192.168.10.1/24 is a common gateway choice. A host configured as 192.168.10.20/24 with gateway 192.168.20.1 will not use that remote-subnet address as a valid directly reachable default gateway in a normal Ethernet design.


8. Cisco Discovery Protocol (CDP)

8.1 Purpose and Scope

CDP is a Cisco-proprietary Layer 2 discovery protocol used by Cisco devices to advertise identity and interface information to directly connected neighbors. Because it operates over the local link, it can be useful even when IP addressing is incomplete or routing is broken. It does not discover devices multiple Layer 3 hops away.

Pasted content image

Figure 8 - CDP helps a Cisco device identify directly connected Cisco neighbors and their attachment ports.


8.2 What CDP Can Tell You

Neighbor device ID / hostname.

Local interface used to reach the neighbor.

Remote port ID.

Platform/model information and capability codes.

Holdtime remaining.

With detailed output, management IP address and additional advertised information such as software version or interface-related details, depending on device/platform.

This makes CDP especially valuable during cabling validation and incident response. If SW1 expects DIST-SW1 on Gi1/0/48 but show cdp neighbors reports a different switch or interface, the issue may be physical patching rather than routing configuration.


8.3 CDP Timers

Common Cisco defaults are an advertisement interval of 60 seconds and a holdtime of 180 seconds. The holdtime is how long a received neighbor entry is retained without a refresh. Values can be changed globally; exact supported commands can vary by platform.

CDP verification commands

show cdp

show cdp neighbors

show cdp neighbors detail

show cdp interface

show cdp traffic


9. Configure, Limit, and Interpret CDP

9.1 Enable or Disable CDP

Enable CDP globally

configure terminal

cdp run

end

Disable CDP globally

configure terminal

no cdp run

end

Disable CDP on one interface

configure terminal

interface GigabitEthernet1/0/10

no cdp enable

end

On many Cisco IOS / IOS XE devices, CDP is enabled globally and on supported interfaces by default. Operational policy may disable it on untrusted/external-facing interfaces to avoid advertising infrastructure information where it is not needed.


9.2 Read show cdp neighbors

SW1# show cdp neighbors

Device ID  Local Intrfce  Holdtme Capability Platform Port ID

DIST-SW1   Gig 1/0/24     143     R S I      C9K      Gig 1/0/1

R1         Gig 1/0/23     165     R          ISR      Gig 0/0/0

Field

Interpretation

Device ID

Advertised neighbor identity, commonly the hostname.

Local Interface

Your local port connected to the neighbor.

Hold time

Seconds before the entry expires if no new advertisement arrives.

Capability

Advertised functions such as router or switch.

Platform

Neighbor platform family/model.

Port ID

Neighbor interface connected to your device.

Troubleshooting use

CDP tells you what is physically adjacent. It does not prove that VLAN tagging, IP addressing, routing, STP, or end-to-end forwarding is correct. Use it to establish topology facts, then move up the stack.


10. Link Layer Discovery Protocol (LLDP)

10.1 Purpose and Standard

LLDP is the IEEE 802.1AB vendor-neutral Layer 2 discovery standard. Like CDP, it exchanges information only with directly connected neighbors, but its standardized TLV-based format makes it useful in mixed-vendor environments.


Pasted content image

Figure 10 - LLDP provides standardized neighbor discovery across multi-vendor infrastructure.


10.2 LLDP TLVs

LLDP advertisements contain Type-Length-Value (TLV) elements. Mandatory/basic information includes items such as chassis identification, port identification, and time-to-live, while optional TLVs can advertise system name, system description, capabilities, management addresses, and vendor or application extensions.

Common LLDP information

Meaning

Chassis ID

Identifies the neighbor device/chassis.

Port ID

Identifies the neighbor port.

TTL

How long the received information remains valid.

System Name

Neighbor hostname/name when advertised.

System Description

Vendor/OS/platform description.

System Capabilities

Functions the neighbor can perform.

Management Address

Management-layer address when advertised.


10.3 LLDP Timers

Common Cisco defaults are a transmit interval of 30 seconds and a holdtime of 120 seconds, with a short reinitialization delay after LLDP is re-enabled. Treat these as common IOS / IOS XE defaults rather than universal values across every vendor/device.


11. Configure and Verify LLDP

11.1 Global Enablement

Enable LLDP globally

configure terminal

lldp run

end

Disable LLDP globally

configure terminal

no lldp run

end


11.2 Per-Interface Transmit / Receive Control

configure terminal

interface GigabitEthernet1/0/24

lldp transmit

lldp receive

end

Disable LLDP on a specific interface

configure terminal

interface GigabitEthernet1/0/10

no lldp transmit

no lldp receive

end

LLDP provides separate transmit and receive controls on many Cisco platforms. This can be useful when policy permits learning neighbor information but not advertising local details, or vice versa.


11.3 Verification Commands

show lldp

show lldp neighbors

show lldp neighbors detail

show lldp interface

show lldp traffic

As with CDP, the first operational question is whether the expected neighbor appears on the expected local interface. If LLDP is globally disabled, or transmit/receive is disabled on one end, the neighbor entry may be missing even when the Ethernet link itself is up.

Protocol independence

A link can carry both CDP and LLDP at the same time if both devices support and enable them. They are separate discovery protocols; enabling one does not automatically enable the other.


12. CDP vs LLDP

Feature

CDP

LLDP

Standard

Cisco proprietary

IEEE 802.1AB

Typical vendor scope

Cisco-centric

Multi-vendor / vendor-neutral

Layer

Layer 2, directly connected

Layer 2, directly connected

Information model

Cisco-defined advertisements

Standardized TLVs

Global command

cdp run

lldp run

Neighbor command

show cdp neighbors

show lldp neighbors

Detailed neighbor command

show cdp neighbors detail

show lldp neighbors detail

Per-interface control

cdp enable / no cdp enable

lldp transmit / receive controls

Common Cisco advertisement timer

60 s

30 s

Common Cisco holdtime

180 s

120 s

Both protocols are primarily operational discovery tools. They help engineers map the physical topology, identify ports, and validate direct neighbors. Neither protocol substitutes for VLAN/trunk verification, routing-table analysis, ARP/MAC inspection, or end-to-end testing.


12.1 LLDP-MED and Voice Devices

LLDP-MED (Media Endpoint Discovery) extends LLDP for media endpoints such as IP phones. Depending on the environment, it can advertise network policy information including voice VLAN-related parameters. Cisco IP phones may also use CDP to learn voice VLAN information in Cisco-centric deployments. For CCNA, focus on the role of discovery protocols rather than memorizing every extension TLV.

Security perspective

Discovery protocols intentionally advertise useful infrastructure metadata. On user-facing or untrusted links, organizations may restrict CDP/LLDP according to security policy. On internal infrastructure links they can be highly valuable for operations and troubleshooting.

Quick knowledge check

1. A host in VLAN 10 needs to communicate with a host in VLAN 20. Which function is required?

Answer: Layer 3 routing through a router or multilayer switch.

2. In Router-on-a-Stick, what command binds subinterface G0/0.10 to VLAN 10?

Answer: Encapsulation dot1Q 10

3. Which command enables IPv4 routing on a Cisco multilayer switch?

Answer: Command: ip routing

4. Which two commands quickly display directly connected neighbors?

Answer: show cdp neighbors and show lldp neighbors.