LESSON PURPOSE |
Build a practical understanding of how devices in different VLANs communicate through Layer 3 routing, then use CDP and LLDP to discover directly connected devices, verify connections, and support troubleshooting and network documentation. |
Lesson Overview
VLANs create separate Layer 2 broadcast domains, so communication between VLANs requires Layer 3 routing. Inter-VLAN routing can be provided by router subinterfaces using 802.1Q or by a multilayer switch using switched virtual interfaces (SVIs). CDP and LLDP complement this by identifying directly connected neighbors and reporting useful details such as device identity, local/remote interfaces, capabilities, platform, and management addressing.
Learning Objectives
• Explain why hosts in different VLANs require Layer 3 routing and a correct default gateway.
• Compare router-on-a-stick and multilayer-switch/SVI methods for inter-VLAN routing.
• Configure and verify 802.1Q router subinterfaces for multiple VLANs.
• Configure and verify SVIs and IP routing on a multilayer switch.
• Trace the packet path between hosts located in different VLANs.
• Use VLAN, trunk, interface, routing-table, and ping outputs to verify inter-VLAN connectivity.
• Troubleshoot missing VLANs, incorrect access VLANs, trunk/allowed-VLAN issues, down SVIs, wrong gateways, and missing routing.
• Explain the purpose of CDP and LLDP and distinguish Cisco-proprietary CDP from standards-based LLDP.
• Enable, disable, and verify CDP/LLDP and interpret neighbor information using show commands.
• Use CDP and LLDP to validate network documentation, confirm adjacent-device links, and support troubleshooting.
Learning Outcomes
By the end of this lesson, a CCNA candidate should be able to explain why devices in different VLANs need Layer 3 forwarding, configure and verify router-on-a-stick, configure and verify switch virtual interfaces (SVIs) on a multilayer switch, interpret routing and ARP information, use CDP and LLDP to discover directly connected neighbors, compare the protocols, and troubleshoot common configuration failures.
CCNA ALIGNMENT |
Cisco 200-301 CCNA v2.0 includes switch-to-switch and switch-to-router infrastructure connectivity, Layer 2 802.1Q trunks, switch virtual interfaces (SVIs), and validation of network documentation using CDP and LLDP. This lesson uses inter-VLAN routing to connect those switching and Layer 3 concepts in a practical workflow. |
1. Inter-VLAN Routing Fundamentals
1.1 Why VLANs Cannot Route by Themselves
A VLAN is a Layer 2 broadcast domain. A Layer 2 switch can forward Ethernet frames between ports in the same VLAN by using its MAC address table, but it does not route an IP packet from one IP subnet to another unless the device also provides Layer 3 routing functionality. If PC-A is in VLAN 10 / 192.168.10.0/24 and PC-B is in VLAN 20 / 192.168.20.0/24, the hosts recognize that the destination is outside their local subnet and send the traffic to a default gateway.
Inter-VLAN routing is the Layer 3 process that forwards traffic between those VLAN interfaces. The gateway can be implemented on a router using 802.1Q sub interfaces or on a multilayer switch using SVIs. In either design, the gateway owns one Layer 3 IP address in each VLAN and makes a routing decision between the connected networks.
Figure 1 - A Layer 3 gateway provides routing between independent Layer 2 VLANs.
|
Core exam idea Same VLAN = Layer 2 switching. Different VLANs/subnets = Layer 3 routing through the configured default gateway. |
1.2 The Default Gateway Decision
When a host wants to send an IPv4 packet, it compares the destination IP address with its own address and subnet mask. If the destination is local, the host resolves the destination host MAC address and sends directly. If the destination is remote, the host resolves the MAC address of its default gateway and sends the Ethernet frame to the gateway while keeping the remote IP address as the Layer 3 destination.
|
Item |
PC-A sending to PC-B in another VLAN |
|
PC-A IP |
192.168.10.10/24 |
|
Destination IP |
192.168.20.10/24 |
|
Default gateway |
192.168.10.1 |
|
Destination MAC in first Ethernet frame |
MAC address of the VLAN 10 gateway, not the MAC address of PC-B |
|
What the router/L3 switch changes |
Layer 2 header is rebuilt for the outgoing VLAN; the IP source/destination remain PC-A and PC-B, apart from normal TTL/checksum updates. |
1.3 ARP and Inter-VLAN Routing
ARP resolves IPv4 addresses to MAC addresses on the local Layer 2 segment. PC-A does not ARP for a remote host such as 192.168.20.10 when its subnet is 192.168.10.0/24. Instead, PC-A ARPs for the gateway 192.168.10.1. After the gateway routes the packet into VLAN 20, the gateway may ARP for 192.168.20.10 if it does not already know the destination MAC.
Useful verification commands
PC-A> arp -a
DIST-SW1# show ip arp
DIST-SW1# show mac address-table
DIST-SW1# show ip route
2. Inter-VLAN Packet Flow - Step by Step
2.1 Example Addressing
|
Device / interface |
VLAN |
IPv4 address |
Role |
|
PC-A |
10 |
192.168.10.10/24 |
Source host |
|
Vlan10 gateway |
10 |
192.168.10.1/24 |
Default gateway for VLAN 10 |
|
Vlan20 gateway |
20 |
192.168.20.1/24 |
Default gateway for VLAN 20 |
|
PC-B |
20 |
192.168.20.10/24 |
Destination host |
2.2 Packet from VLAN 10 to VLAN 20
1. PC-A determines that 192.168.20.10 is outside its local /24 network, so it chooses default gateway 192.168.10.1.
2. PC-A uses ARP to learn the VLAN 10 gateway MAC address if it is not already cached.
3. PC-A sends an Ethernet frame to the gateway MAC. The IP packet inside still has source 192.168.10.10 and destination 192.168.20.10.
4. The router or multilayer switch removes the incoming Layer 2 header, decrements TTL, checks its routing table, and selects the directly connected 192.168.20.0/24 network.
5. The gateway resolves PC-B with ARP if necessary, builds a new Ethernet frame appropriate for VLAN 20, and forwards the packet.
6. PC-B receives the packet. The return traffic follows the same Layer 3 process in reverse using default gateway 192.168.20.1.
|
Important distinction Routers route IP packets. Ethernet MAC addresses are link-local and are rewritten at every Layer 3 hop. The IP source and destination normally remain end-to-end; the Layer 2 source/destination MAC addresses change across the routed boundary. |
2.3 What Must Be Correct for Inter-VLAN Routing to Work?
VLANs exist and access ports belong to the intended VLANs.
802.1Q trunks carry the required VLANs between access and Layer 3 devices.
The gateway interface/subinterface for each VLAN is up/up and has the correct IP address/mask.
Hosts use the correct IP address, subnet mask, and default gateway.
Layer 3 routing is enabled where required (for a multilayer switch, ip routing).
No ACL, port-security, DHCP snooping, firewall, or other policy intentionally blocks the traffic.
3. Router-on-a-Stick (ROAS)
3.1 Design Concept
Router-on-a-Stick uses one physical router interface connected to a Layer 2 switch trunk. The physical interface is divided into logical subinterfaces. Each sub interface is associated with a VLAN by an 802.1Q encapsulation statement and receives an IP address that acts as the default gateway for that VLAN.
Figure 3 - Router-on-a-Stick uses one trunk and one router sub interface per routed VLAN.
|
Mental model The switch trunk transports multiple VLANs to the router. The router sees those VLANs as different logical Layer 3 subinterfaces even though they share one physical link. |
3.2 Router Configuration
enable
configure terminal
hostname R1
!
interface GigabitEthernet0/0
description 802.1Q-TRUNK-TO-SW1
no shutdown
!
interface GigabitEthernet0/0.10
description VLAN10-USERS-GATEWAY
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0.20
description VLAN20-SERVERS-GATEWAY
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
!
end
The physical router interface is enabled with no shutdown but normally does not need an IPv4 address for the ROAS VLANs. Each subinterface receives both the VLAN tag mapping and the Layer 3 address. A common mistake is to configure the IP address but omit encapsulation dot1Q, or to use the wrong VLAN ID.
3.3 Switch Configuration for ROAS
enable
configure terminal
hostname SW1
!
vlan 10
name USERS
vlan 20
name SERVERS
!
interface GigabitEthernet1/0/1
description PC-A
switchport mode access
switchport access vlan 10
spanning-tree portfast
!
interface GigabitEthernet1/0/2
description PC-B
switchport mode access
switchport access vlan 20
spanning-tree portfast
!
interface GigabitEthernet1/0/24
description TRUNK-TO-R1
switchport mode trunk
switchport trunk allowed vlan 10,20
!
end
The router-facing switch port must be a trunk so both VLAN 10 and VLAN 20 can reach the corresponding router subinterfaces. The access interfaces remain untagged endpoint-facing ports in their respective VLANs.
4. Verify and Troubleshoot Router-on-a-Stick
4.1 Router Verification
show ip interface brief
show running-config interface GigabitEthernet0/0
show running-config interface GigabitEthernet0/0.10
show running-config interface GigabitEthernet0/0.20
show interfaces GigabitEthernet0/0.10
show ip route
show ip arp
|
What to verify |
Expected result |
|
Physical interface |
Up/up; no shutdown configured. |
|
G0/0.10 |
Up/up; dot1Q 10; 192.168.10.1/24. |
|
G0/0.20 |
Up/up; dot1Q 20; 192.168.20.1/24. |
|
Routing table |
Connected routes for 192.168.10.0/24 and 192.168.20.0/24. |
|
ARP table |
Host MAC/IP mappings appear after traffic is generated. |
4.2 Switch Verification
show vlan brief
show interfaces trunk
show interfaces GigabitEthernet1/0/24 switchport
show mac address-table
show running-config interface GigabitEthernet1/0/24
4.3 Common ROAS Failures
|
Symptom |
Likely cause |
What to check |
|
Same-VLAN communication works; cross-VLAN fails |
Router sub interface or gateway issue |
Sub interface VLAN ID, IP/mask, interface state, host default gateway. |
|
One VLAN works; another fails |
VLAN omitted or tag mismatch |
Allowed VLAN list, VLAN existence, encapsulation dot1Q number. |
|
Both VLANs fail through router |
Physical/trunk failure |
Router physical interface state, switch trunk state, cabling. |
|
Host can ping gateway but not remote VLAN |
Routing/policy or destination-side issue |
Connected routes, destination gateway, ACLs, ARP. |
|
Sub interface is down/down |
Parent physical interface down |
Check cable, switch port, no shutdown on physical interface. |
|
Troubleshooting order Start with physical/interface state, then VLAN/trunk state, then Layer 3 interfaces/routes, then ARP and host addressing. This reduces guesswork. |
5. Inter-VLAN Routing with a Layer 3 Switch
5.1 What Is an SVI?
An SVI (Switch Virtual Interface) is a logical Layer 3 interface associated with a VLAN. On a multilayer switch, the SVI can own the default-gateway address for that VLAN. With ip routing enabled, the switch routes between its active SVIs and other Layer 3 interfaces using the routing table.
Figure 5 - A multilayer switch routes between VLAN 10 and VLAN 20 through SVIs.
5.2 Layer 3 Switch Configuration
enable
configure terminal
hostname DIST-SW1
!
vlan 10
name USERS
vlan 20
name SERVERS
!
interface Vlan10
description USERS-DEFAULT-GATEWAY
ip address 192.168.10.1 255.255.255.0
no shutdown
!
interface Vlan20
description SERVERS-DEFAULT-GATEWAY
ip address 192.168.20.1 255.255.255.0
no shutdown
!
ip routing
end
The VLANs must exist. The SVI line protocol also depends on VLAN activity on many Cisco platforms: at least one Layer 2 port in that VLAN generally needs to be operational and participating, directly or through a trunk, for the SVI to become fully up/up. The command ip routing enables IPv4 forwarding between Layer 3 interfaces on switches that support it.
5.3 Access-Switch Uplink
interface GigabitEthernet1/0/24
description TRUNK-TO-DIST-SW1
switchport mode trunk
switchport trunk allowed vlan 10,20
|
Common mistake Creating interface Vlan10 and assigning an IP address does not automatically create VLAN 10 in every design. Verify the VLAN exists with show vlan brief and that it is carried across the necessary trunks. |
6. Verify and Troubleshoot SVI Routing
6.1 Core Verification Commands
show ip interface brief
show vlan brief
show interfaces trunk
show ip route
show ip arp
show mac address-table
show interfaces Vlan10
show interfaces Vlan20
show running-config | section interface Vlan
The routing table should contain connected routes for both VLAN subnets. If Vlan10 and Vlan20 are up/up and ip routing is enabled, a packet between those connected networks can be routed locally by the multilayer switch, subject to policy and host configuration.
|
Problem |
Likely cause |
Verification |
|
SVI administratively down |
shutdown configured |
show ip interface brief; interface VlanX; no shutdown |
|
SVI up/down or down/down |
VLAN not active / no active Layer 2 member path |
show vlan brief; show interfaces trunk; STP state |
|
Gateway ping works from switch, not host |
Host/access-port issue |
Host IP/mask/GW; show interfaces switchport; MAC table |
|
Host can reach own gateway, not other VLAN |
ip routing missing or policy issue |
show run | include ip routing; show ip route; ACL review |
|
Only one access switch affected |
Trunk/allowed VLAN mismatch |
show interfaces trunk on both ends |
6.2 Routed Port versus SVI
An SVI represents a VLAN and can serve many Layer 2 ports in that VLAN. A routed physical port is converted from Layer 2 switchport behavior to Layer 3 behavior (commonly with no switchport) and receives an IP address directly. For inter-VLAN default gateways, SVIs are usually the relevant design; routed ports are common for point-to-point links between Layer 3 devices.
Example routed uplink on a multilayer switch
interface GigabitEthernet1/0/48
no switchport
ip address 10.255.0.1 255.255.255.252
no shutdown
7. Router-on-a-Stick vs Layer 3 Switch SVIs
|
Feature |
Router-on-a-Stick |
Layer 3 Switch SVI |
|
Layer 3 device |
External router |
Multilayer switch |
|
VLAN handoff |
802.1Q trunk to router |
VLANs terminate as local SVIs |
|
Gateway interface |
Router sub interface |
interface Vlan X |
|
Routing enablement |
Routers route by default |
Often requires ip routing on multilayer switch |
|
Traffic path |
VLAN traffic traverses trunk to router and back |
Routing can occur inside the switch fabric |
|
Typical use |
Smaller labs/branches; teaching 802.1Q sub interfaces |
Campus/distribution and scalable enterprise designs |
|
Failure domain |
Single trunk/router link is critical |
Depends on switch/redundancy design |
CCNA questions often ask you to identify the method from configuration or topology. A router sub interface with encapsulation dot1Q strongly indicates Router-on-a-Stick. interface Vlan10 plus ip routing on a multilayer switch indicates SVI-based routing.
|
Exam pattern If hosts in different VLANs can reach their own gateways but cannot reach each other, look for Layer 3 forwarding issues. If hosts cannot even reach the local gateway, start closer to the host: IP settings, access port, VLAN, trunk, and gateway interface state. |
7.1 Gateway Addressing Rules
The gateway IP must belong to the same subnet as the hosts in that VLAN and must be unique. For VLAN 10 192.168.10.0/24, 192.168.10.1/24 is a common gateway choice. A host configured as 192.168.10.20/24 with gateway 192.168.20.1 will not use that remote-subnet address as a valid directly reachable default gateway in a normal Ethernet design.
8. Cisco Discovery Protocol (CDP)
8.1 Purpose and Scope
CDP is a Cisco-proprietary Layer 2 discovery protocol used by Cisco devices to advertise identity and interface information to directly connected neighbors. Because it operates over the local link, it can be useful even when IP addressing is incomplete or routing is broken. It does not discover devices multiple Layer 3 hops away.
Figure 8 - CDP helps a Cisco device identify directly connected Cisco neighbors and their attachment ports.
8.2 What CDP Can Tell You
Neighbor device ID / hostname.
Local interface used to reach the neighbor.
Remote port ID.
Platform/model information and capability codes.
Holdtime remaining.
With detailed output, management IP address and additional advertised information such as software version or interface-related details, depending on device/platform.
This makes CDP especially valuable during cabling validation and incident response. If SW1 expects DIST-SW1 on Gi1/0/48 but show cdp neighbors reports a different switch or interface, the issue may be physical patching rather than routing configuration.
8.3 CDP Timers
Common Cisco defaults are an advertisement interval of 60 seconds and a holdtime of 180 seconds. The holdtime is how long a received neighbor entry is retained without a refresh. Values can be changed globally; exact supported commands can vary by platform.
CDP verification commands
show cdp
show cdp neighbors
show cdp neighbors detail
show cdp interface
show cdp traffic
9. Configure, Limit, and Interpret CDP
9.1 Enable or Disable CDP
Enable CDP globally
configure terminal
cdp run
end
Disable CDP globally
configure terminal
no cdp run
end
Disable CDP on one interface
configure terminal
interface GigabitEthernet1/0/10
no cdp enable
end
On many Cisco IOS / IOS XE devices, CDP is enabled globally and on supported interfaces by default. Operational policy may disable it on untrusted/external-facing interfaces to avoid advertising infrastructure information where it is not needed.
9.2 Read show cdp neighbors
SW1# show cdp neighbors
Device ID Local Intrfce Holdtme Capability Platform Port ID
DIST-SW1 Gig 1/0/24 143 R S I C9K Gig 1/0/1
R1 Gig 1/0/23 165 R ISR Gig 0/0/0
|
Field |
Interpretation |
|
Device ID |
Advertised neighbor identity, commonly the hostname. |
|
Local Interface |
Your local port connected to the neighbor. |
|
Hold time |
Seconds before the entry expires if no new advertisement arrives. |
|
Capability |
Advertised functions such as router or switch. |
|
Platform |
Neighbor platform family/model. |
|
Port ID |
Neighbor interface connected to your device. |
|
Troubleshooting use CDP tells you what is physically adjacent. It does not prove that VLAN tagging, IP addressing, routing, STP, or end-to-end forwarding is correct. Use it to establish topology facts, then move up the stack. |
10. Link Layer Discovery Protocol (LLDP)
10.1 Purpose and Standard
LLDP is the IEEE 802.1AB vendor-neutral Layer 2 discovery standard. Like CDP, it exchanges information only with directly connected neighbors, but its standardized TLV-based format makes it useful in mixed-vendor environments.
Figure 10 - LLDP provides standardized neighbor discovery across multi-vendor infrastructure.
10.2 LLDP TLVs
LLDP advertisements contain Type-Length-Value (TLV) elements. Mandatory/basic information includes items such as chassis identification, port identification, and time-to-live, while optional TLVs can advertise system name, system description, capabilities, management addresses, and vendor or application extensions.
|
Common LLDP information |
Meaning |
|
Chassis ID |
Identifies the neighbor device/chassis. |
|
Port ID |
Identifies the neighbor port. |
|
TTL |
How long the received information remains valid. |
|
System Name |
Neighbor hostname/name when advertised. |
|
System Description |
Vendor/OS/platform description. |
|
System Capabilities |
Functions the neighbor can perform. |
|
Management Address |
Management-layer address when advertised. |
10.3 LLDP Timers
Common Cisco defaults are a transmit interval of 30 seconds and a holdtime of 120 seconds, with a short reinitialization delay after LLDP is re-enabled. Treat these as common IOS / IOS XE defaults rather than universal values across every vendor/device.
11. Configure and Verify LLDP
11.1 Global Enablement
Enable LLDP globally
configure terminal
lldp run
end
Disable LLDP globally
configure terminal
no lldp run
end
11.2 Per-Interface Transmit / Receive Control
configure terminal
interface GigabitEthernet1/0/24
lldp transmit
lldp receive
end
Disable LLDP on a specific interface
configure terminal
interface GigabitEthernet1/0/10
no lldp transmit
no lldp receive
end
LLDP provides separate transmit and receive controls on many Cisco platforms. This can be useful when policy permits learning neighbor information but not advertising local details, or vice versa.
11.3 Verification Commands
show lldp
show lldp neighbors
show lldp neighbors detail
show lldp interface
show lldp traffic
As with CDP, the first operational question is whether the expected neighbor appears on the expected local interface. If LLDP is globally disabled, or transmit/receive is disabled on one end, the neighbor entry may be missing even when the Ethernet link itself is up.
|
Protocol independence A link can carry both CDP and LLDP at the same time if both devices support and enable them. They are separate discovery protocols; enabling one does not automatically enable the other. |
12. CDP vs LLDP
|
Feature |
CDP |
LLDP |
|
Standard |
Cisco proprietary |
IEEE 802.1AB |
|
Typical vendor scope |
Cisco-centric |
Multi-vendor / vendor-neutral |
|
Layer |
Layer 2, directly connected |
Layer 2, directly connected |
|
Information model |
Cisco-defined advertisements |
Standardized TLVs |
|
Global command |
cdp run |
lldp run |
|
Neighbor command |
show cdp neighbors |
show lldp neighbors |
|
Detailed neighbor command |
show cdp neighbors detail |
show lldp neighbors detail |
|
Per-interface control |
cdp enable / no cdp enable |
lldp transmit / receive controls |
|
Common Cisco advertisement timer |
60 s |
30 s |
|
Common Cisco holdtime |
180 s |
120 s |
Both protocols are primarily operational discovery tools. They help engineers map the physical topology, identify ports, and validate direct neighbors. Neither protocol substitutes for VLAN/trunk verification, routing-table analysis, ARP/MAC inspection, or end-to-end testing.
12.1 LLDP-MED and Voice Devices
LLDP-MED (Media Endpoint Discovery) extends LLDP for media endpoints such as IP phones. Depending on the environment, it can advertise network policy information including voice VLAN-related parameters. Cisco IP phones may also use CDP to learn voice VLAN information in Cisco-centric deployments. For CCNA, focus on the role of discovery protocols rather than memorizing every extension TLV.
|
Security perspective Discovery protocols intentionally advertise useful infrastructure metadata. On user-facing or untrusted links, organizations may restrict CDP/LLDP according to security policy. On internal infrastructure links they can be highly valuable for operations and troubleshooting. |
Quick knowledge check
1. A host in VLAN 10 needs to communicate with a host in VLAN 20. Which function is required?
Answer: Layer 3 routing through a router or multilayer switch.
2. In Router-on-a-Stick, what command binds subinterface G0/0.10 to VLAN 10?
Answer: Encapsulation dot1Q 10
3. Which command enables IPv4 routing on a Cisco multilayer switch?
Answer: Command: ip routing
4. Which two commands quickly display directly connected neighbors?
Answer: show cdp neighbors and show lldp neighbors.