Why can't two hosts in different VLANs talk at layer 2, and how do router-on-a-stick and a switch virtual interface route between them?

## Why layer 2 stops at the VLAN boundary A VLAN is one **broadcast domain**, and each VLAN is conventionally one **IP subnet**. Two consequences follow directly: 1. **ARP cannot cross.** To send an Ethernet frame to another host in its own subnet, a host broadcasts an ARP request for that host's MAC address. A switch floods that broadcast only within the sender's VLAN, so a host in VLAN 10 can never learn the MAC address of a host in VLAN 20. No MAC, no frame. 2. **Off-subnet traffic goes to the gateway.** When the destination IP is outside the host's own subnet, the host does not ARP for the destination at all. It sends the frame to its configured **default gateway**'s MAC address, and the gateway, a router, forwards the packet towards the destination subnet. So reaching another VLAN is **routing**, not switching. Something with an interface in both subnets must receive the packet, decrement the IP time-to-live, and forward it into the other VLAN. The two standard ways to provide that are router-on-a-stick and the switch virtual interface. ## Router-on-a-stick An external router connects to the switch over a **single 802.1Q trunk** (the "stick"). The router's physical interface is divided into one **subinterface per VLAN**: - Each subinterface is configured with a VLAN ID so it sends and receives frames **tagged** for that VLAN. - Each subinterface holds the **gateway IP address** of its VLAN's subnet, so every host uses its own VLAN's subinterface as its default gateway. A packet from a Finance host (VLAN 10) to an Engineering host (VLAN 20): 1. The Finance host sends the frame to its gateway's MAC; the switch forwards it up the trunk **tagged VID 10**. 2. The router receives it on the VLAN 10 subinterface, looks up the destination, and finds the VLAN 20 subinterface. 3. The router rewrites the Ethernet header (new source and destination MACs), decrements the IP TTL, and sends the packet back down the trunk **tagged VID 20**. 4. The switch delivers it into VLAN 20 to the Engineering host. Every inter-VLAN packet therefore traverses the one trunk **twice**, once in, once out, which makes that link the bottleneck. Router-on-a-stick is cheap and simple, and it is how a small site with a plain router and a plain switch routes between VLANs. ## The switch virtual interface A **layer 3 switch** combines switching and routing in one box. For each VLAN it can own a **switch virtual interface (SVI)**: a logical IP interface, not tied to any physical port, that holds that VLAN's gateway address. - Hosts in each VLAN use their VLAN's SVI address as the default gateway. - When a packet must move between VLANs, the switch routes between the two SVIs **internally**, usually in hardware, at line rate. - No external router and no dedicated trunk are needed; the routing happens where the frames already are. | | Router-on-a-stick | Switch virtual interface | |---|---|---| | Where routing happens | External router | Inside the layer 3 switch | | VLAN-to-VLAN path | Up and down one trunk, twice per packet | Internal, between SVIs | | Typical performance | Limited by the one trunk link | Line-rate, hardware-forwarded | | Each VLAN's gateway lives on | A tagged subinterface on the router | An SVI on the switch | | Suits | Small sites, few VLANs, low volume | Campus and data-centre cores with heavy inter-VLAN traffic | Both are **implementation features**, not protocol mechanisms: the protocol fact is that inter-VLAN traffic is ordinary IP routing between subnets, and both designs simply decide where the router lives and how the VLANs reach it. What crosses the wire between switch and router in the router-on-a-stick case is standard 802.1Q-tagged Ethernet. ## Common misconceptions - **A trunk does not route.** A trunk carries many VLANs but keeps them separate; it never forwards a frame from one VLAN into another. Only a router or an SVI does that. - **The gateway is not optional.** Give two VLANs addresses but no router between them and the hosts simply cannot reach each other, however the switch is cabled. - **Same switch, different VLAN, still routed.** Two hosts on one physical switch but in different VLANs still need a router or SVI; sharing a switch does not give them a layer 2 path. - **The router rewrites the Ethernet header, not the IP addresses.** Routing between VLANs changes source and destination MACs and decrements the TTL; the source and destination IP addresses stay the same (barring NAT, which is a different function).