Layer-3 Switch & SVI Routing

Mental model

Router-on-a-stick (covered in Inter-VLAN Routing) routes between VLANs by trunking every VLAN over a single physical link to an external router. It works, until you have 50 VLANs and 10 Gbps of inter-VLAN traffic. Then the router CPU melts.

A Layer-3 switch solves this. It’s a switch chassis with both:

• a normal Layer-2 forwarding plane (MAC table, VLAN tagging, STP), and
• a Layer-3 forwarding plane (route table, IP forwarding) implemented in the ASIC, at line rate.

The Layer-3 switch is the router for every VLAN it carries. Hosts use the switch itself as their default gateway.

The L3 interface for each VLAN is called an SVI, Switched Virtual Interface. It’s a logical interface (not tied to a physical port) created with interface Vlan<id>. Once you give it an IP and the VLAN exists, the switch can route packets out of that VLAN.

SVI vs routed port: know the difference

A routed port is a physical port acting like a router interface (no VLAN, no switching, just routing). You use routed ports for L3-to-L3 links between distribution and core switches.

Commands: configure an L3 switch

! 1. Enable IP routing globally (CRITICAL: switch is L2-only until this)
SW1(config)# ip routing

! 2. Create VLANs
SW1(config)# vlan 10
SW1(config-vlan)# name USERS
SW1(config)# vlan 20
SW1(config-vlan)# name SERVERS

! 3. Create SVIs (one per VLAN: hosts use these as gateway)
SW1(config)# interface Vlan10
SW1(config-if)# description USERS gateway
SW1(config-if)# ip address 192.168.10.1 255.255.255.0
SW1(config-if)# no shutdown

SW1(config)# interface Vlan20
SW1(config-if)# description SERVERS gateway
SW1(config-if)# ip address 192.168.20.1 255.255.255.0
SW1(config-if)# no shutdown

! 4. Assign access ports to VLANs (as on any switch)
SW1(config)# interface range Gi1/0/1 - 12
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 10

SW1(config)# interface range Gi1/0/13 - 23
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 20

! 5. (Optional) Convert uplink to a routed port
SW1(config)# interface Gi1/0/24
SW1(config-if)# no switchport
SW1(config-if)# ip address 10.0.0.1 255.255.255.252
SW1(config-if)# description Uplink to CORE1

Default gateway behavior

Hosts in VLAN 10 use 192.168.10.1 (the SVI IP) as their default gateway. The switch handles inter-VLAN routing entirely in its ASIC. No external router.

For a host in VLAN 10 to reach a host in VLAN 20:

1. Host sends frame to switch with destination MAC = SVI10 MAC (gateway).
2. Switch sees: destination MAC = me → strip Ethernet header, route at L3.
3. Route table says VLAN 20 = SVI20 → re-encapsulate with SVI20 MAC and forward into VLAN 20.

All at line rate. No CPU involvement after the first packet (CEF caches the rewrite).

SVI “line protocol up”: the hidden gotcha

An SVI’s line protocol is up only when the VLAN exists and at least one Layer 2 port in that VLAN (access or trunk) is up and in STP forwarding state.

SW1# show interface Vlan10
Vlan10 is up, line protocol is down   ← no active ports in VLAN 10

If you create VLAN 10, configure SVI Vlan10, but every port in VLAN 10 is shut down → the SVI is up/down and won’t route. This trips up most CCNA labs the first time.

Workaround: no autostate on the SVI keeps it up regardless of physical port status, which is useful in lab setups where you don’t have hosts plugged in.

Verification

SW1# show ip interface brief
SW1# show ip route
SW1# show ip route connected      ! Should show one /24 per SVI
SW1# show vlan brief
SW1# show interfaces Vlan10
SW1# ping 192.168.10.50 source vlan10

Common mistakes

1. Forgetting ip routing. Without it, the switch is L2-only: SVIs answer pings on their own subnet but cannot forward packets between VLANs.

2. SVI down because no port in VLAN is active. Plug in a host or no autostate if labbing.

3. IP address on a port that’s still switchport. You can’t assign an IP to a port that’s in switch mode. no switchport first → then ip address.

4. Forgetting trunk allowed VLAN list. If the SVI lives on this switch but VLANs come in over a trunk, make sure that VLAN is in the trunk’s allowed list.

5. VLAN exists in CLI but not in the VLAN database. interface Vlan10 doesn’t create VLAN 10; vlan 10 does. Both must exist.

6. Stacking and the wrong stack-master. On stacked 3850/9300 switches, SVIs are owned by the stack master. A master failover takes ~30 seconds during which SVIs briefly bounce.

Lab to try tonight

1. Build in CML or Packet Tracer: one L3 switch (multilayer), two access switches, two hosts per VLAN.
2. Create VLAN 10 (USERS) and VLAN 20 (SERVERS) across all three switches.
3. Trunk between switches; access ports for hosts.
4. On the L3 switch only: ip routing + SVIs Vlan10 and Vlan20.
5. Configure hosts to use the SVI IPs as gateways.
6. Test: host in VLAN 10 pings host in VLAN 20 → success.
7. Now shut down interface Vlan10 → ping fails. show ip route shows the connected /24 disappears.
8. Bonus: convert the L3 switch’s uplink to a routed port to a router. Verify with show ip interface brief that the port is no longer “Vlan” / access.

Cheat strip