Layer 3 Inter-VLAN Routing: SVIs, Routed Ports, and Best Practices

Inter-VLAN routing through SVIs (Switch Virtual Interfaces) on an L3 switch: a modern alternative to router-on-a-stick. Wire-speed performance and straightforward configuration. Practical guide covering Cisco/Juniper/Aruba configuration, capacity planning, and common pitfalls.

SVI vs. Router-on-a-Stick

Router-on-a-stick (legacy)

• L2 switch and external router
• 802.1Q trunk between the switch and router
• Router subinterfaces: 1 per VLAN
• Bottleneck: limited by the capacity of a single link
• More complex configuration

SVI (modern)

• Integrated L3 switch (Catalyst 9300, Aruba CX 6300, EX4300)
• VLAN interface: 1 SVI per VLAN
• Wire-speed hardware routing
• No bottleneck
• Straightforward configuration

Cisco Configuration

• ip routing: enable L3 routing
• interface vlan 10
• ip address 192.168.10.1 255.255.255.0
• no shutdown
• interface Gi1/0/1
• switchport mode access
• switchport access vlan 10

Juniper EX Configuration

• set interfaces irb unit 10 family inet address 192.168.10.1/24
• set vlans DATA vlan-id 10 l3-interface irb.10

Aruba CX Configuration

• vlan 10 ; exit
• interface vlan 10 ; ip address 192.168.10.1/24

HSRP/VRRP on SVIs

For HA between 2 L3 switches:

• 2× distribution-layer L3 switches
• Active-standby HSRP or VRRP
• Priority: 110 for the primary, 100 for the backup
• Preemption enabled

Inter-VLAN ACLs

• ACL applied inbound or outbound on the SVI
• ip access-list extended BLOCK-DATA-TO-SERVERS
• deny ip 192.168.10.0 0.0.0.255 192.168.50.0 0.0.0.255
• permit ip any any
• interface vlan 10 ; ip access-group BLOCK-DATA-TO-SERVERS in

DHCP Relay

When using a centralized DHCP server:

• interface vlan 10
• ip helper-address 10.0.0.50 (DHCP server IP)

Order from OPTINOC

Cisco Catalyst 9300, Aruba CX 6300, and Juniper EX4300 L3 switches. SVI and HSRP configuration. Quote within 48 hours.