Tutorials · Switching

How to Set Up Inter-VLAN Routing on a Layer 3 Switch

Route between VLANs at wire speed using switch virtual interfaces (SVIs), a DHCP relay and ACLs that control which networks can talk.

Intermediate15 min6 steps

Before you start

A Layer 3 managed switch
VLANs already created (see the VLAN tutorial)
A DHCP server address if clients use DHCP

Step by step

Enable IP routing
Many Layer 3 switches need routing enabled globally.
```
ip routing
```

Create an SVI per VLAN

Each SVI becomes the default gateway for its VLAN.

interface vlan 10
 ip address 10.10.0.1 255.255.255.0
interface vlan 30
 ip address 10.30.0.1 255.255.255.0

Add a DHCP relay
If the DHCP server is in another subnet, forward requests from each VLAN.
```
interface vlan 10
 ip helper-address 10.99.0.5
```
Add a default route
Send Internet-bound traffic to the firewall or router.
```
ip route 0.0.0.0 0.0.0.0 10.0.0.254
```

Restrict traffic with ACLs

Allow only what each VLAN needs. For example, CCTV may reach the NVR but not the staff network.

ip access-list extended CCTV-IN
 permit ip 10.30.0.0 0.0.0.255 host 10.31.0.10
 deny ip 10.30.0.0 0.0.0.255 10.10.0.0 0.0.0.255
 permit ip any any
interface vlan 30
 ip access-group CCTV-IN in

Verify
Check the routing table and test from clients in each VLAN.
```
show ip route
show ip interface brief
```

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.

Pro tips

Keep guest traffic out of internal VLANs entirely and route it straight to the firewall.
Use a dedicated transit VLAN between the core switch and the firewall.

FAQ