How to Configure Inter-VLAN Routing with SVIs on a Layer 3 Switch (Step by Step)

Step 1 — Enable IP routing globally (the #1 gotcha)

On a Catalyst switch, Layer 3 forwarding is OFF by default — the box behaves like a Layer 2 switch even if it is a capable multilayer platform. `ip routing` is the single global command that turns it into a router. Without it, your SVIs will come up, hosts can reach their own gateway, but traffic will never cross between subnets. Do this first so you never have to wonder later.

On some entry-level platforms (for example the Catalyst 2960 series) you must first select a routing-capable SDM template with `sdm prefer lanbase-routing` and reload before `ip routing` will take effect. True multilayer switches (3560/3750/9300 and similar) accept `ip routing` directly. Check your platform's current documentation for the exact template names and limits rather than assuming.

Verify the command actually stuck by grepping the running config — it is the most reliable check that routing is on.

SW1# configure terminal
SW1(config)# ip routing
SW1(config)# end

! Confirm it is enabled:
SW1# show running-config | include ^ip routing
ip routing

Step 2 — Create your VLANs

An SVI can only come up if its VLAN actually exists and is active in the VLAN database. Create every VLAN you intend to route before (or alongside) building the SVIs. Naming them is optional but makes `show vlan brief` readable.

In this example we use two data VLANs: VLAN 10 for users (10.10.10.0/24) and VLAN 20 for servers (10.10.20.0/24).

SW1(config)# vlan 10
SW1(config-vlan)# name USERS
SW1(config-vlan)# vlan 20
SW1(config-vlan)# name SERVERS
SW1(config-vlan)# exit

Step 3 — Assign access ports to VLANs

Each end host connects to an access port that belongs to exactly one VLAN. Two things depend on this: the host lands in the right subnet, and — just as important — the SVI's line protocol will only come up when at least one port in its VLAN is up and forwarding. So assigning and enabling member ports is part of making the gateway work, not an afterthought.

Here users go on GigabitEthernet1/0/1–10 (VLAN 10) and servers on GigabitEthernet1/0/11–20 (VLAN 20). Adjust the interface IDs to your hardware.

SW1(config)# interface range GigabitEthernet1/0/1 - 10
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 10
SW1(config-if-range)# no shutdown
SW1(config-if-range)# exit

SW1(config)# interface range GigabitEthernet1/0/11 - 20
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 20
SW1(config-if-range)# no shutdown
SW1(config-if-range)# exit

Step 4 — Create an SVI (gateway) for each VLAN

The SVI is a logical interface — `interface vlan 10` — that gives the switch a presence in that VLAN's subnet. The IP you put on it becomes the default gateway that every host in VLAN 10 points to. Because all the SVIs live on the same routing device, the switch already knows how to move packets between them once `ip routing` is on; there is no trunk hop and no external router involved.

Set each SVI's address to the gateway you plan to hand out to hosts (via DHCP or static config), then `no shutdown`. A newly created SVI can start administratively down, so issuing `no shutdown` explicitly is good hygiene even where it is a no-op.

Remember the dependency from Step 3: `interface vlan 10` will read up/up only when VLAN 10 exists AND at least one access port in it (or an allowed VLAN on an up trunk) is forwarding. This behavior is SVI autostate. If every member port is down, the SVI drops to down/down on purpose.

SW1(config)# interface vlan 10
SW1(config-if)# ip address 10.10.10.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit

SW1(config)# interface vlan 20
SW1(config-if)# ip address 10.10.20.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit

Step 5 — Use a routed port for the L3 uplink (optional but common)

SVIs handle routing between your internal VLANs. To route OUT of the switch — to a core router, firewall, or WAN edge — the clean approach is a routed port: a physical interface taken out of switching mode with `no switchport` and given its own IP, exactly like a router interface. A routed port belongs to no VLAN; it is a straight point-to-point Layer 3 link.

Do not confuse the two. An SVI is logical and represents a whole VLAN; a routed port is a single physical link with `no switchport`. Below, GigabitEthernet1/0/48 becomes a /30 link to an upstream device. After this you would add a static default route (or a dynamic routing protocol) so the switch knows how to reach networks beyond it.

SW1(config)# interface GigabitEthernet1/0/48
SW1(config-if)# no switchport
SW1(config-if)# ip address 10.255.255.1 255.255.255.252
SW1(config-if)# no shutdown
SW1(config-if)# exit

! Example default route toward the upstream peer:
SW1(config)# ip route 0.0.0.0 0.0.0.0 10.255.255.2

Step 6 — Verify routing and interface state

Two commands prove the build. `show ip route` should list each SVI's subnet as a connected route (`C`) via its Vlan interface, plus a local host route (`L`) for the gateway IP itself. Seeing both VLAN subnets as connected routes is your confirmation that the switch will forward between them.

`show ip interface brief` should show each `VlanX` interface with its gateway IP and status up/protocol up. If an SVI shows down/down, jump to the Common problems section — it is almost always a missing member port or a missing/inactive VLAN. `show vlan brief` confirms the VLANs exist and which ports are in them.

Final proof is an end-to-end test: a host in VLAN 10 (gateway 10.10.10.1) should ping a host in VLAN 20 (gateway 10.10.20.1). If each host can ping its own gateway but not across, the routing engine is the missing piece — check Step 1.

SW1# show ip route
...
C     10.10.10.0/24 is directly connected, Vlan10
L     10.10.10.1/32 is directly connected, Vlan10
C     10.10.20.0/24 is directly connected, Vlan20
L     10.10.20.1/32 is directly connected, Vlan20

SW1# show ip interface brief | include Vlan
Vlan10    10.10.10.1    YES manual up      up
Vlan20    10.10.20.1    YES manual up      up

SW1# show vlan brief

SVIs vs. router-on-a-stick (and when to use which)

Router-on-a-stick puts every subnet's gateway on subinterfaces of a single router interface (`interface Gig0/0.10`, `encapsulation dot1q 10`, `ip address ...`) and trunks that one link to the switch. It works, and it is fine for small setups or when you only have a router and a Layer 2 switch. But every packet between VLANs traverses that one trunk twice (in and back out) and is routed in the router's CPU/software path, so the single link and the router become the bottleneck.

SVI-based routing on a multilayer switch keeps the gateways ON the switch and forwards between VLANs in the switching ASIC (hardware), at line rate, with no trunk round trip. It scales to many VLANs and high throughput, which is why it is the standard for campus distribution and any real LAN. Reach for router-on-a-stick only when you genuinely lack a Layer 3 switch. If you need that build, see our router-on-a-stick guide for the subinterface and dot1Q encapsulation steps.

Common problems (and the fix)

Forgot `ip routing`. Symptom: SVIs are up/up, each host pings its own gateway, but no traffic crosses VLANs. This is the number-one failure. Fix: `ip routing` in global config, then confirm with `show running-config | include ^ip routing`. On low-end switches also confirm the SDM template supports routing (`sdm prefer lanbase-routing` + reload).

SVI stuck down/down. Symptom: `interface vlan 10` shows down/down. Cause: the VLAN does not exist / is not active, or no member port in that VLAN is up and forwarding (SVI autostate). Fix: create the VLAN (`vlan 10`), assign at least one access port to it, and `no shutdown` that port — or allow the VLAN on an up trunk. Verify with `show vlan brief` and `show ip interface brief`.

Confusing an SVI with a routed port. Symptom: you put `ip address` on a physical port and it does not route, or it rejects the address. Cause: the port is still in switching mode. Fix: for a Layer 3 uplink, enter the physical interface and issue `no switchport` before `ip address`. For a per-VLAN gateway, use the logical `interface vlan X` instead — do not try to IP a member access port.

Access port assigned to a non-existent VLAN. Symptom: `switchport access vlan 99` but the port goes inactive and its SVI never comes up. Cause: VLAN 99 was never created. Fix: create the VLAN in the database (`vlan 99`), then re-check `show vlan brief` — the port should move from inactive into the VLAN.

Host has the wrong default gateway. Symptom: a host can reach its own subnet but nothing in other VLANs, even though routing is correct. Cause: the host's default gateway does not match its SVI IP. Fix: set each host's gateway to its VLAN's SVI address (10.10.10.1 for VLAN 10, 10.10.20.1 for VLAN 20), whether via DHCP scope option or static config.