1. The Story
Press "Next" to go through it step by step. In each step, one character steps up and explains what they are doing.
Prologue: a quick review
Step 1 of 12
Two zones that can't reach each other
Mac is in the family zone, VLAN 10. Guest PC 1 is in the guest zone, VLAN 20. Different VLANs (Virtual LANs) are different LANs, and I won't forward a Frame between them.
Animation text version (all steps)
- Prologue: a quick review
- Two zones that can't reach each other · Octo: Mac is in the family zone, VLAN 10. Guest PC 1 is in the guest zone, VLAN 20. Different VLANs (Virtual LANs) are different LANs, and I won't forward a Frame between them.
- Act 1: the zones need to talk
- Guests want the Internet, Mac wants to send a file · Rue: Guests need to go online, and Mac wants to send a file to a guest. The two zones are two different networks: the family zone is
192.168.1.0/24and the guest zone is192.168.20.0/24. To reach another network, you come to me, the Router.- Forwarding Packets between different VLANs is called Inter-VLAN Routing
- Every zone needs a Default Gateway · Rue: Every network needs its own Default Gateway. The family zone hands things to my
192.168.1.1. The guest zone hands things to my192.168.20.1. Both addresses live on me. - Method 1: one cable per zone · Rue: The simplest way: run one cable from each VLAN to me. The left cable belongs to VLAN 10 and the right one to VLAN 20. It works, but with lots of VLANs, I'll run out of Ports.
- Act 2: Router-on-a-stick
- One Trunk is enough · Octo: Remember Trunks? I connect to Rue with just one Trunk, and every VLAN goes up this one cable. This method is called Router-on-a-stick.
- One Port, two identities · Rue: On my G0/0 Port, I set up two Subinterfaces (virtual Ports carved out of one real Port):
G0/0.10belongs to VLAN 10 with address192.168.1.1, andG0/0.20belongs to VLAN 20 with address192.168.20.1.G0/0.10· VLAN 10 ·192.168.1.1/24G0/0.20· VLAN 20 ·192.168.20.1/24
- Mac's file goes upstairs · Octo: Mac sees that
192.168.20.10isn't in his own network, so he sends the Frame to the Default Gateway192.168.1.1. I put a "VLAN 10" tag on it and send it to Rue over the Trunk. - Rue swaps the envelope and the tag · Rue: I receive Pip on
G0/0.10and check the IP destination192.168.20.10: it belongs to the network ofG0/0.20! I put him in a new Frame, take 1 off the TTL, add a "VLAN 20" tag and send him back to Octo over the same Trunk.- MAC Address, VLAN tag: replaced
- IP destination
192.168.20.10: unchanged
- Delivered to the guest · Octo: I see the "VLAN 20" tag, so I look for the receiver only in the guest zone. I remove the tag and deliver the Frame to Guest PC 1. The file has arrived!
- Downside: the same Packet goes "up once and down once" on the same Trunk
- When traffic gets heavy, this cable becomes a bottleneck
- Act 3: Octo learns to read IP too
- Layer 3 Switch · Octo: Company networks usually use a Layer 3 Switch: I can read IP Addresses myself! I create one SVI (Switch Virtual Interface) for each VLAN, and Packets cross to the other zone right inside me. Much faster.
- SVIs: VLAN 10 interface
192.168.1.1, VLAN 20 interface192.168.20.1 - The Default Gateway addresses move to the SVIs, and Rue's Subinterfaces are removed
- Rue keeps handling the way to the Internet
- SVIs: VLAN 10 interface
- Traffic can pass, and you can set rules · Rue: The two zones can talk now. But we usually open only some paths: guests can go online and use the printer, but they can't reach Mac's computer. These rules are handled by an ACL (Access Control List) or a Firewall. More on that in Story 19.
- Summary: a bridge between zones · Rue: For different VLANs to talk, traffic must go through a Layer 3 device: one cable per zone, Router-on-a-stick or a Layer 3 Switch. Every zone has its own Default Gateway. This way, this is the fastest route!
2. Where Is the Problem
Octo used VLANs (Virtual LANs) to split the home into two zones: the family zone is VLAN 10 and the guest zone is VLAN 20. A VLAN groups the Ports of one Switch, and each group works as its own separate LAN (Local Area Network).
Once they are split, guests can't see the devices in the home. Much safer. But a new problem appears:
- Guests want to go online, but the Internet isn't inside the guest zone.
- Mac wants to send a file to a guest, but Octo won't forward a Frame between two VLANs.
The two zones are two different networks: the family zone is 192.168.1.0/24 and the guest zone is 192.168.20.0/24. With only a Switch, nothing will ever cross this line.
3. How the Network Solves It
The two VLANs are like the two banks of a river. To cross the river, you need to build a bridge. That bridge is a Router.
Forwarding Packets between different VLANs is called Inter-VLAN Routing. There are three ways to do it:
- Run one cable from each VLAN to the Router.
- Connect the Router with just one Trunk. This is called Router-on-a-stick.
- Teach the Switch itself to read IP Addresses. This is a Layer 3 Switch.
Whichever way you choose, every zone needs its own Default Gateway.
4. A Closer Look
One Default Gateway for each zone
The Default Gateway is the address a device hands its Packets to when they need to go to another network. It must always be inside the device's own network:
| Zone | VLAN | Network | Example device | Default Gateway |
|---|---|---|---|---|
| Family zone | 10 | 192.168.1.0/24 |
Mac 192.168.1.10 |
192.168.1.1 |
| Guest zone | 20 | 192.168.20.0/24 |
Guest PC 1 192.168.20.10 |
192.168.20.1 |
Both Default Gateway addresses live on Rue.
Router-on-a-stick: one Port, two identities
Octo connects to Rue's G0/0 with just one Trunk. Frames on the Trunk carry an 802.1Q tag that says which VLAN they belong to.
Rue splits G0/0 into two Subinterfaces. A Subinterface is a "virtual Port" carved out of one physical Port by configuration:
G0/0.10 VLAN 10 192.168.1.1/24
G0/0.20 VLAN 20 192.168.20.1/24
How does Mac's file cross the bridge?
- Mac compares the network part:
192.168.20.10is not in his own192.168.1.0/24, so he hands the Frame to the Default Gateway192.168.1.1. - Octo puts a "VLAN 10" tag on the Frame and sends it up to Rue over the Trunk.
- Rue receives it on
G0/0.10and looks at the IP destination192.168.20.10: it belongs to the network ofG0/0.20. - Rue puts it in a new Frame. Both the source and destination MAC Addresses are new, the TTL (Time to Live) goes down by 1, and a "VLAN 20" tag goes on. Then it travels back to Octo over the same Trunk.
- Octo sees "VLAN 20", looks for the receiver only in the guest zone, removes the tag and delivers it to Guest PC 1.
Through the whole trip, the IP destination 192.168.20.10 never changes. The MAC Addresses and the VLAN tag are replaced.
The downside: the same Packet goes "up once and down once" on the same Trunk. When traffic gets heavy, this cable becomes a bottleneck.
Layer 3 Switches and SVIs
Company networks usually use a Layer 3 Switch. It is a Switch, but it also knows how to forward Packets by IP Address.
It creates one SVI (Switch Virtual Interface) for each VLAN. An SVI is a virtual interface inside the Switch that stands for one VLAN. You can give it an IP Address and use it as that zone's Default Gateway:
interface Vlan10 192.168.1.1/24
interface Vlan20 192.168.20.1/24
After switching to a Layer 3 Switch, the Default Gateway addresses move to the SVIs and Rue's Subinterfaces are removed. Octo and Rue are then connected using a different address range, and Rue only handles the way to the Internet.
Packets can cross to the other zone without ever leaving the Switch, which is much faster. Rue keeps handling the way to the Internet, for example when a guest opens example.com (192.0.2.80). An address starting with 192 is not always a Private IP. Only addresses starting with 192.168 are.
Comparing the three ways
| Method | Number of cables | Pros | Cons |
|---|---|---|---|
| One cable per VLAN | Number of VLANs | Easiest to understand | Wastes the most Ports and cables |
| Router-on-a-stick | 1 Trunk | Saves cables and Ports | Traffic goes back and forth on one cable, so it jams easily |
| Layer 3 Switch | No extra cables to cross VLANs | Fastest, most common in companies | More expensive equipment |
Traffic can pass, and you can set rules
Being able to pass doesn't mean everything should be let through. Usually only some paths are opened: guests can go online and use the printer, but they can't connect to Mac's computer. These rules are handled by an ACL (Access Control List) or a Firewall, which Story 19 explains in detail.
5. Try It Yourself
Task: find your Default Gateway
- In your phone's Wi-Fi settings, tap the network you are connected to and find the "Router" or "Gateway" field.
- Write down your IP Address and Default Gateway. Their network part should be the same.
- If your home Router has a "guest network" feature, join the guest network and look again. The Default Gateway may be a different address, because it's a different network!
Mini game
Compare the three ways
Which Inter-VLAN Routing method does each sentence describe?
-
1Every new VLAN needs one more cable and one more Router Port
-
2The Router uses only one Trunk, with a Subinterface for each VLAN
-
3Routing happens inside the Switch, so it's the fastest
-
4The same Packet travels up and back down the same cable
-
5Uses an SVI as each VLAN's Default Gateway
-
6Easiest to understand, but wastes the most Ports
All sorted correctly! One cable per VLAN is the simplest but the most wasteful. Router-on-a-stick saves cables but jams easily. A Layer 3 Switch is the fastest and the most common method in company networks.
6. Where the Analogy Breaks
- There's more than one bridge. Real networks can use several methods at once, for example a Layer 3 Switch inside the company and a Router for the way to the Internet.
- Rue is really one Router. In the animation, Rue goes "up and back down", but both Subinterfaces sit on the same Port. They are just handled separately by VLAN tag.
- Octo doesn't "turn into" Rue. A Layer 3 Switch routes with special chips, so it's very fast, but it usually has fewer features than a real Router. For example, it may not support NAT (Network Address Translation).
- A home Router's "guest network" doesn't always work like this. Many home Routers split the two zones internally and automatically, and never show you any VLAN or Subinterface settings.
- After the bridge, there's still a checkpoint. The animation only shows that traffic "can pass". In real life, an ACL or Firewall is always used too, to decide which Packets may cross.
7. Quiz
8. Key Notes
- Different VLANs are different networks, and a Switch won't forward Frames between them. To cross zones, traffic must go through a Layer 3 device. This is called Inter-VLAN Routing.
- Every zone needs its own Default Gateway, and its address must be inside that zone's network.
- Three methods: one cable per VLAN, Router-on-a-stick (one Trunk + Subinterfaces) and a Layer 3 Switch (using SVIs).
- When passing through a Router, the MAC Addresses and VLAN tag are replaced and the TTL goes down by 1, but the IP destination stays the same.
- Being able to pass doesn't mean everything is let through. Rules between zones are handled by an ACL or a Firewall.
Further reading
Now the family zone and the guest zone each have a /24 block of addresses, with Rue connecting them. But what if the upstairs studio needs three networks and only gets one block of addresses? In the next story, Rue picks up a knife and teaches you how to "cut the cake": Subnetting.