Layer 3 Switch Routing – Concepts, Configuration, and Best Practices

1. What Is a Layer 3 Switch?

A Layer 3 switch is a high-performance network device that combines the port density and wire-speed forwarding of a Layer 2 switch with the IP routing intelligence of a router. It makes forwarding decisions based on both MAC addresses (Layer 2) and IP addresses (Layer 3), using dedicated ASIC hardware for both operations at line rate.

The primary use case is inter-VLAN routing inside a campus or data-centre LAN — routing traffic between VLANs internally without needing an external router. Layer 3 switches also support static routes and dynamic routing protocols (OSPF, EIGRP, RIP) to exchange routes with the rest of the network.

  ┌───────────────────────────────────────────────────┐
  │              Layer 3 Switch                        │
  │                                                   │
  │  VLAN 10 ──► SVI 10 (192.168.10.1) ──┐            │
  │  VLAN 20 ──► SVI 20 (192.168.20.1) ──┤ Routing    │
  │  VLAN 30 ──► SVI 30 (192.168.30.1) ──┘ (ASIC)    │
  │                                                   │
  │  Routed Port ──► Uplink to WAN Router              │
  └───────────────────────────────────────────────────┘
            

Related pages: Router-on-a-Stick | VLANs & Trunking | Access & Trunk Ports | HSRP | VRRP & GLBP | DHCP Relay | ACL Overview

2. Layer 2 Switch vs. Layer 3 Switch vs. Router

3. Switch Virtual Interfaces (SVIs)

An SVI (Switch Virtual Interface) is a logical Layer 3 interface created on a switch and associated with a specific VLAN. It serves as the default gateway for all hosts in that VLAN and as the routing interface the switch uses to forward packets between VLANs.

• One SVI per VLAN that requires Layer 3 routing
• The SVI is up/up only when the associated VLAN exists, has at least one active access or trunk port, and no shutdown is configured
• SVIs can also be used as the switch management interface (typically VLAN 1 or a dedicated management VLAN)
• SVIs are also the interface on which DHCP relay (ip helper-address) is configured for each VLAN. See DHCP Relay Agent Configuration.

! Step 1 — Enable IP routing (required on Cisco switches)
ip routing

! Step 2 — Create VLANs
vlan 10
 name Staff
vlan 20
 name Students
vlan 30
 name Servers

! Step 3 — Configure SVIs
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown

interface vlan 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown

interface vlan 30
 ip address 192.168.30.1 255.255.255.0
 no shutdown
            

4. Inter-VLAN Routing on a Layer 3 Switch

When a host in VLAN 10 sends a packet to a host in VLAN 20, the Layer 3 switch handles the entire routing process internally — no traffic leaves the switch chassis. This makes it significantly faster than Router-on-a-Stick, which requires all inter-VLAN traffic to traverse an external trunk link to a router and back.

  PC1 (192.168.10.10 / VLAN 10)
      │
      │ Access port (VLAN 10)
      │
  ┌───┴───────────────────────────────────┐
  │  Layer 3 Switch                        │
  │                                       │
  │  SVI 10: 192.168.10.1  ◄── default GW │
  │          │  (routing decision in ASIC) │
  │  SVI 20: 192.168.20.1  ──► default GW │
  └───────────────────────┬───────────────┘
                          │ Access port (VLAN 20)
                          │
                      PC2 (192.168.20.20 / VLAN 20)
            

Packet flow: PC1 sends to its gateway (SVI 10: 192.168.10.1) → switch looks up 192.168.20.20 in its routing table → matches directly connected route via SVI 20 → ARP resolves PC2’s MAC → frame forwarded out the VLAN 20 access port to PC2.

See also: Step-by-Step: Inter-VLAN Routing on a Layer 3 Switch | Step-by-Step: Router-on-a-Stick

5. Routed Ports

In addition to SVIs, a Layer 3 switch can configure individual physical ports as routed ports — behaving exactly like a router interface rather than a switch port. A routed port has no VLAN membership and is used primarily for uplinks to routers, firewalls, or other Layer 3 devices.

! Convert a switch port to a routed (Layer 3) port
interface GigabitEthernet1/0/24
 no switchport
 ip address 10.0.0.2 255.255.255.252
 no shutdown
            

When to use routed ports vs SVIs:

6. Static Routing on a Layer 3 Switch

Static routes are used for networks not reachable through directly connected SVIs — most commonly a default route pointing upstream to the WAN router for Internet-bound traffic.

! Default route (all unknown destinations to WAN router)
ip route 0.0.0.0 0.0.0.0 10.0.0.1

! Specific static route to a remote subnet via next-hop
ip route 10.1.0.0 255.255.0.0 192.168.30.2

! Specific static route using exit interface (point-to-point only)
ip route 172.16.0.0 255.255.0.0 GigabitEthernet1/0/24
            

See also: Static Routing | Default Routes | Administrative Distance

7. Dynamic Routing Protocol Support

Most enterprise-grade Layer 3 switches support the same IGPs as routers. Dynamic routing is essential when the switch must exchange routes with upstream routers, other distribution switches, or across a campus network.

! Enable IP routing first
ip routing

! OSPF — advertise all three SVI subnets into area 0
router ospf 1
 network 192.168.10.0 0.0.0.255 area 0
 network 192.168.20.0 0.0.0.255 area 0
 network 192.168.30.0 0.0.0.255 area 0
 passive-interface default
 no passive-interface GigabitEthernet1/0/24  ! Uplink to router

! EIGRP (named mode, Cisco IOS 15.0+)
router eigrp CAMPUS
 address-family ipv4 unicast autonomous-system 100
  network 192.168.10.0 0.0.0.255
  network 192.168.20.0 0.0.0.255
  network 192.168.30.0 0.0.0.255
            

See also: OSPF Single-Area | OSPF Areas & LSAs | EIGRP Configuration | Step-by-Step: OSPF

8. Hardware Forwarding – ASIC and the CEF Process

Unlike a software router that processes each packet in the CPU, a Layer 3 switch uses ASICs (Application-Specific Integrated Circuits) to forward frames and route packets in hardware at wire speed. Cisco’s implementation uses CEF (Cisco Express Forwarding) as the software control plane that populates two hardware tables:

The result: once a flow is established, every packet is forwarded entirely in hardware without CPU involvement, giving throughputs of tens to hundreds of Gbps on modern campus switches.

! Verify CEF is active (enabled by default on IOS)
show ip cef
show ip cef 192.168.20.0/24 detail
            

9. Complete Configuration Example

Scenario: Three VLANs (Staff, Students, Servers), uplink to WAN router, OSPF to exchange routes. Each VLAN SVI also serves as the DHCP relay agent for its VLAN — see DHCP Relay Agent Configuration and DHCP Server Configuration.

! ---- Global ----
hostname DIST-SW1
ip routing

! ---- VLANs ----
vlan 10
 name Staff
vlan 20
 name Students
vlan 30
 name Servers

! ---- SVIs (inter-VLAN gateways) ----
interface vlan 10
 description Staff Gateway
 ip address 192.168.10.1 255.255.255.0
 no shutdown

interface vlan 20
 description Students Gateway
 ip address 192.168.20.1 255.255.255.0
 no shutdown

interface vlan 30
 description Servers Gateway
 ip address 192.168.30.1 255.255.255.0
 no shutdown

! ---- Routed uplink to WAN router ----
interface GigabitEthernet1/0/24
 description Uplink to WAN-Router
 no switchport
 ip address 10.0.0.2 255.255.255.252
 no shutdown

! ---- Default route upstream ----
ip route 0.0.0.0 0.0.0.0 10.0.0.1

! ---- OSPF (share internal subnets with router) ----
router ospf 1
 router-id 1.1.1.1
 network 192.168.10.0 0.0.0.255 area 0
 network 192.168.20.0 0.0.0.255 area 0
 network 192.168.30.0 0.0.0.255 area 0
 network 10.0.0.0 0.0.0.3 area 0
 passive-interface vlan 10
 passive-interface vlan 20
 passive-interface vlan 30
            

Hosts in each VLAN use the respective SVI IP as their default gateway. Assign addresses dynamically using DHCP — see DHCP Server Configuration.

10. Layer 3 Switch vs. Router – When to Use Which

Rule of thumb: Deploy Layer 3 switches at the distribution and core layers for high-speed inter-VLAN routing. Deploy routers at the WAN/Internet edge for connectivity, VPNs, and advanced security. See also: Routers | Switches

11. Security – ACLs on SVIs

ACLs applied to SVIs control which traffic is permitted to cross VLAN boundaries, implementing a policy similar to a firewall at the distribution layer. An ACL applied inbound on an SVI filters traffic as it enters the routing engine from that VLAN. See Applying ACLs for placement rules.

! Prevent Students (VLAN 20) from reaching Servers (VLAN 30)
! but allow all other traffic

ip access-list extended PROTECT_SERVERS
 deny   ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255
 permit ip any any

interface vlan 20
 ip access-group PROTECT_SERVERS in

! Allow only SSH from Staff to management (VLAN 30)
ip access-list extended STAFF_TO_SERVERS
 permit tcp 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 eq 22
 deny   ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
 permit ip any any

interface vlan 10
 ip access-group STAFF_TO_SERVERS in
            

See also: ACL Overview | Applying ACLs | Standard ACLs | Named ACLs | Step-by-Step: Extended ACLs

12. High Availability and Redundancy

In production networks, a single Layer 3 switch is a single point of failure. Three complementary mechanisms provide redundancy:

! HSRP on DIST-SW1 (active for VLAN 10)
interface vlan 10
 ip address 192.168.10.2 255.255.255.0
 standby 10 ip 192.168.10.1      ! Virtual IP = hosts' default gateway
 standby 10 priority 110
 standby 10 preempt
 no shutdown

! HSRP on DIST-SW2 (standby for VLAN 10)
interface vlan 10
 ip address 192.168.10.3 255.255.255.0
 standby 10 ip 192.168.10.1
 standby 10 priority 100
 no shutdown
            

See also: Step-by-Step: FHRP (HSRP / VRRP / GLBP) | Step-by-Step: EtherChannel LACP

13. Verification and Troubleshooting

Common Troubleshooting Checklist

• ip routing missing? — Without this global command, the switch acts as a pure Layer 2 device and all SVIs will reject routed traffic
• SVI is down/down? — The VLAN must exist (show vlan brief) and have at least one active access or trunk port assigned to it
• Hosts cannot reach the gateway? — Confirm the host’s default gateway matches the SVI IP and VLAN assignment is correct on the access port
• One-way routing? — Check return routes exist with show ip route; a missing route in one direction produces asymmetric or dropped traffic
• ACL blocking traffic? — Run show ip access-lists and look for unexpected match counters on deny entries
• Hosts not getting IPs? — Verify DHCP relay (ip helper-address) is configured on each SVI. See DHCP Relay Agent Configuration.

See also: Step-by-Step: Troubleshooting Layer 3 Routing | Step-by-Step: Troubleshooting VLANs & Trunks

14. Key Points & CCNA Exam Tips

• ip routing must be entered in global config — without it, no routing occurs regardless of SVI configuration
• An SVI is up/up only when: the VLAN exists, has at least one active port, and no shutdown is set
• Layer 3 switch inter-VLAN routing is always faster than Router-on-a-Stick because all routing is internal hardware (no trunk bottleneck)
• Use routed ports (no switchport) for point-to-point uplinks to routers or firewalls
• OSPF passive-interface should be applied to all SVI interfaces — only enable OSPF hellos on interfaces that face other routers
• ACLs on SVIs filter traffic as it enters the routing engine — inbound on the source VLAN’s SVI is the most common and efficient placement
• FHRP (HSRP/VRRP/GLBP) provides gateway redundancy when two distribution switches share SVI responsibilities
• CEF must be enabled (default on IOS) for hardware forwarding — use show ip cef to verify
• show ip route, show ip interface brief, and show vlan brief are the three essential troubleshooting commands
• Layer 3 switches do not replace routers at the WAN edge — they lack WAN interfaces, IPsec VPN, and advanced security features
• Configure DHCP relay (ip helper-address) on each SVI so hosts receive IP addresses from a centralised DHCP server

Layer 3 Switch Routing Quiz