Explain how you would troubleshoot a VLAN connectivity issue where a device on one VLAN cannot communicate with a device on another VLAN.

Question

Accepted Answer

Inter-VLAN communication requires a Layer 3 device, either a router or a Layer 3 switch, to route traffic between the VLANs. When this communication fails, a systematic approach helps isolate the problem quickly.

Start by confirming the basic connectivity within each VLAN. Can the device on VLAN 10 communicate with other devices on VLAN 10? Can the device on VLAN 20 communicate with its VLAN peers? If intra-VLAN communication works, the Layer 2 infrastructure is functioning and the issue is specifically with inter-VLAN routing.

Next, verify the IP configuration on both devices. Check that each device has the correct IP address, subnet mask, and default gateway. The default gateway should be the IP address of the Layer 3 interface, often called an SVI or Switch Virtual Interface, for their respective VLAN on the routing device. A common mistake is configuring a device with the wrong gateway address or leaving the gateway unconfigured entirely.

Check the Layer 3 device that handles inter-VLAN routing. Verify that the SVIs for both VLANs are configured and in an up/up state. Use commands like show ip interface brief on a Cisco device to verify interface status. If an SVI is administratively down or has no IP address, inter-VLAN routing will fail for that VLAN.

Verify that IP routing is enabled on the Layer 3 switch. On some platforms, you need to explicitly enable routing with a command like ip routing. Without this, the switch can manage VLANs at Layer 2 but will not route traffic between them.

Check for access control lists that might be blocking traffic between the VLANs. ACLs applied to the SVIs or to the routed interfaces can silently drop packets. Review any ACLs applied in the inbound or outbound direction on the relevant interfaces.

Verify the VLAN configuration on trunk ports between switches. If the VLANs are not allowed on a trunk link, traffic for those VLANs cannot traverse between switches. Use show interface trunk to verify the allowed VLAN list on each trunk.

If a router-on-a-stick configuration is used instead of a Layer 3 switch, check that the sub-interfaces are properly configured with the correct VLAN encapsulation, either dot1q or ISL, and that each sub-interface has the correct IP address for its VLAN.

Finally, test the routing path using traceroute from one device to the other. This shows whether traffic reaches the Layer 3 device and whether the return path is correct. Asymmetric routing issues, where traffic takes a different path in each direction, can also cause inter-VLAN communication failures.