Overview
Inter-VLAN routing is the process of forwarding IP traffic between devices on different VLANs using a Layer 3 (L3) managed switch. A standard Layer 2 switch keeps VLANs fully isolated — devices on VLAN 1 cannot reach devices on VLAN 2 by design. An ORing Layer 3 managed switch ([L3_PRODUCT_MODELS]) has built-in IP routing capability, acting as the default gateway for each VLAN subnet and routing traffic between them without an external router. This guide demonstrates inter-VLAN routing between two subnets: 192.168.10.0/24 (VLAN 1, Port 24) and 192.168.20.0/24 (VLAN 2, Port 23).
Prerequisites
- Applicable models: ORing Layer 3 managed switch ([L3_PRODUCT_MODELS])
- Minimum firmware: [FIRMWARE_VERSION]
- Login level required: Administrator
- VLANs 1 and 2 must already exist on the switch
- Two test PCs with configurable NIC settings
Test topology
| Device | Port | VLAN | IP Address | Default Gateway |
|---|---|---|---|---|
| L3 Switch — VLAN 1 interface | — | VLAN 1 | 192.168.10.1/24 | — |
| L3 Switch — VLAN 2 interface | — | VLAN 2 | 192.168.20.1/24 | — |
| PC1 | Port 24 | VLAN 1 | 192.168.10.x/24 | 192.168.10.1 |
| PC2 | Port 23 | VLAN 2 | 192.168.20.x/24 | 192.168.20.1 |
Part 1 — ORing Layer 3 switch configuration
Three settings must be configured on the switch in order: VLAN IP interfaces, VLAN port membership, and Port VLAN IDs (PVID). A mismatch in any one of them will prevent inter-VLAN routing from working.
Step 1 — Assign IP addresses to VLAN interfaces
Navigate to [MENU_PATH_VLAN_IP]. Assign a unique IP address to each VLAN interface. Each IP acts as the default gateway for all devices on that subnet:
- VLAN 1 →
192.168.10.1/ 255.255.255.0 (/24) - VLAN 2 →
192.168.20.1/ 255.255.255.0 (/24)
The two IP addresses must be on different subnets. If both interfaces shared the same subnet (e.g., both 192.168.10.x/24), the switch would treat them as one network and would not route between them — it would only switch at Layer 2.
Step 2 — Assign ports to VLAN membership
Navigate to [MENU_PATH_VLAN_MEMBER]. Add each port as an untagged member of its VLAN:
- VLAN 1 → Port 24 (untagged)
- VLAN 2 → Port 23 (untagged)
Ports are set as untagged because the PCs send standard (untagged) Ethernet frames. Tagged membership is used for trunk ports connecting switches that carry multiple VLANs.
Step 3 — Set Port VLAN ID (PVID)
Navigate to [MENU_PATH_PVID]. The PVID tags untagged incoming frames with the correct VLAN ID:
- Port 23 → PVID:
2 - Port 24 → PVID:
1
If PVID does not match VLAN membership — for example, Port 24 has PVID = 2 but is a member of VLAN 1 — frames from PC1 will be tagged as VLAN 2 and will miss the 192.168.10.1 gateway. This is the most common misconfiguration causing inter-VLAN routing failures.
Part 2 — PC configuration
Each PC must be configured with a static IP in its VLAN subnet and a default gateway pointing to the L3 switch's VLAN interface. Two additional steps are required for test environments: disabling the Windows Firewall and disabling unused NICs.
Step 4 — Configure PC1 network settings
On PC1, open Network Adapter Settings and configure the NIC:
- IP address: 192.168.10.10 (or any 192.168.10.x address)
- Subnet mask: 255.255.255.0
- Default gateway: 192.168.10.1
Step 5 — Configure PC2 network settings
On PC2, open Network Adapter Settings and configure the NIC:
- IP address: 192.168.20.10 (or any 192.168.20.x address)
- Subnet mask: 255.255.255.0
- Default gateway: 192.168.20.1
Step 5a — Disable Windows Firewall (test environment only)
On both PCs, disable Windows Firewall to allow ICMP (ping) packets through: Control Panel > Windows Defender Firewall > Turn Windows Defender Firewall on or off. Disable for the Private network profile.
Production note: Do not disable the firewall in production environments. Instead, create an inbound firewall rule to allow ICMPv4 Echo Request on the relevant network profile.
Step 5b — Disable unused network adapters
On both PCs, open Device Manager > Network Adapters and disable all adapters except the one connected to the switch. Multiple active NICs can cause the OS to route traffic through the wrong interface, making inter-VLAN routing appear to fail even when the switch is configured correctly.
Step 6 — Verify inter-VLAN routing
Ping test from PC1 to PC2
On PC1, open Command Prompt and run:
ping 192.168.20.10Expected successful output:
Reply from 192.168.20.10: bytes=32 time<1ms TTL=63
Reply from 192.168.20.10: bytes=32 time<1ms TTL=63A TTL of 63 (one less than the default 64) confirms the packet passed through one Layer 3 hop — the switch's IP routing engine. If the result shows Request timed out, go to the Troubleshooting section below.
Routing table verification on the switch
Navigate to [VERIFY_PATH] and confirm the routing table contains both directly connected routes:
192.168.10.0/24→ directly connected via VLAN 1192.168.20.0/24→ directly connected via VLAN 2
If either route is missing, return to Step 1 and re-apply the VLAN IP settings — the interface may not have been saved correctly.
Troubleshooting common inter-VLAN routing issues
PC1 cannot ping PC2 — Request timed out
Check in this order: (1) PVID on Port 24 = 1 and Port 23 = 2 — this is the most common root cause; (2) Port 24 is a member of VLAN 1 and Port 23 is a member of VLAN 2; (3) VLAN 1 IP = 192.168.10.1/24 and VLAN 2 IP = 192.168.20.1/24; (4) PC1 default gateway = 192.168.10.1 and PC2 default gateway = 192.168.20.1; (5) Windows Firewall disabled or ICMP rule active on both PCs; (6) no other active NICs on either PC.
PC1 can ping the switch (192.168.10.1) but not PC2 (192.168.20.10)
The switch is reachable on VLAN 1 but routing to VLAN 2 is failing. Check: (1) VLAN 2 IP interface 192.168.20.1/24 is saved on the switch; (2) Port 23 PVID = 2 and Port 23 is a member of VLAN 2; (3) PC2 default gateway = 192.168.20.1 — without a correct gateway, PC2 cannot send the reply packet back through the switch.
PVID and VLAN membership mismatch
If PVID does not match VLAN membership — for example, Port 24 has PVID = 2 but is only a member of VLAN 1 — frames from PC1 will be tagged as VLAN 2, miss the VLAN 1 IP interface (192.168.10.1), and PC1 will appear unreachable. Always set PVID to the same number as the VLAN the port is an untagged member of.
Frequently asked questions
What is inter-VLAN routing and why do I need a Layer 3 switch?
Inter-VLAN routing forwards IP traffic between devices on different VLANs. A Layer 2 switch keeps VLANs isolated by design — an ORing Layer 3 managed switch has built-in IP routing capability, acting as the default gateway for each VLAN and routing between subnets without a separate external router.
Why must VLAN IP addresses be on different subnets?
If both VLAN interfaces shared the same subnet, the switch would treat them as the same network and forward at Layer 2 — not route between them. Assigning 192.168.10.1/24 to VLAN 1 and 192.168.20.1/24 to VLAN 2 places them on separate subnets, enabling the routing engine to forward traffic between them.
What is a Port VLAN ID (PVID) and why must it match VLAN membership?
PVID is the VLAN tag applied to untagged incoming frames on a port. If Port 24 PVID = 1, frames from PC1 are tagged as VLAN 1 and reach the 192.168.10.1 gateway. A PVID mismatch causes frames to be tagged with the wrong VLAN ID, missing the correct IP interface and breaking routing.
Why disable the PC firewall and other NICs for the test?
Windows Firewall blocks ICMP by default, causing ping timeouts even when routing works. Extra NICs can route traffic via the wrong interface. These are test-environment steps only — in production, add an inbound ICMP allow rule rather than disabling the firewall.
PC1 cannot ping PC2 — what should I check first?
Start with the PVID settings — PVID mismatch is the most common cause. Verify Port 24 PVID = 1 and Port 23 PVID = 2, then confirm VLAN membership, VLAN IP addresses, PC gateway settings, firewall, and NIC state in that order. See the Troubleshooting section above for a full checklist.
