FUNDAMENTALS · MECHANISM WALKTHROUGH

Different VLANs, Same Switch
Crossing the Layer 3 Boundary

the moment the destination isn't in the local VLAN, everything from the "same VLAN" walkthrough changes — the gateway gets involved, and something has to route between the two broadcast domains.

SUBNET CHECK: NOT LOCAL→ ARP FOR GATEWAY→ TAGGED TO ROUTER/SVI→ L3 LOOKUP→ RE-TAG TO DEST VLAN→ ARP FOR DEST→ DELIVERED

01 The Full Sequence — Worked Example

The Setup

PC-A (192.168.10.10/24, VLAN 10, gateway 192.168.10.1) and PC-C (192.168.20.10/24, VLAN 20, gateway 192.168.20.1) sit on access ports of the same switch. A router-on-a-stick is trunked to that switch on Gi0/1, with sub-interfaces Gi0/1.10 (802.1Q tag 10) and Gi0/1.20 (tag 20) each holding the respective gateway IP. (An L3 switch with SVIs for VLAN 10/20 does the identical job internally — see the gotcha below.)

Setup

Local Subnet Check — Not Local

PC-A runs ping 192.168.20.10. Its stack ANDs the destination against its own /24 mask — 192.168.20.10 does not fall inside 192.168.10.0/24. Unlike the same-VLAN case, PC-A now needs to reach its gateway's MAC, not the destination's.

L3 Logic

ARP for the Gateway

PC-A's ARP cache has no entry for 192.168.10.1 yet, so it broadcasts "who has 192.168.10.1?" — this broadcast is confined to VLAN 10 only; PC-C on VLAN 20 never sees it, because a broadcast domain stops at the VLAN boundary. The router's Gi0/1.10 sub-interface replies with its MAC.

ARP

Frame Sent Toward the Router — Tagged in Transit

PC-A sends the ICMP Echo Request addressed to the router's MAC. The switch forwards it out the trunk port toward the router, adding an 802.1Q tag for VLAN 10 on the trunk (the access port itself carries no tag — tagging is a trunk-link-only concept).

802.1Q

Checkpoint — What Changed vs. Same-VLAN

The frame's Layer 2 destination is now the gateway's MAC, not PC-C's — PC-A still has no idea what PC-C's MAC even is. The packet is about to leave VLAN 10 entirely and be re-originated as a new frame on VLAN 20 by whatever device owns both sub-interfaces/SVIs.

Checkpoint

Router Strips the Tag and Routes

The router receives the frame on Gi0/1.10, strips the VLAN 10 tag and the Ethernet header, and is left with an IP packet destined for 192.168.20.10. It checks its routing table — a connected route for 192.168.20.0/24 points out Gi0/1.20.

L3 Route

Router ARPs Into the Destination VLAN

The router checks its own ARP cache for 192.168.20.10 on the VLAN 20 side. First time, it's a miss, so the router broadcasts an ARP request tagged for VLAN 20 back down the trunk. The switch floods it out VLAN 20's access ports; PC-C replies.

ARP

Router Re-Originates the Frame on VLAN 20

The router builds a brand new Ethernet frame — source MAC is now the router's own Gi0/1.20 MAC, destination is PC-C's MAC — tags it VLAN 20, and sends it back down the trunk. The switch strips the tag at the access port and delivers an untagged frame to PC-C.

L2 Re-frame

PC-C Receives the Echo Request

To PC-C, this looks exactly like traffic from a same-VLAN neighbor — it has no visibility into the fact that the source is actually on a different VLAN two hops back. It generates an ICMP Echo Reply addressed to its own gateway, 192.168.20.1, because it also does the local-subnet check and determines PC-A isn't local to it.

ICMP

Return Trip — Mirror of the Forward Path

PC-C ARPs for its gateway (192.168.20.1) — already cached from step 7 — sends the reply to the router's Gi0/1.20 MAC, tagged VLAN 20. The router routes it back toward 192.168.10.0/24, re-frames it tagged VLAN 20→10 out Gi0/1.10 using PC-A's MAC (learned in step 3), and the switch delivers it untagged to PC-A's access port.

Return

Steady State

Subsequent pings skip both ARP resolutions (already cached at PC-A, the router, and PC-C) — every packet still transits the router for the L3 lookup and re-framing, because that's not optional the way ARP caching is; only a route change or ACL would alter that.

Delivered

02 How to Explain This in an Interview

Anchor on the subnet check again. The entire branch point between this walkthrough and the same-VLAN one is a single comparison at the source host — say that out loud first.
Say "re-originated," not "forwarded," for the router's job. The router doesn't relay the same frame — it builds a genuinely new Layer 2 frame with new source/destination MACs. Conflating the two is a common and telling mistake.
Call out that two separate broadcast domains mean two separate ARP resolutions — PC-A never ARPs for PC-C directly, and PC-C never sees PC-A's original broadcast at all.
Be ready to name both implementations. Router-on-a-stick (single physical/trunk link, sub-interfaces) and an L3 switch with SVIs (routing done in switch hardware, no external router) achieve the identical result — know which one is likely in the environment you're interviewing for and lead with that.
If asked "what if there's no route between VLANs," say so plainly: without a Layer 3 device connecting them, VLANs are fully isolated broadcast domains by design — that isolation is usually the point.

03 Follow-Up / Gotcha Questions

Q How is an L3 switch with SVIs different from router-on-a-stick, mechanically?

A Functionally identical — an SVI (Switched Virtual Interface) is a logical Layer 3 interface tied to a VLAN inside the switch itself, so routing happens in the switch's ASIC without traffic ever leaving on a physical trunk to an external router. Router-on-a-stick does the same lookup and re-framing, just on a separate box reached over one trunk link, which makes it a bandwidth chokepoint SVIs don't have.

Q Does the destination PC (PC-C) know the traffic originated on a different VLAN?

A No. PC-C only ever sees a normal frame from the router's own MAC and IP on its local VLAN 20 — VLAN membership and tagging are entirely invisible above Layer 2/2.5; the host has no field that reveals "this originally came from VLAN 10."

Q What's the native VLAN, and why does it matter here?

A The native VLAN is the one VLAN on a trunk that's sent untagged — a legacy 802.1Q behavior. If it's misconfigured to differ between the two switch/router ends, untagged frames get associated with the wrong VLAN, a classic and hard-to-spot cause of "traffic randomly lands in the wrong VLAN."

Q What stops PC-A from just ARPing directly for PC-C's IP instead of going through the gateway?

A Nothing stops it from trying, but it would never get an answer — ARP is a broadcast confined to the local VLAN, so the request would never reach PC-C's VLAN 20 segment. The subnet-mask check exists precisely so the host doesn't waste time on a resolution that's mechanically impossible.

Q Where would an ACL or firewall rule sit in this flow, if one existed between the VLANs?

A Applied at the L3 boundary device itself — either a router ACL on the sub-interfaces or a VLAN ACL / firewall zone on an L3 switch — evaluated at step 6, before the packet is re-framed onto the destination VLAN. Same-VLAN traffic (the earlier walkthrough) never passes through this device at all, so it can't be filtered this way.

Q Why does the trunk link need 802.1Q tagging at all instead of just using separate physical cables per VLAN?

A Tagging lets one physical link carry traffic for many VLANs simultaneously by stamping each frame with its VLAN ID — the alternative (one cable per VLAN) doesn't scale past a handful of VLANs and wastes switch ports and router interfaces.

04 Quick-Fire Glossary

Term	Meaning
Router-on-a-Stick	A router with one physical trunk link to a switch, using sub-interfaces to route between VLANs
SVI	Switched Virtual Interface — a logical L3 interface bound to a VLAN, used for inter-VLAN routing inside an L3 switch
802.1Q	The standard for tagging Ethernet frames with a VLAN ID on trunk links
Trunk Port	A switchport carrying tagged traffic for multiple VLANs, typically between switches or to a router
Access Port	A switchport assigned to exactly one VLAN; frames are untagged on the wire to the end host
Native VLAN	The one VLAN on a trunk sent without a tag; must match on both ends of the trunk
Broadcast Domain	The scope a broadcast/ARP request reaches — bounded by VLAN, not by physical switch
Connected Route	A route the L3 device installs automatically for a subnet directly attached to one of its interfaces/SVIs
Inter-VLAN Routing	The general term for moving traffic between VLANs, requiring a Layer 3 device
VLAN ACL / Router ACL	A filter applied at the L3 boundary that inter-VLAN traffic must cross, unlike intra-VLAN traffic