A Layer 3 switch can bridge one frame and route the next. The interview question is not simply whether the destination IP is in another subnet: it is how the frame reaches the switch's routing function in the first place.
Short answer: On a Layer 2 switchport, ordinary unicast traffic is bridged within its VLAN using the destination MAC address; a frame addressed to the switch's gateway/SVI MAC can enter Layer 3 processing.[1] Routing then uses the destination IP address to select the onward path and builds a new Ethernet frame for the outgoing link.[1][3]
Scope: ordinary IPv4 unicast on an Ethernet LAN
This explanation uses a conventional two-VLAN network with the Layer 3 switch acting as the hosts' default gateway. The example assumes no NAT, proxy ARP, policy-based routing, tunnels or first-hop redundancy. Multicast, broadcast and traffic addressed to the switch itself need separate treatment; this is not a complete ASIC pipeline description.
The key distinction: the host chooses a next hop first
For an ordinary directly connected destination, a host resolves the destination host's MAC address; for a remote destination reached through its default gateway, it resolves the gateway's MAC instead.[3] The IP destination remains the final host, not the default gateway.[3]
This explains why a transit Layer 3-capable switch does not automatically route every frame containing a remote destination IP. If the Ethernet frame is addressed to a gateway located elsewhere, the local device can simply bridge it toward that gateway. Layer 3 capability is not a command to bypass the host's selected next hop.
MAC table, routing table and ARP: three different questions
| Information | Question it answers | Practical check |
|---|---|---|
| MAC address table | Which Layer 2 port leads to this destination MAC in this VLAN? | Correct VLAN and learned destination port |
| IP routing/forwarding information | Which Layer 3 path reaches this destination IP? | Connected or learned route in the right routing context |
| ARP information | What Ethernet address belongs to the IPv4 neighbor on this link? | Destination host for a connected subnet, or router next hop for a remote subnet |
Source learning and destination-MAC forwarding belong to Layer 2 switching; the IP route lookup belongs to Layer 3 forwarding.[1] ARP supplies the local-link IP-to-MAC mapping needed to send an Ethernet frame to the selected neighbor.[3]
Do not treat an ARP entry as proof that a route exists, or a learned MAC as proof that the switch can route between two VLANs. Use each table to answer its own question.
Packet walk: same VLAN versus another VLAN
The following addresses and names are fictional lab values, not a production capture:
- Host A:
192.0.2.10/25, VLAN 10, default gateway192.0.2.1. - Host B:
192.0.2.20/25, VLAN 10, default gateway192.0.2.1. - Host C:
198.51.100.20/25, VLAN 20, default gateway198.51.100.1. - Switch gateways: SVI VLAN 10 at
192.0.2.1/25; SVI VLAN 20 at198.51.100.1/25.
A to B: bridge within VLAN 10
A identifies B as on-link and, if necessary, uses ARP to obtain B's MAC address.[3] A sends a frame whose destination MAC is B; the switch's Layer 2 function forwards it within VLAN 10 rather than passing it through the SVI routing function.[1][2]
If the destination MAC is not learned, ordinary unknown-unicast flooding stays within the VLAN's eligible forwarding ports; it is not a fallback IP route lookup. A Layer 2 transit hop does not decrement the packet's IP TTL.
A to C: enter the gateway, then route
- A treats C as remote and resolves the VLAN 10 gateway's MAC, not C's MAC.[3]
- A sends an Ethernet frame to the gateway MAC, carrying an IP packet addressed to
198.51.100.20.[3] - Because the frame is addressed to the switch's SVI MAC, the switch can process it through its Layer 3 function.[1]
- The destination IP lookup selects the connected VLAN 20 path; an operational SVI with its subnet produces a connected route.[2]
- For this directly attached destination, the gateway resolves C's MAC if necessary and emits a newly encapsulated Ethernet frame toward C.[3]
| Field | A to gateway in VLAN 10 | Gateway to C in VLAN 20 |
|---|---|---|
| Source MAC | A's MAC | Gateway's egress MAC |
| Destination MAC | VLAN 10 gateway MAC | C's MAC |
| Source IP | 192.0.2.10 | 192.0.2.10 |
| Destination IP | 198.51.100.20 | 198.51.100.20 |
| IP TTL, illustrative | 64 | 63 |
The MAC identities change across the routed hop, while source and destination IP addresses remain unchanged in this no-NAT example.[3] IPv4 routing also decrements TTL and updates the IPv4 header checksum; the Ethernet frame receives a new FCS. Gateway MAC values may be shared across interfaces on some platforms, so do not assume every SVI must have a different numerical MAC address.
SVI versus routed port
An SVI is a Layer 3 interface into a VLAN whose physical member ports still operate as Layer 2 switchports.[2] A routed physical port instead operates as a Layer 3 interface rather than as a Layer 2 member of a VLAN; Cisco's no switchport command is used on supported interfaces to select that mode.[1]
Creating VLANs or making a trunk does not by itself create inter-VLAN routing: the switch needs the appropriate Layer 3 interfaces and routing configuration.[2] In this example, both VLAN interfaces need to be operational and both hosts need suitable gateway settings.
Read-only troubleshooting checklist
These Cisco IOS/IOS XE-style commands are illustrative, not output from an executed switch lab. Availability and exact syntax depend on the platform and release.
show interfaces switchport
show vlan brief
show interfaces trunk
show mac address-table dynamic vlan 10
show ip interface brief
show interfaces vlan 10
show interfaces vlan 20
show ip route 198.51.100.20
show ip arp
show access-lists
Use the results in this order:
- Host decision: verify the source address, subnet mask and selected gateway. In a capture, identify the actual destination MAC of the data frame.
- Layer 2 path: confirm the access VLAN, any required trunk allowance, forwarding state and gateway reachability.
- Gateway state: check that the intended SVI is operational, has the correct address, and that IPv4 routing is enabled where required.
- Layer 3 path: verify the exact destination lookup in the correct routing context, not just the existence of some default route.
- Outgoing neighbor: check ARP resolution and the Layer 2 path toward the destination or next-hop router.
- Policy and return path: inspect relevant ACL counters, then repeat the reasoning for the reply.
Cisco documents that SVI operational state depends on more than its own administrative state: VLAN existence/activity and an eligible forwarding Layer 2 port also matter.[2] Consequently, no shutdown on the SVI alone is not a sufficient verification step.[2]
Common interview pitfalls
- “Different subnet means this switch routes it.” First establish which gateway MAC the host actually used.
- “An unknown MAC triggers routing.” Unknown-unicast handling and IP forwarding are different decisions.
- “The IP destination becomes the gateway.” In normal forwarding without NAT, the gateway is the local-link next hop; the IP destination remains the remote host.[3]
- “An SVI address proves transit routing works.” Check routing enablement, operational state, routes, policy and the return direction.
- “Anything addressed to the SVI MAC is forwarded onward.” A packet addressed to the switch's own IP is for local processing, not necessarily transit forwarding.
- “A Layer 3 switch routes everything in software.” The forwarding model and the hardware/software implementation are separate issues; do not infer the implementation from the word routing.
A concise interview answer
“On a switchport, I start with the ingress VLAN and Ethernet destination. A normal host-to-host frame is bridged within that VLAN. When the host sends an off-subnet packet to this switch's gateway MAC, the switch can perform the IP route lookup and rewrite the Ethernet encapsulation for the next hop.”[1][3]
“I would verify the host's next-hop choice, VLAN path, SVI state, route, ARP mapping and return path. I would not decide that routing occurred merely because the packet contains a destination in another subnet.”
Related reading
- What happens when a PC boots: DHCP, ARP and DNS
- Access port vs trunk port vs native VLAN
- Administrative distance vs metric vs longest prefix match
Summary and practice
Keep three questions separate: where the Ethernet frame should go, which IP path is selected, and how the next-hop address is resolved. That distinction makes both interview answers and troubleshooting more precise.
Preparing for a network engineering interview? Draw A-to-B and A-to-C on paper, label both destination MAC and destination IP at each step, and explain why the same switch bridges one exchange but routes the other.
Post a Comment