How does a layer 3 switch route a packet between two VLANs in hardware?
Show the answer
Say this first
The host sends the frame to its gateway's MAC, the SVI's MAC. The switch sees its own router MAC as the destination, so it routes instead of bridging: a longest-prefix lookup in the FIB (held in TCAM) returns an adjacency with the rewrite information. The ASIC swaps the source MAC to the SVI's and the destination MAC to the host's, decrements the TTL, fixes the IP checksum and recomputes the FCS, then sends it out the right port in the egress VLAN, all at line rate. Only exceptions go to the CPU.
Go deeper
Step by step
PC1 10.10.0.10 in VLAN 10 sends to PC2 10.20.0.10 in VLAN 20. Both gateways are SVIs on DSW1.
- PC1 sends the frame to the MAC of
interface Vlan10, with PC2's IP as destination. - DSW1 receives it in VLAN 10. The destination MAC is its router MAC, so the frame goes to the layer 3 lookup instead of the MAC table.
- The FIB returns the host entry for
10.20.0.10, learned from ARP, pointing at an adjacency on Vlan20. - The adjacency holds the new header: destination MAC of PC2, source MAC of the Vlan20 SVI, VLAN 20.
- The MAC table for VLAN 20 gives the egress port. TTL goes from 128 to 127 and the frame leaves.
What goes to the CPU (punted)
- No ARP entry yet for PC2: the glean adjacency sends the packet to the CPU, which ARPs.
- TTL expiring (traceroute), packets addressed to the switch itself, IP options.
- Features the hardware cannot do on that platform.
Commands
show ip cef 10.20.0.10 detail shows the FIB entry, show adjacency vlan 20 detail the rewrite, and
show ip arp vlan 20 the ARP entries the adjacencies are built from.
They will ask next
Why is the first ping to a new host often lost?
The first packet hits a glean adjacency. The switch ARPs for the host and typically drops that first packet while it waits, so the first echo times out and the rest succeed.
All SVIs on many Catalyst switches share one MAC. Is that a problem?
No. MAC tables are per VLAN, so the same router MAC in VLAN 10 and VLAN 20 never collide.
Traps
- Saying the switch looks up the destination MAC in the MAC table and floods. A frame addressed to the router MAC is routed, not bridged.