VLANIF and Inter-VLAN Routing

Why Layer 2 isolation is not enough for real networks

VLANs successfully isolate broadcast domains. Employees in VLAN 10 should not share ARP floods with guests in VLAN 20. Yet employees still need the Internet, printers in another VLAN, and servers in a data VLAN. That requires inter-VLAN routing: forwarding IP packets between subnets that map to different VLANs.

HCIA-Datacom emphasizes two common campus patterns:

1. VLANIF on a multilayer switch (SVI-style) — preferred modern campus core/distribution approach on Huawei.
2. Router-on-a-stick — external router (or L3 device) with sub-interfaces over a trunk to a Layer 2 switch.

Both deliver the same user outcome: Host A’s default gateway is in its VLAN; the gateway routes to Host B’s subnet and rewrites the Ethernet header for the destination VLAN.

Mental model: one subnet per VLAN

Host in VLAN 10: IP 192.168.10.10/24, gateway 192.168.10.1. Host in VLAN 20: 192.168.20.20/24, gateway 192.168.20.1. Same-switch Layer 2 never bridges these VLANs; the VLANIF interfaces route between them if routing is enabled and interfaces are up.

VLANIF configuration on Huawei VRP

Prerequisites

1. VLAN created (vlan 10 or vlan batch ...).
2. At least one access/hybrid/trunk path actually carries that VLAN (otherwise the SVI may stay down/down depending on platform rules).
3. No IP conflict with another interface.

Create and address VLANIF 10:

[Huawei] vlan 10
[Huawei] interface Vlanif 10
[Huawei-Vlanif10] ip address 192.168.10.1 255.255.255.0
[Huawei-Vlanif10] quit

VLANIF 20:

[Huawei] vlan 20
[Huawei] interface Vlanif 20
[Huawei-Vlanif20] ip address 192.168.20.1 255.255.255.0
[Huawei-Vlanif20] quit

Verification:

<Huawei> display ip interface brief
<Huawei> display interface Vlanif 10
<Huawei> display ip routing-table

You should see connected routes for 192.168.10.0/24 and 192.168.20.0/24. On devices that route by default between connected SVIs, hosts with correct gateways can already ping across VLANs. Some platforms require enabling routing features or ensuring no policy blocks traffic—HCIA scenarios typically assume connected VLANIF routes are enough for basic inter-VLAN pings.

Why the VLANIF can be down

Common reasons:

• VLAN has no up ports in that VLAN (no access member and no trunk allowing it).
• Interface administratively down (shutdown).
• Hardware/license layer-3 limitations on pure access-only models (know your device class).

display vlan and display interface Vlanif 10 tell you whether the logical gateway is live.

Packet walk: VLAN 10 host to VLAN 20 host

1. PC-A (192.168.10.10) sends to 192.168.20.20 → different subnet → ARP for gateway 192.168.10.1 if needed.
2. Frame to VLANIF 10 MAC arrives on access VLAN 10; switch delivers to the L3 engine.
3. Router logic decrements TTL, looks up destination 192.168.20.20 → connected via VLANIF 20.
4. ARP for PC-B on VLAN 20 if needed; new frame sourced from VLANIF 20 MAC toward PC-B.
5. Access port in VLAN 20 delivers untagged frame to PC-B.

Notice: MAC addresses change at the gateway; IP addresses stay end-to-end. That is the OSI Layer 2/3 split you must narrate on the exam.

Router-on-a-stick overview

When the access switch is Layer 2 only:

PC-A --(access VLAN10)-- L2 Switch --(trunk allow 10,20)-- Router
PC-B --(access VLAN20)--/

On the router, sub-interfaces (or equivalent) carry encapsulation per VLAN:

[Router] interface GigabitEthernet0/0/0.10
[Router-GigabitEthernet0/0/0.10] dot1q termination vid 10
[Router-GigabitEthernet0/0/0.10] ip address 192.168.10.1 255.255.255.0
[Router-GigabitEthernet0/0/0.10] arp broadcast enable

[Router] interface GigabitEthernet0/0/0.20
[Router-GigabitEthernet0/0/0.20] dot1q termination vid 20
[Router-GigabitEthernet0/0/0.20] ip address 192.168.20.1 255.255.255.0
[Router-GigabitEthernet0/0/0.20] arp broadcast enable

Exact sub-interface keywords vary by VRP version and router model; HCIA wants the architecture:

• One physical link, 802.1Q trunk.
• One logical interface per VLAN with the gateway IP.
• Switch trunk must allow-pass every routed VLAN.

Compared with VLANIF on a multilayer switch, router-on-a-stick can become a bandwidth bottleneck (all inter-VLAN traffic hairpins through one link) but remains a valid small-site or teaching design.

VLANIF vs physical interface addressing

Do not put the user gateway on a random physical access port unless that port is intentionally a routed port design. Campus users almost always point to a VLANIF or sub-interface gateway.

Inter-VLAN ACL and services (preview)

Once routing works, security often applies ACLs on VLANIF interfaces (traffic-filter in later chapters) so guests cannot initiate sessions into employee VLANs. DHCP pools bind to VLANIF networks; NAT may hide private subnets toward the WAN. Inter-VLAN routing is therefore the foundation for those services—not an isolated trick.

Troubleshooting checklist (HCIA gold)

Work top-down:

1. Host VLAN membership — access/hybrid PVID correct? display vlan.
2. Host IP and mask — same subnet as its VLANIF? Gateway correct?
3. VLANIF up with correct IP — display ip interface brief.
4. Trunk path to gateway — if host is on a remote access switch, trunks must allow the VLAN all the way to the L3 device.
5. ARP — display arp on the gateway; host ARP table for gateway MAC.
6. Routing table — connected routes present; no conflicting static blackhole.
7. ACL / zone policy — advanced, but remember after basics work.

Classic traps

• Hosts in different VLANs but same IP subnet configured by mistake—routing and ARP behavior becomes pathological.
• VLANIF created without creating the VLAN.
• Gateway IP correct on paper but host default gateway still points to an old address.
• Router-on-a-stick trunk missing allow-pass for one VLAN—only some subnets work.
• Expecting two VLANs to communicate because they share a physical switch—“same switch” ≠ “same VLAN.”

Design notes for larger campuses

Distribution/core switches host many VLANIFs; access switches stay Layer 2 with trunks. First-hop redundancy (VRRP) may present a virtual gateway IP—concepts appear in broader Huawei materials. For H12-811, nail single gateway VLANIF labs first, then connect them to static routing and OSPF chapters where VLANIF networks are advertised or used as next-hop connected routes.

Lab sequence to cement skills

1. Two VLANs, two access ports, same switch: confirm no cross-VLAN ping without VLANIF.
2. Add VLANIF 10 and 20 with gateways: confirm yes cross-VLAN ping.
3. Move one host to a second switch over a trunk: break allow-pass and watch failure; restore and succeed.
4. Optional: replace VLANIF design with router-on-a-stick and repeat pings.

Chapter synthesis

• MAC tables forward frames inside a VLAN; unknown traffic floods inside that VLAN.
• VLANs define those flood domains; vlan batch creates them; same VLAN is mandatory for L2 adjacency.
• Access / trunk / hybrid place ports into VLANs and control tags; never forget trunk allow-pass.
• VLANIF / router-on-a-stick restore IP reachability between VLANs with proper gateways.

If you can configure a two-VLAN lab from scratch on VRP—including verification commands—you have the Ethernet switching core that HCIA-Datacom weights heavily alongside STP and Eth-Trunk in the broader switching domain.