What is meaning of the ip default-gateway command on a Cisco L2 switch? I read something about it on the Internet, but there was written that it allows you to Telnet to the switch. I am little bit confused. When I want to Telnet to the switch, I set the IP address of the VLAN 1 interface, and it works.

  • Great explanation, Ron. Thanks tommy Commented Jun 17, 2020 at 18:30

3 Answers 3



The switch management cannot send anything to a different layer-3 network without a default gateway. Telnet is a bidirectional protocol, and the switch, without the default gateway, would be unable to respond to the host which is attempting to establish the Telnet session.

Long explanation:

The default gateway on a switch has the same function as any gateway configured on a host PC. Without a default gateway, the switch management address (on VLAN 1 in your case, but it could be on any VLAN configured on the switch) cannot send traffic off its network to another network.

When a host (including the switch management), wants to send a packet to another host, it needs to resolve the layer-3 address (IP, etc.) to the other host's layer-2 address (MAC, etc.) in order to build a layer-2 frame.

The host (including the switch management) sends an ARP (Address Resolution Protocol) request via a broadcast to do the resolution. Broadcasts do not cross layer-3 boundaries (routers). The host (including the switch management) can tell if the destination layer-3 address is outside its network because it has its own layer-3 address, the destination layer-3 address, and the network mask of its network. If the destination is on a different layer-3 network, the host (including the switch management) will send the frame to the gateway's layer-2 address.

IPv6 does basically the same thing, but IPv6 doesn't have broadcasts, so it uses a special multicast group based on the last 24 bits of the IPv6 address. This doesn't interrupt every host on the LAN, and it, in all probability, with only hit the host for which it wants to resolve the layer-2 address. Multicast doesn't cross layer-3 boundaries, either, unless a router is configured to route multicast (off by default).


The short answer here is that the default gateway is the local router that gets traffic to other networks. It is the default way to get off of your network.

Remember, routers connect networks and switches create networks. If you are off on another (non-Vlan1) network, you must route the traffic. For instance, your home LAN (x.x.x.x) and your ISP network (y.y.y.y) have a router to connect them (commonly called a cable modem).


When I want to Telnet to the switch, I set the IP address of the VLAN 1 interface, and it works.

I was also puzzled to know that even though I did not configure a default gateway (using the ip default-gateway command) on my Catalyst 2960 L2 Switch. I could ping/telnet to it not only from a host on the same subnet, but also from hosts on remote subnets.

Hosts send packets to its default gateway when the packet's destination IP Address is in a different subnet, and if no default gateway has been configured they simply can't communication outside its local subnet. So, the question is how come the Switch's VLAN 1 Interface is a able to send data to the local router/gateway if it hasn't been configured with such?

Well, turns out that although the Switch's VLAN 1 Interface doesn't know the IP Address of its Default Gateway, it issues an ARP Broadcast to learn the MAC Address of packet's destination Host (just like it would if the packet's destination IP Address was in the same subnet) and once the router's LAN Interface receives the ARP Broadcast message it tries to match the Target IP Address to any of its routes, if a match is found (meaning that the router knows how to get to the subnet the Target IP Address resides in), then it replies with the MAC Address of the interface in which the ARP Message was received.

Here's a diagram explaining the whole process:

enter image description here

Notice that without a configured default gateway the Switch needs to issue an ARP Broadcast for every new non-local IP Address it wants to communicate with, meaning that the Switch's ARP Table will list an entry for every non-local IP Address pointing to the same MAC Address (the local router's interface MAC Address). On the other hand, if you configure the Switch with a Default Gateway, the Switch needs to issue only one ARP Broadcast to learn the MAC Address of its configured default gateway.

Update: As pointed out by @RonMaupin, Routers will only reply to ARP Requests for non-local IP Addresses if proxy arp is enabled on the gateway's Interface

  • 1
    You are describing proxy ARP, which is disabled by people of knowledge because it represents a huge security risk. You only ever enable it under specific, controlled circumstances when nothing else will do.
    – Ron Maupin
    Commented Jul 1, 2017 at 0:34
  • I see, thanks for the clarification, is proxy ARP disabled by default on L2 Switches?
    – chomba
    Commented Jul 1, 2017 at 0:43
  • Proxy ARP is enabled or disabled on your router. The router will answer ARP for devices in other networks. This opens up a security hole that is often unacceptable for many companies. If it is disabled, your switch would never get an ARP reply. ARP is broadcast, and as a broadcast, it doesn't cross a router to a different network. Proxy ARP will let the router answer in place of a device in the other network.
    – Ron Maupin
    Commented Jul 1, 2017 at 0:46
  • Got it, last question, why does the switch's management interface tries to resolve the non-local IP Address in the first place? I mean why does it send an ARP Broadcast with the non-local IP Address as the target? AFAIK hosts should only use ARP to find the physical address of an IP Address in the same network.
    – chomba
    Commented Jul 1, 2017 at 2:23
  • 1
    That depends on the OS. I have seen that behavior, but there is no blanket way to say any device will or will not work that way.
    – Ron Maupin
    Commented Jul 1, 2017 at 3:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.