Routers Inside the Enterprise: What They Do Besides Reach the Internet

June 4, 2026 12 min read Networking Deep Dives

networkingroutingenterprisevlanlayer-3-switchsegmentationhsrp

Contents

Ask someone what a router does and you’ll usually hear some version of “it connects your network to the internet.” That is true, and it is also the least interesting thing a router does. In a home, the router at the edge is the only router you have, so it’s easy to conclude that reaching the internet is the whole job. In a company network with thousands of devices across dozens of subnets and several buildings, routing happens constantly inside the building, between segments that never touch the public internet at all. The internet uplink is one port on one device; the routing that keeps the company running is everywhere else.

This post is about that everywhere-else. What does a router fundamentally do that a switch can’t, and why does a real enterprise need that capability in a dozen internal places? We’ll cover connecting subnets, controlling the size of failure and broadcast domains, enforcing security boundaries, tying sites together, and staying up when hardware dies. If you want the bit-level mechanics of how a router picks a path — the routing table, longest-prefix match, administrative distance — the IPv4 routing fundamentals post covers that; this one is about why the routers are there in the first place.

The One Thing a Switch Cannot Do

Start with the dividing line. A switch forwards frames within a single subnet by MAC address. It is fast, cheap, and completely blind to IP networks — it has no concept of “this subnet vs that subnet.” Every device plugged into a flat switched network shares one broadcast domain: when one host sends a broadcast (an ARP request, a DHCP discover), every other host hears it.

A router forwards packets between subnets by IP address. It is the only kind of device that can move traffic from 10.0.1.0/24 to 10.0.2.0/24. The moment your network has more than one subnet — and every non-trivial network does — you need something that routes, or those subnets are islands that cannot reach each other. That “something” is a router, whether it’s a dedicated router appliance or, far more commonly inside modern campuses, a Layer 3 switch doing the routing in hardware. (More on that distinction below; the function is routing either way.)

So the first and most fundamental internal use of routing has nothing to do with the internet: it is simply connecting the company’s own subnets to each other. Everything that follows is a reason you’d deliberately split a network into multiple subnets in the first place — because each split creates a boundary that only a router can cross, and each boundary buys you something.

Reason 1: Bounding Broadcast Domains and Failure Domains

A single flat Layer 2 network does not scale, and the reason is broadcasts. Broadcast and unknown-unicast traffic floods to every port in the broadcast domain. With 50 hosts that’s noise; with 5,000 it’s a measurable tax on every device’s CPU and the network’s bandwidth, and a single misbehaving host or a forwarding loop can melt the entire segment in a broadcast storm. Spanning Tree, MAC address table sizes, and the blast radius of a loop all degrade as the flat domain grows.

Routing cuts the network into pieces. A router does not forward broadcasts, so each routed subnet is its own broadcast domain. Split 5,000 hosts into twenty subnets of 250 and a broadcast storm or a loop is contained to one segment of 250 instead of taking down all 5,000. This is the performance-and-stability argument for internal routing: you route not because the segments need the internet, but because you need walls between them so that local problems stay local. The art of carving the address space to match — right-sizing each subnet — is exactly the subnetting work that makes those /26-shaped masks show up.

Reason 2: Inter-VLAN Routing

VLANs are how a single physical switch fabric is divided into multiple logical Layer 2 networks — a Users VLAN, a Servers VLAN, a Voice VLAN, a Guest VLAN — each its own broadcast domain. VLANs solve segmentation at Layer 2, but they create a problem: a device in the Users VLAN cannot, by design, reach a server in the Servers VLAN, because VLANs are isolated by definition. They need a router to talk between them. This is inter-VLAN routing, and it is probably the single most common internal routing job in any office.

There are two ways it’s done:

Router-on-a-stick: a router connects to the switch over one trunk link carrying all VLANs, with a virtual sub-interface per VLAN acting as that VLAN’s default gateway. Simple, cheap, and a bottleneck — every cross-VLAN packet makes a round trip up the single link and back.
Layer 3 switch with SVIs: the switch itself routes. Each VLAN gets a Switch Virtual Interface (SVI) — a virtual routed interface that is the gateway for that VLAN — and the switch moves packets between VLANs in ASIC hardware at wire speed. This is how essentially every modern campus does it, because there’s no trunk bottleneck and the routing is line-rate.

          ┌──────────────────────────────────────────┐
          │            Layer 3 Switch                 │
          │   SVI VLAN10 = 10.0.10.1  (Users gw)      │
          │   SVI VLAN20 = 10.0.20.1  (Servers gw)    │
          │   SVI VLAN30 = 10.0.30.1  (Voice gw)      │
          │   routing between VLANs happens in ASIC   │
          └───┬───────────────┬───────────────┬───────┘
        VLAN10│         VLAN20 │         VLAN30 │
          ┌───┴───┐       ┌────┴───┐       ┌────┴───┐
          │ Users │       │Servers │       │ Phones │
          └───────┘       └────────┘       └────────┘
   different subnets — only the L3 switch moves traffic between them

The default gateway your laptop is configured with — 10.0.10.1 in the diagram — is a router interface. Every time you reach a server on another VLAN, that traffic is being routed internally. None of it involves the internet.

Reason 3: Security Segmentation and Policy

Once traffic between segments has to pass through a routed boundary, that boundary becomes the natural place to enforce policy. A flat network has no chokepoints — anything can talk to anything. A routed network forces inter-segment traffic through router interfaces where you can apply access control lists and firewall rules: the Guest VLAN can reach the internet but not the internal server subnet; the IoT VLAN can reach a specific update server and nothing else; the PCI cardholder segment is walled off from general user traffic for compliance.

This is “east-west” control — governing traffic between internal zones, not just north-south traffic to the internet. It is a core building block of network segmentation and of zero-trust designs, where the assumption is that the inside of the network is not automatically trusted and every zone boundary is a policy enforcement point. You cannot enforce a boundary that doesn’t exist; routing is what creates the boundary, and the router (or L3 switch, or firewall sitting at the routed edge of a zone) is where the rules live.

Reason 4: Connecting Sites and the WAN

Companies are rarely one building. Headquarters, branch offices, warehouses, and data centers each have their own local networks, and routing is what stitches them together over the wide-area network — leased lines, MPLS, broadband with VPN, or modern SD-WAN overlays. The router at each site’s edge isn’t (only) providing internet; it’s advertising that site’s internal subnets to the others and choosing paths between them.

This is also where the media changes. A branch might connect over a different physical technology than the campus LAN, and a router is the device that moves IP packets across that change of medium. Site-to-site connectivity is internal traffic — payroll reaching the HQ database, a warehouse scanner hitting the central inventory system — that crosses the WAN without ever being “internet” traffic in the sense people usually mean. For the protocols that make this scale, see the WAN technologies reference, and for software-defined approaches, Tailscale shows the overlay-network version of the same idea.

Reason 5: Dynamic Routing and Summarization at Scale

In a small network you can hand-write static routes telling each router how to reach each subnet. Past a handful of subnets that becomes unmanageable and brittle — every topology change means touching every router. So internal networks of any size run a dynamic routing protocol — OSPF or EIGRP inside the enterprise, sometimes internal BGP in large or data-center fabrics — so routers discover each other, advertise the subnets they can reach, and automatically reconverge around a failed link within seconds.

Dynamic routing brings a second internal job: route summarization. A distribution router that owns 10.1.0.0/24 through 10.1.7.0/24 can advertise them to the core as a single 10.1.0.0/21 summary instead of eight separate routes. This keeps routing tables small and hides local instability — if one of those eight subnets flaps, the summary doesn’t change, so the rest of the network never sees the churn. Summarization is internal routing optimizing itself, and it relies directly on a sane hierarchical address plan. The dedicated OSPF and BGP posts go deep on how these protocols behave, and FRRouting in production covers running them on Linux.

Reason 6: Redundancy and High Availability

If every device in a VLAN points at one gateway IP and the device owning that IP dies, the whole VLAN loses the ability to leave its subnet — even though the rest of the network is fine. Internal routing solves this with first-hop redundancy protocols: HSRP and VRRP (and GLBP) let two or more routers or L3 switches share a single virtual gateway IP. One is active, one is standby; if the active one fails, the standby takes over the virtual IP in a second or two, and the hosts — which only ever knew the virtual address — never notice.

   hosts' default gateway = 10.0.10.1  (virtual IP)
                  │
         ┌────────┴────────┐
         ▼                 ▼
   ┌───────────┐     ┌───────────┐
   │  L3 SW A  │◄───►│  L3 SW B  │
   │  ACTIVE   │     │  STANDBY  │
   │ owns .1   │     │ takes .1  │
   │           │     │ if A dies │
   └───────────┘     └───────────┘

Combine that with multiple equal-cost paths (ECMP) between the distribution and core layers, and the internal network keeps forwarding through link and device failures with no human intervention and no client reconfiguration. This resilience is a purely internal property — it has nothing to do with the internet uplink and everything to do with the network surviving its own hardware failing.

Routers vs Layer 3 Switches: a Necessary Clarification

A fair objection at this point: “but my campus doesn’t have a rack of routers, it has switches.” Correct — and that’s the modern reality worth stating plainly. Most internal routing in a contemporary enterprise is performed by Layer 3 switches, which route between VLANs in dedicated ASIC hardware at the same speed they switch. They are, functionally, routers that also switch, optimized for the high-volume, many-interfaces, LAN-speed routing a campus needs.

Dedicated routers still exist, but they’ve migrated to the jobs switches do poorly: the WAN edge (where you need serial/cellular/DSL interfaces, complex NAT, deep ACLs, tunnels, and WAN protocols), and services that benefit from software flexibility over raw hardware throughput. The rough division of labor:

Job	Typically done by
Inter-VLAN routing inside a campus	Layer 3 switch (SVIs, ASIC)
WAN / branch / internet edge	Router or firewall
High-throughput LAN routing	Layer 3 switch
Complex NAT, tunnels, deep policy	Router / firewall
Routing between data center fabrics	L3 switches / routers running BGP

So when this post says “router,” read it as “the routing function.” Inside the building that function usually wears a switch’s clothing. The principle is unchanged: something has to make Layer 3 forwarding decisions to move traffic between subnets, and that is routing.

The Honest Trade-offs

Routing internally is not free, and more of it is not automatically better.

Complexity. Every subnet boundary is something to design, document, and troubleshoot. A routed network has an address plan, a routing protocol, gateway redundancy config, and ACLs — all of which can be misconfigured. A flat network has none of that to get wrong (it just doesn’t scale or contain anything).
Cost. Layer 3 switches cost meaningfully more than Layer 2-only switches, and first-hop redundancy means buying devices in pairs. There’s a real budget conversation in how much routing to push toward the access layer.
It’s not a security panacea. Routing creates places to enforce policy; it doesn’t enforce anything by itself. A routed network with permissive ACLs is no more segmented than a flat one. The boundary only matters if you put rules on it.
Over-segmentation has a cost too. Slicing a small office into fifteen subnets because you can adds troubleshooting overhead and gateway sprawl with little benefit. Segment where there’s a real reason — scale, a security zone, a distinct site — not reflexively.

The right amount of internal routing is “as much as your scale, security, and resilience requirements actually demand, and no more.” For a small flat office of thirty devices, one subnet and the edge router is genuinely the correct design. The internal-routing machinery earns its keep as the network grows.

The Verdict

The “router connects you to the internet” mental model is a home-network artifact. Inside a company network, the internet uplink is a single edge function, while routing is doing structural work throughout: it connects the company’s subnets to each other, bounds broadcast and failure domains so local problems stay local, enables inter-VLAN communication, creates the boundaries where security policy is enforced, ties branch offices and data centers together over the WAN, scales the whole thing with dynamic routing and summarization, and keeps it running through hardware failures with gateway redundancy.

Most of that traffic never reaches the public internet — it’s the company talking to itself, segment to segment, site to site. And nearly all of it, in a modern building, is performed by Layer 3 switches rather than the boxes we traditionally call routers. But the function is the same one your home router performs at the edge, just multiplied across the entire internal topology and put to work for performance, security, and resilience rather than merely for reaching the outside world.