CCNA online course

Configure Router-on-a-Stick for Inter-VLAN Routing

Learn to configure Cisco IOS router-on-a-stick inter-VLAN routing with 802.1Q trunking, router subinterfaces, host gateways, verification, and troubleshooting.

Router-on-a-stick is an inter-VLAN routing design that uses one physical router interface and multiple logical subinterfaces. The router connects to a Layer 2 switch through one Ethernet trunk, and each subinterface provides Layer 3 connectivity for one VLAN.

This design is useful for small networks and training labs, but its single router link can become a throughput bottleneck. This lesson builds a two-VLAN Cisco IOS lab, verifies the configuration, and explains common failures.

Router-on-a-Stick Purpose

A VLAN is a logical Layer 2 broadcast domain identified by a VLAN ID. Devices in different VLANs are separated at Layer 2, even when they connect to the same physical switch. They cannot communicate directly across VLAN boundaries.

Inter-VLAN routing is Layer 3 forwarding between separate VLANs and their IP subnets. A router or multilayer switch performs this routing. In a router-on-a-stick design, one physical router interface carries traffic for several VLANs by using logical subinterfaces.

• An access port connects an endpoint to one VLAN.
• A trunk port carries traffic for multiple VLANs.
• IEEE 802.1Q adds VLAN information to Ethernet frames crossing a trunk.
• Each router subinterface has a VLAN association and an IP address.
• That subinterface IP address is the default gateway for hosts in its VLAN.

Topology and Traffic Flow

In the example topology, a Layer 2 switch connects users in VLAN 10 and VLAN 20. The switch connects to one router Ethernet interface through a trunk. Endpoint-facing switch ports are access ports, while the router-facing port is a trunk.

Traffic from PC-A to PC-B follows this sequence:

1. PC-A determines that PC-B is outside its local subnet and sends the frame to its default gateway, 192.168.10.1.
2. SW1 receives the frame on a VLAN 10 access port and forwards it over the trunk with an 802.1Q VLAN 10 tag.
3. R1 receives the frame on subinterface GigabitEthernet0/0.10, removes the Layer 2 framing, and routes the packet toward the VLAN 20 subnet.
4. R1 sends the result through subinterface GigabitEthernet0/0.20. The switch receives traffic associated with VLAN 20 and forwards it through the VLAN 20 access port to PC-B.

The router performs Layer 3 routing, while the switch continues to provide Layer 2 VLAN separation and forwarding.

When to Use Router-on-a-Stick

Router-on-a-stick is appropriate when a network has few VLANs, limited hardware interfaces, or a requirement for a simple training topology. It is commonly used in CCNA practice labs and small environments.

All inter-VLAN traffic crosses the same physical router interface and switch trunk. As traffic volume grows, that link and the router interface can become a throughput bottleneck. A failure of the router, its physical interface, the cable, or the trunk disrupts inter-VLAN communication.

In a larger campus network, a multilayer switch usually provides a more scalable design. It can route using switched virtual interfaces, or SVIs, within the switching infrastructure and can provide higher performance and better redundancy. Router-on-a-stick remains valuable for learning the relationship between VLANs, trunks, subinterfaces, and gateways.

VLAN and IPv4 Addressing Plan

Each routed VLAN needs three related values: a unique VLAN ID, a nonoverlapping IPv4 subnet, and a gateway address in that subnet. Hosts must use the correct subnet mask and gateway.

The subnets must not overlap. For example, a VLAN 10 host uses 192.168.10.10 with mask 255.255.255.0 and gateway 192.168.10.1. A VLAN 20 host uses 192.168.20.10 with mask 255.255.255.0 and gateway 192.168.20.1.

Configure the Switch

Create the VLANs

configure terminal
vlan 10
 name USERS_VLAN10
vlan 20
 name USERS_VLAN20

Assign Endpoint Access Ports

Configure each endpoint-facing interface as an access port and assign it to the intended VLAN. The interface in this example is only an example; use the interfaces that match your topology.

interface gigabitEthernet0/1
 switchport mode access
 switchport access vlan 10

interface gigabitEthernet0/2
 switchport mode access
 switchport access vlan 20

An access port carries traffic for one assigned VLAN. Assigning a PC to the wrong access VLAN places its frames in the wrong broadcast domain and usually prevents it from using the expected subnet and gateway.

Configure the Router-Facing Port as a Trunk

interface gigabitEthernet0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 no shutdown

The allowed VLAN list must include every VLAN that needs to reach the router. If VLAN 20 is absent from this list, VLAN 10 may work while VLAN 20 fails.

The native VLAN is the VLAN associated with untagged traffic on an 802.1Q trunk. Native VLAN expectations must match on both sides. Use a deliberate native VLAN design, and do not assume that untagged traffic belongs to the same VLAN on every device. On the router, use the native encapsulation form only when the topology intentionally makes a VLAN native; otherwise use tagged subinterfaces such as encapsulation dot1Q 10.

Configure Router Subinterfaces

First enable the physical router interface connected to the switch. The physical interface does not need a separate IP address for this design. Each logical subinterface receives the gateway address for one VLAN.

configure terminal
interface gigabitEthernet0/0
 no ip address
 no shutdown

interface gigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0

interface gigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

Encapsulation here means associating a subinterface with an 802.1Q VLAN tag. The number in encapsulation dot1Q must match the VLAN ID configured on the switch. Subinterfaces are logical interfaces; they do not require separate physical cables.

Configure the Hosts

Configure every endpoint with an address from the subnet assigned to its access VLAN. The default gateway must be the IP address of the matching router subinterface.

• PC-A, in VLAN 10: IP address 192.168.10.10, mask 255.255.255.0, gateway 192.168.10.1.
• PC-B, in VLAN 20: IP address 192.168.20.10, mask 255.255.255.0, gateway 192.168.20.1.

An incorrect VLAN assignment places a host in a different Layer 2 domain. An incorrect IP address or mask can make the host believe a remote device is local, or place it in the wrong subnet. An incorrect gateway prevents the host from sending remote-network traffic to the router.

Adding a Third VLAN

To add VLAN 30, repeat the relationship between VLAN, trunk, subinterface, subnet, and gateway. For example, use network 192.168.30.0/24 and gateway 192.168.30.1.

vlan 30
 name MANAGEMENT

interface gigabitEthernet0/24
 switchport trunk allowed vlan 10,20,30

interface gigabitEthernet0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0

Also assign the appropriate endpoint or management port to VLAN 30 and configure its hosts with addresses in 192.168.30.0/24 and gateway 192.168.30.1. The VLAN must exist on the switch, be permitted on the trunk, and have a matching router subinterface.

Verification and Testing

Switch Verification

show vlan brief
show interfaces trunk
show interfaces gigabitEthernet0/24 switchport

• show vlan brief verifies that VLANs exist and shows access-port membership.
• show interfaces trunk verifies trunk operational status, native VLAN information, and allowed and active VLANs.
• show interfaces gigabitEthernet0/24 switchport displays administrative and operational switchport mode, encapsulation, native VLAN, and allowed VLAN settings.

Router Verification

show ip interface brief
show interfaces gigabitEthernet0/0.10
show ip route
show running-config interface gigabitEthernet0/0

Confirm that the physical interface and subinterfaces are up. Check each subinterface for the correct 802.1Q VLAN ID and IP address. In show ip route, the router should have directly connected routes for 192.168.10.0/24 and 192.168.20.0/24.

Test in a Useful Order

1. Test same-VLAN connectivity first. This checks the endpoint, access port, VLAN membership, and local addressing.
2. From each host, ping its own gateway: ping 192.168.10.1 or ping 192.168.20.1.
3. Test the remote host: ping 192.168.20.10 from the VLAN 10 host.
4. Use traceroute 192.168.20.10 to observe the routed hop where supported.

Operational Limitations and Design Considerations

• Throughput: all inter-VLAN traffic shares one physical router interface and trunk.
• Availability: failure of the router, physical interface, cable, or trunk affects inter-VLAN communication.
• Compatibility: check speed, duplex, link state, trunk mode, allowed VLANs, and native VLAN settings on both devices.
• Scalability: multilayer switching with SVIs is generally preferred for larger campus networks because routing can occur at switching infrastructure speed and can be designed with more redundancy.

Common Configuration Failures

Exam-Relevant Notes

• One physical router interface can support multiple subinterfaces, but each VLAN needs its own logical subinterface and gateway address.
• The VLAN ID in encapsulation dot1Q must match the VLAN carried by the switch trunk.
• Access ports connect endpoints to one VLAN; trunk ports carry multiple VLANs.
• Each VLAN is a separate broadcast domain and normally uses a separate IP subnet.
• The router must have directly connected routes for the configured VLAN subnets.
• A native VLAN mismatch can cause untagged traffic problems even when a trunk appears operational.