VMware ESXi and vSphere Cluster Management

Configure Router-on-a-Stick for Inter-VLAN Routing

Learn to configure router-on-a-stick with Cisco IOS: create VLANs, trunk a switch uplink, configure router subinterfaces, assign gateways, and verify inter-VLAN routing.

Router-on-a-stick (ROAS) is an inter-VLAN routing design that uses multiple logical router subinterfaces over one physical Ethernet connection to a switch. Each subinterface is associated with one VLAN and provides the IPv4 default gateway for hosts in that VLAN.

This design is useful in labs, small networks, and lower-throughput environments. It is also a practical way to learn how VLAN trunking, 802.1Q tags, IPv4 subnets, and Layer 3 routing work together.

What Router-on-a-Stick Does

A VLAN is a logical Layer 2 network on a switch. Each VLAN is a separate broadcast domain, so broadcasts in one VLAN do not normally cross into another VLAN.

Hosts in different VLANs also normally use different IP subnets. Because communication between different IP subnets requires Layer 3 forwarding, hosts in separate VLANs cannot communicate without a Layer 3 device such as a router or multilayer switch. This process is called inter-VLAN routing.

In a ROAS design, one physical router Ethernet port contains several subinterfaces. A subinterface is a logical interface created beneath a physical interface. Each subinterface has four important properties:

• An interface name such as GigabitEthernet0/0.10.
• An IEEE 802.1Q VLAN association, configured with encapsulation dot1q.
• An IPv4 address and subnet mask.
• A role as the default gateway for hosts in that VLAN.

Traffic from multiple VLANs shares the single router-to-switch link. The switch uses an 802.1Q trunk to carry those VLANs, while the router uses the VLAN tags to select the correct subinterface.

ROAS Topology and Packet Path

A typical lab has one router, one Layer 2 switch, and hosts assigned to VLANs 10, 20, and 30. Host-facing switch ports are configured as access ports. The single switch port connected to the router is configured as a trunk.

For example, when the VLAN 10 host sends traffic to the VLAN 20 host, the packet follows this path:

1. The VLAN 10 host determines that 192.168.20.10 is outside its local subnet and sends the frame to its default gateway, 192.168.10.1.
2. The switch receives the frame on the VLAN 10 access port.
3. The switch sends the frame over the router uplink trunk with an 802.1Q VLAN 10 tag.
4. The router associates the tag with subinterface GigabitEthernet0/0.10.
5. The router removes the incoming Layer 2 framing, examines the destination IP address, and makes a routing decision.
6. The router selects subinterface GigabitEthernet0/0.20 for the 192.168.20.0/24 destination network.
7. The router sends the packet back over the trunk with VLAN 20 identification.
8. The switch forwards the frame out the VLAN 20 access port to the destination host.

802.1Q Tagging and Encapsulation

IEEE 802.1Q, commonly called dot1q, is the VLAN-tagging standard used on Ethernet trunk links. When a switch sends a frame for a tagged VLAN across a trunk, it inserts VLAN identification into the frame. The receiving device can then determine which VLAN the frame belongs to.

The router identifies the destination subinterface by the VLAN tag. The command encapsulation dot1q 10 binds a router subinterface to VLAN 10, while encapsulation dot1q 20 binds another subinterface to VLAN 20.

An access port carries traffic for one assigned VLAN and is normally used for an end device. A trunk port carries traffic for multiple VLANs using VLAN tags and is used for the router uplink in this design.

Step 1: Create the Switch VLANs

Create every VLAN required by the lab. VLAN names are optional but make the configuration easier to understand.

Switch> enable
Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name USERS_10
Switch(config-vlan)# vlan 20
Switch(config-vlan)# name USERS_20
Switch(config-vlan)# vlan 30
Switch(config-vlan)# name USERS_30
Switch(config-vlan)# end

Step 2: Assign Host Access Ports

Configure each host-facing port as an access port and assign it to the correct VLAN. Do not configure these ports as trunks.

Switch# configure terminal
Switch(config)# interface FastEthernet0/2
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# interface FastEthernet0/3
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20
Switch(config-if)# interface FastEthernet0/4
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 30
Switch(config-if)# end

Step 3: Configure the Router Uplink as a Trunk

Configure the switch port connected to the router as an IEEE 802.1Q trunk. The actual interface may differ between hardware and simulators. Allow every VLAN that must use inter-VLAN routing.

Switch# configure terminal
Switch(config)# interface FastEthernet0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# no shutdown
Switch(config-if)# end

Some switch platforms negotiate trunk encapsulation automatically or support only 802.1Q. The router does not use switchport mode trunk; that is a switchport command. The router uses 802.1Q encapsulation on its subinterfaces.

Step 4: Prepare the Router Physical Interface

Identify the router Ethernet interface connected to the switch. In this example, it is GigabitEthernet0/0.

In a standard ROAS deployment, the parent physical interface does not receive a regular IPv4 address. The IPv4 addresses are placed on its subinterfaces. The physical interface must be enabled, however. Use no shutdown where required.

Router> enable
Router# configure terminal
Router(config)# interface GigabitEthernet0/0
Router(config-if)# no ip address
Router(config-if)# no shutdown

Step 5: Create and Address Router Subinterfaces

Create one subinterface for each VLAN. The syntax is interface physical-interface.subinterface-number. Matching the suffix to the VLAN ID, such as .10 for VLAN 10, is a common convention. It makes the configuration easy to read, but the suffix itself does not have to match the VLAN ID.

Router(config)# interface GigabitEthernet0/0.10
Router(config-subif)# encapsulation dot1q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config-subif)# interface GigabitEthernet0/0.20
Router(config-subif)# encapsulation dot1q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0
Router(config-subif)# interface GigabitEthernet0/0.30
Router(config-subif)# encapsulation dot1q 30
Router(config-subif)# ip address 192.168.30.1 255.255.255.0
Router(config-subif)# end

Each subinterface address becomes the default gateway for hosts in its VLAN. The address and mask must belong to the same subnet as the hosts using that gateway.

Optional Native VLAN Configuration

The native VLAN is the VLAN whose frames are normally sent untagged on an 802.1Q trunk. Native VLAN configuration is not required for the basic ROAS lab. If a native VLAN is intentionally used, the switch and router must agree about its VLAN ID.

Router(config)# interface GigabitEthernet0/0.99
Router(config-subif)# encapsulation dot1q 99 native
Router(config-subif)# ip address 192.168.99.1 255.255.255.0

Use this only when the switch trunk is intentionally configured with VLAN 99 as its native VLAN and routed native-VLAN traffic is required. A native VLAN mismatch can cause unexpected traffic behavior.

Step 6: Configure Host IPv4 Settings

Assign each host an address from the subnet belonging to its VLAN. Configure the matching router subinterface address as the default gateway.

• VLAN 10 host: IP address 192.168.10.10, mask 255.255.255.0, gateway 192.168.10.1.
• VLAN 20 host: IP address 192.168.20.10, mask 255.255.255.0, gateway 192.168.20.1.
• VLAN 30 host: IP address 192.168.30.10, mask 255.255.255.0, gateway 192.168.30.1.

Each VLAN must use a separate IP subnet. A host uses its default gateway when the destination is outside the host's local subnet.

Verification and Testing

Verify the switch before testing routed communication. Confirm that the VLANs exist, access ports are assigned correctly, and the router uplink is carrying the required VLANs.

Test in stages. From the VLAN 10 host, first ping 192.168.10.1. Then ping 192.168.20.10 and 192.168.30.10. Repeat from hosts in the other VLANs when practical.

• If the local gateway ping succeeds but a different VLAN host ping fails, investigate the subinterfaces, routing table, remote host addressing, or remote host firewall.
• If the local gateway ping fails, investigate the host address and gateway, access-port VLAN, trunk, parent interface, and matching subinterface before testing inter-VLAN routing.
• If all connected routes appear on the router, the router has learned the directly connected VLAN subnets from the subinterface addresses.

Troubleshooting ROAS

Same-VLAN communication works, but inter-VLAN communication fails

• Check whether a subinterface exists for every required VLAN.
• Compare each encapsulation dot1q VLAN ID with the switch VLAN and allowed list.
• Check that every subinterface has the correct IPv4 address and mask.
• Confirm that each host uses the matching subinterface address as its default gateway.
• Use show ip interface brief and show ip route on the router.

One VLAN cannot reach its gateway

• Use show vlan brief to confirm that the VLAN exists and the host access port is assigned to it.
• Use show interfaces trunk to confirm that the VLAN is allowed and active on the router uplink.
• Verify that the corresponding router subinterface is present, addressed correctly, and operational.

Subinterfaces are down or line protocol is down

• Enable the parent router interface with no shutdown.
• Check the physical cable and link status.
• Confirm that the switch port connected to the router is not shut down.
• Verify that the switch uplink is operating as a trunk.

Traffic appears associated with the wrong VLAN

• Compare the switch trunk configuration with every router encapsulation dot1q value.
• Check whether a required VLAN was omitted from the trunk allowed list.
• If native VLAN traffic is being used, make sure the native VLAN setting matches on both devices.

A host cannot ping its own default gateway

• Validate the host IP address, subnet mask, and default gateway.
• Confirm that the host switch port is in the intended VLAN.
• Check that the router subinterface address is in the same subnet as the host.
• Check the switch uplink and router parent interface status.

Design Considerations and Limitations

ROAS is straightforward and economical because it uses one router interface and one switch uplink for several VLANs. It is well suited to small networks, practice labs, and environments with modest inter-VLAN traffic.

The main limitation is that all inter-VLAN traffic traverses the same physical router-to-switch link and is processed by the router. The link or router interface can become a bandwidth or processing bottleneck as traffic grows. A large number of VLANs or high-throughput workloads may require a different design.

A multilayer switch can perform inter-VLAN routing using switched virtual interfaces, commonly called SVIs. That approach generally keeps routing within the switch and can provide higher throughput and scalability. ROAS remains valuable when the available switch is Layer 2 only or when learning the underlying concepts.

Exam-Relevant Notes

• Access ports are for one VLAN; trunk ports carry multiple VLANs.
• The switch uplink uses trunk configuration, but the router uses subinterfaces with encapsulation dot1q.
• The parent physical router interface is enabled, while the VLAN gateway IP addresses are configured on subinterfaces.
• Each VLAN requires a matching router subinterface, 802.1Q VLAN ID, IPv4 subnet, and host default gateway.
• Matching subinterface suffixes to VLAN IDs is a useful naming convention, not a requirement.
• Successful host-to-gateway pings should be confirmed before interpreting failed inter-VLAN pings.

For a related configuration reference, see Configure Router On A Stick.