VLANs are great for segmenting a network, but at some point, devices in different VLANs need to talk to each other — and that’s where inter-VLAN routing comes in. One of the most classic methods for achieving this, especially in smaller networks or lab environments, is the “router-on-a-stick” design. I remember configuring this exact setup during my own CCNA studies, and it’s still something I use regularly when a dedicated Layer 3 switch isn’t available. In this guide, I’ll cover the concept from the ground up, then walk through the complete configuration, verification, and troubleshooting.
What Is Inter-VLAN Routing?
VLANs (Virtual LANs) segment a physical switch into multiple logical broadcast domains. Devices within the same VLAN can communicate directly at Layer 2, but devices in different VLANs are isolated from each other by design — this is one of the main benefits of VLANs, since it limits broadcast traffic and improves security through segmentation. However, isolation is only useful up to a point; eventually, a device in the Sales VLAN needs to reach a server in the Servers VLAN, and that requires Layer 3 routing between VLANs.
Inter-VLAN routing can be achieved a few different ways:
- Router-on-a-stick – a single physical router interface, subdivided into logical subinterfaces using 802.1Q trunking, handles routing for multiple VLANs
- Multiple physical interfaces – one router interface per VLAN (rarely used today due to inefficiency)
- Layer 3 switching – using switch virtual interfaces (SVIs) on a multilayer switch, which is the modern enterprise standard, but requires more expensive hardware
This guide focuses on router-on-a-stick, since it remains extremely common in smaller networks, branch offices, and lab/certification study environments.
How Router-on-a-Stick Works
The core idea is that a single physical router interface is divided into multiple logical subinterfaces, each associated with a specific VLAN via 802.1Q trunk encapsulation. The switch port connecting to the router is configured as a trunk port, carrying tagged traffic for all relevant VLANs over the single physical link.
Packet flow for inter-VLAN traffic:
- Host in VLAN 10 sends a packet destined for a host in VLAN 20.
- Switch forwards the frame toward its default gateway (the router subinterface for VLAN 10), tagging it with VLAN 10 as it crosses the trunk link.
- Router receives the tagged frame on its VLAN 10 subinterface, strips the tag, and examines the Layer 3 destination.
- Router determines the destination is in VLAN 20, and forwards the packet out its VLAN 20 subinterface, re-tagging it with VLAN 20.
- Switch receives the tagged frame on the trunk, removes the tag, and forwards it to the destination host in VLAN 20 access port.
graph LR
A[Host VLAN 10] --> B[Switch]
C[Host VLAN 20] --> B
B <-->|802.1Q Trunk| D[Router Subinterfaces]
D -->|Gi0/0.10| A
D -->|Gi0/0.20| C
Lab Topology
[PC-A VLAN10 10.10.10.10/24] --- [Switch SW1] --- G0/0 [Router R1]
[PC-B VLAN20 10.10.20.10/24] --- [Switch SW1]
- VLAN 10: Sales, 10.10.10.0/24
- VLAN 20: Servers, 10.10.20.0/24
- Trunk link between SW1 and R1’s G0/0 interface
Step 1: Configure VLANs on the Switch
SW1> enable
SW1# configure terminal
SW1(config)# vlan 10
SW1(config-vlan)# name SALES
SW1(config-vlan)# exit
SW1(config)# vlan 20
SW1(config-vlan)# name SERVERS
SW1(config-vlan)# exit
Assign access ports:
SW1(config)# interface FastEthernet0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# exit
SW1(config)# interface FastEthernet0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 20
SW1(config-if)# exit
Step 2: Configure the Trunk Port on the Switch
SW1(config)# interface FastEthernet0/24
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20
SW1(config-if)# exit
Step 3: Configure Subinterfaces on the Router
Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface GigabitEthernet0/0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 10.10.10.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface GigabitEthernet0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 10.10.20.1 255.255.255.0
R1(config-subif)# exit
Each subinterface represents the default gateway for its respective VLAN. Note that encapsulation dot1Q 10 must match the VLAN ID exactly, and the physical parent interface (GigabitEthernet0/0) itself does not need an IP address in this design, only no shutdown.
Handling the Native VLAN
If your trunk uses a native VLAN (untagged traffic, typically VLAN 1 by default), you can configure a subinterface for it using the native keyword:
R1(config)# interface GigabitEthernet0/0.1
R1(config-subif)# encapsulation dot1Q 1 native
R1(config-subif)# ip address 10.10.1.1 255.255.255.0
It’s best practice to change the native VLAN away from VLAN 1 on both the switch trunk and router subinterface for security reasons, which I cover below.
Step 4: Configure Default Gateways on End Hosts
Each host’s default gateway should point to its respective router subinterface IP:
- PC-A (VLAN 10): default gateway 10.10.10.1
- PC-B (VLAN 20): default gateway 10.10.20.1
Verification
R1# show ip interface brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 unassigned YES manual up up
GigabitEthernet0/0.10 10.10.10.1 YES manual up up
GigabitEthernet0/0.20 10.10.20.1 YES manual up up
R1# show ip route connected
C 10.10.10.0/24 is directly connected, GigabitEthernet0/0.10
C 10.10.20.0/24 is directly connected, GigabitEthernet0/0.20
R1# show vlans
SW1# show interfaces trunk
Port Mode Encapsulation Status Native vlan
Fa0/24 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/24 10,20
From PC-A, testing connectivity to PC-B:
C:\> ping 10.10.20.10
Reply from 10.10.20.10: bytes=32 time=2ms TTL=127
Reply from 10.10.20.10: bytes=32 time=1ms TTL=127
The TTL of 127 (instead of 128, which you’d see for a same-subnet ping from a Windows host) confirms the packet crossed a router hop, exactly as expected for inter-VLAN traffic.
Real-World Enterprise Scenario
Router-on-a-stick is most commonly deployed in small branch offices or lab environments where a Layer 3 switch isn’t available or isn’t cost-justified for the traffic volume involved. A typical real-world case: a small branch office with three VLANs — Staff, Guest Wi-Fi, and VoIP phones — connected through an access switch trunked to a single branch router that also handles the WAN uplink. Since branch traffic volume is relatively low, the router-on-a-stick design avoids the cost of a multilayer switch while still providing full inter-VLAN connectivity and a single point for applying ACLs and QoS policies between VLANs.
In larger enterprise campus environments, this design is generally replaced by SVIs on Layer 3 switches, since router-on-a-stick becomes a bandwidth bottleneck when VLAN-to-VLAN traffic volumes grow — the entire inter-VLAN traffic load is squeezed through the single trunk link to the router.
Security Considerations
- Change the native VLAN away from the default VLAN 1 on trunk links, to protect against VLAN hopping attacks:
SW1(config-if)# switchport trunk native vlan 999
- Explicitly prune unused VLANs from trunk links using
switchport trunk allowed vlanrather than allowing all VLANs by default. - Apply ACLs on router subinterfaces to control traffic between VLANs where segmentation policy requires it — for example, restricting the Guest VLAN from reaching internal Staff or Servers VLANs:
R1(config)# ip access-list extended GUEST-RESTRICT
R1(config-ext-nacl)# deny ip 10.10.30.0 0.0.0.255 10.10.10.0 0.0.0.255
R1(config-ext-nacl)# deny ip 10.10.30.0 0.0.0.255 10.10.20.0 0.0.0.255
R1(config-ext-nacl)# permit ip any any
R1(config)# interface GigabitEthernet0/0.30
R1(config-subif)# ip access-group GUEST-RESTRICT in
- Disable unused switch ports and place them in an unused VLAN to prevent unauthorized device connections.
- Enable DHCP snooping and Dynamic ARP Inspection on the switch if VLANs carry sensitive traffic, to mitigate spoofing attacks.
Best Practices
- Keep VLAN numbering and subnet addressing consistent and documented (e.g., VLAN 10 = 10.10.10.0/24) for easier troubleshooting.
- Use descriptive VLAN names (
SALES,SERVERS) rather than leaving them as default names. - Limit the trunk to only the VLANs actually required using
switchport trunk allowed vlan. - For any network expecting significant inter-VLAN traffic growth, plan a migration path to Layer 3 switching with SVIs rather than scaling router-on-a-stick indefinitely.
- Document subinterface-to-VLAN mappings clearly in your network diagrams and change management records.
Optimization and Performance Tuning
- Router-on-a-stick is inherently bandwidth-limited by the single physical trunk link; if you observe congestion, monitor with
show interfaces GigabitEthernet0/0for output drops or high utilization. - Consider link aggregation (EtherChannel) between the switch and router if a single link becomes a consistent bottleneck, though note that a single router’s forwarding capacity is still the ultimate ceiling.
- For latency-sensitive traffic like VoIP, apply QoS marking and prioritization on the trunk link to avoid inter-VLAN voice traffic being delayed behind bulk data transfers.
- If traffic volume between VLANs continues to grow, this is the clearest signal it’s time to migrate to a Layer 3 switch design instead of continuing to scale a single router interface.
Troubleshooting and Common Configuration Mistakes
Mistake 1: Mismatched encapsulation VLAN ID If the subinterface’s encapsulation dot1Q number doesn’t match the VLAN configured on the switch, traffic will silently fail to route.
Mistake 2: Physical interface left administratively down Subinterfaces will not pass traffic if the parent physical interface itself is shut down — always confirm no shutdown on the physical interface, not just the subinterfaces.
Mistake 3: Switch port not configured as trunk If the switch port connecting to the router remains in access mode, VLAN tagging will not occur, and inter-VLAN routing will fail entirely.
Mistake 4: VLAN not allowed on the trunk If switchport trunk allowed vlan explicitly excludes a VLAN, that VLAN’s traffic will be dropped at the trunk even if everything else is configured correctly.
Mistake 5: Wrong default gateway on end hosts Hosts pointing to the wrong subinterface IP as their gateway will be unable to reach other VLANs, even though the router itself is configured correctly.
Useful troubleshooting commands:
R1# show ip interface brief
R1# show interfaces GigabitEthernet0/0.10
R1# show ip route
SW1# show interfaces trunk
SW1# show vlan brief
SW1# show interfaces status
Frequently Asked Questions
Q: What is the difference between router-on-a-stick and Layer 3 switching? Router-on-a-stick uses a single physical router interface with logical subinterfaces to route between VLANs over a trunk link, while Layer 3 switching uses switch virtual interfaces (SVIs) directly on a multilayer switch, offering much higher throughput since routing happens in hardware at wire speed.
Q: Can I use router-on-a-stick with more than two VLANs? Yes, you can create as many subinterfaces as needed, each with a unique encapsulation dot1Q VLAN ID and its own IP subnet, all sharing the single physical trunk link.
Q: Does the physical router interface need an IP address? No, in a router-on-a-stick configuration, the physical parent interface typically has no IP address; only the subinterfaces are assigned IP addresses.
Q: Why is router-on-a-stick considered less scalable than Layer 3 switching? Because all inter-VLAN traffic must traverse the single physical trunk link and be processed by the router’s forwarding capacity, which becomes a bottleneck as traffic volume grows, unlike Layer 3 switches which route in dedicated hardware (ASICs) at line rate.
Q: What VLAN ID should I avoid using as my native VLAN? Avoid using VLAN 1 as your native VLAN in production networks, since it is the default on most switches and is a common target for VLAN hopping attacks; use a dedicated, non-default VLAN instead.
Summary and Key Takeaways
Router-on-a-stick remains a practical and widely used method for inter-VLAN routing, especially in smaller networks, branch offices, and certification labs where a Layer 3 switch isn’t available. The design relies on 802.1Q trunk encapsulation between the switch and a single router interface, subdivided logically into subinterfaces, each acting as the default gateway for its VLAN. While it’s not the most scalable solution for high-traffic enterprise campuses, understanding this configuration thoroughly — including trunk setup, subinterface encapsulation, native VLAN handling, and security hardening — is essential groundwork before moving on to Layer 3 switching designs.
References
- Cisco Configuring InterVLAN Routing: https://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/41860-howto-L3-intervlanrouting.html
- Cisco IOS LAN Switching Configuration Guide: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/lanswitch/configuration/xe-16/lanswitch-xe-16-book.html
