Offensive Security Researcher & Quantum Cryptography Analyst

How to Configure Inter-VLAN Routing on a Cisco Router: Router-on-a-Stick Setup Guide

Abdul Wahab Junaid
How to Configure Inter-VLAN Routing on a Cisco Router

How to Configure Inter-VLAN Routing on a Cisco Router

VLANs are great for segmenting a network, but at some point, devices in different VLANs need to talk to each other — and that’s where inter-VLAN routing comes in. One of the most classic methods for achieving this, especially in smaller networks or lab environments, is the “router-on-a-stick” design. I remember configuring this exact setup during my own CCNA studies, and it’s still something I use regularly when a dedicated Layer 3 switch isn’t available. In this guide, I’ll cover the concept from the ground up, then walk through the complete configuration, verification, and troubleshooting.

What Is Inter-VLAN Routing?

VLANs (Virtual LANs) segment a physical switch into multiple logical broadcast domains. Devices within the same VLAN can communicate directly at Layer 2, but devices in different VLANs are isolated from each other by design — this is one of the main benefits of VLANs, since it limits broadcast traffic and improves security through segmentation. However, isolation is only useful up to a point; eventually, a device in the Sales VLAN needs to reach a server in the Servers VLAN, and that requires Layer 3 routing between VLANs.

Inter-VLAN routing can be achieved a few different ways:

This guide focuses on router-on-a-stick, since it remains extremely common in smaller networks, branch offices, and lab/certification study environments.

How Router-on-a-Stick Works

The core idea is that a single physical router interface is divided into multiple logical subinterfaces, each associated with a specific VLAN via 802.1Q trunk encapsulation. The switch port connecting to the router is configured as a trunk port, carrying tagged traffic for all relevant VLANs over the single physical link.

Packet flow for inter-VLAN traffic:

  1. Host in VLAN 10 sends a packet destined for a host in VLAN 20.
  2. Switch forwards the frame toward its default gateway (the router subinterface for VLAN 10), tagging it with VLAN 10 as it crosses the trunk link.
  3. Router receives the tagged frame on its VLAN 10 subinterface, strips the tag, and examines the Layer 3 destination.
  4. Router determines the destination is in VLAN 20, and forwards the packet out its VLAN 20 subinterface, re-tagging it with VLAN 20.
  5. Switch receives the tagged frame on the trunk, removes the tag, and forwards it to the destination host in VLAN 20 access port.
graph LR
    A[Host VLAN 10] --> B[Switch]
    C[Host VLAN 20] --> B
    B <-->|802.1Q Trunk| D[Router Subinterfaces]
    D -->|Gi0/0.10| A
    D -->|Gi0/0.20| C

Lab Topology

[PC-A VLAN10 10.10.10.10/24] --- [Switch SW1] --- G0/0 [Router R1]
[PC-B VLAN20 10.10.20.10/24] --- [Switch SW1]

Step 1: Configure VLANs on the Switch

SW1> enable
SW1# configure terminal
SW1(config)# vlan 10
SW1(config-vlan)# name SALES
SW1(config-vlan)# exit
SW1(config)# vlan 20
SW1(config-vlan)# name SERVERS
SW1(config-vlan)# exit

Assign access ports:

SW1(config)# interface FastEthernet0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# exit

SW1(config)# interface FastEthernet0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 20
SW1(config-if)# exit

Step 2: Configure the Trunk Port on the Switch

SW1(config)# interface FastEthernet0/24
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20
SW1(config-if)# exit

Step 3: Configure Subinterfaces on the Router

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface GigabitEthernet0/0
R1(config-if)# no shutdown
R1(config-if)# exit

R1(config)# interface GigabitEthernet0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 10.10.10.1 255.255.255.0
R1(config-subif)# exit

R1(config)# interface GigabitEthernet0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 10.10.20.1 255.255.255.0
R1(config-subif)# exit

Each subinterface represents the default gateway for its respective VLAN. Note that encapsulation dot1Q 10 must match the VLAN ID exactly, and the physical parent interface (GigabitEthernet0/0) itself does not need an IP address in this design, only no shutdown.

Handling the Native VLAN

If your trunk uses a native VLAN (untagged traffic, typically VLAN 1 by default), you can configure a subinterface for it using the native keyword:

R1(config)# interface GigabitEthernet0/0.1
R1(config-subif)# encapsulation dot1Q 1 native
R1(config-subif)# ip address 10.10.1.1 255.255.255.0

It’s best practice to change the native VLAN away from VLAN 1 on both the switch trunk and router subinterface for security reasons, which I cover below.

Step 4: Configure Default Gateways on End Hosts

Each host’s default gateway should point to its respective router subinterface IP:

Verification

R1# show ip interface brief
Interface                  IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0         unassigned      YES manual up                    up
GigabitEthernet0/0.10      10.10.10.1      YES manual up                    up
GigabitEthernet0/0.20      10.10.20.1      YES manual up                    up

R1# show ip route connected
C    10.10.10.0/24 is directly connected, GigabitEthernet0/0.10
C    10.10.20.0/24 is directly connected, GigabitEthernet0/0.20

R1# show vlans

SW1# show interfaces trunk
Port        Mode             Encapsulation  Status        Native vlan
Fa0/24      on               802.1q         trunking      1

Port        Vlans allowed on trunk
Fa0/24      10,20

From PC-A, testing connectivity to PC-B:

C:\> ping 10.10.20.10

Reply from 10.10.20.10: bytes=32 time=2ms TTL=127
Reply from 10.10.20.10: bytes=32 time=1ms TTL=127

The TTL of 127 (instead of 128, which you’d see for a same-subnet ping from a Windows host) confirms the packet crossed a router hop, exactly as expected for inter-VLAN traffic.

Real-World Enterprise Scenario

Router-on-a-stick is most commonly deployed in small branch offices or lab environments where a Layer 3 switch isn’t available or isn’t cost-justified for the traffic volume involved. A typical real-world case: a small branch office with three VLANs — Staff, Guest Wi-Fi, and VoIP phones — connected through an access switch trunked to a single branch router that also handles the WAN uplink. Since branch traffic volume is relatively low, the router-on-a-stick design avoids the cost of a multilayer switch while still providing full inter-VLAN connectivity and a single point for applying ACLs and QoS policies between VLANs.

In larger enterprise campus environments, this design is generally replaced by SVIs on Layer 3 switches, since router-on-a-stick becomes a bandwidth bottleneck when VLAN-to-VLAN traffic volumes grow — the entire inter-VLAN traffic load is squeezed through the single trunk link to the router.

Security Considerations

SW1(config-if)# switchport trunk native vlan 999

R1(config)# ip access-list extended GUEST-RESTRICT
R1(config-ext-nacl)# deny ip 10.10.30.0 0.0.0.255 10.10.10.0 0.0.0.255
R1(config-ext-nacl)# deny ip 10.10.30.0 0.0.0.255 10.10.20.0 0.0.0.255
R1(config-ext-nacl)# permit ip any any
R1(config)# interface GigabitEthernet0/0.30
R1(config-subif)# ip access-group GUEST-RESTRICT in

Best Practices

Optimization and Performance Tuning

Troubleshooting and Common Configuration Mistakes

Mistake 1: Mismatched encapsulation VLAN ID If the subinterface’s encapsulation dot1Q number doesn’t match the VLAN configured on the switch, traffic will silently fail to route.

Mistake 2: Physical interface left administratively down Subinterfaces will not pass traffic if the parent physical interface itself is shut down — always confirm no shutdown on the physical interface, not just the subinterfaces.

Mistake 3: Switch port not configured as trunk If the switch port connecting to the router remains in access mode, VLAN tagging will not occur, and inter-VLAN routing will fail entirely.

Mistake 4: VLAN not allowed on the trunk If switchport trunk allowed vlan explicitly excludes a VLAN, that VLAN’s traffic will be dropped at the trunk even if everything else is configured correctly.

Mistake 5: Wrong default gateway on end hosts Hosts pointing to the wrong subinterface IP as their gateway will be unable to reach other VLANs, even though the router itself is configured correctly.

Useful troubleshooting commands:

R1# show ip interface brief
R1# show interfaces GigabitEthernet0/0.10
R1# show ip route
SW1# show interfaces trunk
SW1# show vlan brief
SW1# show interfaces status

Frequently Asked Questions

Q: What is the difference between router-on-a-stick and Layer 3 switching? Router-on-a-stick uses a single physical router interface with logical subinterfaces to route between VLANs over a trunk link, while Layer 3 switching uses switch virtual interfaces (SVIs) directly on a multilayer switch, offering much higher throughput since routing happens in hardware at wire speed.

Q: Can I use router-on-a-stick with more than two VLANs? Yes, you can create as many subinterfaces as needed, each with a unique encapsulation dot1Q VLAN ID and its own IP subnet, all sharing the single physical trunk link.

Q: Does the physical router interface need an IP address? No, in a router-on-a-stick configuration, the physical parent interface typically has no IP address; only the subinterfaces are assigned IP addresses.

Q: Why is router-on-a-stick considered less scalable than Layer 3 switching? Because all inter-VLAN traffic must traverse the single physical trunk link and be processed by the router’s forwarding capacity, which becomes a bottleneck as traffic volume grows, unlike Layer 3 switches which route in dedicated hardware (ASICs) at line rate.

Q: What VLAN ID should I avoid using as my native VLAN? Avoid using VLAN 1 as your native VLAN in production networks, since it is the default on most switches and is a common target for VLAN hopping attacks; use a dedicated, non-default VLAN instead.

Summary and Key Takeaways

Router-on-a-stick remains a practical and widely used method for inter-VLAN routing, especially in smaller networks, branch offices, and certification labs where a Layer 3 switch isn’t available. The design relies on 802.1Q trunk encapsulation between the switch and a single router interface, subdivided logically into subinterfaces, each acting as the default gateway for its VLAN. While it’s not the most scalable solution for high-traffic enterprise campuses, understanding this configuration thoroughly — including trunk setup, subinterface encapsulation, native VLAN handling, and security hardening — is essential groundwork before moving on to Layer 3 switching designs.

References

Exit mobile version