VLANs separate a switch into isolated broadcast domains, which is great for security and performance, but it also means PCs in different VLA...
VLANs separate a switch into isolated broadcast domains, which is great for security and performance, but it also means PCs in different VLANs cannot talk to each other on their own. In this lab you will build router-on-a-stick in Cisco Packet Tracer 8.x: one router, one physical link, and a subinterface for each VLAN that routes traffic between them. It is a classic CCNA topic and a design you will still find in small offices.
Prefer video? Watch more hands-on labs on the Technical Hakim YouTube channel.
How router-on-a-stick works
The switch port that connects to the router is configured as an 802.1Q trunk. Every frame that crosses that link carries a VLAN tag. On the router, the single physical interface is split into logical subinterfaces, for example GigabitEthernet0/0.10 for VLAN 10 and GigabitEthernet0/0.20 for VLAN 20. Each subinterface is told which VLAN tag it belongs to and gets an IP address that acts as the default gateway for that VLAN.
When PC1 in VLAN 10 sends a packet to PC3 in VLAN 30, the frame goes up the trunk tagged with VLAN 10, the router receives it on subinterface .10, routes it, and sends it back down the same trunk tagged with VLAN 30. The traffic goes up and down the same "stick", which is where the name comes from.
Lab topology
Devices used in Packet Tracer:
- 1 x Cisco 2911 router (R1)
- 1 x Cisco 2960-24TT switch (SW1)
- 3 x PCs (PC1, PC2, PC3)
Connect R1 GigabitEthernet0/0 to SW1 GigabitEthernet0/1 with a copper straight-through cable. Connect each PC's FastEthernet0 to the switch port listed below.
Addressing table
| Device | Interface | VLAN | IP address | Subnet mask | Default gateway |
|---|---|---|---|---|---|
| R1 | G0/0.10 | 10 (SALES) | 192.168.10.1 | 255.255.255.0 | N/A |
| R1 | G0/0.20 | 20 (HR) | 192.168.20.1 | 255.255.255.0 | N/A |
| R1 | G0/0.30 | 30 (IT) | 192.168.30.1 | 255.255.255.0 | N/A |
| PC1 | SW1 Fa0/1 | 10 | 192.168.10.10 | 255.255.255.0 | 192.168.10.1 |
| PC2 | SW1 Fa0/2 | 20 | 192.168.20.10 | 255.255.255.0 | 192.168.20.1 |
| PC3 | SW1 Fa0/3 | 30 | 192.168.30.10 | 255.255.255.0 | 192.168.30.1 |
Set the PC addresses under Desktop > IP Configuration on each PC. The default gateway is the important part: it must match the router subinterface for that VLAN.
Step 1: Create VLANs and access ports on SW1
Switch> enable
Switch# configure terminal
Switch(config)# hostname SW1
SW1(config)# vlan 10
SW1(config-vlan)# name SALES
SW1(config-vlan)# vlan 20
SW1(config-vlan)# name HR
SW1(config-vlan)# vlan 30
SW1(config-vlan)# name IT
SW1(config-vlan)# exit
SW1(config)# interface fastEthernet 0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# interface fastEthernet 0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 20
SW1(config-if)# interface fastEthernet 0/3
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 30
SW1(config-if)# exitvlan 10 creates the VLAN in the switch's VLAN database and name SALES gives it a readable label. switchport mode access forces the port to be a non-trunk port so it never negotiates trunking with whatever is plugged in. switchport access vlan 10 places the port into VLAN 10.
Step 2: Configure the trunk to the router
SW1(config)# interface gigabitEthernet 0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20,30
SW1(config-if)# end
SW1# copy running-config startup-configswitchport mode trunk makes Gi0/1 a permanent 802.1Q trunk. The 2960 only supports 802.1Q, so you do not need (and cannot enter) a switchport trunk encapsulation command on it. If you build this lab with a 3560 multilayer switch instead, you must enter switchport trunk encapsulation dot1q before switchport mode trunk.
switchport trunk allowed vlan 10,20,30 is optional, but I recommend it. Limiting the trunk to the VLANs the router actually routes is cleaner and keeps unnecessary broadcasts off the link.
Step 3: Configure subinterfaces on R1
Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface gigabitEthernet 0/0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface gigabitEthernet 0/0.10
R1(config-subif)# description Gateway for VLAN 10 SALES
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface gigabitEthernet 0/0.20
R1(config-subif)# description Gateway for VLAN 20 HR
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface gigabitEthernet 0/0.30
R1(config-subif)# description Gateway for VLAN 30 IT
R1(config-subif)# encapsulation dot1Q 30
R1(config-subif)# ip address 192.168.30.1 255.255.255.0
R1(config-subif)# end
R1# copy running-config startup-configImportant points about these commands:
no shutdownon the physical interface. Subinterfaces inherit the state of the parent interface. If G0/0 is shut down, every subinterface stays down no matter what you do on them.encapsulation dot1Q 10tells the subinterface to accept frames tagged with VLAN 10 and to tag outgoing frames with VLAN 10. This command must come beforeip address; IOS will refuse the IP address on a subinterface that has no encapsulation configured.- The subinterface number (.10) does not have to match the VLAN ID, but matching them makes troubleshooting much easier. The
encapsulation dot1Qvalue is what actually matters. - Do not put an IP address on the physical G0/0 interface itself in this design.
Step 4: Verify
Check the router interfaces
R1# show ip interface brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 unassigned YES unset up up
GigabitEthernet0/0.10 192.168.10.1 YES manual up up
GigabitEthernet0/0.20 192.168.20.1 YES manual up up
GigabitEthernet0/0.30 192.168.30.1 YES manual up up
GigabitEthernet0/1 unassigned YES unset administratively down down
GigabitEthernet0/2 unassigned YES unset administratively down down
Vlan1 unassigned YES unset administratively down downAll three subinterfaces should be up/up. The physical interface shows no IP address, which is correct.
Check the routing table
R1# show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is not set
192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.10.0/24 is directly connected, GigabitEthernet0/0.10
L 192.168.10.1/32 is directly connected, GigabitEthernet0/0.10
192.168.20.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.20.0/24 is directly connected, GigabitEthernet0/0.20
L 192.168.20.1/32 is directly connected, GigabitEthernet0/0.20
192.168.30.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.30.0/24 is directly connected, GigabitEthernet0/0.30
L 192.168.30.1/32 is directly connected, GigabitEthernet0/0.30Each VLAN appears as a connected (C) network plus a local (L) /32 route for the router's own address. Because all three networks are directly connected, no routing protocol or static route is needed for inter-VLAN traffic.
Check the switch
SW1# show interfaces trunk
Port Mode Encapsulation Status Native vlan
Gig0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Gig0/1 10,20,30
Port Vlans allowed and active in management domain
Gig0/1 10,20,30
Port Vlans in spanning tree forwarding state and not pruned
Gig0/1 10,20,30Status must say trunking. If the port is missing from this output completely, it is not a trunk. Then confirm the access ports:
SW1# show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/4, Fa0/5, Fa0/6, Fa0/7
Fa0/8, Fa0/9, Fa0/10, Fa0/11
Fa0/12, Fa0/13, Fa0/14, Fa0/15
Fa0/16, Fa0/17, Fa0/18, Fa0/19
Fa0/20, Fa0/21, Fa0/22, Fa0/23
Fa0/24, Gig0/2
10 SALES active Fa0/1
20 HR active Fa0/2
30 IT active Fa0/3
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active Trunk ports never appear in show vlan brief, so do not worry that Gig0/1 is missing here.
Test from the PCs
From PC1, open Desktop > Command Prompt and ping PC3 in VLAN 30:
C:\>ping 192.168.30.10
Pinging 192.168.30.10 with 32 bytes of data:
Request timed out.
Reply from 192.168.30.10: bytes=32 time<1ms TTL=127
Reply from 192.168.30.10: bytes=32 time<1ms TTL=127
Reply from 192.168.30.10: bytes=32 time<1ms TTL=127
Ping statistics for 192.168.30.10:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0msThe first timeout is normal; it is ARP resolution on both sides. The TTL of 127 (one less than the PC default of 128) proves the packet crossed one router. A tracert confirms the path:
C:\>tracert 192.168.30.10
Tracing route to 192.168.30.10 over a maximum of 30 hops:
1 0 ms 0 ms 0 ms 192.168.10.1
2 0 ms 0 ms 0 ms 192.168.30.10
Trace complete.Common mistakes
- Physical interface left shut down. Every subinterface shows "administratively down" until you run
no shutdownon G0/0 itself. - Wrong VLAN in
encapsulation dot1Q. If subinterface .20 saysencapsulation dot1Q 30, the HR VLAN has no working gateway even though the interface is up/up. - Switch port to the router left as access. If Gi0/1 is an access port in VLAN 1, the router sees untagged frames only and none of the subinterfaces receive traffic.
- Missing or wrong default gateway on the PC. PCs in the same VLAN will still ping each other, which hides the problem until you test across VLANs.
- VLAN not created on the switch. If you assign a port with
switchport access vlan 30before creating VLAN 30, the 2960 prints "% Access VLAN does not exist. Creating vlan 30" and creates it without a name. But a VLAN that is only listed on the trunk and never created will not appear under "Vlans allowed and active in management domain", and its traffic will not cross the trunk. Always checkshow vlan brief. - VLAN removed from the allowed list. Typing
switchport trunk allowed vlan 40later replaces the whole list. Useswitchport trunk allowed vlan add 40instead.
Summary
Router-on-a-stick needs three pieces: VLANs and access ports on the switch, an 802.1Q trunk from the switch to the router, and one router subinterface per VLAN with encapsulation dot1Q and the gateway IP. Verify with show ip interface brief, show ip route, show interfaces trunk and a cross-VLAN ping. The design is simple and cheap, but all inter-VLAN traffic shares one link, so larger networks usually move to a Layer 3 switch with SVIs.
Related tutorials
- Trunking and 802.1Q on Cisco Switches: Configs and Common Errors
- Subnetting Made Simple: /24 to /30 with Worked Examples
- DHCP Server on a Cisco Router plus DHCP Relay (ip helper-address)
- Basic Cisco Router Setup: Hostname, Passwords, Banner and SSH
Sources
- IEEE 802.1Q, Bridges and Bridged Networks (VLAN tagging standard)
- Cisco Catalyst 2960 Switch Software Configuration Guide, chapter on configuring VLANs and VLAN trunks
- Cisco IOS LAN Switching Configuration Guide, routing between VLANs with 802.1Q encapsulation
No comments