Goldfish Networks wordmark
IntermediatePublished 2026-07-01

Inter-VLAN Routing: Router-on-a-Stick Across a Branch

Archive lab

Deploy router-on-a-stick inter-VLAN routing across a compact branch topology with a distribution and access switch, a hardened 802.1Q trunk, and two user VLANs. Configure VLANs and access/trunk ports, build router subinterfaces, verify end-to-end user reachability, and troubleshoot trunk/native-VLAN/subinterface mismatches.

Track
Est. time
55 minutes
Difficulty
Intermediate
Topics

Learning objectives

  • Configure VLANs and access/trunk ports on Layer 2 switches with hardened 802.1Q trunks.
  • Configure router subinterfaces for router-on-a-stick inter-VLAN routing.
  • Assign hosts to different VLANs and verify inter-VLAN connectivity.
  • Verify connected routes and VLAN/trunk interface status.
  • Troubleshoot inter-VLAN routing and trunking misconfigurations.

Troubleshooting focus

  • A host cannot ping its own gateway (ping 10.10.10.1 or ping 10.20.20.1): its access port is in the wrong VLAN.
  • Gateways answer but PC-USER10 and PC-FIN20 cannot reach each other: a VLAN is missing from a trunk allow-list.
  • Untagged frames drop and control-plane behaviour is erratic: native VLAN mismatch.
  • One VLAN fails to route while the others work: the subinterface tag does not match the switch VLAN ID.
  • A host reaches its own subnet but nothing beyond it: its default gateway must be the router subinterface for its VLAN — 10.10.10.1 for PC-USER10, 10.20.20.1 for PC-FIN20.
  • Replies are intermittent or an address is reported duplicate: only the router owns.1 in each VLAN and each host owns.10. Fix the collision before chasing routing.
  • Nothing passes even though the config looks complete: it is on ports that are not cabled. RTR-BR-EDGE1 Ethernet0/0; SW-BR-DIST1 Ethernet0/0 to the router, Ethernet0/2 to SW-BR-ACC1, Ethernet0/1 to PC-USER10; SW-BR-ACC1 Ethernet0/0 and Ethernet0/1 to PC-FIN20.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.