Diagnosing a Broken Router-on-a-Stick

Bundle lab

Advanced CCNA troubleshooting lab on a router-on-a-stick design. VLAN 10 users can reach their gateway and other hosts, but VLAN 20 users cannot reach their gateway or any resources in VLAN 10. Methodically trace L2/L3 intent end-to-end - from the access ports through the trunks up to the router subinterfaces - to isolate the first-hop failure and implement fixes that restore inter-VLAN routing while maintaining enterprise trunk hardening and clean configurations.

Learning objectives

• Correlate endpoint symptoms to L2/L3 design intent in a router-on-a-stick topology
• Identify and correct a dot1Q tag mismatch on a router subinterface
• Identify and correct a trunk allowed VLAN list that omits a required VLAN
• Verify inter-VLAN reachability using Linux hosts and IOS show commands
• Develop a systematic troubleshooting flow from endpoint failure back to infrastructure

Troubleshooting focus

• If PC-B still cannot reach 10.10.20.1: Check the access port for PC-B is in VLAN 20 and is up/up.; Verify the access-to-core trunk carries every VLAN required by the design and that native VLANs match across the link.; Confirm each router subinterface's 802.1Q encapsulation tag and IP address match its intended VLAN and the gateway plan.
• If pings work one way but not the other: Ensure you are testing from hosts (not sourcing pings from the router). Host-sourced tests validate ARP and both directions of forwarding.
• If trunk shows inconsistent native VLAN: Align native VLANs and keep them off host access ports. Ensure user VLANs are not configured as native.
• If you see ARP timeouts on PC-B for the gateway: Re-examine the full path — access port, trunk configuration, and router subinterface — for any mismatch; ARP relies on an intact VLAN/tag path from host to gateway.