Three-VLAN Router-on-a-Stick: Build, Harden & Verify

Bundle lab

Build and verify a three-VLAN router-on-a-stick design: one IOS router provides inter-VLAN routing via 802.1Q subinterfaces to a single Layer-2 access switch, with three Alpine hosts in VLANs 10, 20, and 30. The starter environment does not yet forward traffic correctly between all three VLANs, so you will apply a disciplined router-switch-host verification method to diagnose and fix the problem, then briefly break and restore one VLAN's connectivity before finishing with an enterprise-clean, hardened trunk.

Learning objectives

• Configure inter-VLAN routing using router-on-a-stick (ROAS) on a single IOS router.
• Assign access ports to VLANs 10, 20, and 30 on an L2 switch and trunk all routed VLANs to the router.
• Apply trunk hardening: dot1Q, explicit allowed VLANs, native VLAN 999, and nonegotiate.
• Use a disciplined cross-device verification checklist (router, switch, hosts) to prove forwarding.
• Diagnose and resolve faults caused by an incorrect trunk allow-list and an incorrect host VLAN assignment.

Troubleshooting focus

• Trace end-to-end failures from the host perspective; confirm where traffic first fails.
• Correlate router subinterfaces and IP gateways to switch VLAN membership and trunk state.
• Identify and correct switch trunk allow-list omissions that strand a VLAN.
• Identify and correct an access port in the wrong VLAN.