Goldfish Networks wordmark
IntermediatePublished 2026-06-30

Multi-Dept Campus Inter-VLAN with Router-on-a-Stick

Bundle lab

Design and implement a three-department campus edge using a single router-on-a-stick to provide inter-VLAN routing for Sales (VLAN 10), Engineering (VLAN 20), and Servers (VLAN 30). Map the addressing plan directly to router subinterfaces and build an 802.1Q trunk on the access switch. Verify end-to-end reachability and troubleshoot an allow-list drift scenario.

Track
Est. time
55 minutes
Difficulty
Intermediate
Topics

Learning objectives

  • Translate a departmental IP addressing plan into one router-on-a-stick subinterface per VLAN.
  • Configure an 802.1Q trunk between a router and a Layer-2 access switch without using SVIs.
  • Create VLANs and assign host-facing access ports on a Layer-2 switch.
  • Verify inter-VLAN reachability from end hosts and validate device state with IOS show commands.
  • Diagnose and correct trunk allow-list drift and confirm the native VLAN posture.

Troubleshooting focus

  • ping 172.16.30.10 from PC-SALES or PC-ENG gets no reply: check VLAN 30 is in the trunk allow-list with show interfaces trunk, and SRV-APP01's port Ethernet0/3 is in VLAN 30.
  • A tag mismatch breaks only that VLAN.
  • The trunk is up but nothing routes: confirm the router's physical Ethernet0/0 is no shutdown and carries the subinterfaces, and the switch has no SVIs or ip routing.
  • Native VLAN mismatch warnings appear: the trunk native VLAN must be 999 on the switch, and the router must not expect a native subinterface.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn VLANs, Trunking & Inter-VLAN RoutingWhat Is a VLAN? VLANs Explained for Beginners

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.