Router-on-a-Stick: Inter-VLAN Routing on Cisco (Step by Step)

Step 1 — Trunk the switch port to the router

Create the VLANs, then make the port facing the router a trunk that carries them. The trunk tags frames with 802.1Q so the router can tell which VLAN each frame belongs to.

SW1(config)# vlan 10
SW1(config)# vlan 20
SW1(config)# interface gigabitethernet0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20

Step 2 — One router subinterface per VLAN

On the router, create a subinterface for each VLAN, tag it with encapsulation dot1q <vlan>, and give it the gateway IP for that VLAN's subnet. Hosts in each VLAN use these addresses as their default gateway.

Make sure the physical interface itself is up (no shutdown) — the subinterfaces won't pass traffic if the parent is down.

R1(config)# interface gigabitethernet0/0
R1(config-if)# no shutdown
R1(config)# interface gigabitethernet0/0.10
R1(config-subif)# encapsulation dot1q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config)# interface gigabitethernet0/0.20
R1(config-subif)# encapsulation dot1q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0

Step 3 — Verify

Confirm the subinterfaces are up with the right IPs, check the trunk on the switch, then ping between a host in VLAN 10 and a host in VLAN 20 to prove routing works end to end.

R1# show ip interface brief
SW1# show interfaces trunk

A complete worked example: two VLANs with real addressing

Concrete numbers make the pattern click. Say VLAN 10 is Sales on 192.168.10.0/24 and VLAN 20 is Engineering on 192.168.20.0/24, with the router's Gi0/0 cabled to the switch's Gi0/1. Each subnet's gateway is its .1 address, which lives on the matching router subinterface, and every host in a VLAN points its default gateway at that .1. Access ports Gi0/2 and Gi0/3 drop the Sales and Engineering PCs into their VLANs.

Here is the full configuration for both devices. Note the switch line 'switchport trunk encapsulation dot1q': it is required only on switches that support both ISL and 802.1Q (older Catalyst 3560/3750-class boxes), and it simply doesn't exist on switches that only speak dot1q — so add it if IOS rejects 'switchport mode trunk' without it, otherwise skip it.

Once this is in place, a Sales PC at 192.168.10.50 (gateway 192.168.10.1) should ping an Engineering PC at 192.168.20.50 (gateway 192.168.20.1). The router has connected routes for both /24s the moment the subinterfaces come up, so if a ping fails the problem is almost always a host-side default gateway, an access port in the wrong VLAN, or the native-VLAN detail from the FAQ — not the routing itself.

! ---- SW1 (switch) ----
SW1(config)# vlan 10
SW1(config-vlan)#  name SALES
SW1(config)# vlan 20
SW1(config-vlan)#  name ENGINEERING
SW1(config)# interface gigabitethernet0/1        ! link to the router
SW1(config-if)#  switchport trunk encapsulation dot1q   ! only if the switch also supports ISL
SW1(config-if)#  switchport mode trunk
SW1(config-if)#  switchport trunk allowed vlan 10,20
SW1(config)# interface gigabitethernet0/2        ! Sales PC
SW1(config-if)#  switchport mode access
SW1(config-if)#  switchport access vlan 10
SW1(config)# interface gigabitethernet0/3        ! Engineering PC
SW1(config-if)#  switchport mode access
SW1(config-if)#  switchport access vlan 20

! ---- R1 (router) ----
R1(config)# interface gigabitethernet0/0
R1(config-if)#  no shutdown                      ! parent up, no IP here
R1(config)# interface gigabitethernet0/0.10
R1(config-subif)#  encapsulation dot1q 10
R1(config-subif)#  ip address 192.168.10.1 255.255.255.0
R1(config)# interface gigabitethernet0/0.20
R1(config-subif)#  encapsulation dot1q 20
R1(config-subif)#  ip address 192.168.20.1 255.255.255.0

Why one physical interface can be many gateways (802.1Q under the hood)

A trunk carries frames from several VLANs over a single wire, so each frame needs a label saying which VLAN it belongs to. 802.1Q inserts a 4-byte tag into the Ethernet header carrying a 12-bit VLAN ID; without that tag, the router would have no way to tell a Sales frame from an Engineering frame arriving on the same link. This is exactly why the switch port must be a trunk, not an access port — an access port strips VLAN information and the router loses the ability to demultiplex.

On ingress, the router reads the tag and hands the frame to the subinterface whose 'encapsulation dot1q' value matches. That is the whole trick: one physical interface fans out into many logical subinterfaces, each with its own IP address and connected subnet, so the router sees two directly-connected networks and can route between them with an ordinary routing-table lookup. Nothing exotic happens at Layer 3 — it is standard routing between two interfaces that just happen to share a cable.

On egress the router rewrites the frame with the destination VLAN's tag and sends it back out the same physical link, which is why this design is nicknamed a 'one-armed' or 'router-on-a-stick' setup — traffic hairpins in and out the single arm. That shared arm is also its ceiling: a flow between two VLANs consumes the trunk in both directions, so a busy inter-VLAN workload can saturate that one link. When that bandwidth becomes the constraint, moving the gateways onto Layer 3 SVIs on a multilayer switch removes the hairpin and forwards in hardware.

Common problems (and the fix)

Traffic won't cross VLANs if the encapsulation VLAN doesn't match the switch's VLAN ID; the switch port is an access port instead of a trunk; the native VLAN differs on each end of the trunk; the router's physical interface is shut; or the hosts point at the wrong default gateway. Check each in that order.