14 hands-on Inter-VLAN Routing scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. Inter-VLAN Routing configuration and troubleshooting practice for CCNA and CCNP.
Included with a subscription
Deploy router-on-a-stick inter-VLAN routing across a compact branch topology with a distribution and access switch, a hardened 802.1Q trunk, and two user VLANs. Configure VLANs and access/trunk ports, build router subinterfaces, verify end-to-end user reachability, and troubleshoot trunk/native-VLAN/subinterface mismatches.
Advanced CCNA capstone: diagnose and repair a fully-broken three-VLAN router-on-a-stick deployment. One iol-xe router uplinks by 802.1Q trunk to a pure layer-2 ioll2-xe switch, with three alpine PCs on their own access VLANs (10 Sales, 20 Voice, 30 CCTV); after a recent switch and router change, inter-VLAN connectivity is broken or intermittent across all three VLANs. Trace VLAN intent end-to-end from each host through the trunk to the router's subinterfaces, repair whatever faults you find, and verify with end-host pings/traceroutes and IOS show commands.
Advanced CCNA troubleshooting lab on a router-on-a-stick design. VLAN 10 users can reach their gateway and other hosts, but VLAN 20 users cannot reach their gateway or any resources in VLAN 10. Methodically trace L2/L3 intent end-to-end - from the access ports through the trunks up to the router subinterfaces - to isolate the first-hop failure and implement fixes that restore inter-VLAN routing while maintaining enterprise trunk hardening and clean configurations.
Build and verify inter-VLAN routing using router-on-a-stick with a native (untagged) VLAN on the trunk. Configure one router (subinterfaces only), one Layer-2 access switch (VLANs, access ports, and a single 802.1Q trunk), and two end hosts in different VLANs. The management VLAN 99 rides untagged as the trunk's native VLAN, so the router subinterface must use 'encapsulation dot1Q 99 native' and the switch trunk must match 'switchport trunk native vlan 99'. Verify from Linux hosts and IOS 'show' commands, then practice troubleshooting common native-VLAN faults.
Design and implement a three-department campus edge using a single router-on-a-stick to provide inter-VLAN routing for Sales (VLAN 10), Engineering (VLAN 20), and Servers (VLAN 30). Map the addressing plan directly to router subinterfaces and build an 802.1Q trunk on the access switch. Verify end-to-end reachability and troubleshoot an allow-list drift scenario.
Extend a working two-VLAN router-on-a-stick design to a third VLAN (Guest) without breaking Sales and Engineering. Add one router subinterface, one switch VLAN + access port, and update the switch trunk’s allowed-VLAN list safely using 'add' so existing VLANs remain transported.
Configure the Layer-2 switch side of a router-on-a-stick design. A single IOS router already provides inter-VLAN routing on Ethernet0/0.10 (10.0.10.1/24) and Ethernet0/0.20 (10.0.20.1/24). Bring up VLAN transport by creating VLANs on the switch, assigning host access ports, and converting the router-facing link into an 802.1Q trunk that carries VLANs 10 and 20. Validate with show commands on the switch and with cross-VLAN pings from the hosts.
Practice creating 802.1Q subinterfaces on a single router uplink to deliver inter-VLAN routing using router-on-a-stick. The Layer-2 switch is already fully configured with VLAN 10 and VLAN 20, access ports for two hosts, and a working 802.1Q trunk to the router. Your job: leave the router's physical Ethernet0/0 unnumbered and add exactly two subinterfaces with the correct encapsulation tags and gateway IPs so hosts can reach their gateways and each other.
Configure inter-VLAN routing using router-on-a-stick with one router, one Layer-2 switch, and two hosts. Build VLAN 10 and VLAN 20, trunk the router uplink, create subinterfaces for each VLAN, and verify that hosts can now reach each other across VLANs.
Free with an account
Build a router-on-a-stick design with three VLANs (SALES, HR, GUEST) on a single router and single access switch, then enforce guest isolation using a single extended ACL applied inbound on the Guest subinterface. SALES and HR can reach each other; GUEST can reach only its default gateway and is blocked from internal subnets. The lab focuses on correct 802.1Q tagging, trunking, access port assignments, ACL placement/order, and end-host verification.
Build and verify a three-VLAN router-on-a-stick design: one IOS router provides inter-VLAN routing via 802.1Q subinterfaces to a single Layer-2 access switch, with three Alpine hosts in VLANs 10, 20, and 30. The starter environment does not yet forward traffic correctly between all three VLANs, so you will apply a disciplined router-switch-host verification method to diagnose and fix the problem, then briefly break and restore one VLAN's connectivity before finishing with an enterprise-clean, hardened trunk.
Advanced Layer-2 capstone, run as a fault hunt. A branch was cut over last night: one user VLAN has no gateway, another user sits in the wrong subnet, the management VLAN is unreachable from the distribution switch, and a port that should lock to one MAC no longer does. Nothing was recorded. You get symptoms and the required end state — no fault list. Faults span the router and both switches, and more than one of them presents as 'the trunk is broken'.
Hands-on CCNA VLAN lab: build VLANs with names, assign access ports, harden and verify 802.1Q trunks, and troubleshoot a broken allow-list that prevents a VLAN from traversing the SW1–SW2 trunk. Includes router-on-a-stick gateways, management VLAN, and end-host validation.
Implement VLANs, 802.1Q trunking, router-on-a-stick inter-VLAN routing, and access-layer port security on a compact branch network with two access switches and two endpoints. You will configure segmentation (VLANs 10, 20, 99), hardened trunks with a dedicated native VLAN 999, Layer 3 gateways on a core router, and sticky MAC port security on user-facing ports. Verify end-to-end reachability and remediate common misconfigurations like missing allowed VLANs, native VLAN mismatches, and unauthorized endpoint moves.
Inter-VLAN routing is where the Layer 2 and Layer 3 halves of the CCNA finally meet. You have segmented a switch into VLANs, and now nothing can talk to anything else until every VLAN has a gateway. There are two ways to provide one, subinterfaces on a router across an 802.1Q trunk or SVIs on a Layer 3 switch, and you are expected to configure both and to know why production almost always picks the second. What makes the topic hard to learn on paper is that it fails in layers. A ping between VLANs crosses an access port, a trunk, a VLAN tag, a gateway address, and a routing decision, and a break anywhere along that chain produces the same useless symptom: request timed out. Narrowing it down is the actual skill, and reading a working configuration never teaches it.
These labs give you real Cisco IOS switches and routers in Cisco Modeling Labs. On the router-on-a-stick side you build the trunk on the switch, bring the parent interface up with no shutdown, then create one subinterface per VLAN with encapsulation dot1Q and the gateway address for that subnet, including the native keyword when a subinterface has to accept untagged frames. On the Layer 3 switch side you enable ip routing, the single omission that produces a lab where every host reaches its own gateway and nothing beyond it, create the VLAN interfaces, and take an uplink out of switching with no switchport. Verification uses show interfaces trunk, show vlan brief, show ip interface brief, and show ip route for the connected and local routes each gateway creates. Fault labs supply an access port in the wrong VLAN, a VLAN pruned off the trunk, an encapsulation value that does not match the switch, an SVI held down by autostate, and a host pointed at the wrong gateway. Your uploaded export is graded requirement by requirement against the answer key.
Both, because the exam covers both and they fail in different ways. Router-on-a-stick hairpins every inter-VLAN packet up one trunk and back down, so that single link and the router forwarding rate cap your throughput. A Layer 3 switch routes between SVIs in the switching ASIC with no round trip, which is why campus distribution layers use it. Reachability is identical either way; the difference is scale, and the troubleshooting steps are not interchangeable.
On a Layer 3 switch this is almost always a missing ip routing. The SVIs come up and answer pings because they are local interfaces, but the switch never forwards between them. Confirm it is enabled in the running configuration. If routing is already on, check that each host default gateway matches its VLAN SVI address. With router-on-a-stick the same symptom usually means the encapsulation dot1Q value does not match the switch VLAN ID, or the VLAN is not on the trunk allowed list.
No hardware at all. The topologies use virtual switch and router nodes inside your own Cisco Modeling Labs instance, and each lab imports as a package built on CML free-tier images, so there is nothing to buy beyond the CML instance you already run.
Study the theory behind these labs — the concept explainer and step-by-step guides.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.