Course menu

Course 5: LAN SwitchingLesson 3.1 (6 of 8 in this course)29 of 122 in the CCNA series

Lab: inter-VLAN routing

Configure router-on-a-stick, move the routing to SVIs on a multilayer switch, verify each design and fix five faults.

Intermediate · 25 min read

What you will learn

After this lesson, you can route between two VLANs first with router-on-a-stick and then with SVIs on a multilayer switch, verify each design, and fix the faults that stop it working.

  • Router-on-a-stick
  • SVIs and ip routing
  • Troubleshooting

Inter-VLAN routing forwards traffic between VLANs, which are separate subnets and broadcast domains. A router (or a multilayer switch) has an address in each VLAN, acts as the hosts' default gateway, and routes packets from one VLAN to another.

In simple terms: VLANs keep groups apart. To let them talk, something with an address in each group has to pass traffic between them, just as a router does between any two networks.

The situation

Sales are in VLAN 10 (192.168.10.0/24) and Accounts in VLAN 20 (192.168.20.0/24). Both VLANs and the access ports already exist on SW1, and each PC uses .1 in its subnet as the default gateway. The PCs can't reach each other yet. Start with a router (Part A), then move the routing into a multilayer switch (Part B). The background is in VLANs and trunks.

802.1Q: 10, 20, native 99Gi0/10Gi0/20R1Gi0/0 trunkSW1Gi0/1 trunk to R1PC10VLAN 10 · 192.168.10.10PC20VLAN 20 · 192.168.20.10
  1. 1. Up the trunk: PC10 sends to its gateway 192.168.10.1. SW1 tags the frame with VLAN 10 on the trunk to R1.
  2. 2. Back down: R1 receives it on Gi0/0.10, routes it out of Gi0/0.20, and the frame returns tagged 20. SW1 delivers it to PC20.

Part A, task 1: configure router-on-a-stick

Show the configuration
! SW1 vlan 99 name NATIVE interface GigabitEthernet0/1 switchport mode trunk switchport trunk native vlan 99 switchport trunk allowed vlan 10,20,99

The switch port facing R1 is a trunk. A dedicated, unused native VLAN is good practice.

! R1 interface GigabitEthernet0/0 no shutdown ! interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0 ! interface GigabitEthernet0/0.20 encapsulation dot1Q 20 ip address 192.168.20.1 255.255.255.0 ! interface GigabitEthernet0/0.99 encapsulation dot1Q 99 native

One subinterface per VLAN. encapsulation dot1Q must come before the IP address. The physical interface carries no IP address but must be up: shutting it down takes every subinterface down.

Part A, task 2: verify

Example output · based on Cisco documentation; exact format varies by platform and software version
R1#show ip interface brief | include 0/0
GigabitEthernet0/0     unassigned      YES unset  up                    up
GigabitEthernet0/0.10  192.168.10.1    YES manual up                    up
GigabitEthernet0/0.20  192.168.20.1    YES manual up                    up
GigabitEthernet0/0.99  unassigned      YES unset  up                    up
Example output · based on Cisco documentation; exact format varies by platform and software version
R1#show ip route connected
      192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.10.0/24 is directly connected, GigabitEthernet0/0.10
L        192.168.10.1/32 is directly connected, GigabitEthernet0/0.10
      192.168.20.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.20.0/24 is directly connected, GigabitEthernet0/0.20
L        192.168.20.1/32 is directly connected, GigabitEthernet0/0.20
Both VLAN subnets are directly connected, so R1 can route between them with no routing protocol.
show vlans

On R1: lists each subinterface with its VLAN ID and traffic counters, and which VLAN is native.

Question: PC10 pings PC20 for the first time. Which ARP requests happen?

PC10 sees PC20 is in another subnet, so it ARPs for its gateway, 192.168.10.1, in VLAN 10. R1 answers from Gi0/0.10. R1 then ARPs for 192.168.20.10 out of Gi0/0.20, in VLAN 20, and PC20 answers. PC10 never learns PC20's MAC address.

Part B: move routing to the multilayer switch

Router-on-a-stick sends all inter-VLAN traffic up and down one link. A multilayer switch routes in hardware between its own SVIs (switched virtual interfaces), one per VLAN. Remove R1's subinterfaces first, so the gateway addresses aren't duplicated.

Show the configuration
! SW1 (multilayer) ip routing ! interface Vlan10 ip address 192.168.10.1 255.255.255.0 no shutdown interface Vlan20 ip address 192.168.20.1 255.255.255.0 no shutdown

ip routing turns on routing between the SVIs; without it the switch only uses its SVIs for management. The PCs keep the same gateway addresses, so nothing changes on them.

Example output · based on Cisco documentation; exact format varies by platform and software version
SW1#show ip interface brief | include Vlan
Vlan10                 192.168.10.1    YES manual up                    up
Vlan20                 192.168.20.1    YES manual up                    up
An SVI is up/up only when its VLAN exists and at least one port in that VLAN (an access port or a trunk carrying it) is up and forwarding.

Break it and fix it

Fault 1

PC20 can't ping its gateway. PC10 works. R1 shows:

Example output · based on Cisco documentation; exact format varies by platform and software version
R1#show running-config interface GigabitEthernet0/0.20
interface GigabitEthernet0/0.20
 encapsulation dot1Q 21
 ip address 192.168.20.1 255.255.255.0
Show diagnosis

The subinterface expects tag 21, but VLAN 20 frames arrive tagged 20. Fix: encapsulation dot1Q 20.

Fault 2

Both VLANs lost their gateway after maintenance. In show ip interface brief, Gi0/0 and every subinterface are down.

Show diagnosis

The physical interface Gi0/0 was shut down. Subinterfaces inherit its state. Fix: no shutdown on Gi0/0.

Fault 3

Example output · based on Cisco documentation; exact format varies by platform and software version
SW1#show interfaces trunk | begin allowed and active
Port        Vlans allowed and active in management domain
Gi0/1       10,99
Show diagnosis

VLAN 20 is not allowed on the trunk to R1. Fix: switchport trunk allowed vlan add 20. Use add, or retype the full list: without it the list is replaced.

Fault 4

In Part B, both SVIs are up/up and each PC can ping its own gateway, but PC10 can't reach PC20.

Show diagnosis

ip routing is missing on SW1. The SVIs answer for themselves but nothing is routed between them. show ip route says "Default gateway is …" instead of a routing table.

Fault 5

Example output · based on Cisco documentation; exact format varies by platform and software version
SW1#show ip interface brief | include Vlan30
Vlan30                 192.168.30.1    YES manual up                    down
Show diagnosis

A new SVI for VLAN 30 is up/down: VLAN 30 hasn't been created, or no port in VLAN 30 is up yet. Fix: vlan 30 and assign at least one active access port (or allow it on an up trunk).

Check yourself

Predict · scenario 1

On a router-on-a-stick, which command must come first on subinterface Gi0/0.10?

Predict · scenario 2

Compared with router-on-a-stick, what is the main advantage of SVIs on a multilayer switch?

Predict · scenario 3

An SVI shows up/down. Which is a likely cause?