Lab: VLANs and router-on-a-stick

What are we trying to make work?

PC1 and PC3 are employees in VLAN 10 on different switches. Their frames should cross the inter-switch trunk without passing through a router. PC2 is in VLAN 20, a separate Ethernet group and IP subnet. PC1 needs gateway R1 to reach it. We deliberately permit that routed lab test; a production guest policy may deny it.

A VLAN separates local Ethernet forwarding. A trunk carries multiple VLANs on one link. Router-on-a-stick places several logical router subinterfaces on one physical trunk. Each data subinterface supplies its VLAN's default gateway, the local router address used for remote destinations.

Test the switched path before the routed path. A failure between VLANs is easier to investigate after you have proved the required local links.

Lab equipment and starting state

Build a small two-floor office with router-on-a-stick. Use a router that supports 802.1Q subinterfaces and two switches with 802.1Q trunk support. Interface names vary by model. Start with console access and set the PCs to the static addresses below. Commands and output are documentation-based examples, not lab captures.

The commands use Cisco Catalyst IOS or IOS XE-style Layer 2 switchports and an IOS-style router. Use an isolated emulator, simulator or spare lab devices with the required feature support. Simulator command coverage varies. Begin with the named interfaces free of conflicting configurations, their cables connected and links enabled. Do not erase or repurpose an operational network to reproduce this lab.

Every /24 host uses mask 255.255.255.0. PC1 and PC3 share network 192.168.10.0/24; PC2 is in 192.168.20.0/24. The VLAN IDs 10 and 20 are switch classifications, not values calculated from those IP addresses. The table pairs one subnet with each VLAN as a design choice.

Create the VLANs, then assign the ports

Reach global configuration mode with configure terminal from the privileged prompt. vlan 10 creates or selects a VLAN; name supplies a label. switchport mode access fixes an endpoint port's role, and switchport access vlan 10 assigns ordinary untagged data to VLAN 10.

SW1 · global configuration mode

SW2 · global configuration mode

Give R1 a gateway for each data VLAN

Use the router-on-a-stick configuration from Design 1 in Routing between VLANs.

The encapsulation dot1Q value binds a subinterface to a VLAN. The suffix .10 is a helpful name; the encapsulation value is the actual binding. R1 learns both subnets as directly connected when the interfaces are operational, so no static route between VLANs 10 and 20 is needed.

Some older platforms also need switchport trunk encapsulation dot1q before switchport mode trunk.

Learn more: Lab: Inter-VLAN Routing

What the working lab shows

SW1#show vlan brief
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi1/0/2, Gi1/0/4, Gi1/0/5, ...
10   EMPLOYEES                        active    Gi1/0/1
20   GUESTS                           active    Gi1/0/3
99   NATIVE                           active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

SW1#show interfaces trunk
Port        Mode             Encapsulation  Status        Native vlan
Gi1/0/23    on               802.1q         trunking      99
Gi1/0/24    on               802.1q         trunking      99

Port        Vlans allowed on trunk
Gi1/0/23    10,20,99
Gi1/0/24    10,20,99

Port        Vlans allowed and active in management domain
Gi1/0/23    10,20,99
Gi1/0/24    10,20,99

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/23    10,20,99
Gi1/0/24    10,20,99

R1#show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0     unassigned      YES unset  up                    up
GigabitEthernet0/0.10  192.168.10.1    YES manual up                    up
GigabitEthernet0/0.20  192.168.20.1    YES manual up                    up
GigabitEthernet0/0.99  unassigned      YES unset  up                    up

PC1> ping 192.168.20.11
Reply from 192.168.20.11: bytes=32 time=1ms TTL=127
Reply from 192.168.20.11: bytes=32 time=1ms TTL=127

A working ping proves connectivity, not that the design is secure. If guests shouldn't reach employees, also test that the prohibited paths are blocked once your ACLs or firewall rules are in place.

ARP (Address Resolution Protocol) finds a local receiver's MAC address. PC1 resolves PC3 directly for the same-subnet test. For PC2, PC1 resolves R1's VLAN 10 gateway instead. The IP destination remains PC2; R1 builds a new frame in VLAN 20. PC2's reply requires its own correct gateway, 192.168.20.1.

Finish and verify

1. Ping each PC's own gateway, then PC1 → PC3 across the switch trunk, then PC1 → PC2 through R1.
2. On isolated SW1 Gi1/0/23, use switchport trunk allowed vlan remove 10. Confirm that PC1 → PC3 fails while PC1 → PC2 can still work. The two tests use different SW1 uplinks.
3. Restore that same interface with switchport trunk allowed vlan add 10. The add form retains VLANs 20 and 99. Verify the trunk lists on both ends, then repeat both tests.
4. Save only the recovered, intended configuration on R1, SW1 and SW2 with copy running-config startup-config. Do not save the deliberately broken state as the finished lab.

If PC1 cannot reach its own gateway, inspect its address, mask, access port and SW1's router trunk before changing the inter-switch uplink. If PC1 → PC3 works but PC1 → PC2 fails, check R1's connected routes, both host gateways and any host firewall or access-control list (ACL). A missing ping reply alone does not identify the failed device.

Router-on-a-stick saves physical router interfaces, but the data VLANs share the router uplink and forwarding resources. This lab demonstrates the mechanism; it does not measure throughput or prove that the design is suitable for every office.

Explain the results

Technical references

The switch commands follow Cisco's IOS XE VLAN trunking guide. Router subinterfaces follow its external-router inter-VLAN example. Exact interface names, defaults and output vary by platform. No hardware or simulator execution is claimed.