Networking LabsLabsIntermediate

Lab: inter-VLAN routing with router-on-a-stick and SVIs

By Mohamed Fayas 9 min readUpdated 8 October 2026

In short: Hosts in different VLANs need a Layer 3 device to talk. In this lab you first route between two VLANs with router-on-a-stick, then replace the router with a multilayer switch using SVIs, and compare the two.

Aim and what you need

The aim is to let the STAFF (VLAN 10) and STUDENTS (VLAN 20) networks from the VLAN lab communicate through a router, using two different designs. You will see that the PCs only need a correct default gateway; the routing device does the rest.

Packet Tracer, or your own lab kit: one 2960 switch, one 1941 or 4321 router, and one 3650 or 3560 multilayer switch for part B.
Two PCs: PC-A 192.168.10.11/24 (gateway .1) in VLAN 10 and PC-B 192.168.20.11/24 (gateway .1) in VLAN 20.

Design

Figure 1. Router-on-a-stick and multilayer switch SVIs achieve the same result with different hardware and performance.

Figure 2. With router-on-a-stick, a packet crosses the trunk twice: up tagged VLAN 10 and back down tagged VLAN 20.

In both designs, each VLAN gets one gateway interface with the .1 address. In router-on-a-stick these are logical subinterfaces on one physical port. On a multilayer switch they are SVIs, and the switch must have IP routing turned on.

Steps

Part A: router-on-a-stick. Connect S1 G0/1 to R1 G0/0. Make S1 G0/1 a trunk, then create one subinterface per VLAN on the router.

! on S1
interface g0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
! on R1
interface g0/0
 no shutdown
interface g0/0.10
 description STAFF gateway
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface g0/0.20
 description STUDENTS gateway
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
end

Part B: SVIs on a multilayer switch. Replace S1 and R1 with a 3650, create the VLANs, assign access ports and add the SVIs.

configure terminal
ip routing
vlan 10
 name STAFF
vlan 20
 name STUDENTS
interface g1/0/1
 switchport mode access
 switchport access vlan 10
interface g1/0/2
 switchport mode access
 switchport access vlan 20
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown
interface vlan 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown
end

Verify

On the routing device, both gateway interfaces should be up/up and the routing table should show two connected networks marked C. From PC-A, ping PC-B and trace the path; success is replies from 192.168.20.11 and a trace with the gateway 192.168.10.1 as the first hop.

show ip interface brief
show ip route connected
show interfaces trunk
show vlan brief

ping 192.168.20.11
tracert 192.168.20.11

Troubleshooting and clean-up

Subinterfaces down: the physical interface G0/0 still needs no shutdown; subinterfaces inherit its state.
One VLAN works, the other does not: check the encapsulation dot1Q number matches the VLAN, and the VLAN is allowed on the trunk.
SVI stays down: an SVI only comes up when the VLAN exists and at least one port in that VLAN is up.
Routing works from the switch but not the PCs: check each PC's default gateway, and that ip routing is on for part B.
Windows PCs in a real lab do not reply: Windows Defender Firewall blocks inbound ping by default; allow ICMP echo for the lab.

Save both versions as separate files. At work, multilayer switch SVIs are the normal choice for a campus core because routing happens in hardware at line rate. Router-on-a-stick remains useful in small branches and appears often in CCNA exams.

Practice

Why does router-on-a-stick need a trunk between the switch and router?

The router must receive frames from several VLANs on one physical link, so they must carry 802.1Q tags to show which VLAN each belongs to.

An SVI for VLAN 30 shows down/down. Name two likely causes.

VLAN 30 does not exist on the switch, or no port in VLAN 30 is up (or the SVI is shut down).

What global command lets a multilayer switch route between SVIs?

ip routing.

Key takeaways

Hosts in different VLANs need a Layer 3 gateway to communicate.
Router-on-a-stick uses one trunk and a dot1Q subinterface per VLAN.
Multilayer switches use SVIs plus ip routing, and route in hardware.
The PCs only need the correct default gateway for their VLAN.
Verify with show ip route connected, ping and tracert.

Tracks your learning on this device only. See your progress on the learning paths.

About the author

Mohamed Fayas

Founder of FM TecHub. CCNA certified, with a BTEC HND in Network Engineering, and BEng (Hons) in Computer Networking and Cloud Security. He writes practical, plain-English guides on networking, security and cloud.

More about the author