4.2.7 Packet Tracer - Configure Router-on-a-stick Inter-vlan Routing

Packet Tracer - Configure Router-on-a-Stick Inter-VLAN Routing

Have you ever built a small network lab and realized your devices from different VLANs can't talk to each other? Now imagine trying to replicate that exact setup in Cisco Packet Tracer. That's the classic problem. It feels impossible until you understand how router-on-a-stick works. And honestly, once you do, everything clicks That's the whole idea..

Router-on-a-stick is one of those networking concepts that seems intimidating at first—layered VLANs, shared physical interfaces, separate logical networks—but it's actually a straightforward design pattern once you see the big picture. Even so, in this guide, we'll walk through configuring router-on-a-stick inter-VLAN routing step by step using Packet Tracer. By the end, you'll be able to set up multi-VLAN access points behind a single router interface, which is exactly what many small businesses and home labs need Which is the point..

What Is Router-on-a-Stick Inter-VLAN Routing

At its core, router-on-a-stick is a method of connecting multiple VLANs together by running a single logical network across a shared physical link. Still, think of it as a virtual bridge between different broadcast domains. Instead of having separate routers for each VLAN, you put one router in charge of handling traffic between all of them.

Worth pausing on this one Most people skip this — try not to..

The magic happens on the router's interface. You create a subinterface (often called the "stub layer") that carries traffic destined for each VLAN. Each subinterface gets its own IP address within a private range, and packets flowing between VLANs take that subinterface path instead of going directly between switches. This keeps the VLANs logically isolated while still allowing them to communicate easily That alone is useful..

Why bother with this approach? Worth adding: well, it gives you centralized management. Worth adding: you can monitor all VLANs from one device, apply security policies uniformly, and troubleshoot issues without jumping between dozens of switches. For beginners, it's also easier to learn because you're working with fewer physical connections—the whole point of the design is simplicity That alone is useful..

Why It Matters / Why People Care

Understanding router-on-a-stick matters for several reasons. But first, it's the foundation for many modern network architectures. That's why when companies expand their infrastructure, they often start with a single VLAN and gradually add others. Router-on-a-stick provides a clean way to scale without rewriting entire designs.

Second, it solves a very common pain point: managing multiple VLANs on limited hardware. Many learning labs and small office environments have just enough switch ports to handle three or four VLANs. Without router-on-a-stick, you'd need a separate router per VLAN—which quickly becomes expensive and complex. With this technique, one router handles everything.

Third, security improves. By consolidating VLANs under a single router, you gain visibility into cross-VLAN traffic patterns. You can enforce access control lists (ACLs) on the router interface to block unwanted communications before packets even leave the local segment. It's a simple but powerful way to harden your network perimeter Which is the point..

Finally, troubleshooting becomes more efficient. In real terms, instead of hunting through multiple switch configurations, you know all the inter-VLAN paths converge at one logical point. If something breaks, you can isolate the issue faster by checking the router's statistics rather than digging through dozens of switch logs.

How It Works (and How to Configure It)

Now let's get practical. Setting up router-on-a-stick in Packet Tracer involves several clear steps. I'll walk through each one so you can follow along whether you're using the free trial or a full account Surprisingly effective..

Step 1: Create Your VLANs

Start by building the VLAN structure you need. Worth adding: on your workstation, launch Packet Tracer and create a new simulation. In practice, add a few switches—let's say two 24-port switches—and connect them in a typical topology. Then, right-click on each switch and select "Create VLANs." Choose the number of VLANs you want (three is a good starting point), assign names like "VLAN10", "VLAN20", and "VLAN30", and give each a unique ID within its VLAN (for example, 10.1.Now, 0. 1 for VLAN10) And that's really what it comes down to. Which is the point..

Make sure to enable trunking on the switches so they can carry multiple VLANs simultaneously. This is crucial—if your switches aren't configured correctly, the router won't receive the necessary information to route between VLANs.

Step 2: Configure Inter-VLAN Routing on the Router

On your router (preferably a Cisco 2960 or 3650 model), go to the configuration mode. Here's where things get interesting. You need to create a subinterface on the router's interface that connects to the switch port(s) carrying the trunk. In my experience, this is the step people find hardest because it requires understanding both physical and logical addressing.

First, identify which port on the router is connected to the switch trunk. Then, create a subinterface on that interface. Take this: if you're using GigabitEthernet0/1 for the trunk to Switch1, you'd enter:

interface GigabitEthernet0/1
 description Trunk to Switch1
 ip address 192.168.1.1/24
 no shutdown

Wait—that's not quite right. Let me correct that. The subinterface needs its own IP address assigned via the "subnet-address" command.

interface GigabitEthernet0/1
 description Trunk to Switch1
 ip subnet-address 192.168.1.1
 no shutdown

This tells the router that the subinterface (GigabitEthernet0/1.1) has IP address 192.That said, 168. 1.1/24. The .1 suffix indicates it's the subinterface on that physical line Most people skip this — try not to..

After creating the subinterface, you need to tell it what to do with traffic. You'll configure static

Step 3: Create Sub‑Interfaces for Each VLAN

Now that the trunk is up, you need a logical interface for every VLAN that will be routed. In Cisco IOS, sub‑interfaces are created by appending a dot and a VLAN identifier to the physical interface name (e.g., GigabitEthernet0/1.10). Each sub‑interface will carry a single VLAN and must be assigned an IP address that belongs to the VLAN’s subnet Most people skip this — try not to..

# Enter global configuration mode
router# configure terminal

# --- VLAN 10 (Subnet 10.10.10.0/24) ---
interface GigabitEthernet0/1.10
 description Sub‑interface for VLAN10
 ip address 10.10.10.1 255.255.255.0
 no shutdown

# --- VLAN 20 (Subnet 20.20.20.0/24) ---
interface GigabitEthernet0/1.20
 description Sub‑interface for VLAN20
 ip address 20.20.20.1 255.255.255.0
 no shutdown

# --- VLAN 30 (Subnet 30.30.30.0/24) ---
interface GigabitEthernet0/1.30
 description Sub‑interface for VLAN30
 ip address 30.30.30.1 255.255.255.0
 no shutdown

What’s happening?

• The router’s physical interface GigabitEthernet0/1 remains in layer‑3 mode (it’s a trunk, not a switchport).
• Each sub‑interface is a virtual interface that belongs to a single VLAN. Because the trunk carries all three VLANs, the router can receive traffic destined for any of them and forward it out the appropriate sub‑interface.

Step 4: Enable IP Routing on the Router

Even though the router is a Layer‑3 device, you must explicitly enable the IP routing process so that packets are forwarded between sub‑interfaces rather than being dropped.

router# ip routing

That single command activates the routing table and allows inter‑VLAN traffic to flow It's one of those things that adds up. And it works..

Step 5: Assign Host Interfaces to VLANs (on the switches)

Back in Packet Tracer, right‑click each PC or laptop and assign it to the appropriate VLAN. For example:

Make sure each switch’s access ports are configured as access ports and assigned to the correct VLAN (right‑click → Access Mode VLAN → VLAN10, etc.). Save the configuration.

Step 6: Verify Connectivity

Now you can test inter‑VLAN routing. Open the CLI of any router (or use the Packet Tracer simulation console) and ping across VLANs:

# From PC‑A (VLAN10) – assume its gateway is 10.10.10.1
Cisco# ping 20.20.20.2

You should see successful replies, confirming that traffic from VLAN10 reaches VLAN20 via the router’s sub‑interfaces. Repeat the test for the remaining VLAN pairs to ensure full mesh connectivity.

If pings fail, double‑check:

1. Trunk encapsulation – ensure both switches and the router are using the same trunk mode (dynamic auto/negotiate or trunked).
2. VLAN IDs – the sub‑interface number must match the VLAN ID (e.g., GigabitEthernet0/1.10 for VLAN10).
3. IP addressing – each sub‑interface’s IP must be the gateway for its VLAN.

Step 7 (Optional): Add Access‑Control Lists (ACLs)

If you want to restrict traffic between VLANs, create a standard ACL and apply it to the appropriate sub‑interface. Here's one way to look at it: to block VLAN30 from reaching VLAN10:

router# access-list 101 deny ip 30.30.30.0

```text
router# access-list 101 deny ip 30.30.30.0 0.0.0.255 10.10.10.0 0.0.0.255
router# access-list 101 permit ip any any
router# interface GigabitEthernet0/1.10
router(config-subif)# ip access-group 101 in
router(config-subif)# exit
router# end
router# write memory

Explanation of the ACL

• The first line blocks any traffic sourced from the 30.30.30.0/24 subnet (VLAN 30) destined for the 10.10.10.0/24 subnet (VLAN 10).
• The second line permits all other traffic, ensuring that VLAN 30 can still reach VLAN 20 and that VLAN 10 and VLAN 20 remain fully communicative.
• Applying the list inbound on the VLAN 10 sub‑interface drops the offending packets before they are routed, which is more efficient than an outbound filter on the source side.

Verifying the ACL

router# show access-lists 101
Extended IP access list 101
    10 deny ip 30.30.30.0 0.0.0.255 10.10.10.0 0.0.0.255
    20 permit ip any any

router# show ip interface GigabitEthernet0/1.10
GigabitEthernet0/1.Because of that, 10 is up, line protocol is up
  Internet address is 10. Plus, 10. 10.

A quick test from a host in VLAN 30 (e.g., PC‑E) to a host in VLAN 10 (PC‑A) should now fail:

```text
PC-E> ping 10.10.10.2
!!!!!
Success rate is 0 percent (0/5)

Meanwhile, pinging from VLAN 30 to VLAN 20 (PC‑C) succeeds, confirming that the restriction is selective.

Additional Tips

• Extended ACLs give you granular control (e.g., blocking only specific protocols or ports).
• Place ACLs as close to the source as possible to minimize unnecessary processing on the router.
• Always keep a default permit statement at the end of an ACL unless you intend an implicit deny‑all policy.
• Document each ACL entry with remarks (remark) for future troubleshooting.
• After any change, save the configuration (write memory or copy running-config startup-config) to persist across reloads.

Conclusion

By configuring a trunk between the switches, creating matching sub‑interfaces on the router, enabling IP routing, and (optionally) applying targeted ACLs, you have built a fully functional inter‑VLAN routing environment in Packet Tracer. This “router‑on‑a‑stick” design leverages a single physical link to carry multiple VLANs, simplifying cabling while preserving the flexibility to segment traffic, enforce security policies, and scale the network as needed. Here's the thing — verify each step with the appropriate show and ping commands, and remember to save your configurations to ensure the setup survives device reboots. With these fundamentals in place, you can extend the design to more VLANs, integrate DHCP relay, or add advanced services such as QoS and NAT as your network evolves.

Short version: it depends. Long version — keep reading Easy to understand, harder to ignore..