Inter-VLAN Routing with Router-on-a-Stick

In our previous two chapters, we built solid virtual walls between Sales (VLAN 10) and Engineering (VLAN 20). No broadcast storm from Engineering can slow down Sales, and no visitor in the reception lobby can listen in on payroll files. But this complete separation creates a practical problem: what happens when a Sales rep genuinely needs to send a proposal to an engineer, or open a shared company wiki hosted on the Engineering network?

Because VLANs are separate Layer 2 broadcast domains, a switch cannot connect them on its own. It is like having two different islands with no bridge between them. To allow authorized traffic between subnets, packets must pass through a Layer 3 routing decision. In enterprise networks, the most common and cost-effective design for this is Router-on-a-Stick.

Why Is It Called Router-on-a-Stick?

The name sounds playful, but it describes the physical shape of the network perfectly. Picture a lollipop: the round candy at the bottom is your main switch, and the vertical stick sticking out of it is a single Ethernet cable connected to a router above. All traffic flows up the stick into the router, gets routed, and turns right around to flow back down the exact same physical wire into the destination department.

Instead of buying a router with ten expensive physical ports—one for every single VLAN—the router divides one physical port (such as GigabitEthernet0/0) into multiple Virtual Subinterfaces:

Cisco Subinterface Setup:
interface GigabitEthernet0/0
 no shutdown

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

When you type encapsulation dot1Q 10, you are telling the router: "Any frame traveling up the trunk with an 802.1Q tag of 10 belongs to this virtual interface." The router gives that virtual interface its own IP address (192.168.10.1), which becomes the Default Gateway for every computer in the Sales department.

The U-Turn Journey of a Cross-VLAN Packet

When Sales-PC1 (192.168.10.10) pings Engineering-PC1 (192.168.20.10), the packet takes a fascinating round trip:

1. Asking the Gateway: Sales-PC1 sees that the destination IP belongs to a foreign network. It sends the frame to its Default Gateway (192.168.10.1).
2. Up the Stick: The switch receives the frame on port Fa0/1, stamps it with VLAN ID: 10, and sends it up the trunk link to the router.
3. Inspection: The router reads the frame on subinterface Gi0/0.10, strips off the Layer 2 tag, and checks the destination IP address.
4. The Routing Decision: The router looks at its routing table and sees that 192.168.20.0/24 lives on subinterface Gi0/0.20. It rewrites the frame header, stamps it with VLAN ID: 20, and sends it back down the exact same physical cable.
5. Down to the Target: The switch receives the frame tagged with VLAN 20, strips the tag, and delivers it cleanly out port Fa0/3 to the engineer's desk.

Step	Where the Frame Is	802.1Q Tag	Source IP	Target IP
1. Outbound	Sales-PC1 to Switch	Untagged	192.168.10.10	192.168.20.10
2. Up the Trunk	Switch to Router	Tag 10	192.168.10.10	192.168.20.10
3. Down the Trunk	Router to Switch	Tag 20	192.168.10.10	192.168.20.10
4. Inbound	Switch to Eng-PC1	Untagged	192.168.10.10	192.168.20.10

When Engineering-PC1 replies to the ping, the ICMP Echo Reply executes the exact same U-turn journey in reverse. The reply travels tagged with VLAN 20 up to the router, where the router rewrites the Layer 2 header and delivers it down tagged with VLAN 10 to reach the Sales computer.

Field Engineering Trade-Off: The Bottleneck

While Router-on-a-Stick is economical, notice the hidden physical constraint: because all traffic between departments shares that single physical cable in both directions, a busy file transfer between departments can fill up the trunk bandwidth quickly. In massive university campuses or data centers with thousands of computers, engineers upgrade to Layer 3 Multilayer Switches that route between VLANs at hardware speed inside the switch chip.

For small and medium offices, network engineers often solve this bottleneck by configuring an EtherChannel. By bundling two or four physical Gigabit cables together into a single logical trunk link, the router gains multiple gigabits of bandwidth while keeping the simple Router-on-a-Stick configuration intact.

The Next Challenge: Cable Failure and Loops

Now our network can route traffic smoothly between departments. But what happens if that critical trunk cable gets cut, or a switch fails? To protect the office, engineers connect backup cables between switches. But adding extra cables creates dangerous physical loops.

When switches are connected in a loop, broadcast frames spin infinitely until switch processors crash. In our next chapter, we will see how the Spanning Tree Protocol keeps backup paths ready on standby without crashing the office network.