2021/2/17 Inter-VLAN Routing | Objectives

Cisco Press

Inter-VLAN Routing
Date: Jul 29, 2020 By Cisco Networking Academy. Sample Chapter is provided
courtesy of Cisco Press.

In this sample chapter from Switching, Routing, and Wireless Essentials

Companion Guide (CCNAv7) for Cisco Networking Academy students, you
will learn how to troubleshoot common inter-VLAN conguration issues.

Objectives
Upon completion of this chapter, you will be able to answer the following
questions:

What are the options for conguring inter-VLAN routing?

How do you congure router-on-a-stick inter-VLAN routing?

How do you congure inter-VLAN routing using Layer 3 switching?

How do you troubleshoot common inter-VLAN conguration issues?

Key Terms
This chapter uses the following key terms. You can nd the denitions in the
Glossary.

inter-VLAN routing Page 98

legacy inter-VLAN routing Page 98

router-on-a-stick Page 98

subinterfaces Page 100

switched virtual interface (SVI) Page 112

routed port Page 112

Introduction (4.0)
Now you know how to segment and organize your network into VLANs. Hosts
can communicate with other hosts in the same VLAN, and you no longer have
hosts sending out broadcast messages to every other device in your network,
eating up needed bandwidth. But what if a host in one VLAN needs to
communicate with a host in a dierent VLAN? If you are a network administrator,
you know that people will want to communicate with other people outside of
your network. This is where inter-VLAN routing can help you. Inter-VLAN routing
uses a Layer 3 device, such as a router or a Layer 3 switch. Let’s take your
VLAN expertise and combine it with your network layer skills and put them to the
test!

Inter-VLAN Routing Operation (4.1)

In this section, you learn about two options for conguring for inter-VLAN
routing.

What Is Inter-VLAN Routing? (4.1.1)

VLANs are used to segment switched Layer 2 networks for a variety of reasons.
Regardless of the reason, hosts in one VLAN cannot communicate with hosts in

[Link] 1/28
2021/2/17 Inter-VLAN Routing | Objectives

another VLAN unless there is a router or a Layer 3 switch to provide routing

services.

Inter-VLAN routing is the process of forwarding network trac from one VLAN
to another VLAN.

There are three inter-VLAN routing options:

Legacy Inter-VLAN routing : This is a legacy solution. It does not scale

well.

Router-on-a-Stick : This is an acceptable solution for a small- to

medium-sized network.

Layer 3 switch using switched virtual interfaces (SVIs): This is the most
scalable solution for medium to large organizations.

Legacy Inter-VLAN Routing (4.1.2)

The rst inter-VLAN routing solution relied on using a router with multiple
Ethernet interfaces. Each router interface was connected to a switch port in
dierent VLANs. The router interfaces served as the default gateways to the
local hosts on the VLAN subnet.

For example, refer to the topology in Figure 4-1 where R1 has two interfaces
connected to switch S1.

NOTE

The IPv4 addresses of PC1, PC2, and R1 all have a /24 subnet mask.

Figure 4-1 Legacy Inter-VLAN Routing Example

As shown in Table 4-1, the example MAC address table of S1 is populated as

follows:

Fa0/1 port is assigned to VLAN 10 and is connected to the R1 G0/0/0

interface.

Fa0/11 port is assigned to VLAN 10 and is connected to PC1.

Fa0/12 port is assigned to VLAN 20 and is connected to the R1 G0/0/1

interface.

Fa0/11 port is assigned to VLAN 20 and is connected to PC2.

Table 4-1 MAC Address Table for S1

Port MAC Address VLAN

F0/1 R1 G0/0/0 MAC 10
F0/11 PC1 MAC 10
F0/12 R1 G0/0/1 MAC 20
F0/24 PC2 MAC 20

[Link] 2/28
2021/2/17 Inter-VLAN Routing | Objectives

When PC1 sends a packet to PC2 on another network, it forwards it to its

default gateway [Link]. R1 receives the packet on its G0/0/0 interface
and examines the destination address of the packet. R1 then routes the packet
out its G0/0/1 interface to the F0/12 port in VLAN 20 on S1. Finally, S1 forwards
the frame to PC2.

Legacy inter-VLAN routing using physical interfaces works, but it has a

signicant limitation. It is not reasonably scalable because routers have a limited
number of physical interfaces. Requiring one physical router interface per VLAN
quickly exhausts the physical interface capacity of a router.

In our example, R1 required two separate Ethernet interfaces to route between

VLAN 10 and VLAN 20. What if there were six (or more) VLANs to interconnect?
A separate interface would be required for each VLAN. Obviously, this solution is
not scalable.

NOTE

This method of inter-VLAN routing is no longer implemented in switched

networks and is included for explanation purposes only.

Router-on-a-Stick Inter-VLAN Routing (4.1.3)

The “router-on-a-stick” inter-VLAN routing method overcomes the limitation of
the legacy inter-VLAN routing method. It requires only one physical Ethernet
interface to route trac between multiple VLANs on a network.

A Cisco IOS router Ethernet interface is congured as an 802.1Q trunk and

connected to a trunk port on a Layer 2 switch. Specically, the router interface is
congured using subinterfaces to identify routable VLANs.

The congured subinterfaces are software-based virtual interfaces. Each is

associated with a single physical Ethernet interface. Subinterfaces are
congured in software on a router. Each subinterface is independently
congured with an IP address and VLAN assignment. Subinterfaces are
congured for dierent subnets that correspond to their VLAN assignment. This
facilitates logical routing.

When VLAN-tagged trac enters the router interface, it is forwarded to the

VLAN subinterface. After a routing decision is made based on the destination IP
network address, the router determines the exit interface for the trac. If the
exit interface is congured as an 802.1Q subinterface, the data frames are
VLAN-tagged with the new VLAN and sent back out the physical interface.

Figure 4-2 shows an example of router-on-a-stick inter-VLAN routing. PC1 on

VLAN 10 is communicating with PC3 on VLAN 30 through router R1 using a
single, physical router interface.

Figure 4-2 Unicast from VLAN 10 Is Route to VLAN 30

Figure 4-2 illustrates the following steps:

Step 1. PC1 sends its unicast trac to switch S2.

[Link] 3/28
2021/2/17 Inter-VLAN Routing | Objectives

Step 2. Switch S2 tags the unicast trac as originating on VLAN 10 and

forwards the unicast trac out its trunk link to switch S1.

Step 3. Switch S1 forwards the tagged trac out the other trunk interface
on port F0/3 to the interface on router R1.

Step 4. Router R1 accepts the tagged unicast trac on VLAN 10 and

routes it to VLAN 30 using its congured subinterfaces.

In Figure 4-3, R1 routes the trac to the correct VLAN.

Figure 4-3 Router Tags Unicast Frame with VLAN 30

Figure 4-3 illustrates the following steps:

Step 5. The unicast trac is tagged with VLAN 30 as it is sent out the
router interface to switch S1.

Step 6. Switch S1 forwards the tagged unicast trac out the other trunk
link to switch S2.

Step 7. Switch S2 removes the VLAN tag of the unicast frame and
forwards the frame out to PC3 on port F0/23.

NOTE

The router-on-a-stick method of inter-VLAN routing does not scale beyond 50

VLANs.

Inter-VLAN Routing on a Layer 3 Switch (4.1.4)

The modern method of performing inter-VLAN routing is to use Layer 3 switches
and switched virtual interfaces (SVI). An SVI is a virtual interface that is
congured on a Layer 3 switch, as shown in Figure 4-4.

Figure 4-4 Layer 3 Switch Inter-VLAN Routing Example

NOTE

A Layer 3 switch is also called a multilayer switch because it operates at Layer 2

and Layer 3. However, in this course we use the term Layer 3 switch.
[Link] 4/28
2021/2/17 Inter-VLAN Routing | Objectives

Inter-VLAN SVIs are created the same way that the management VLAN interface
is congured. The SVI is created for a VLAN that exists on the switch. Although
virtual, the SVI performs the same functions for the VLAN as a router interface
would. Specically, it provides Layer 3 processing for packets that are sent to or
from all switch ports associated with that VLAN.

The following are advantages of using Layer 3 switches for inter-VLAN routing:

They are much faster than router-on-a-stick because everything is

hardware switched and routed.

There is no need for external links from the switch to the router for
routing.

They are not limited to one link because Layer 2 EtherChannels can be
used as trunk links between the switches to increase bandwidth.

Latency is much lower because data does not need to leave the switch to
be routed to a dierent network.

They are more commonly deployed in a campus LAN than routers.

The only disadvantage is that Layer 3 switches are more expensive than Layer 2
switches, but they can be less expensive than a separate Layer 2 switch and
router.

CHECK YOUR UNDERSTANDING—INTER-VLAN ROUTING OPERATION (4.1.5)

Refer to the online course to complete this activity.

Router-on-a-Stick Inter-VLAN Routing (4.2)

In this section, you congure router-on-a-stick inter-VLAN routing.

Router-on-a-Stick Scenario (4.2.1)

In the previous section, three ways to create inter-VLAN routing were listed, and
legacy inter-VLAN routing was detailed. This section details how to congure
router-on-a-stick inter-VLAN routing. You can see in the gure that the router is
not in the center of the topology but instead appears to be on a stick near the
border, hence the name.

In Figure 4-5, the R1 GigabitEthernet 0/0/1 interface is connected to the S1

FastEthernet 0/5 port. The S1 FastEthernet 0/1 port is connected to the S2
FastEthernet 0/1 port. These are trunk links that are required to forward trac
within and between VLANs.

[Link] 5/28
2021/2/17 Inter-VLAN Routing | Objectives

Figure 4-5 Router-on-a-Stick Topology

To route between VLANs, the R1 GigabitEthernet 0/0/1 interface is logically

divided into three subinterfaces, as shown in Table 4-2. The table also shows
the three VLANs that will be congured on the switches.

Table 4-2 Router R1 Subinterfaces

Subinterface VLAN IP Address

G0/0/1.10 10 [Link]/24
G0/0/1.20 20 [Link]/24
G0/0/1.30 99 [Link]/24

Assume that R1, S1, and S2 have initial basic congurations. Currently, PC1 and
PC2 cannot ping each other because they are on separate networks. Only S1
and S2 can ping each other, but they but are unreachable by PC1 or PC2
because they are also on dierent networks.

To enable devices to ping each other, the switches must be congured with
VLANs and trunking, and the router must be congured for inter-VLAN routing.

S1 VLAN and Trunking Conguration (4.2.2)

Complete the following steps to congure S1 with VLANs and trunking:

Step 1. Create and name the VLANs. First, the VLANs are created and
named, as shown in Example 4-1. VLANs are created only after you exit
out of VLAN subconguration mode.

Example 4-1 Create and Name VLANs

S1(config)# v l a n 10
S1(config-vlan)# name LAN10
S1(config-vlan)# exit
S1(config)# v l a n 20
S1(config-vlan)# name LAN20
S1(config-vlan)# exit
S1(config)# v l a n 99
S1(config-vlan)# name Management

[Link] 6/28
2021/2/17 Inter-VLAN Routing | Objectives

S1(config-vlan)# e x i t
S1(config)#

Step 2. Create the management interface. Next, the management

interface is created on VLAN 99 along with the default gateway of R1, as
shown in Example 4-2.

Example 4-2 Create the Management Interface

S1(config)# i n t e r f a c e v l a n 9 9
S1(config-if)# i p a d d 1 9 2 . 1 6 8 . 9 9 . 2 2 5 5 . 2 5 5 . 2 5 5 . 0
S1(config-if)# n o s h u t
S1(config-if)# e x i t
S1(config)# i p d e f a u l t - g a t e w a y 1 9 2 . 1 6 8 . 9 9 . 1
S1(config)#

Step 3. Congure access ports. Next, port Fa0/6 connecting to PC1 is

congured as an access port in VLAN 10, as shown in Example 4-3.
Assume PC1 has been congured with the correct IP address and default
gateway.

Example 4-3 Congure Access Ports

S1(config)# i n t e r f a c e f a 0 / 6
S1(config-if)# s w i t c h p o r t m o d e a c c e s s
S1(config-if)# s w i t c h p o r t a c c e s s v l a n 1 0
S1(config-if)# n o s h u t
S1(config-if)# e x i t
S1(config)#

Step 4. Congure trunking ports. Finally, ports Fa0/1 connecting to S2

and Fa05 connecting to R1 are congured as trunk ports, as shown in
Example 4-4.

Example 4-4 Congure Trunking Ports

S1(config)# i n t e r f a c e f a 0 / 1
S1(config-if)# s w i t c h p o r t m o d e t r u n k
S1(config-if)# n o s h u t
S1(config-if)# e x i t
S1(config)# i n t e r f a c e f a 0 / 5
S1(config-if)# s w i t c h p o r t m o d e t r u n k
S1(config-if)# n o s h u t
S1(config-if)# e n d
*Mar 1 00:23:43.093: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet0/1, changed state to up
*Mar 1 00:23:44.511: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet0/5, changed state to up

S2 VLAN and Trunking Conguration (4.2.3)

The conguration for S2 is similar to S1, as shown in Example 4-5.

Example 4-5 S2 Conguration

S2(config)# v l a n 10
S2(config-vlan)# name LAN10
S2(config-vlan)# exit
S2(config)# v l a n 20
S2(config-vlan)# name LAN20
S2(config-vlan)# exit
S2(config)# v l a n 99
S2(config-vlan)# name Management

[Link] 7/28
2021/2/17 Inter-VLAN Routing | Objectives

S2(config-vlan)# e x i t
S2(config)#
S2(config)# i n t e r f a c e v l a n 9 9
S2(config-if)# i p a d d 1 9 2 . 1 6 8 . 9 9 . 3 2 5 5 . 2 5 5 . 2 5 5 . 0
S2(config-if)# n o s h u t
S2(config-if)# e x i t
S2(config)# i p d e f a u l t - g a t e w a y 1 9 2 . 1 6 8 . 9 9 . 1
S2(config)# i n t e r f a c e f a 0 / 1 8
S2(config-if)# s w i t c h p o r t m o d e a c c e s s
S2(config-if)# s w i t c h p o r t a c c e s s v l a n 2 0
S2(config-if)# n o s h u t
S2(config-if)# e x i t
S2(config)# i n t e r f a c e f a 0 / 1
S2(config-if)# s w i t c h p o r t m o d e t r u n k
S2(config-if)# n o s h u t
S2(config-if)# e x i t
S2(config-if)# e n d
*Mar 1 00:23:52.137: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet0/1, changed state to up

R1 Subinterface Conguration (4.2.4)

The router-on-a-stick method requires you to create a subinterface for each
VLAN to be routed.

A subinterface is created using the interface interface_id.subinterface_id global

conguration mode command. The subinterface syntax is the physical interface
followed by a period and a subinterface number. Although not required, it is
customary to match the subinterface number with the VLAN number.

Each subinterface is then congured with the following two commands:

encapsulation dot1q vlan_id [native]: This command congures the

subinterface to respond to 802.1Q encapsulated trac from the specied
vlan-id. The native keyword option is only appended to set the native
VLAN to something other than VLAN 1.

ip address ip-address subnet-mask: This command congures the IPv4

address of the subinterface. This address typically serves as the default
gateway for the identied VLAN.

Repeat the process for each VLAN to be routed. Each router subinterface must
be assigned an IP address on a unique subnet for routing to occur.

When all subinterfaces have been created, enable the physical interface using
the no shutdown interface conguration command. If the physical interface is
disabled, all subinterfaces are disabled.

In the conguration in Example 4-6, the R1 G0/0/1 subinterfaces are congured

for VLANs 10, 20, and 99.

Example 4-6 R1 Subinterface Conguration

R1(config)# i n t e r f a c e G 0 / 0 / 1 . 1 0
R1(config-subif)# d e s c r i p t i o n D e f a u l t Gateway for VLAN 10
R1(config-subif)# e n c a p s u l a t i o n d o t 1 Q 10
R1(config-subif)# i p a d d 1 9 2 . 1 6 8 . 1 0 . 1 [Link]
R1(config-subif)# e x i t
R1(config)#
R1(config)# i n t e r f a c e G 0 / 0 / 1 . 2 0
R1(config-subif)# d e s c r i p t i o n D e f a u l t Gateway for VLAN 20
R1(config-subif)# e n c a p s u l a t i o n d o t 1 Q 20
R1(config-subif)# i p a d d 1 9 2 . 1 6 8 . 2 0 . 1 [Link]
R1(config-subif)# e x i t
R1(config)#
R1(config)# i n t e r f a c e G 0 / 0 / 1 . 9 9
R1(config-subif)# d e s c r i p t i o n D e f a u l t Gateway for VLAN 99
R1(config-subif)# e n c a p s u l a t i o n d o t 1 Q 99

[Link] 8/28
2021/2/17 Inter-VLAN Routing | Objectives

R1(config-subif)# i p a d d 1 9 2 . 1 6 8 . 9 9 . 1 2 5 5 . 2 5 5 . 2 5 5 . 0
R1(config-subif)# e x i t
R1(config)#
R1(config)# i n t e r f a c e G 0 / 0 / 1
R1(config-if)# d e s c r i p t i o n T r u n k l i n k t o S 1
R1(config-if)# n o s h u t
R1(config-if)# e n d
R1#
*Sep 15 19:08:47.015: %LINK-3-UPDOWN: Interface GigabitEthernet0/0/1, changed
state to down
*Sep 15 19:08:50.071: %LINK-3-UPDOWN: Interface GigabitEthernet0/0/1, changed
state to up
*Sep 15 19:08:51.071: %LINEPROTO-5-UPDOWN: Line protocol on Interface
GigabitEthernet0/0/1, changed state to up
R1#

Verify Connectivity Between PC1 and PC2 (4.2.5)

The router-on-a-stick conguration is complete after the switch trunk and the
router subinterfaces have been congured. The conguration can be veried
from the hosts, router, and switch.

From a host, verify connectivity to a host in another VLAN using the ping
command. It is a good idea to rst verify the current host IP conguration using
the ipcong Windows host command, as shown in Example 4-7.

Example 4-7 Verify Windows Host Conguration

C:\Users\PC1> i p c o n f i g
Windows IP Configuration
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . :
Link-local IPv6 Address : fe80::5c43:ee7c:2959:da68%6
IPv4 Address : [Link]
Subnet Mask : [Link]
Default Gateway : [Link]
C:\Users\PC1>

The output conrms the IPv4 address and default gateway of PC1. Next, use
ping to verify connectivity with PC2 and S1, as shown in Figure 4-5. The ping
output successfully conrms that inter-VLAN routing is operating, as shown in
Example 4-8.

Example 4-8 Verify Inter-VLAN Routing by Pinging from PC1

C:\Users\PC1> p i n g 1 9 2 . 1 6 8 . 2 0 . 1 0
Pinging [Link] with 32 bytes of data:
Reply from [Link]: bytes=32 time<1ms TTL=127
Reply from [Link]: bytes=32 time<1ms TTL=127
Reply from [Link]: bytes=32 time<1ms TTL=127
Reply from [Link]: bytes=32 time<1ms TTL=127
Ping statistics for [Link]:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss).
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
C:\Users\PC1>
C:\Users\PC1> p i n g 1 9 2 . 1 6 8 . 9 9 . 2
Pinging [Link] with 32 bytes of data:
Request timed out.
Request timed out.
Reply from [Link]: bytes=32 time=2ms TTL=254
Reply from [Link]: bytes=32 time=1ms TTL=254 |
Ping statistics for [Link]:
Packets: Sent = 4, Received = 2, Lost = 2 (50% loss).
Approximate round trip times in milli-seconds:

[Link] 9/28
2021/2/17 Inter-VLAN Routing | Objectives

Minimum = 1ms, Maximum = 2ms, Average = 1ms

C:\Users\PC1>

Router-on-a-Stick Inter-VLAN Routing Verication (4.2.6)

In addition to using ping between devices, the following show commands can
be used to verify and troubleshoot the router-on-a-stick conguration.

show ip route

show ip interface brief

show interfaces

show interfaces trunk

As shown in Example 4-9, verify that the subinterfaces are appearing in the
routing table of R1 by using the show ip route command. Notice that there are
three connected routes (C) and their respective exit interfaces for each routable
VLAN. The output conrms that the correct subnets, VLANs, and subinterfaces
are active.

Example 4-9 Verify Subinterfaces Are in Routing Table

R1# s h o w i p r o u t e | b e g i n G a t e w a y
Gateway of last resort is not set
[Link]/24 is variably subnetted, 2 subnets, 2 masks
C [Link]/24 is directly connected, GigabitEthernet0/0/1.10
L [Link]/32 is directly connected, GigabitEthernet0/0/1.10
[Link]/24 is variably subnetted, 2 subnets, 2 masks
C [Link]/24 is directly connected, GigabitEthernet0/0/1.20
L [Link]/32 is directly connected, GigabitEthernet0/0/1.20
[Link]/24 is variably subnetted, 2 subnets, 2 masks
C [Link]/24 is directly connected, GigabitEthernet0/0/1.99
L [Link]/32 is directly connected, GigabitEthernet0/0/1.99
R1#

Another useful router command is show ip interface brief, as shown in Example

4-10. The output conrms that the subinterfaces have the correct IPv4 address
congured, and that they are operational.

Example 4-10 Verify Subinterface IP Addresses and Status

R1# s h o w i p i n t e r f a c e b r i e f | i n c l u d e up
GigabitEthernet0/0/1 unassigned YES unset up up
Gi0/0/1.10 [Link] YES manual up up
Gi0/0/1.20 [Link] YES manual up up
Gi0/0/1.99 [Link] YES manual up up
R1#

Subinterfaces can be veried using the show interfaces subinterface-id

command, as shown in Example 4-11.

Example 4-11 Verify Details of the Subinterface

R1# s h o w i n t e r f a c e s g 0 / 0 / 1 . 1 0
GigabitEthernet0/0/1.10 is up, line protocol is up
Hardware is ISR4221-2x1GE, address is 10b3.d605.0301 (bia 10b3.d605.0301)
Description: Default Gateway for VLAN 10
Internet address is [Link]/24
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation 802.1Q Virtual LAN, Vlan ID 10.
ARP type: ARPA, ARP Timeout 04:00:00
Keepalive not supported

[Link] 10/28
2021/2/17 Inter-VLAN Routing | Objectives

Last clearing of "show interface" counters never

R1#

The misconguration could also be on the trunking port of the switch. Therefore,
it is also useful to verify the active trunk links on a Layer 2 switch by using the
show interfaces trunk command, as shown in Example 4-12. The output
conrms that the link to R1 is trunking for the required VLANs.

NOTE

Although VLAN 1 was not explicitly congured, it was automatically included

because control trac on trunk links will always be forwarded on VLAN 1.

Example 4-12 Verify Trunk Link Status

S1# s h o w i n t e r f a c e s t r u n k
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 1
Fa0/5 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1-4094
Fa0/5 1-4094
Port Vlans allowed and active in management domain
Fa0/1 1,10,20,99
Fa0/5 1,10,20,99
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 1,10,20,99
Fa0/5 1,10,20,99
S1#

PACKET TRACER—CONFIGURE ROUTER-ON-A-STICK INTER-VLAN ROUTING

(4.2.7)

In this Packet Tracer activity, you check for connectivity prior to implementing
inter-VLAN routing. Then you congure VLANs and inter-VLAN routing. Finally,
you enable trunking and verify connectivity between VLANs.

LAB—CONFIGURE ROUTER-ON-A-STICK INTER-VLAN ROUTING (4.2.8)

In this lab, you complete the following objectives:

Part 1: Build the Network and Congure Basic Device Settings

Part 2: Congure Switches with VLANs and Trunking

Part 3: Congure Trunk-Based Inter-VLAN Routing

Inter-VLAN Routing using Layer 3 Switches (4.3)

In this section, you congure inter-VLAN routing using Layer 3 switches.

Layer 3 Switch Inter-VLAN Routing (4.3.1)

Modern enterprise networks rarely use router-on-a-stick because it does not
scale easily to meet requirements. In these very large networks, network
administrators use Layer 3 switches to congure inter-VLAN routing.

Inter-VLAN routing using the router-on-a-stick method is simple to implement

for a small- to medium-sized organization. However, a large enterprise requires

[Link] 11/28
2021/2/17 Inter-VLAN Routing | Objectives

a faster, much more scalable method to provide inter-VLAN routing.

Enterprise campus LANs use Layer 3 switches to provide inter-VLAN routing.

Layer 3 switches use hardware-based switching to achieve higher-packet
processing rates than routers. Layer 3 switches are also commonly implemented
in enterprise distribution layer wiring closets.

Capabilities of a Layer 3 switch include the ability to do the following:

Route from one VLAN to another using multiple switched virtual interfaces
(SVIs).

Convert a Layer 2 switchport to a Layer 3 interface (that is, a routed port).

A routed port is similar to a physical interface on a Cisco IOS router.

To provide inter-VLAN routing, Layer 3 switches use SVIs. SVIs are congured
using the same interface vlan vlan-id command used to create the management
SVI on a Layer 2 switch. A Layer 3 SVI must be created for each of the routable
VLANs.

Layer 3 Switch Scenario (4.3.2)

In Figure 4-6, the Layer 3 switch, D1, is connected to two hosts on dierent
VLANs. PC1 is in VLAN 10, and PC2 is in VLAN 20, as shown. The Layer 3
switch will provide inter-VLAN routing services to the two hosts.

Figure 4-6 Layer 3 Switch Inter-VLAN Routing Topology

Table 4-3 shows the IP addresses for each VLAN.

Table 4-3 D1 VLAN IP Addresses

VLAN Interface IP Address

10 [Link]/24
20 [Link]/24

Layer 3 Switch Conguration (4.3.3)

Complete the following steps to congure S1 with VLANs and trunking:

Step 1. Create the VLANs. First, create the two VLANs as shown in
Example 4-13.

[Link] 12/28
2021/2/17 Inter-VLAN Routing | Objectives

Example 4-13 Create the VLANs

D1(config)# v l a n 10
D1(config-vlan)# name LAN10
D1(config-vlan)# vlan 20
D1(config-vlan)# name LAN20
D1(config-vlan)# exit
D1(config)#

Step 2. Create the SVI VLAN interfaces. Congure the SVI for VLANs 10
and 20, as shown in Example 4-14. The IP addresses that are congured
will serve as the default gateways to the hosts in the respective VLANs.
Notice the informational messages showing the line protocol on both SVIs
changed to up.

Example 4-14 Create the SVI VLAN Interfaces

D1(config)# i n t e r f a c e v l a n 1 0
D1(config-if)# d e s c r i p t i o n D e f a u l t G a t e w a y S V I f o r 1 9 2 . 1 6 8 . 1 0 . 0 / 2 4
D1(config-if)# i p a d d 1 9 2 . 1 6 8 . 1 0 . 1 2 5 5 . 2 5 5 . 2 5 5 . 0
D1(config-if)# n o s h u t
D1(config-if)# e x i t
D1(config)#
D1(config)# i n t v l a n 2 0
D1(config-if)# d e s c r i p t i o n D e f a u l t G a t e w a y S V I f o r 1 9 2 . 1 6 8 . 2 0 . 0 / 2 4
D1(config-if)# i p a d d 1 9 2 . 1 6 8 . 2 0 . 1 2 5 5 . 2 5 5 . 2 5 5 . 0
D1(config-if)# n o s h u t
D1(config-if)# e x i t
D1(config)#
*Sep 17 13:52:16.053: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan10,
changed state to up
*Sep 17 13:52:16.160: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan20,
changed state to up

Step 3. Congure access ports. Next, congure the access ports

connecting to the hosts and assign them to their respective VLANs, as
shown in Example 4-15.

Example 4-15 Congure Access Ports

D1(config)# i n t e r f a c e G i g a b i t E t h e r n e t 1 / 0 / 6
D1(config-if)# d e s c r i p t i o n A c c e s s p o r t t o P C 1
D1(config-if)# s w i t c h p o r t m o d e a c c e s s
D1(config-if)# s w i t c h p o r t a c c e s s v l a n 1 0
D1(config-if)# e x i t
D1(config)#
D1(config)# i n t e r f a c e G i g a b i t E t h e r n e t 1 / 0 / 1 8
D1(config-if)# d e s c r i p t i o n A c c e s s p o r t t o P C 2
D1(config-if)# s w i t c h p o r t m o d e a c c e s s
D1(config-if)# s w i t c h p o r t a c c e s s v l a n 2 0
D1(config-if)# e x i t

Step 4. Enable IP routing. Finally, enable IPv4 routing with the ip routing
global conguration command to allow trac to be exchanged between
VLANs 10 and 20, as shown in Example 4-16. This command must be
congured to enable inter-VAN routing on a Layer 3 switch for IPv4.

Example 4-16 Enable IP Routing

D1(config)# i p r o u t i n g
D1(config)#

Layer 3 Switch Inter-VLAN Routing Verication (4.3.4)

[Link] 13/28
2021/2/17 Inter-VLAN Routing | Objectives

Inter-VLAN routing using a Layer 3 switch is simpler to congure than the

router-on-a-stick method. After the conguration is complete, the conguration
can be veried by testing connectivity between the hosts.

From a host, verify connectivity to a host in another VLAN using the ping
command. It is a good idea to rst verify the current host IP conguration using
the ipcong Windows host command. The output in Example 4-17 conrms the
IPv4 address and default gateway of PC1.

Example 4-17 Verify Windows Host Conguration

C:\Users\PC1> i p c o n f i g
Windows IP Configuration
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . :
Link-local IPv6 Address : fe80::5c43:ee7c:2959:da68%6
IPv4 Address : [Link]
Subnet Mask : [Link]
Default Gateway : [Link]
C:\Users\PC1>

Next, verify connectivity with PC2 using the ping Windows host command, as
shown in Example 4-18. The ping output successfully conrms that inter-VLAN
routing is operating.

Example 4-18 Verify Inter-VLAN Routing by Pinging from PC1

C:\Users\PC1> p i n g 1 9 2 . 1 6 8 . 2 0 . 1 0
Pinging [Link] with 32 bytes of data:
Reply from [Link]: bytes=32 time<1ms TTL=127
Reply from [Link]: bytes=32 time<1ms TTL=127
Reply from [Link]: bytes=32 time<1ms TTL=127
Reply from [Link]: bytes=32 time<1ms TTL=127
Ping statistics for [Link]:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
C:\Users\PC1>

Routing on a Layer 3 Switch (4.3.5)

If VLANs are to be reachable by other Layer 3 devices, they must be advertised
using static or dynamic routing. To enable routing on a Layer 3 switch, a routed
port must be congured.

A routed port is created on a Layer 3 switch by disabling the switchport feature

on a Layer 2 port that is connected to another Layer 3 device. Specically,
conguring the no switchport interface conguration command on a Layer 2 port
converts it into a Layer 3 interface. Then the interface can be congured with an
IPv4 conguration to connect to a router or another Layer 3 switch.

Routing Scenario on a Layer 3 Switch (4.3.6)

In Figure 4-7, the previously congured D1 Layer 3 switch is now connected to
R1. R1 and D1 are both in an Open Shortest Path First (OSPF) routing protocol
domain. Assume inter-VLAN has been successfully implemented on D1. The
G0/0/1 interface of R1 has also been congured and enabled. Additionally, R1 is
using OSPF to advertise its two networks, [Link]/24 and [Link]/24.

[Link] 14/28
2021/2/17 Inter-VLAN Routing | Objectives

Figure 4-7 Routing Scenario on a Layer 3 Switch Topology

NOTE

OSPF routing conguration is covered in another course. In this module, OSPF

conguration commands will be given to you in all activities and assessments. It
is not required that you understand the conguration in order to enable OSPF
routing on the Layer 3 switch.

Routing Conguration on a Layer 3 Switch (4.3.7)

Complete the following steps to congure D1 to route with R1:

Step 1. Congure the routed port. Congure G1/0/1 to be a routed port,

assign it an IPv4 address, and enable it, as shown in Example 4-19.

Example 4-19 Congure the Routed Port

D1(config)# i n t e r f a c e G i g a b i t E t h e r n e t 1 / 0 / 1
D1(config-if)# d e s c r i p t i o n r o u t e d P o r t L i n k t o R 1
D1(config-if)# n o s w i t c h p o r t
D1(config-if)# i p a d d r e s s 1 0 . 1 0 . 1 0 . 2 2 5 5 . 2 5 5 . 2 5 5 . 0
D1(config-if)# n o s h u t
D1(config-if)# e x i t
D1(config)#

Step 2. Enable routing, as shown in Example 4-20. Ensure IPv4 routing is

enabled with the ip routing global conguration command.

Example 4-20 Enable Routing

D1(config)# i p r o u t i n g
D1(config)#

Step 3. Congure routing. Congure the OSPF routing protocol to

advertise the VLAN 10 and VLAN 20 networks, along with the network
that is connected to R1, as shown in Example 4-21. Notice the message
informing you that an adjacency has been established with R1.

Example 4-21 Congure Routing

D1(config)# r o u t e r o s p f 1 0
D1(config-router)# n e t w o r k 1 9 2 . 1 6 8 . 1 0 . 0 0 . 0 . 0 . 2 5 5 a r e a 0
D1(config-router)# n e t w o r k 1 9 2 . 1 6 8 . 2 0 . 0 0 . 0 . 0 . 2 5 5 a r e a 0
D1(config-router)# n e t w o r k 1 0 . 1 0 . 1 0 . 0 0 . 0 . 0 . 3 a r e a 0
D1(config-router)# ^ Z
D1#
*Sep 17 13:52:51.163: %OSPF-5-ADJCHG: Process 10, Nbr [Link] on

[Link] 15/28
2021/2/17 Inter-VLAN Routing | Objectives

GigabitEthernet1/0/1 from LOADING to FULL, Loading Done

D1#

Step 4. Verify routing. Verify the routing table on D1, as shown in Example
4-22. Notice that D1 now has a route to the [Link]/24 network.

Example 4-22 Verify Routing

D1# s h o w i p r o u t e | b e g i n G a t e w a y
Gateway of last resort is not set
[Link]/8 is variably subnetted, 3 subnets, 3 masks
C [Link]/30 is directly connected, GigabitEthernet1/0/1
L [Link]/32 is directly connected, GigabitEthernet1/0/1
O [Link]/24 [110/2] via [Link], 00:00:06, GigabitEthernet1/0/1
[Link]/24 is variably subnetted, 2 subnets, 2 masks
C [Link]/24 is directly connected, Vlan10
L [Link]/32 is directly connected, Vlan10
[Link]/24 is variably subnetted, 2 subnets, 2 masks
C [Link]/24 is directly connected, Vlan20
L [Link]/32 is directly connected, Vlan20
D1#

Step 5. Verify connectivity. At this time, PC1 and PC2 are able to ping the
server connected to R1, as shown in Example 4-23.

Example 4-23 Verify Connectivity

C:\Users\PC1> p i n g 1 0 . 2 0 . 2 0 . 2 5 4
Pinging [Link] with 32 bytes of data:
Request timed out.
Reply from [Link]: bytes=32 time<1ms TTL=127
Reply from [Link]: bytes=32 time<1ms TTL=127
Reply from [Link]: bytes=32 time<1ms TTL=127
Ping statistics for [Link]:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss).
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 2ms, Average = 1ms
C:\Users\PC1>
!==================================================
C:\Users\PC2> ping [Link]
Pinging [Link] with 32 bytes of data:
Reply from [Link]: bytes=32 time<1ms TTL=127
Reply from [Link]: bytes=32 time<1ms TTL=127
Reply from [Link]: bytes=32 time<1ms TTL=127
Reply from [Link]: bytes=32 time<1ms TTL=127
Ping statistics for [Link]:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss).
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 2ms, Average = 1ms
C:\Users\PC2>

PACKET TRACER—CONFIGURE LAYER 3 SWITCHING AND INTER-VLAN

ROUTING (4.3.8)

In this Packet Tracer activity, you congure Layer 3 switching and Inter-VLAN
routing on a Cisco 3560 switch.

Troubleshoot Inter-VLAN Routing (4.4)

In this section, you learn how to troubleshoot issues in an inter-VLAN routing
environment.

[Link] 16/28
2021/2/17 Inter-VLAN Routing | Objectives

Common Inter-VLAN Issues (4.4.1)

By now, you know that when you congure and verify, you must also be able to
troubleshoot. This section discusses some common network problems
associated with inter-VLAN routing.

There are a number of reasons why an inter-VAN conguration may not work.
All are related to connectivity issues. First, check the physical layer to resolve
any issues where a cable might be connected to the wrong port. If the
connections are correct, use the list in Table 4-4 for other common reasons why
inter-VLAN connectivity may fail.

Table 4-4 Common Inter-VLAN Issues

Issue Type How to Fix How to Verify

Create (or re-create) the VLAN s h o w v l a n [brief]
if it does not exist.
show interfaces
Missing VLANs
Ensure host port is assigned to s w i t c h p o r t
the correct VLAN.
ping
Ensure trunks are congured
show interfaces
correctly.
Switch Trunk trunk
Port Issues Ensure port is a trunk port and
show running-
enabled.
config
Assign correct VLAN to access
port. show interfaces
switchport
Switch Access Ensure port is an access port
and enabled. show running-
Port Issues
config interface
Host is incorrectly congured in
the wrong subnet. ipconfig

Router subinterface IPv4

address is incorrectly
Router show ip interface
congured.
Conguration brief
Issues Router subinterface is assigned
show interfaces
to the VLAN ID.

Troubleshoot Inter-VLAN Routing Scenario (4.4.2)

Next, examples of some of these inter-VLAN routing problems are covered in
more detail.

The topology in Figure 4-8 will be used for all of these issues.

[Link] 17/28
2021/2/17 Inter-VLAN Routing | Objectives

Figure 4-8 Inter-VLAN Routing Troubleshooting Topology

The VLAN and IPv4 addressing information for R1 is shown in Table 4-5.

Table 4-5 Router R1 Subinterfaces

Subinterface VLAN IP Address

G0/0/0.10 10 [Link]/24
G0/0/0.20 20 [Link]/24
G0/0/0.30 99 [Link]/24

Missing VLANs (4.4.3)

An inter-VLAN connectivity issue could be caused by a missing VLAN. The
VLAN could be missing if it was not created, it was accidently deleted, or it is
not allowed on the trunk link.

For example, PC1 is currently connected to VLAN 10, as shown in the show vlan
brief command output in Example 4-24.

Example 4-24 Verify VLAN for PC1

S1# s h o w v l a n b r i e f
VLAN Name Status Ports
---- ------------------------------- --------- -------------------------------
1 default active Fa0/2, Fa0/3, Fa0/4, Fa0/7
Fa0/8, Fa0/9, Fa0/10, Fa0/11
Fa0/12, Fa0/13, Fa0/14, Fa0/15
Fa0/16, Fa0/17, Fa0/18, Fa0/19
Fa0/20, Fa0/21, Fa0/22, Fa0/23
Fa0/24, Gi0/1, Gi0/2
10 LAN10 active Fa0/6
20 LAN20 active
99 Management active
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
S1#

Now assume that VLAN 10 is accidently deleted, as shown in Example 4-25.

[Link] 18/28
2021/2/17 Inter-VLAN Routing | Objectives

Example 4-25 VLAN 10 Is Deleted

S1(config)# n o v l a n 1 0
S1(config)# d o s h o w v l a n b r i e f
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/2, Fa0/3, Fa0/4, Fa0/7
Fa0/8, Fa0/9, Fa0/10, Fa0/11
Fa0/12, Fa0/13, Fa0/14, Fa0/15
Fa0/16, Fa0/17, Fa0/18, Fa0/19
Fa0/20, Fa0/21, Fa0/22, Fa0/23
Fa0/24, Gi0/1, Gi0/2
20 LAN20 active
99 Management active
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
S1(config)#

Notice that VLAN 10 is now missing from the output in Example 4-25. Also
notice that port Fa0/6 has not been reassigned to the default VLAN. The reason
is because when you delete a VLAN, any ports assigned to that VLAN become
inactive. They remain associated with the VLAN (and thus inactive) until you
assign them to a new VLAN or re-create the missing VLAN.

Use the show interface interface-id switchport command to verify the VLAN
membership, as shown in Example 4-26.

Example 4-26 Verify an Interface’s VLAN Membership

S1(config)# d o s h o w i n t e r f a c e f a 0 / 6 s w i t c h p o r t
Name: Fa0/6
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 10 (Inactive)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
(Output omitted)

Re-creating the missing VLAN would automatically reassign the hosts to it, as
shown in Example 4-27.

Example 4-27 Attempt to Re-create and Verify VLAN 10

S1(config)# v l a n 1 0
S1(config-vlan)# d o s h o w v l a n b r i e f
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/2, Fa0/3, Fa0/4, Fa0/7
Fa0/8, Fa0/9, Fa0/10, Fa0/11
Fa0/12, Fa0/13, Fa0/14, Fa0/15
Fa0/16, Fa0/17, Fa0/18, Fa0/19
Fa0/20, Fa0/21, Fa0/22, Fa0/23
Fa0/24, Gi0/1, Gi0/2
20 LAN20 active
99 Management active
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup

[Link] 19/28
2021/2/17 Inter-VLAN Routing | Objectives

1005 trnet-default act/unsup

S1(config-vlan)#

Notice that the VLAN has not been created as expected. The reason is because
you must exit from VLAN sub-conguration mode to create the VLAN, as shown
in Example 4-28.

Example 4-28 Exit VLAN Conguration Mode and Then Re-create and
Verify VLAN

S1(config-vlan)# e x i t
S1(config)# v l a n 1 0
S1(config)# d o s h o w v l a n b r i e f
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/2, Fa0/3, Fa0/4, Fa0/7
Fa0/8, Fa0/9, Fa0/10, Fa0/11
Fa0/12, Fa0/13, Fa0/14, Fa0/15
Fa0/16, Fa0/17, Fa0/18, Fa0/19
Fa0/20, Fa0/21, Fa0/22, Fa0/23
Fa0/24, Gi0/1, Gi0/2
10 VLAN0010 active Fa0/6
20 LAN20 active
99 Management active
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
S1(config)#

Now notice that the VLAN is included in the list and that the host connected to
Fa0/6 is on VLAN 10.

Switch Trunk Port Issues (4.4.4)

Another issue for inter-VLAN routing includes miscongured switch ports. In a
legacy inter-VLAN solution, this could be caused when the connecting router
port is not assigned to the correct VLAN.

However, with a router-on-a-stick solution, the most common cause is a

miscongured trunk port.

For example, assume PC1 was able to connect to hosts in other VLANs until
recently. A quick look at maintenance logs revealed that the S1 Layer 2 switch
was recently accessed for routine maintenance. Therefore, you suspect the
problem may be related to that switch.

On S1, verify that the port connecting to R1 (i.e., F0/5) is correctly congured as
a trunk link using the show interfaces trunk command, as shown in Example 4-
29.

Example 4-29 Verify Trunking

S1# s h o w i n t e r f a c e s t r u n k
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1-4094
Port Vlans allowed and active in management domain
Fa0/1 1,10,20,99
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 1,10,20,99
S1#

The Fa0/5 port connecting to R1 is mysteriously missing from the output. Verify
the interface conguration using the show running-cong interface fa0/5
[Link] 20/28
2021/2/17 Inter-VLAN Routing | Objectives

command, as shown in Example 4-30.

Example 4-30 Verify Interface Conguration

S1# s h o w r u n n i n g - c o n f i g i n t e r f a c e f a 0 / 5
Building configuration...
Current configuration : 96 bytes
!
interface FastEthernet0/5
description Trunk link to R1
switchport mode trunk
shutdown
end
S1#

As you can see, the port was accidently shut down. To correct the problem,
reenable the port and verify the trunking status, as shown in Example 4-31.

Example 4-31 Reenable and Verify the Port

S1(config)# i n t e r f a c e f a 0 / 5
S1(config-if)# n o s h u t
S1(config-if)#
*Mar 1 04:46:44.153: %LINK-3-UPDOWN: Interface FastEthernet0/5, changed state to
up
S1(config-if)#
*Mar 1 04:46:47.962: %LINEPROTO-5-UPDOWN: Line protocol on Interface
FastEthernet0/5, changed state to up
S1(config-if)# d o s h o w i n t e r f a c e t r u n k
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 1
Fa0/5 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1-4094
Fa0/5 1-4094
Port Vlans allowed and active in management domain
Fa0/1 1,10,20,99
Fa0/5 1,10,20,99
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 1,10,20,99
Fa0/1 1,10,20,99
S1(config-if)#

To reduce the risk of a failed inter-switch link disrupting inter-VLAN routing,

redundant links and alternate paths should be part of the network design.

Switch Access Port Issues (4.4.5)

When a problem is suspected with a switch access port conguration, use
verication commands to examine the conguration and identify the problem.

Assume PC1 has the correct IPv4 address and default gateway but is not able
to ping its own default gateway. PC1 is supposed to be connected to a VLAN 10
port.

Verify the port conguration on S1 using the show interfaces interface-id

switchport command, as shown in Example 4-32.

Example 4-32 Verify the Port Conguration

S1# s h o w i n t e r f a c e f a 0 / 6 s w i t c h p o r t
Name: Fa0/6
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
[Link] 21/28
2021/2/17 Inter-VLAN Routing | Objectives

Administrative Trunking Encapsulation: dot1q

Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none

The Fa0/6 port has been congured as an access port, as indicated by “static
access”. However, it appears that it has not been congured to be in VLAN 10.
Verify the conguration of the interface, as shown in Example 4-33.

Example 4-33 Verify the Port Conguration in the Running-Cong

S1# s h o w r u n n i n g - c o n f i g i n t e r f a c e f a 0 / 6
Building configuration...
Current configuration : 87 bytes
!
interface FastEthernet0/6
description PC-A access port
switchport mode access
end
S1#

Assign port Fa0/6 to VLAN 10 and verify the port assignment, as shown in
Example 4-34.

Example 4-34 Assign the VLAN to the Port and Verify the Conguration

S1# c o n f i g u r e t e r m i n a l
S1(config)# i n t e r f a c e f a 0 / 6
S1(config-if)# s w i t c h p o r t a c c e s s v l a n 1 0
S1(config-if)#
S1(config-if)# d o s h o w i n t e r f a c e f a 0 / 6 s w i t c h p o r t
Name: Fa0/6
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 10 (VLAN0010)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
(Output omitted)

PC1 is now able to communicate with hosts on other VLANs.

Router Conguration Issues (4.4.6)

Router-on-a-stick conguration problems are usually related to subinterface
miscongurations. For instance, an incorrect IP address was congured or the
wrong VLAN ID was assigned to the subinterface.

For example, R1 should be providing inter-VLAN routing for users in VLANs 10,
20, and 99. However, users in VLAN 10 cannot reach any other VLAN.

You veried the switch trunk link and all appears to be in order. Verify the
subinterface status using the show ip interface brief command, as shown in
Example 4-35.

Example 4-35 Verify the Status of the Subinterfaces

[Link] 22/28
2021/2/17 Inter-VLAN Routing | Objectives

R1# s h o w i p i n t e r f a c e b r i e f
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0/0 unassigned YES unset administratively down down
GigabitEthernet0/0/1 unassigned YES unset up up
Gi0/0/1.10 [Link] YES manual up up
Gi0/0/1.20 [Link] YES manual up up
Gi0/0/1.99 [Link] YES manual up up
Serial0/1/0 unassigned YES unset administratively down down
Serial0/1/1 unassigned YES unset administratively down down
R1#

The subinterfaces have been assigned the correct IPv4 addresses, and they are
operational.

Verify which VLANs each of the subinterfaces is on. To do so, the show
interfaces command is useful, but it generates a great deal of additional
unrequired output. The command output can be reduced using IOS command
lters as shown in Example 4-36.

Example 4-36 Verify the VLANs Congured on Each Subinterface

R1# s h o w i n t e r f a c e s | i n c l u d e G i g | 8 0 2 . 1 Q
GigabitEthernet0/0/0 is administratively down, line protocol is down
GigabitEthernet0/0/1 is up, line protocol is up
Encapsulation 802.1Q Virtual LAN, Vlan ID 1., loopback not set
GigabitEthernet0/0/1.10 is up, line protocol is up
Encapsulation 802.1Q Virtual LAN, Vlan ID 100.
GigabitEthernet0/0/1.20 is up, line protocol is up
Encapsulation 802.1Q Virtual LAN, Vlan ID 20.
GigabitEthernet0/0/1.99 is up, line protocol is up
Encapsulation 802.1Q Virtual LAN, Vlan ID 99.
R1#

The pipe symbol ( | ) along with some select keywords is a useful method to
help lter command output. In this example, the keyword include was used to
identify that only lines containing the letters “Gig” or “802.1Q” will be displayed.
Because of the way the show interface output is naturally listed, using these
lters produces a condensed list of interfaces and their assigned VLANs.

Notice that the G0/0/1.10 interface has been incorrectly assigned to VLAN 100
instead of VLAN 10. This is conrmed by looking at the conguration of the R1
GigabitEthernet 0/0/1.10 subinterface, as shown in Example 4-37.

Example 4-37 Verify the Conguration of the Subinterface in the

Running-Cong

R1# s h o w r u n n i n g - c o n f i g i n t e r f a c e g 0 / 0 / 1 . 1 0
Building configuration...
Current configuration : 146 bytes
!
interface GigabitEthernet0/0/1.10
description Default Gateway for VLAN 10
encapsulation dot1Q 100
ip address [Link] [Link]
end
R1#

To correct this problem, congure subinterface G0/0/1.10 to be on the correct

VLAN using the encapsulation dot1q 10 subinterface conguration mode
command, as shown in Example 4-38.

Example 4-38 Correct and Verify the Subinterface Conguration

[Link] 23/28
2021/2/17 Inter-VLAN Routing | Objectives

R1# c o n f t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)# i n t e r f a c e g i g a b i t E t h e r n e t 0 / 0 / 1 . 1 0
R1(config-subif)# e n c a p s u l a t i o n d o t 1 Q 1 0
R1(config-subif)# e n d
R1#
R1# s h o w i n t e r f a c e s | i n c l u d e G i g | 8 0 2 . 1 Q
GigabitEthernet0/0/0 is administratively down, line protocol is down
GigabitEthernet0/0/1 is up, line protocol is up
Encapsulation 802.1Q Virtual LAN, Vlan ID 1., loopback not set
GigabitEthernet0/0/1.10 is up, line protocol is up
Encapsulation 802.1Q Virtual LAN, Vlan ID 10.
GigabitEthernet0/0/1.20 is up, line protocol is up
Encapsulation 802.1Q Virtual LAN, Vlan ID 20.
GigabitEthernet0/0/1.99 is up, line protocol is up
R1#

When the subinterface has been assigned to the correct VLAN, it is accessible
by devices on that VLAN, and the router can perform inter-VLAN routing.

With verication, router conguration problems are quickly addressed, allowing

inter-VLAN routing to function properly.

CHECK YOUR UNDERSTANDING—TROUBLESHOOT INTER-VLAN ROUTING

(4.4.7)

Refer to the online course to complete this activity.

PACKET TRACER—TROUBLESHOOT INTER-VLAN ROUTING (4.4.8)

In this Packet Tracer activity, you complete the following objectives:

Part 1: Locate Network Problems

Part 2: Implement the Solution

Part 3: Verify Network Connectivity

LAB—TROUBLESHOOT INTER-VLAN ROUTING (4.4.9)

In this lab, you complete the following objectives:

Part 1: Build the Network and Load Device Congurations

Part 2: Troubleshoot the Inter-VLAN Routing Conguration

Part 3: Verify VLAN Conguration, Port Assignment, and Trunking

Part 4: Test Layer 3 Connectivity

Summary (4.5)
The following is a summary of each section in the chapter:

Inter-VLAN Routing Operation

Hosts in one VLAN cannot communicate with hosts in another VLAN unless
there is a router or a Layer 3 switch to provide routing services. Inter-VLAN
[Link] 24/28
2021/2/17 Inter-VLAN Routing | Objectives

routing is the process of forwarding network trac from one VLAN to another
VLAN. Three options include legacy, router-on-a-stick, and a Layer 3 switch
using SVIs. Legacy used a router with multiple Ethernet interfaces. Each router
interface was connected to a switch port in dierent VLANs. Requiring one
physical router interface per VLAN quickly exhausts the physical interface
capacity of a router. The router-on-a-stick inter-VLAN routing method requires
only one physical Ethernet interface to route trac between multiple VLANs on a
network. A Cisco IOS router Ethernet interface is congured as an 802.1Q trunk
and connected to a trunk port on a Layer 2 switch. The router interface is
congured using subinterfaces to identify routable VLANs. The congured
subinterfaces are software-based virtual interfaces associated with a single
physical Ethernet interface. The modern method is Inter-VLAN routing on a
Layer 3 switch using SVIs. The SVI is created for a VLAN that exists on the
switch. The SVI performs the same functions for the VLAN as a router interface.
It provides Layer 3 processing for packets being sent to or from all switch ports
associated with that VLAN.

Router-on-a-Stick Inter-VLAN Routing

To congure a switch with VLANs and trunking, complete the following steps:
create and name the VLANs, create the management interface, congure
access ports, and congure trunking ports. The router-on-a-stick method
requires a subinterface to be created for each VLAN to be routed. A
subinterface is created using the interface interface_id.subinterface_id global
conguration mode command. Each router subinterface must be assigned an IP
address on a unique subnet for routing to occur. When all subinterfaces have
been created, the physical interface must be enabled using the no shutdown
interface conguration command. From a host, verify connectivity to a host in
another VLAN using the ping command. Use ping to verify connectivity with the
host and the switch. To verify and troubleshoot, use the show ip route, show ip
interface brief, show interfaces, and show interfaces trunk commands.

Inter-VLAN Routing Using Layer 3 Switches

Enterprise campus LANs use Layer 3 switches to provide inter-VLAN routing.
Layer 3 switches use hardware-based switching to achieve higher-packet
processing rates than routers. Capabilities of a Layer 3 switch include routing
from one VLAN to another using multiple switched virtual interfaces (SVIs) and
converting a Layer 2 switch port to a Layer 3 interface (that is, a routed port). To
provide inter-VLAN routing, Layer 3 switches use SVIs. SVIs are congured
using the same interface vlan vlan-id command used to create the management
SVI on a Layer 2 switch. A Layer 3 SVI must be created for each of the routable
VLANs. To congure a switch with VLANS and trunking, complete the following
steps: create the VLANS, create the SVI VLAN interfaces, congure access
ports, and enable IP routing. From a host, verify connectivity to a host in another
VLAN using the ping command. Next, verify connectivity with the host using the
ping Windows host command. VLANs must be advertised using static or
dynamic routing. To enable routing on a Layer 3 switch, a routed port must be
congured. A routed port is created on a Layer 3 switch by disabling the switch
port feature on a Layer 2 port that is connected to another Layer 3 device. The
interface can be congured with an IPv4 conguration to connect to a router or
another Layer 3 switch. To congure a Layer 3 switch to route with a router,
follow these steps: congure the routed port, enable routing, congure routing,
verify routing, and verify connectivity.

Troubleshoot Inter-VLAN Routing

There are a number of reasons why an inter-VAN conguration may not work.
All are related to connectivity issues such as missing VLANs, switch trunk port
issues, switch access port issues, and router conguration issues. A VLAN could
be missing if it was not created, it was accidently deleted, or it is not allowed on
the trunk link. Another issue for inter-VLAN routing includes miscongured
switch ports. In a legacy inter-VLAN solution, a miscongured switch port could
be caused when the connecting router port is not assigned to the correct VLAN.
With a router-on-a-stick solution, the most common cause is a miscongured
trunk port. When a problem is suspected with a switch access port
conguration, use ping and show interfaces interface-id switchport commands
to identify the problem. Router conguration problems with router-on-a-stick

[Link] 25/28
2021/2/17 Inter-VLAN Routing | Objectives

congurations are usually related to subinterface miscongurations. Verify the

subinterface status using the show ip interface brief command.

PACKET TRACER—INTER-VLAN ROUTING CHALLENGE (4.5.1)

In this activity, you demonstrate and reinforce your ability to implement inter-
VLAN routing, including conguring IP addresses, VLANs, trunking, and
subinterfaces.

LAB—IMPLEMENT INTER-VLAN ROUTING (4.5.2)

In this lab, you complete the following objectives:

Part 1: Build the Network and Congure Basic Device Settings

Part 2: Create VLANs and Assign Switch Ports

Part 3: Congure an 802.1Q Trunk between the Switches

Part 4: Congure Inter-VLAN Routing on the S1 Switch

Part 5: Verify Inter-VLAN Routing is Working

Practice
The following activities provide practice with the topics introduced in this
chapter. The Labs are available in the companion Switching, Routing, and
Wireless Essentials Labs and Study Guide (CCNAv7) (ISBN 9780136634386).
The Packet Tracer Activity instructions are also in the Labs & Study Guide. The
PKA les are found in the online course.

LABS

Lab 4.2.8: Congure Router-on-a-Stick Inter-VLAN Routing

Lab 4.4.9: Troubleshoot Inter-VLAN Routing

Lab 4.5.2: Implement Inter-VLAN Routing

PACKET TRACER ACTIVITIES

Packet Tracer 4.2.7: Congure Router-on-a-Stick Inter-VLAN Routing

Packet Tracer 4.3.8: Congure Layer 3 Switching and Inter-VLAN Routing

Packet Tracer 4.4.8: Troubleshoot Inter-VLAN Routing

Packet Tracer 4.5.1: Inter-VLAN Routing Challenge

Check Your Understanding Questions

Complete all the review questions listed here to test your understanding of the
sections and concepts in this chapter. The appendix “Answers to the ‘Check
[Link] 26/28
2021/2/17 Inter-VLAN Routing | Objectives

Your Understanding’ Questions” lists the answers.

1. A router has two FastEthernet interfaces and needs to connect to four VLANs
in the local network. How can this be accomplished using the fewest number of
physical interfaces without unnecessarily decreasing network performance?

A. Add a second router to handle the inter-VLAN trac.

B. Implement a router-on-a-stick conguration.

C. Interconnect the VLANs via the two additional FastEthernet interfaces.

D. Use a hub to connect the four VLANS with a FastEthernet interface on the
router.

2. What distinguishes traditional legacy inter-VLAN routing from router-on-a-

stick?

A. Traditional routing is able to use only a single switch interface, whereas a

router-on-a-stick can use multiple switch interfaces.

B. Traditional routing requires a routing protocol, whereas a router-on-a-

stick only needs to route directly connected networks.

C. Traditional routing uses one port per logical network, whereas a router-
on-a-stick uses subinterfaces to connect multiple logical networks to a
single router port.

D. Traditional routing uses multiple paths to the router and therefore requires
STP, whereas router-on-a-stick does not provide multiple connections
and therefore eliminates the need for STP.

3. Subinterface G0/1.10 on R1 must be congured as the default gateway for

the VLAN 10 [Link]/24 network. Which command should be congured
on the subinterface to enable inter-VLAN routing for VLAN 10?

A. encapsulation dot1q 10

B. encapsulation vlan 10

C. switchport mode access

D. switchport mode trunk

4. What is important to consider while conguring the subinterfaces of a router

when implementing inter-VLAN routing?

A. The IP address of each subinterface must be the default gateway address

for each VLAN subnet.

B. The no shutdown command must be given on each subinterface.

C. The physical interface must have an IP address congured.

D. The subinterface numbers must match the VLAN ID number.

5. What are the steps that must be completed in order to enable inter-VLAN
routing using router-on-a-stick?

A. Congure the physical interfaces on the router and enable a routing

protocol.

B. Create the VLANs on the router and dene the port membership
assignments on the switch.

C. Create the VLANs on the switch to include port membership assignment

and enable a routing protocol on the router.

D. Create the VLANs on the switch to include port membership assignment

and congure subinterfaces on the router matching the VLANs.

[Link] 27/28
2021/2/17 Inter-VLAN Routing | Objectives

6. What two statements are true regarding the use of subinterfaces for inter-
VLAN routing? (Choose two.)

A. Fewer router Ethernet ports required than in traditional inter-VLAN routing

B. Less complex physical connection than in traditional inter-VLAN routing

C. More switch ports required than in traditional inter-VLAN routing

D. Simpler Layer 3 troubleshooting than with traditional inter-VLAN routing

E. Subinterfaces have no contention for bandwidth

7. Which router-on-a-stick command and prompt on R1 correctly encapsulates

802.1Q trac for VLAN 20?

A. R1(cong-if)# encapsulation 802.1q 20

B. R1(cong-if)# encapsulation dot1q 20

C. R1(cong-subif)# encapsulation 802.1q 20

D. R1(cong-subif)# encapsulation dot1q 20

8. What are two disadvantages of using the router-on-a-stick inter-VLAN

routing method in a large network? (Choose two.)

A. A dedicated router is required.

B. It does not scale well.

C. It requires multiple physical interfaces on a router.

D. It requires subinterfaces to be congured on the same subnets.

E. Multiple SVIs are needed.

9. What is a characteristic of a routed port on a Layer 3 switch? (Choose two.)

A. It requires the switchport mode access interface cong command.

B. It requires the no switchport interface cong command.

C. It requires the switchport access vlan vlan-id interface cong command.

D. It supports trunking.

10. What are two advantages of using a Layer 3 switch with SVIs for inter-VLAN
routing? (Choose two.)

A. A router is not required.

B. It switches packets faster than using the router-on-a-stick method.

C. SVIs can be bundled into EtherChannels.

D. SVIs can be divided using subinterfaces.

E. SVIs eliminate the need for a default gateway in the hosts.

© 2021 Pearson Education, Cisco Press. All rights reserved.

221 River Street, Hoboken, NJ 07030

[Link] 28/28