Configuring InterVLAN Routing on Cisco Routers (Router on a stick)

A host or workstation from one Vlan can communicate with hosts located in other VLANs using a Cisco router that would handle the Layer 3 routing between the different  VLANs. The Cisco router has to be connected to the switch through a Trunk port. Each packet of traffic is marked with the VLAN number (called Vlan ID) when it is sent over a trunk port. This allows the participating devices to handle the packets correctly.
The trunk interface on the router is divided into subinterfaces with the matching IP addresses for each VLAN subnet.
Here we have an example of a configured trunk port on Cisco 2811 router that is connected to a Layer 2 switch. Note that the configuration commans will be the same for all Cisco routers like Cisco ASR1000, ISR 4000 or any other.

Video version of this article

Enter the configuration mode:

R-DELTACONFIG#conf t

Enter the interface configuration mode for the FastEthernet0/0 interface and clear previous configuration:

interface FastEthernet0/0
no shut
no ip address

Configure the interface for the default VLAN 1 that serves as the network management VLAN (notice how we don’t create a FastEthernet0/0.1 subinterface because this is the default, or native, VLAN):

interface FastEthernet0/0
ip address 192.168.1.1 255.255.255.0

Configure the subinterface for the Sales Department:
interface FastEthernet0/0.10
encapsulation dot1q 10
ip address 192.168.10.1 255.255.255.0
description Sales

Configure the subinterface for the Accounting Department:
interface FastEthernet0/0.20
encapsulation dot1q 20
ip address 192.168.20.1 255.255.255.0
description Accounting

Configure the subinterface for the Administration Department:
interface FastEthernet0/0.100
encapsulation dot1q 100
ip address 192.168.100.1 255.255.255.0
description Admins

I highly recommend to put interface descriptions under each subinterface with the “description” command. This has no effect on any other interface settings, but makes the configuration much more easier to read and return to.

Note how we reference the VLAN number (20) in the “encapsulation dot1q <20>” command and in the subinterface name “interface FastEthernet0/0.20“. You can actually enter any number you want for the subinterface (FastEthernet0/0.X), but in the encapsulation configuration string you must enter the exact and correct VLAN number of the subnet you’re configuring.
On your Layer 2 switch you also need to have a trunk port, in addition to the access ports that connect users from various VLANs (this article describes how to configure that).
After you make sure that the switch has the trunk port configured, all of the needed VLANs have been created with the correct VLAN numbers (10, 20 and 100), connect the switch trunk port to the FastEthernet0/0 interface of the router.
In order for hosts from different VLANs to be able to communicate with each other, you need to have the following in place:

• each workstation needs to be connected to an access port on the switch that is configured with the correct VLAN
• each port connected to a workstation needs to have the following configuration lines present:switchport access vlan Х
  For example, a port connecting workstation from the Accounting Department:
  switchport access vlan 20
• each workstation needs to have an IP address from the correct subnet.
  Host in the Sales Department would have an IP address of 192.168.10.5 255.255.255.0, for example
• each workstation needs to be configured with the correct default gateway – it should be set to the IP address of the subinterface on the router that belongs in the same VLAN as the workstation.
  For example, for Sales Department this would be 192.168.10.1
• All the relevant interfaces on the switch and the router need to be up and connected

The command “show ip inter brief” will show you the state of all interfaces on each device. The used interfaces should have a state of “Up/Up“.

The above configuration should result in all hosts being able to see all other hosts, no matter which VLAN they belong to (including the IP addresses on the router’s interfaces). You should check the availability issuing the “ping” command  from any host or router.

Important!

Don’t forget to save the configuration with the “write” or “copy run start” commands. Otherwise you will lose all your configuration changes after the next reload.

This article was written by Alexey Yurchenko

Back to Table of contents