Segment the network into VLANs on the Catalyst C2960L, then route between them with sub-interfaces on the Cisco 1921 — the pattern called router-on-a-stick, because one cable carries every VLAN. No Layer-3 switch required. Eight steps: plan, build the VLANs and ports on the switch, trunk to the router, split the router port into one sub-interface per VLAN, hand out addresses, verify, and a checklist for when it doesn't work.
Decide VLAN IDs, names, subnets, and which switch ports belong to each VLAN before touching any equipment. A clear plan prevents mismatched IDs between the switch and router.
| VLAN ID | Name | Subnet | Gateway (Router) | Switch Ports |
|---|---|---|---|---|
| 10 | Staff | 192.168.10.0/24 | 192.168.10.1 | Fa0/1–Fa0/8 |
| 20 | Guests | 192.168.20.0/24 | 192.168.20.1 | Fa0/9–Fa0/16 |
| 30 | Servers | 192.168.30.0/24 | 192.168.30.1 | Fa0/17–Fa0/20 |
VLAN IDs must match exactly between the switch database, the trunk allowed list, and the router sub-interface encapsulation. A single mismatch silently breaks routing.
Same VLAN number in three places: the switch database, the trunk, the sub-interface. Miss one and nothing complains.
VLANs must be defined in the switch VLAN database before they can be assigned to ports. Undefined VLANs on a trunk are silently pruned.
Switch> enable Switch# configure terminal Switch(config)# vlan 10 Switch(config-vlan)# name Staff Switch(config-vlan)# exit Switch(config)# vlan 20 Switch(config-vlan)# name Guests Switch(config-vlan)# exit Switch(config)# vlan 30 Switch(config-vlan)# name Servers Switch(config-vlan)# exit
Run show vlan brief — all three VLANs should appear as active. VLANs 1 and 1002–1005 are defaults and cannot be deleted.
End-device ports are access ports — they carry traffic for exactly one VLAN (untagged). Use interface range to configure multiple ports at once.
! VLAN 10 — Staff devices on Fa0/1 through Fa0/8 Switch(config)# interface range FastEthernet 0/1 - 8 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 10 Switch(config-if-range)# spanning-tree portfast Switch(config-if-range)# exit ! VLAN 20 — Guest devices on Fa0/9 through Fa0/16 Switch(config)# interface range FastEthernet 0/9 - 16 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 20 Switch(config-if-range)# spanning-tree portfast Switch(config-if-range)# exit ! VLAN 30 — Servers on Fa0/17 through Fa0/20 Switch(config)# interface range FastEthernet 0/17 - 20 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 30 Switch(config-if-range)# spanning-tree portfast Switch(config-if-range)# exit
Ports skip STP listening/learning states and come up immediately. Use only on end-device ports — never on trunk ports or ports connecting to other switches.
The uplink from the switch to the router carries all VLANs tagged with 802.1Q headers. This single cable is the "stick" in router-on-a-stick — one wire, all VLANs.
! GigabitEthernet0/1 connects to router Gi0/0 Switch(config)# interface GigabitEthernet 0/1 Switch(config-if)# switchport mode trunk Switch(config-if)# switchport trunk encapsulation dot1q Switch(config-if)# switchport trunk allowed vlan 10,20,30 Switch(config-if)# no shutdown Switch(config-if)# exit Switch(config)# end Switch# write memory
One cable now carries Staff, Guest and Server traffic at the same time. Explain how the router at the other end knows which network each frame belongs to.
The switch sticks a small label on every frame before it goes up the trunk — a four-byte 802.1Q tag that says “this one is VLAN 20.” The router reads the label, hands the frame to the sub-interface whose encapsulation dot1Q 20 matches, and strips the tag off. Replies get the tag put back on the way down. That's the whole trick: the wire is shared, the labels keep the networks apart, and a wrong number on either end means the label matches nothing and the traffic silently disappears.
A trunk allows all VLANs by default. Explicitly listing only 10, 20, 30 prevents unneeded broadcast flooding. Verify with: show interfaces GigabitEthernet 0/1 trunk
On the 1921, one physical interface (Gi0/0) is divided into logical sub-interfaces — one per VLAN. Each sub-interface acts as the default gateway for its VLAN's subnet. The physical interface itself gets no IP address.
Router> enable Router# configure terminal ! Bring up the physical interface — no IP assigned here Router(config)# interface GigabitEthernet 0/0 Router(config-if)# no shutdown Router(config-if)# exit ! Sub-interface for VLAN 10 — Staff Router(config)# interface GigabitEthernet 0/0.10 Router(config-subif)# encapsulation dot1Q 10 Router(config-subif)# ip address 192.168.10.1 255.255.255.0 Router(config-subif)# no shutdown Router(config-subif)# exit ! Sub-interface for VLAN 20 — Guests Router(config)# interface GigabitEthernet 0/0.20 Router(config-subif)# encapsulation dot1Q 20 Router(config-subif)# ip address 192.168.20.1 255.255.255.0 Router(config-subif)# no shutdown Router(config-subif)# exit ! Sub-interface for VLAN 30 — Servers Router(config)# interface GigabitEthernet 0/0.30 Router(config-subif)# encapsulation dot1Q 30 Router(config-subif)# ip address 192.168.30.1 255.255.255.0 Router(config-subif)# no shutdown Router(config-subif)# exit Router(config)# end Router# write memory
The .10 suffix is arbitrary — it does not have to match the VLAN ID. Matching them is a best practice that makes configs easier to read and troubleshoot.
The 1921 can hand out IP addresses automatically to each VLAN's devices. Skip this step if you're using static IPs or a separate DHCP server.
! Exclude gateway and reserved addresses from each pool Router(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.10 Router(config)# ip dhcp excluded-address 192.168.20.1 192.168.20.10 Router(config)# ip dhcp excluded-address 192.168.30.1 192.168.30.10 ! Pool for VLAN 10 — Staff (7-day lease) Router(config)# ip dhcp pool VLAN10_STAFF Router(dhcp-config)# network 192.168.10.0 255.255.255.0 Router(dhcp-config)# default-router 192.168.10.1 Router(dhcp-config)# dns-server 8.8.8.8 8.8.4.4 Router(dhcp-config)# lease 7 Router(dhcp-config)# exit ! Pool for VLAN 20 — Guests (1-day lease) Router(config)# ip dhcp pool VLAN20_GUESTS Router(dhcp-config)# network 192.168.20.0 255.255.255.0 Router(dhcp-config)# default-router 192.168.20.1 Router(dhcp-config)# dns-server 8.8.8.8 8.8.4.4 Router(dhcp-config)# lease 1 Router(dhcp-config)# exit ! Pool for VLAN 30 — Servers (30-day lease) Router(config)# ip dhcp pool VLAN30_SERVERS Router(dhcp-config)# network 192.168.30.0 255.255.255.0 Router(dhcp-config)# default-router 192.168.30.1 Router(dhcp-config)# dns-server 8.8.8.8 8.8.4.4 Router(dhcp-config)# lease 30 Router(dhcp-config)# exit Router(config)# end Router# write memory
Confirm sub-interfaces are up, the routing table shows all three subnets, and hosts in different VLANs can reach each other through the router.
! All sub-interfaces should show up/up Router# show ip interface brief
| Interface | IP-Address | Status | Protocol |
|---|---|---|---|
| GigabitEthernet0/0 | unassigned | up | up |
| GigabitEthernet0/0.10 | 192.168.10.1 | up | up |
| GigabitEthernet0/0.20 | 192.168.20.1 | up | up |
| GigabitEthernet0/0.30 | 192.168.30.1 | up | up |
! Each VLAN subnet should appear as directly connected (C) Router# show ip route
! Ping from VLAN 10 gateway to a VLAN 20 host Router# ping 192.168.20.50 source 192.168.10.1
When inter-VLAN routing fails, work down this checklist — start at the switch access port and work toward the router.
| Symptom | Likely Cause | Fix |
|---|---|---|
| Host can't ping its own gateway | Port in wrong VLAN or not in access mode | show vlan brief — verify port is in correct VLAN |
| Sub-interface shows down/down | Physical Gi0/0 is shut down | interface Gi0/0 → no shutdown |
| VLAN missing from trunk | Not in allowed vlan list | switchport trunk allowed vlan add 10 |
| VLAN not in switch database | VLAN not created with vlan command | Create VLAN: vlan 10 → name Staff |
| Wrong encapsulation VLAN ID | Sub-if VLAN ID doesn't match switch VLAN | Check encapsulation dot1Q number matches VLAN |
| Hosts not getting DHCP | DHCP pool misconfigured | show ip dhcp pool, show ip dhcp binding |
With three subnets routing through the 1921, the natural next step is NAT so every VLAN shares the WAN address — remember to put ip nat inside on each sub-interface, not the physical port. After that, ACLs decide which VLANs may talk to each other (Guests to Servers is the classic one to block).
The ACL section shows a named extended ACL blocking Telnet from Guests to Servers.