Learn Computer Networking PNETLab - Inter-VLAN Routing (Router-on-a-Stick vs Layer 3 Switch)

#Introduction

In episode 4 you deliberately made two PCs unable to ping each other because they were in different VLANs. Now it is time to reconnect them in a controlled way through Layer 3 routing. This process is called inter-VLAN routing: connecting communication between VLANs that sit in different subnets.

Episode 6 discusses two popular methods: router-on-a-stick (ROAS) which splits one physical router interface into sub-interfaces, and the Switched Virtual Interface (SVI) on a Layer 3 switch. You will configure both in PNETLab and compare them directly.

#The Inter-VLAN Routing Concept

#Connecting Different Subnets

Communication between VLANs is essentially the same as communication between subnets: it needs a router. Each VLAN has its own subnet and gateway, and the router is responsible for deciding where packets are forwarded based on the routing table. The difference from typical router-to-router routing is that this traffic enters and leaves through the same link carrying VLAN tags.

#Method 1: Router-on-a-Stick (ROAS)

#Sub-interfaces as the Gateway per VLAN

ROAS uses a single physical router interface split into several logical sub-interfaces. Each sub-interface is associated with one VLAN through dot1q encapsulation and becomes the gateway for that VLAN's subnet. In PNETLab, connect router R1 to switch SW1, then configure:

configure terminal
interface g0/0.10
 encapsulation dot1q 10
 ip address 192.168.10.1 255.255.255.0
exit
interface g0/0.20
 encapsulation dot1q 20
 ip address 192.168.20.1 255.255.255.0
exit
interface g0/0
 no shutdown

encapsulation dot1q 10 tags sub-interface g0/0.10's traffic with VLAN 10, and ip address 192.168.10.1 makes that sub-interface the gateway for the VLAN 10 subnet. The router now receives tagged frames from the trunk and routes packets between VLANs.

#Preparing the Switch for ROAS

Make sure the switch port facing the router is a trunk, and allow VLANs 10 and 20 over that trunk. PCs in VLAN 10 use gateway 192.168.10.1, PCs in VLAN 20 use 192.168.20.1. Test with a ping between PCs: frames move from the source PC to the switch, up to the router over the trunk, then back down to the destination VLAN.

#Method 2: Switched Virtual Interface (SVI)

#Enabling Routing on a Multilayer Switch

A multilayer switch can route directly. Enable the routing feature, then create an SVI — a virtual interface for each VLAN that serves as the gateway:

configure terminal
ip routing
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown
exit
interface vlan 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown
exit

ip routing enables Layer 3 routing on the switch, and interface vlan 10 creates the SVI for VLAN 10. Because routing happens inside the switch itself, inter-VLAN traffic does not need to leave to an external router — everything is handled internally in switching hardware.

#Enabling Layer 3 on Switch Interfaces

To connect a Layer 3 switch to another router, make the interface a Layer 3 routed port:

configure terminal
interface g0/0
 no switchport
 ip address 192.168.100.1 255.255.255.0
exit

no switchport changes an interface that was Layer 2 into a routed port that can be given an IP address like a router interface.

#ROAS vs SVI Comparison

#Performance and Efficiency

ROAS relies on an external router: one physical link becomes a bottleneck because all inter-VLAN traffic passes through it. Its configuration is simple and suits small networks, but its capacity is limited to the speed of one link and the router CPU.

SVI leverages the switching hardware inside the multilayer switch, making it much faster and avoiding the external bottleneck. SVI is also more scalable: adding a VLAN is just a matter of adding another interface vlan without adding cabling. The drawbacks are the higher price of a multilayer switch and the deeper Layer 3 understanding the configuration requires.

In PNETLab you can test both: run ping and observe the latency. For a small lab, ROAS with vIOS is sufficient; for simulating an enterprise core in episode 20, SVI is the more realistic choice.

#Verifying Inter-VLAN Routing

The verification commands you must try after both methods are complete:

R1# show ip route
R1# show ip interface brief
R1# ping 192.168.20.2

show ip route displays the routes the router knows, and the ping toward a PC in another VLAN is proof that inter-VLAN routing works. If the ping fails, re-check the dot1q encapsulation and the trunk status on the switch.

#Closing

Key takeaways:

• Inter-VLAN routing connects VLANs that sit in different subnets.
• ROAS splits one physical interface into dot1q-encapsulated sub-interfaces.
• SVI uses ip routing and interface vlan for switch-internal routing.
• SVI is faster and scales larger; ROAS is simple for small labs.
• Each VLAN's gateway: ROAS on the sub-interface, SVI on the interface vlan.
• Final verification is always show ip route and ping between VLANs.

In the next episode, episode 7, we discuss loop prevention: Spanning Tree Protocol (STP) and Rapid STP — the dangers of Layer 2 loops such as broadcast storms, root bridge selection and port roles, port state transitions, and the PortFast and BPDU Guard features for optimizing switches at the network edge.