Router on a stick: routing between VLANs on one interface
One physical router interface, split into logical sub-interfaces, one per VLAN. The switch port facing the router becomes an 802.1Q trunk; each sub-interface is tagged with a VLAN ID and holds that VLAN's default gateway. Inter-VLAN traffic goes up the single cable, gets routed, and comes back down it. That cable is the stick.
A router routes between networks that are on different interfaces. VLANs are different networks — but they all live on the same switch, and a small router has two or three ports, not eight. Router on a stick resolves that mismatch by making one port behave like several.
The topology
Switch side first
Nothing on the router will work until the switch is tagging. Create the VLANs, trunk the uplink, and put the access ports where they belong.
SW1(config)# vlan 10
SW1(config-vlan)# name STAFF
SW1(config)# vlan 20
SW1(config-vlan)# name VOICE
SW1(config)# vlan 30
SW1(config-vlan)# name GUEST
! The link to the router — this is the stick
SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# switchport trunk encapsulation dot1q ← older switches only
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20,30
! A user port
SW1(config)# interface range FastEthernet0/1 - 8
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 10The switchport trunk encapsulation dot1q line only exists on switches that once supported Cisco's ISL. On anything current, dot1Q is the only option and IOS rejects the command — that is expected, not an error on your part.
Router side
The physical interface gets no address. It only needs to be up. Each sub-interface then declares which VLAN tag it answers to, and carries that VLAN's gateway address.
R1(config)# interface GigabitEthernet0/0
R1(config-if)# no ip address
R1(config-if)# no shutdown ← physical port up, unaddressed
R1(config)# interface GigabitEthernet0/0.10
R1(config-subif)# encapsulation dot1Q 10 ← MUST come before the address
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config)# interface GigabitEthernet0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0
R1(config)# interface GigabitEthernet0/0.30
R1(config-subif)# encapsulation dot1Q 30
R1(config-subif)# ip address 192.168.30.1 255.255.255.0Two things to hold onto. The encapsulation command must precede the IP address — IOS will refuse the address on an unencapsulated sub-interface. And the sub-interface number is arbitrary: G0/0.10 does not have to carry VLAN 10, only the encapsulation statement decides that. Matching them anyway is a convention worth keeping, because the person troubleshooting at 3 a.m. will assume it.
The native VLAN trap
Frames in the native VLAN cross a trunk untagged. A sub-interface waiting for a tag will never see them, so that VLAN silently has no gateway — everything else works, which is what makes it hard to spot.
R1(config)# interface GigabitEthernet0/0.99
R1(config-subif)# encapsulation dot1Q 99 native ← expect untagged frames
R1(config-subif)# ip address 192.168.99.1 255.255.255.0In practice most networks avoid the problem rather than solve it: set the native VLAN to an unused ID on both ends so no user traffic ever rides untagged. Mismatched native VLANs between switch and router also generate CDP complaints, which is usually how the fault announces itself.
Verifying it
R1# show ip interface brief | include 0/0
GigabitEthernet0/0 unassigned YES manual up up
GigabitEthernet0/0.10 192.168.10.1 YES manual up up
GigabitEthernet0/0.20 192.168.20.1 YES manual up up
GigabitEthernet0/0.30 192.168.30.1 YES manual up up
R1# show ip route connected
C 192.168.10.0/24 is directly connected, GigabitEthernet0/0.10
C 192.168.20.0/24 is directly connected, GigabitEthernet0/0.20
C 192.168.30.0/24 is directly connected, GigabitEthernet0/0.30
SW1# show interfaces trunk
Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1
Port Vlans allowed and active in management domain
Gi0/1 10,20,30The physical interface reading unassigned but up/up is correct, not a fault. If a sub-interface shows down, the physical port is shut. If routes are missing, the sub-interface has no address or no encapsulation. If everything looks right and hosts still cannot reach each other, check the PCs' default gateways — that is the most common cause by a distance.
When to stop using it
Every inter-VLAN packet crosses the trunk twice — once up, once back — so a gigabit trunk gives you roughly 500 Mbps of usable inter-VLAN throughput, and the router forwards in software. It is also a single point of failure: that one cable carries every VLAN. For a branch office with one switch it is perfectly reasonable. For a campus, a layer 3 switch with switched virtual interfaces routes in hardware at line rate with no trunk bottleneck, and that comparison is on the inter-VLAN routing page.
Frequently asked
What is router on a stick?
Router on a stick is a way of routing between VLANs using a single physical router interface. The switch port facing the router is configured as an 802.1Q trunk, and the router's interface is divided into logical sub-interfaces — one per VLAN, each tagged with that VLAN's ID and holding the gateway address for it. Traffic from one VLAN arrives tagged, is routed inside the router, and leaves tagged for the destination VLAN. The name comes from the single cable, the stick, carrying every VLAN.
How do I configure router on a stick on a Cisco router?
Three parts. On the switch, set the port facing the router to trunk mode with switchport mode trunk. On the router, bring the physical interface up with no shutdown but give it no IP address. Then create one sub-interface per VLAN, numbered conventionally to match the VLAN, and under each one issue encapsulation dot1Q followed by the VLAN ID, then the ip address command with that VLAN's gateway. The encapsulation command must come before the IP address, or IOS rejects it.
What is the native VLAN problem with router on a stick?
Frames in the native VLAN cross a trunk untagged, so a sub-interface expecting a tag will never match them and that VLAN loses its gateway. There are two fixes. Add the native keyword to the sub-interface, as in encapsulation dot1Q 99 native, so the router knows to expect untagged frames. Or avoid the issue by making the native VLAN an unused one on both switch and router so no user traffic ever rides untagged. The second is the more common production practice.
Is router on a stick still used in production?
Rarely in campus networks, often in small branches. Every packet between two VLANs must travel up the trunk to the router and back down, so the single link carries the traffic twice and becomes both a bottleneck and a single point of failure. A layer 3 switch using switched virtual interfaces routes in hardware at line rate and has neither problem. Router on a stick survives where there is no layer 3 switch, typically a small site with one router and one access switch, and it remains a CCNA exam topic because it teaches trunking and tagging clearly.
Why is there no IP address on the physical interface?
Because the physical interface is not a routed endpoint here — it is a carrier for tagged sub-interfaces, and the addressing lives on those. The physical interface must still be administratively up, so no shutdown is required on it, but an IP address there would be either ignored or a source of confusion. The one exception is when you use the native keyword on a sub-interface, which is still the preferred way to handle untagged traffic rather than addressing the physical interface.
Trunking and inter-VLAN routing sit in the CCNA Network Access domain. Related: inter-VLAN routing methods compared, trunk port vs access port, and VLANs explained.