Troubleshooting

Inter-VLAN Routing Not Working (Router-on-a-Stick)

VSVipul Sir · 6 min readLast updated: 22 July 2026

If hosts can reach their own VLAN but not others, inter-VLAN routing is broken at one of five points: the trunk, the sub-interface encapsulation, the sub-interface IP, the host default gateway, or the router interface being shut down.

What you see

PC1> ping 192.168.20.10
Request timed out.

R1# show ip interface brief
GigabitEthernet0/0      unassigned   YES  manual  administratively down  down

Why it happens

Router-on-a-stick carries several VLANs over one physical router interface using 802.1Q sub-interfaces. Each sub-interface handles one VLAN, tags with encapsulation dot1q <vlan>, and holds the gateway IP for that subnet.

Five things must all be true, and missing any one produces identical symptoms. The most commonly missed is the physical interface being left shut down — sub-interfaces inherit that state, so every VLAN fails at once even though the sub-interface config looks perfect.

How to confirm it

show ip interface brief
show interfaces trunk
show ip route
show vlan brief

Work outwards: is the physical interface up? Is the switch port a trunk? Do the sub-interface IPs match the hosts' default gateways? Is the VLAN actually created on the switch?

The fix

! Switch side — the link to the router must be a trunk
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
!
! Router side — one sub-interface per VLAN
interface GigabitEthernet0/0
 no shutdown
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

The sub-interface number does not have to match the VLAN ID, but making them match (Gi0/0.10 for VLAN 10) saves hours later. The encapsulation dot1Q number is what actually matters.

How to stop it happening again

Check show ip route after configuring — you should see a connected route per VLAN. If a subnet is missing there, the sub-interface is down or has no IP.

Questions people ask

Do I need a routing protocol for inter-VLAN routing?

No. Each sub-interface creates a directly connected route, and the router forwards between them automatically. Routing protocols are only needed to reach networks beyond this router.

Why do all VLANs fail at once?

Almost always because the physical interface is administratively down. Sub-interfaces cannot come up while their parent is shut.

Reading the fix is not the same as doing it

Every fault on this page can be broken and repaired on real Cisco routers and switches in our Ahmedabad lab — which is how it stops being theory. Come and see the rack before you pay anything.