Multi-VLAN Office Network with RoaS

Segment a 3-department office into VLANs and route between them.

Introduction

30 Second Summary

In most offices, you don't want the sales team's file transfers flooding the engineering team's network. Networks solve this by splitting departments into separate virtual lanes called VLANs.

In this project, you will build a multi-VLAN office network in Cisco Packet Tracer where three departments are segmented across two switches. You'll then configure a router to enable communication between them using the router-on-a-stick method.

What You'll Build

You'll watch pings fail between isolated departments, diagnose why, then bring full cross-VLAN connectivity online by configuring 802.1Q trunks and router subinterfaces.

By the end of this project, you'll have:

Three VLANs (Sales, Engineering, Management) spanning two Layer 2 switches, isolating each department's broadcast traffic.
802.1Q trunk links carrying tagged VLAN traffic between switches and up to the router.
A router-on-a-stick configuration with subinterfaces acting as the default gateway for every VLAN, enabling full inter-VLAN communication verified with ping tests and show ip route.
Secret Mission: A voice VLAN configured alongside a data VLAN on a single access port, just like real office IP phone deployments.

Are there any prerequisites?

You'll need a basic understanding of IP addressing and subnetting. You'll also need Cisco Packet Tracer installed, which is free with a Cisco Networking Academy account.

Before We Start

Before any cables get connected or commands get typed, let's lock in what you're about to build and why it matters for your networking career.

Set Up the Network Topology

Before you can configure VLANs or routing, you need a physical network to work with. Building the topology first gives you a visual map of how traffic flows between devices.

In this step, you will place all nine devices in Cisco Packet Tracer, cable them together with the correct cable types, and assign IP addresses to every PC.

In this step, get ready to:

Place and label a router, two switches, and six PCs.
Cable the topology using the correct straight-through and crossover cables.
Assign IP addresses and default gateways to all PCs, then verify connectivity.

Place and cable the network devices

You will place nine devices in the workspace and connect them with Ethernet cables. The cable type matters because switches transmit on different pins than PCs and routers.

Press Cmd+Space (macOS) or the Windows key (Windows) to open your search bar.
Type Packet Tracer and press Enter to open it.
Click the Network Devices icon in the bottom toolbar, then click Routers in the submenu.
Locate the 1941 router and drag it into the workspace.
Click the label beneath the router (it defaults to Router0) and rename it to R1.
Click Switches in the submenu.
Drag two 2960 switches into the workspace.
Rename them SW1 and SW2.

You should see R1, SW1, and SW2 in your workspace.

Click the End Devices icon in the bottom toolbar.
Drag six PC devices into the workspace.
Rename them PC1 through PC6.
Arrange the devices so SW1 is on the left, SW2 is on the right, R1 is above SW1, PC1/PC3/PC5 are below SW1, and PC2/PC4/PC6 are below SW2.

All nine devices should now be visible in the workspace. Next you will cable them together.

Why does cable type matter?

Switches transmit and receive on different pin pairs than PCs and routers. A Copper Straight-Through cable works when connecting unlike devices (PC to switch, switch to router). A Copper Cross-Over cable is needed for like devices (switch to switch).

For the CCNA exam, you must know which cable type to use even though modern devices support auto-MDIX.

Click the Connections icon (lightning bolt) in the bottom toolbar.
Select Copper Cross-Over from the cable list.
Click SW1 and choose GigabitEthernet0/1 from the popup.
Click SW2 and choose GigabitEthernet0/1 from the popup.

A cable now connects SW1 to SW2. The link lights may initially flash orange, then turn green.

Select Copper Straight-Through from the cable list.
Click SW1 and choose GigabitEthernet0/2.
Click R1 and choose GigabitEthernet0/0.

SW1 is now linked to R1. Connect the six PCs using the same Copper Straight-Through cable.

Click PC1 and choose FastEthernet0. Then click SW1 and choose FastEthernet0/1.
Click PC3 and choose FastEthernet0. Then click SW1 and choose FastEthernet0/2.
Click PC5 and choose FastEthernet0. Then click SW1 and choose FastEthernet0/3.
Click PC2 and choose FastEthernet0. Then click SW2 and choose FastEthernet0/1.
Click PC4 and choose FastEthernet0. Then click SW2 and choose FastEthernet0/2.
Click PC6 and choose FastEthernet0. Then click SW2 and choose FastEthernet0/3.

Wait a few seconds for all link lights to turn green. Every connection in your topology should show green indicators on both ends.

Seeing orange or red link lights?

Orange lights on switch ports are normal for the first 30 seconds while Spanning Tree Protocol (STP) converges. Wait and they will turn green.

Red lights mean the cable type is wrong or you selected the wrong port. Delete the cable (click it and press Delete) and reconnect using the correct cable type and port numbers listed above.

Need more help? Why are my link lights red in Packet Tracer?

Assign IP addresses to all PCs

Each PC needs a static IP address, subnet mask, and default gateway. The gateway points to the router subinterface you will create later, but you configure it now so everything is ready.

Click PC1 to open its configuration window.
Click the Desktop tab.
Click IP Configuration.
Enter 192.168.10.10 in the IPv4 Address field.
Enter 255.255.255.0 in the Subnet Mask field.
Enter 192.168.10.1 in the Default Gateway field.
Close the PC1 window.

Repeat this process for PC2 through PC6, using the values from this table:

PC2 (Sales, SW2): IP 192.168.10.20, Mask 255.255.255.0, Gateway 192.168.10.1.
PC3 (Engineering, SW1): IP 192.168.20.10, Mask 255.255.255.0, Gateway 192.168.20.1.
PC4 (Engineering, SW2): IP 192.168.20.20, Mask 255.255.255.0, Gateway 192.168.20.1.
PC5 (Management, SW1): IP 192.168.30.10, Mask 255.255.255.0, Gateway 192.168.30.1.
PC6 (Management, SW2): IP 192.168.30.20, Mask 255.255.255.0, Gateway 192.168.30.1.

Why set the gateway now?

The default gateway tells each PC where to send traffic destined for a different subnet. Right now the router has no IP addresses configured, so the gateway address does not respond yet. You set it now so you do not have to revisit every PC later.

✔️ Awesome, I've got everything!

Great. Make sure you have closed each PC's configuration window after entering the values.

ⓧ I'd like to double check the full configuration

Verify each PC matches these exact settings:

PC1: IP 192.168.10.10, Mask 255.255.255.0, Gateway 192.168.10.1.
PC2: IP 192.168.10.20, Mask 255.255.255.0, Gateway 192.168.10.1.
PC3: IP 192.168.20.10, Mask 255.255.255.0, Gateway 192.168.20.1.
PC4: IP 192.168.20.20, Mask 255.255.255.0, Gateway 192.168.20.1.
PC5: IP 192.168.30.10, Mask 255.255.255.0, Gateway 192.168.30.1.
PC6: IP 192.168.30.20, Mask 255.255.255.0, Gateway 192.168.30.1.

Test baseline connectivity

Right now every port on both switches lives on the default VLAN 1. There is no segmentation. This is the flat network problem: every device receives every broadcast, and there is no logical separation between departments.

Before you run this ping, what do you think will happen? All six PCs sit on the same default VLAN with no segmentation in place.

Click PC1 to open it.
Click the Desktop tab, then click Command Prompt.
Type the following ping command and press Enter:

ping 192.168.20.10

You should see replies from 192.168.20.10 (PC3). The ping succeeds because all ports are on the same VLAN 1, so the switches forward traffic everywhere.

Now ping PC5 to verify a third subnet also works:

ping 192.168.30.10

This also succeeds. Every PC can reach every other PC regardless of subnet. This is exactly the problem VLANs will solve in the next step.

What is a flat network?

A flat network has all devices in a single broadcast domain. Every frame sent by any PC is flooded to all other PCs. This means no security boundaries between departments and wasted bandwidth from unnecessary broadcasts.

VLANs solve this by splitting one physical switch into multiple logical segments. Traffic stays within its VLAN unless a Layer 3 device (a router) forwards it.

Ping shows Request timed out?

Double-check that all link lights are green. Orange lights mean STP is still converging. Wait 30 seconds and try again.

Verify the IP address on the destination PC. Click PC3, go to Desktop > IP Configuration, and confirm the IP is 192.168.20.10.

Still stuck? Help me troubleshoot why my ping between PCs is timing out in Packet Tracer.

Your flat network is up and running. Every PC can reach every other PC with no restrictions. In the next step, you will create VLANs to segment this network by department and watch that open connectivity disappear.

Create VLANs and Assign Access Ports

Your topology is cabled and every PC can reach every other PC. That flat network is the problem. A single broadcast from any device floods all six PCs, and there is no logical separation between Sales, Engineering, and Management.

VLANs segment the network into isolated broadcast domains. In this step, you'll create three VLANs and assign each PC to the correct department. You'll then discover what "isolated" really means.

In this step, get ready to:

Create VLANs 10, 20, and 30 on both switches.
Assign access ports to place each PC in its department VLAN.
Discover the connectivity trade-off of VLAN segmentation.

Create VLANs on both switches

Each department needs its own VLAN. You'll create three VLANs on SW1 first, then repeat on SW2 so both switches know these VLANs exist.

Click on SW1 in your topology, then select the CLI tab.
Create VLANs 10, 20, and 30 by entering these commands:

SW1> enable
SW1# configure terminal
SW1(config)# vlan 10
SW1(config-vlan)# name Sales
SW1(config-vlan)# exit
SW1(config)# vlan 20
SW1(config-vlan)# name Engineering
SW1(config-vlan)# exit
SW1(config)# vlan 30
SW1(config-vlan)# name Management
SW1(config-vlan)# exit

What do these commands do?

enable enters privileged EXEC mode, and configure terminal enters global configuration mode.
vlan 10 creates VLAN 10 and enters VLAN configuration mode for it.
name Sales gives the VLAN a human-readable label. This makes show vlan brief output much easier to read later.

Verify the VLANs exist on SW1 by running:

SW1(config)# end
SW1# show vlan brief

You should see VLANs 10 (Sales), 20 (Engineering), and 30 (Management) listed as active. No ports are assigned to them yet.

VLANs not appearing?

Make sure you typed vlan 10 (not vlan10 without a space). The space between vlan and the number is required.
Confirm you ran end to return to privileged EXEC mode before running show vlan brief. Show commands do not work in config mode on a 2960.
help me troubleshoot why my VLANs are not showing up in show vlan brief on a Cisco 2960 switch in Packet Tracer

Now click on SW2 in your topology, then select the CLI tab.
Create the same three VLANs on SW2 by entering these commands:

SW2> enable
SW2# configure terminal
SW2(config)# vlan 10
SW2(config-vlan)# name Sales
SW2(config-vlan)# exit
SW2(config)# vlan 20
SW2(config-vlan)# name Engineering
SW2(config-vlan)# exit
SW2(config)# vlan 30
SW2(config-vlan)# name Management
SW2(config-vlan)# exit

Why create VLANs on both switches?

Each switch maintains its own VLAN database independently. If a switch does not know about a VLAN, it cannot assign ports to it or forward traffic for it. Both switches need all three VLANs defined before you can assign ports.

Verify the VLANs exist on SW2 by running:

SW2(config)# end
SW2# show vlan brief

You should see VLANs 10, 20, and 30 listed as active on SW2, matching what you saw on SW1.

Assign access ports to VLANs on both switches

With the VLANs created, you need to tell each switch which port belongs to which VLAN. An access port carries traffic for exactly one VLAN.

Return to the CLI tab on SW1.
Assign each PC's port to the correct VLAN by entering these commands:

SW1# configure terminal
SW1(config)# interface FastEthernet0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# exit
SW1(config)# interface FastEthernet0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 20
SW1(config-if)# exit
SW1(config)# interface FastEthernet0/3
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 30
SW1(config-if)# exit

What do these port commands do?

switchport mode access sets the port as an access port, meaning it belongs to a single VLAN only.
switchport access vlan 10 places that port into VLAN 10. Any device plugged into this port will be part of the Sales broadcast domain.
FastEthernet0/1 connects to PC1 (Sales), FastEthernet0/2 connects to PC3 (Engineering), and FastEthernet0/3 connects to PC5 (Management).

Verify the port assignments on SW1 by running:

SW1(config)# end
SW1# show vlan brief

You should see Fa0/1 listed under VLAN 10, Fa0/2 under VLAN 20, and Fa0/3 under VLAN 30. These ports are no longer under VLAN 1.

Port still showing under VLAN 1?

Check you typed the correct interface name. It is FastEthernet0/1 (not GigabitEthernet). The PC connections use the FastEthernet ports.
Make sure you included both lines: switchport mode access and switchport access vlan 10. Skipping switchport mode access can prevent the VLAN assignment from taking effect.
help me figure out why my port is still in VLAN 1 after running switchport access vlan on a 2960

Now click on SW2 and open the CLI tab.
Assign the same VLAN-to-port mapping on SW2 by entering these commands:

SW2# configure terminal
SW2(config)# interface FastEthernet0/1
SW2(config-if)# switchport mode access
SW2(config-if)# switchport access vlan 10
SW2(config-if)# exit
SW2(config)# interface FastEthernet0/2
SW2(config-if)# switchport mode access
SW2(config-if)# switchport access vlan 20
SW2(config-if)# exit
SW2(config)# interface FastEthernet0/3
SW2(config-if)# switchport mode access
SW2(config-if)# switchport access vlan 30
SW2(config-if)# exit

Which PCs are on SW2?

FastEthernet0/1 connects to PC2 (Sales), FastEthernet0/2 connects to PC4 (Engineering), and FastEthernet0/3 connects to PC6 (Management). Each department has one PC on each switch.

Verify VLANs and test connectivity

Both switches now have VLANs configured and ports assigned. Time to confirm the full picture and test what this segmentation does to connectivity.

On SW2, verify the port assignments by running:

SW2(config)# end
SW2# show vlan brief

Confirm that Fa0/1 is under VLAN 10, Fa0/2 is under VLAN 20, and Fa0/3 is under VLAN 30.

Now for the real test. Before you run any pings, think about this: PC1 and PC3 are both on SW1, but on different VLANs. Do you think PC1 can still reach PC3?

Click on PC1, go to the Desktop tab, and open Command Prompt.
Ping PC3 (Engineering, same switch but different VLAN) by running:

ping 192.168.20.10

You'll see "Request timed out" four times. PC1 (VLAN 10) cannot reach PC3 (VLAN 20) even though they are plugged into the same physical switch. VLANs are separate Layer 2 broadcast domains. Without a Layer 3 device (a router), there is no path between them.

Now try pinging PC2 (Sales, same VLAN 10 but on SW2) by running:

ping 192.168.10.20

This also fails with "Request timed out." PC1 and PC2 are in the same VLAN, but on different switches. The link between SW1 and SW2 is still a regular access port on VLAN 1. It does not carry VLAN 10 traffic across.

Why do both pings fail?

You've hit two separate problems that require two separate solutions:

Cross-VLAN (PC1 to PC3): Different VLANs cannot communicate without a router performing inter-VLAN routing. This is the problem Step 4 solves.
Same-VLAN, cross-switch (PC1 to PC2): The inter-switch link needs to be a trunk so it can carry tagged traffic for VLANs 10, 20, and 30. This is the problem Step 3 solves.

You've just segmented your network into three VLANs and witnessed the isolation in action. Next, you'll configure 802.1Q trunk links between the switches so that same-VLAN PCs on different switches can talk to each other again.

Configure 802.1Q Trunk Links

You've segmented your network into three VLANs, but you discovered two connectivity failures. PC1 can't reach PC3 because they're on different VLANs. PC1 also can't reach PC2 even though they share VLAN 10.

The second failure happens because the link between SW1 and SW2 is still a regular access port on VLAN 1. An 802.1Q trunk link solves this by tagging frames with their VLAN ID, allowing a single physical cable to carry traffic for multiple VLANs between switches.

In this step, get ready to:

Configure an 802.1Q trunk between SW1 and SW2 for inter-switch VLAN traffic.
Configure an 802.1Q trunk from SW1 to R1 to prepare for inter-VLAN routing.
Verify trunk operation and test same-VLAN cross-switch connectivity.

Configure the trunk between SW1 and SW2

The GigabitEthernet0/1 port on each switch connects them together. Right now that link only carries VLAN 1 traffic because it's in access mode. Converting it to a trunk lets it carry tagged frames for VLANs 10, 20, and 30 simultaneously.

Click on SW1 in your Packet Tracer workspace, then select the CLI tab.
Enter global configuration mode and configure the trunk on GigabitEthernet0/1 by entering these commands:

SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20,30
SW1(config-if)# exit

What do these commands do?

switchport mode trunk changes the port from access mode to trunk mode, enabling it to carry multiple VLANs.
switchport trunk allowed vlan 10,20,30 restricts the trunk to only carry your three department VLANs. This is a security best practice that prevents unknown VLANs from crossing the link.

Why no encapsulation command?

On the 2960 switch, 802.1Q is the only supported trunk encapsulation. The switchport trunk encapsulation dot1q command is only needed on switches like the 3560 that support multiple encapsulation types.

Now click on SW2 and select the CLI tab.
Configure the matching trunk on SW2's GigabitEthernet0/1 by entering these commands:

SW2(config)# interface GigabitEthernet0/1
SW2(config-if)# switchport mode trunk
SW2(config-if)# switchport trunk allowed vlan 10,20,30
SW2(config-if)# exit

Both sides of the trunk are now configured. VLAN traffic can flow between the switches.

Test the trunk by opening PC1's Desktop tab, then click Command Prompt.
Ping PC2 (same VLAN, different switch) by running this command:

ping 192.168.10.20

This ping now succeeds. PC1 and PC2 are both on VLAN 10, and the trunk link carries their tagged frames between switches.

Ping still timing out?

Make sure you configured the trunk on BOTH SW1 and SW2. A trunk only works when both ends are set to trunk mode.
Check that you used GigabitEthernet0/1 (the inter-switch link), not FastEthernet0/1 (which connects to a PC).
Try the ping a second time. The first ping sometimes fails while the switch learns the MAC address.

Why isn't my trunk link working between SW1 and SW2?

Configure the trunk from SW1 to R1

The router will eventually handle inter-VLAN routing, but it needs to receive tagged VLAN traffic from the switch. SW1's GigabitEthernet0/2 connects to R1, so you need to trunk that port as well.

Return to SW1's CLI tab.
Configure the trunk on GigabitEthernet0/2 (the link toward R1) by entering these commands:

SW1(config)# interface GigabitEthernet0/2
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20,30
SW1(config-if)# exit

Why trunk toward the router?

In a router-on-a-stick setup, the router needs to receive traffic from all VLANs on a single physical link. The trunk tags each frame with its VLAN ID so the router knows which subnet the traffic belongs to.

Verify trunk links and test connectivity

Time to confirm that both trunks are operational. The show interfaces trunk command displays all active trunks, their encapsulation type, and which VLANs they carry.

On SW1's CLI, exit to privileged EXEC mode and run the trunk verification command:

SW1# show interfaces trunk

You should see both Gig0/1 and Gig0/2 listed with encapsulation 802.1q and VLANs 10, 20, 30 in the allowed list.

What does this output tell you?

The Mode column shows on, meaning the trunk was manually configured (not auto-negotiated).
The Encapsulation column confirms 802.1q tagging is active.
The VLANs allowed section shows only 10, 20, and 30. Other VLANs are blocked from crossing this trunk.

Now for the real test. Before you run the next two pings, predict what will happen. Will PC1 reach PC2 (same VLAN, different switch)? Will PC1 reach PC3 (different VLAN)?

Open PC1's Command Prompt and ping PC2 by running:

ping 192.168.10.20

Now ping PC3 (VLAN 20) from PC1 by running:

ping 192.168.20.10

The ping to PC2 succeeds. The ping to PC3 fails with "Request timed out."

This confirms that trunking solves inter-switch communication within the same VLAN, but it does not solve inter-VLAN communication. Cross-VLAN traffic needs a Layer 3 device to route between subnets.

PC1 to PC2 still failing?

Run show interfaces trunk on both SW1 and SW2. Both should list GigabitEthernet0/1 as a trunk port.
Verify that VLAN 10 appears in the allowed VLAN list on both sides. If you typed switchport trunk allowed vlan 10 20 30 with spaces instead of commas, only VLAN 10 was actually set.
Confirm PC1 and PC2 both have subnet mask 255.255.255.0 and the same default gateway of 192.168.10.1.

Help me troubleshoot my trunk link between two 2960 switches.

Your trunk links are live and carrying VLAN traffic between switches. Next up, you'll configure the router to bridge the gap between VLANs using subinterfaces and 802.1Q encapsulation.

Configure Router-on-a-Stick for Inter-VLAN Routing

Your trunk links are live. Same-VLAN PCs on different switches can finally talk to each other.

Cross-VLAN pings still fail, though. VLANs are Layer 2 boundaries, and no Layer 2 device can forward traffic between them. You need a Layer 3 device. Router-on-a-stick uses a single physical interface divided into subinterfaces, each tagged with a VLAN ID via 802.1Q encapsulation, to route between all VLANs over one cable.

In this step, get ready to:

Configure subinterfaces on R1 with 802.1Q encapsulation.
Verify the routing table shows all three VLAN subnets.
Test full inter-VLAN connectivity across all departments and switches.

Configure subinterfaces on R1

A subinterface is a virtual division of a single physical router interface. Each subinterface gets its own VLAN tag and IP address, acting as the default gateway for that VLAN.

Why router-on-a-stick instead of a Layer 3 switch?

Router-on-a-stick is explicitly tested on the CCNA 200-301 exam and teaches the foundational concept of subinterfaces with 802.1Q encapsulation. Layer 3 switch routing (using SVIs) is a separate technique for a future project.

In small networks, a single trunk link to a router handles inter-VLAN routing without needing expensive Layer 3 switch hardware.

Click on R1 in your Packet Tracer workspace.
Select the CLI tab.
Enter the following commands to bring up the physical interface and create three subinterfaces:

R1> enable
R1# configure terminal
R1(config)# interface GigabitEthernet0/0
R1(config-if)# no shutdown
R1(config-if)# no ip address
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface GigabitEthernet0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface GigabitEthernet0/0.30
R1(config-subif)# encapsulation dot1Q 30
R1(config-subif)# ip address 192.168.30.1 255.255.255.0
R1(config-subif)# exit

What does this configuration do?

no shutdown brings the physical interface online. Without it, all subinterfaces stay down.
no ip address on the physical interface is best practice when using subinterfaces. The IP addresses live on the subinterfaces instead.
encapsulation dot1Q 10 tells the subinterface to tag outgoing frames with VLAN 10 and accept incoming frames tagged with VLAN 10.
Each subinterface IP (like 192.168.10.1) matches the default gateway you already set on the PCs in that VLAN.

✔️ Awesome, I've got everything!

Great. Make sure you entered all commands without typos. The prompt should show R1(config)# after the final exit.

ⓧ I'd like to double check the full config

Here is the complete router-on-a-stick configuration. Confirm each subinterface has the correct VLAN tag and IP address.

R1> enable
R1# configure terminal
R1(config)# interface GigabitEthernet0/0
R1(config-if)# no shutdown
R1(config-if)# no ip address
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface GigabitEthernet0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface GigabitEthernet0/0.30
R1(config-subif)# encapsulation dot1Q 30
R1(config-subif)# ip address 192.168.30.1 255.255.255.0
R1(config-subif)# exit

Verify the router configuration

The routing table confirms whether the router recognizes each VLAN subnet. If all three subnets appear as directly connected, the subinterfaces are working.

Return to R1's CLI and exit back to privileged EXEC mode by running:

R1(config)# end

Check the routing table by running:

R1# show ip route

You should see three directly connected networks in the output:

C 192.168.10.0/24 is directly connected, GigabitEthernet0/0.10
C 192.168.20.0/24 is directly connected, GigabitEthernet0/0.20
C 192.168.30.0/24 is directly connected, GigabitEthernet0/0.30

Each line proves the router knows about that VLAN's subnet and can route traffic to it through the corresponding subinterface.

Missing a subnet in the routing table?

Make sure you ran no shutdown on the physical GigabitEthernet0/0 interface. If the physical interface is down, all subinterfaces stay down.
Check that each subinterface number matches the VLAN ID (e.g., GigabitEthernet0/0.10 uses encapsulation dot1Q 10).
Confirm the cable between SW1 GigabitEthernet0/2 and R1 GigabitEthernet0/0 shows green link lights.

Why isn't my subinterface showing as connected in the routing table?

Test full inter-VLAN connectivity

This is the moment of truth. Every cross-VLAN ping that failed in Step 2 should now succeed because the router can forward traffic between subnets.

Before you run the first ping, think about what you expect to happen. PC1 is in VLAN 10 on SW1. PC4 is in VLAN 20 on SW2. Do you think this ping will succeed now that the router has subinterfaces configured?

Click on PC1 and open the Desktop tab.
Open Command Prompt.
Ping PC4 (Engineering, SW2) by running:

ping 192.168.20.20

You should see replies from 192.168.20.20. This ping crosses both VLANs AND switches. Traffic flows from PC1 to SW1, up the trunk to R1, gets routed from subinterface .10 to .20, back down to SW1, across the trunk to SW2, and out to PC4.

Now test PC5 (Management, SW1) to PC2 (Sales, SW2). Click on PC5, open Command Prompt, and run:

ping 192.168.10.20

Finally, test PC3 (Engineering, SW1) to PC6 (Management, SW2). Click on PC3, open Command Prompt, and run:

ping 192.168.30.20

All three pings should return replies. Every department can now communicate across VLANs and across switches. Your router-on-a-stick configuration is complete.

What just happened?

Each PC sends traffic to its default gateway (the router subinterface IP). The router examines the destination IP, finds the matching subnet in its routing table, and forwards the packet out the correct subinterface with the appropriate VLAN tag.

The switch then delivers the tagged frame to the correct access port. All of this happens over a single physical cable between SW1 and R1.

Pings still failing?

Verify each PC's default gateway matches the corresponding subinterface IP. For example, PC1's gateway must be 192.168.10.1 (not 192.168.20.1).
Confirm that SW1 GigabitEthernet0/2 (the link to R1) is configured as a trunk with VLANs 10, 20, and 30 allowed. Run show interfaces trunk on SW1 to check.
Try pinging the gateway first. From PC1, run ping 192.168.10.1. If this fails, the issue is between PC1 and the router, not between VLANs.

Help me troubleshoot why my cross-VLAN pings are failing after configuring router-on-a-stick.

Secret mission

Add a Voice VLAN for IP Phones

In real offices, IP phones and PCs share the same physical port. Can you configure a single access port to carry both data and voice traffic on separate VLANs? This is a direct CCNA exam objective (2.1.a) that tests your understanding of access ports with data and voice VLANs.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally in Cisco Packet Tracer, so there are no ongoing costs.

Resources you used:

Packet Tracer topology file (.pkt) containing your multi-VLAN network with R1, SW1, SW2, and 6 PCs.

Keep everything running

No action needed. Choose this if you're still actively building or want to use this topology for exam review.

Save your topology by pressing Ctrl+S (or Cmd+S on macOS) in Packet Tracer.
Name the file something memorable like multi-vlan-router-on-a-stick.pkt and save it to your Desktop.
You can reopen this file anytime to review your VLAN, trunk, and subinterface configurations.

Pause - I'll come back to this later

Save your work and close Packet Tracer to free up system memory. Your topology is preserved in the saved file.

Save your topology by pressing Ctrl+S (or Cmd+S on macOS).
Name the file multi-vlan-router-on-a-stick.pkt and save it to your Desktop.
Close Cisco Packet Tracer.
When you're ready to return, double-click the .pkt file to reopen it with all configurations intact.

Delete - I don't want to use this again

Remove the project file entirely if you no longer need this topology.

Close Cisco Packet Tracer without saving (click Don't Save if prompted).
If you already saved the file, delete it from your Desktop by running this command in your terminal:

macOS

rm ~/Desktop/multi-vlan-router-on-a-stick.pkt

Windows

Remove-Item ~\Desktop\multi-vlan-router-on-a-stick.pkt

That's it. No cloud resources, accounts, or services need to be cleaned up.

Nice Work!

You just built a fully segmented multi-VLAN office network from scratch and brought full inter-VLAN connectivity online using router-on-a-stick.

You've learned how to:

Create and assign VLANs across multiple switches, configure 802.1Q trunk links with allowed VLAN lists, and verify everything with show vlan brief and show interfaces trunk.
Implement router-on-a-stick using subinterfaces with dot1Q encapsulation to route between VLANs on a single physical interface.
Diagnose connectivity failures caused by missing trunks and missing Layer 3 routing, then verify full connectivity with show ip route and cross-VLAN ping tests.
Secret Mission: Configured a voice VLAN alongside a data VLAN on a single access port, covering CCNA exam objective 2.1.a.

Ready to quiz yourself?