Configure VLANs and Inter-VLAN Routing

Segment a corporate network with VLANs and route traffic using Router-on-a-Stick.

Introduction

30 Second Summary

In any office, you wouldn't want the sales team accidentally seeing HR's confidential payroll data or stumbling into IT's admin systems. Networks solve this problem by creating virtual walls between departments, keeping each team's traffic isolated.

In this project, you will build a simulated corporate network in Cisco Packet Tracer that segments traffic into three department VLANs and routes between them using a single router.

What You'll Build

A multi-VLAN corporate network spanning two switches with Router-on-a-Stick inter-VLAN routing, built and verified entirely in Cisco Packet Tracer.

By the end of this project, you'll have:

  • A working network topology with 2 switches, 1 router, and 4 PCs segmented into 3 department VLANs (Sales, HR, and IT).
  • Fully configured 802.1Q trunk links carrying VLAN traffic between switches and up to the router.
  • Router subinterfaces performing inter-VLAN routing, verified by successful ping tests between PCs in different VLANs.
  • Secret Mission: Add a Management VLAN with Switch Virtual Interfaces for remote switch access, and restrict trunk traffic for security.

Are there any prerequisites?

You should have a basic understanding of IP addressing and subnetting. No prior experience with Cisco switches or routers is required.

Build the Network Topology

Before configuring any VLANs or routing, you need the physical foundation of your network in place.

In this step, you will place all seven devices onto the workspace and cable them together into the topology that will carry your department traffic.

In this step, get ready to:
  • Place a router, two switches, and four PCs on the workspace.
  • Cable every device using the correct cable types and port assignments.
Place devices on the workspace

Every network starts with hardware. You need one router to handle inter-VLAN traffic, two switches to connect departments, and four PCs representing end users.

  • In the bottom-left corner of the Packet Tracer window, locate the device category icons. These are grouped into rows: the top row shows device types, and the bottom row shows specific models.
  • Click the Routers category in the device-type selection area.
  • In the device-specific selection box that appears to the right, find and click the 2911 router model.
  • Click on the workspace to place it near the top-centre of the canvas.

What is the 2911?

The Cisco 2911 is an Integrated Services Router commonly used in CCNA labs. It supports subinterfaces with 802.1Q encapsulation, which you will use later to route traffic between VLANs.

  • Click the Switches category in the device-type selection area.
  • Select the 2960 switch model from the device-specific selection box.
  • Click the workspace to place it in the middle-left area, below and to the left of the router. This is Switch 1 (S1).
  • Click the workspace again to place a second 2960 switch in the middle-right area. This is Switch 2 (S2).
  • Click the End Devices category.
  • Select PC from the device-specific selection box.
  • Place two PCs below S1 (these become PC1 and PC2).
  • Place two more PCs below S2 (these become PC3 and PC4).
  • Rename each device by clicking it, selecting the Config tab, and typing the new name into the Display Name field.
  • Rename the router to R1, the left switch to S1, the right switch to S2, and the PCs to PC1 through PC4.

Your workspace should now show seven devices arranged with the router at the top, switches in the middle, and PCs at the bottom.

Can't find the 2960 or 2911?

Make sure you are clicking the correct category first (Routers or Switches) in the top row of icons. The specific models only appear in the second row after selecting a category.

Hover over each icon in the device-type selection box to see its category name displayed at the bottom.

Cable the devices

With all devices placed, you need to connect them with the correct cable types. The cable type matters because it determines whether the electrical signals are transmitted correctly between device pairs.

  • Click the Connections category in the bottom-left device panel. It looks like a lightning bolt icon.
  • Select Copper Straight-Through from the cable options that appear.
  • Click on R1. A popup menu shows available interfaces. Select GigabitEthernet0/0.
  • Click on S1. Select GigabitEthernet0/1 from the popup menu.

Why a straight-through cable here?

Straight-through cables connect devices at different layers of the network. A router (Layer 3) connecting to a switch (Layer 2) is a different-layer connection, so a straight-through cable is the correct choice.

  • Now select Copper Cross-Over from the Connections panel.
  • Click on S1 and select FastEthernet0/24.
  • Click on S2 and select FastEthernet0/24.

Why a crossover cable between switches?

Crossover cables connect devices operating at the same network layer. Both S1 and S2 are Layer 2 switches, so their transmit and receive pins would conflict with a straight-through cable. The crossover cable swaps the pairs so each device receives on the correct pins.

  • Switch back to Copper Straight-Through in the Connections panel.
  • Click PC1 and select FastEthernet0. Then click S1 and select FastEthernet0/1.
  • Click PC2 and select FastEthernet0. Then click S1 and select FastEthernet0/2.
  • Click PC3 and select FastEthernet0. Then click S2 and select FastEthernet0/1.
  • Click PC4 and select FastEthernet0. Then click S2 and select FastEthernet0/2.

After connecting all cables, check the link light indicators on each connection. These are small coloured shapes at each end of a cable.

  • Green triangle means the physical link is up.
  • Orange circle means the port is blocked by STP (Spanning Tree Protocol). This is normal on switch ports and will resolve in about 30 seconds.
  • Red triangle means the link is down. The router interface will show red because router interfaces default to administratively shutdown. This is expected and will be fixed when you configure routing later.

You can hover your mouse over any cable to see which interfaces are connected at each end. Use this to double-check your port assignments.

Seeing red on a PC-to-switch link?

If a PC-to-switch connection shows red on both ends, you likely selected the wrong cable type. Delete the cable by clicking the red X tool in the toolbar, then clicking the cable. Re-create it using a Copper Straight-Through cable.

If you connected to the wrong port, click the link light near the device to unplug that end. Then click the device again and select the correct interface.

Your physical topology is complete. Next up, you will enter the switch CLI to create VLANs and assign each PC to its department.

Create VLANs and Assign Access Ports

Your network topology is cabled and ready. Right now, all four PCs share the same broadcast domain, meaning any traffic from one PC floods to every other device on the switch.

In a real corporate network, you want departments isolated from each other. VLANs solve this by logically segmenting the network so that Sales, HR, and IT traffic stays separated at Layer 2.

In this step, get ready to:
  • Create three VLANs (Sales, HR, IT) on both switches.
  • Assign each PC's switch port to the correct VLAN using access ports.
  • Verify the VLAN configuration with show commands.
Create VLANs on Switch 1 (S1)

VLANs must be created in the switch's VLAN database before any ports can be assigned to them. You create each VLAN by entering its ID and giving it a human-readable name.

  • Click on S1 in your Packet Tracer workspace.
  • Go to the CLI tab.
  • Create VLANs 10, 20, and 30 by entering these commands:
enable
configure terminal
vlan 10
name Sales
vlan 20
name HR
vlan 30
name IT
end

What do these commands do?

  • enable enters privileged EXEC mode, giving you full access to the switch.
  • configure terminal enters global configuration mode where you can change the switch's settings.
  • vlan 10 creates a VLAN with ID 10 and enters VLAN configuration mode for it.
  • name Sales assigns the human-readable name "Sales" to VLAN 10.
  • end exits back to privileged EXEC mode.
  • Verify the VLANs were created by running:
show vlan brief

You should see VLANs 10, 20, and 30 listed with their names (Sales, HR, IT) and a status of "active".

Don't see VLANs 10, 20, 30?

  • Make sure you typed configure terminal before entering the VLAN commands. Without it, the switch rejects configuration commands.
  • Check that you pressed Enter after each line. Each command must be entered on its own line.

Help me troubleshoot why my VLANs aren't showing up in show vlan brief on S1.

Create the same VLANs on Switch 2 (S2)

Each switch maintains its own VLAN database independently. For VLANs to work across both switches, you need to create the same VLAN entries on S2.

  • Click on S2 in your Packet Tracer workspace.
  • Go to the CLI tab.
  • Enter the same VLAN creation commands:
enable
configure terminal
vlan 10
name Sales
vlan 20
name HR
vlan 30
name IT
end

Why create VLANs on both switches?

This project creates VLANs manually on each switch rather than using VTP (VLAN Trunking Protocol) to propagate them automatically. This is the safest approach for lab environments and is the method tested in network engineering interviews.

  • Verify by running:
show vlan brief

You should see VLANs 10 (Sales), 20 (HR), and 30 (IT) listed as active, matching what you created on S1.

Seeing an error when entering commands?

  • If you see "Invalid input detected", you may still be in VLAN configuration mode from a previous command. Type end to exit, then start fresh with configure terminal.
  • Make sure you clicked on S2 (not S1) before entering commands.

Help me fix VLAN creation errors on my Cisco 2960 switch in Packet Tracer.

Assign PCs to VLANs via access ports

Creating VLANs alone does not place any device into them. You need to configure each switch port as an access port and assign it to a specific VLAN. An access port carries traffic for only one VLAN.

Here is the mapping you will configure:

  • PC1 on S1 Fa0/1 → VLAN 10 (Sales).
  • PC2 on S1 Fa0/2 → VLAN 20 (HR).
  • PC3 on S2 Fa0/1 → VLAN 30 (IT).
  • PC4 on S2 Fa0/2 → VLAN 10 (Sales).
  • Switch back to S1's CLI tab.
  • Assign PC1 (Fa0/1) to VLAN 10 and PC2 (Fa0/2) to VLAN 20 by entering these commands:
configure terminal
interface FastEthernet0/1
switchport mode access
switchport access vlan 10
interface FastEthernet0/2
switchport mode access
switchport access vlan 20
end

What do these commands do?

  • interface FastEthernet0/1 selects the specific port you want to configure.
  • switchport mode access sets the port to carry traffic for a single VLAN only (no trunking).
  • switchport access vlan 10 assigns the port to VLAN 10. Any device plugged into this port will be in the Sales VLAN.
  • Now click on S2 and go to the CLI tab.
  • Assign PC3 (Fa0/1) to VLAN 30 and PC4 (Fa0/2) to VLAN 10 by entering:
configure terminal
interface FastEthernet0/1
switchport mode access
switchport access vlan 30
interface FastEthernet0/2
switchport mode access
switchport access vlan 10
end

Why is PC4 in VLAN 10?

PC4 is in the Sales VLAN (10) just like PC1, but it's connected to a different switch. This demonstrates how a single VLAN can span multiple physical switches. Later, you will configure trunk links to carry VLAN 10 traffic between S1 and S2.

  • Verify the port assignments on S1 by running show vlan brief in S1's CLI.
  • Verify the port assignments on S2 by running show vlan brief in S2's CLI.

On S1, you should see Fa0/1 under VLAN 10 and Fa0/2 under VLAN 20. On S2, you should see Fa0/1 under VLAN 30 and Fa0/2 under VLAN 10.

Port still showing under VLAN 1?

  • The most common cause is a typo in the interface name. Make sure you typed FastEthernet0/1 (not FastEthernet 0/1 with a space or Fa0/1).
  • Confirm you entered switchport mode access before switchport access vlan. Both commands are required.
  • Make sure the VLAN exists on that switch. If you assign a port to a VLAN that has not been created, the port may appear inactive.

Help me figure out why my port assignment isn't showing up in the correct VLAN.

✔️ Awesome, I've got everything!

Great. Both switches now have VLANs 10, 20, and 30 created, and each PC port is assigned to its department VLAN.

ⓧ I'd like to double check the full configuration

Here is the expected output when you run show vlan brief on each switch.

On S1, look for these entries:

  • VLAN 10 (Sales): Fa0/1 listed under its ports.
  • VLAN 20 (HR): Fa0/2 listed under its ports.
  • VLAN 30 (IT): no ports assigned yet on S1.

On S2, look for these entries:

  • VLAN 10 (Sales): Fa0/2 listed under its ports.
  • VLAN 20 (HR): no ports assigned yet on S2.
  • VLAN 30 (IT): Fa0/1 listed under its ports.

All remaining ports (Fa0/3 through Fa0/23, etc.) should still appear under VLAN 1 (the default).

Your VLANs are created and your PCs are assigned to their departments. Right now, PCs in different VLANs cannot communicate at all. Next, you will configure trunk links so that VLAN traffic can flow between the two switches and up to the router.

Configure Trunk Links

Your VLANs are created and your PCs are assigned to the correct departments. There is one problem though.

Right now, VLAN traffic on S1 has no way to reach S2 or the router. Trunk links solve this by carrying traffic from multiple VLANs over a single physical connection. In this step, you will configure trunk ports between the two switches and from S1 up to the router.

In this step, get ready to:
  • Configure the trunk link between S1 and S2.
  • Configure the trunk link from S1 to Router R1.
  • Verify that all trunk links are active and carrying VLAN traffic.
Configure the trunk between S1 and S2

A trunk port tags each frame with its VLAN ID using IEEE 802.1Q encapsulation. This lets the receiving switch read the tag and forward the frame to the correct VLAN. You need to configure both ends of the link as trunk ports for it to work.

  • Click on S1, go to the CLI tab, and configure FastEthernet0/24 as a trunk port by entering these commands:
configure terminal
interface FastEthernet0/24
switchport mode trunk
end
  • Click on S2, go to the CLI tab, and configure FastEthernet0/24 as a trunk port by entering these commands:
configure terminal
interface FastEthernet0/24
switchport mode trunk
end

What does switchport mode trunk do?

The switchport mode trunk command puts the port into permanent trunking mode. On a Catalyst 2960, this automatically uses 802.1Q encapsulation because it is the only supported trunking method on this switch model.

By default, a trunk port carries traffic for all VLANs (1-4094). You will restrict this in the Secret Mission later.

You will not see a visible change yet. The next substep configures the router-facing trunk, then you will verify everything together.

Configure the trunk from S1 to Router R1

The router needs to receive tagged VLAN traffic so it can route between VLANs. The link from S1 to R1 must also be a trunk.

  • Return to S1's CLI tab and configure GigabitEthernet0/1 as a trunk port by entering these commands:
configure terminal
interface GigabitEthernet0/1
switchport mode trunk
end

Why does only S1 need a trunk to the router?

S2 does not have a direct connection to the router. Its VLAN traffic reaches R1 by traveling over the S1-S2 trunk first, then up through S1's GigabitEthernet0/1 trunk to R1. This is why every trunk link in the chain matters.

Verify trunk links

Now you will confirm that both trunk links on S1 and the trunk on S2 are active and carrying your VLANs.

  • On S1, run the following command to display trunk information:
show interfaces trunk

You should see both Gig0/1 and Fa0/24 listed as trunking ports with 802.1q encapsulation. The "Vlans allowed on trunk" column should show 1-4094 (all VLANs). The "Vlans allowed and active" column should show 1,10,20,30.

  • On S2, run the same command to verify its trunk:
show interfaces trunk

You should see Fa0/24 listed as a trunking port.

Don't see a port listed as trunking?

Make sure you entered switchport mode trunk while inside the correct interface configuration. If you typed it in global config mode, the command will not apply to the port.

Check that both ends of the link are configured. A trunk only forms if both sides agree. If S1's Fa0/24 is trunk but S2's Fa0/24 is not, the trunk will not come up.

If the ports show as trunking but no VLANs appear in the "active" column, wait 30-60 seconds for Spanning Tree Protocol to converge. You can also click the fast-forward time button in Packet Tracer.

Help me troubleshoot my trunk links in Packet Tracer

✔️ Awesome, I've got everything!

Great. Your trunk links are carrying VLAN traffic across the network.

ⓧ I'd like to double check the full configuration

Here is the complete trunk configuration you should have on each device.

S1 trunk configuration (two trunk ports):

! S1 - Switch-to-Switch trunk
configure terminal
interface FastEthernet0/24
switchport mode trunk
end

! S1 - Switch-to-Router trunk
configure terminal
interface GigabitEthernet0/1
switchport mode trunk
end

S2 trunk configuration (one trunk port):

! S2 - Switch-to-Switch trunk
configure terminal
interface FastEthernet0/24
switchport mode trunk
end

When you run show interfaces trunk on S1, you should see both Gig0/1 and Fa0/24 listed with 802.1q encapsulation and VLANs 1,10,20,30 active.

Your trunk links are now bridging VLAN traffic between both switches and up to the router. Next up, you will configure the router with subinterfaces so it can actually route traffic between VLANs.

Configure Router-on-a-Stick Inter-VLAN Routing

Your trunk links are in place. Traffic from all three VLANs can now flow between the switches and up to the router.

The problem is that your router has only one physical interface connecting to S1. To handle traffic for three separate VLANs on that single link, you will create subinterfaces. Each subinterface acts as the default gateway for one VLAN, enabling the router to route packets between them. This technique is called Router-on-a-Stick.

In this step, get ready to:
  • Create router subinterfaces with 802.1Q encapsulation for each VLAN.
  • Enable the physical interface so subinterfaces come up.
  • Assign IP addresses and default gateways to all four PCs.
Create subinterfaces on the router

A subinterface is a virtual subdivision of a physical interface. Each subinterface uses 802.1Q encapsulation to tag traffic for a specific VLAN, and holds the IP address that PCs in that VLAN use as their default gateway.

  • Click on R1 in the workspace, then go to the CLI tab.
  • Configure subinterfaces for each VLAN by entering these commands:
enable
configure terminal
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
interface GigabitEthernet0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
end

What do these commands do?

Each interface GigabitEthernet0/0.10 command creates a subinterface numbered to match the VLAN ID. The number after the dot is a label you choose. Matching it to the VLAN ID keeps things readable.

The encapsulation dot1Q 10 command tells the router to tag outgoing frames with VLAN 10 and accept incoming frames tagged with VLAN 10. The ip address on each subinterface becomes the default gateway for PCs in that VLAN.

Seeing 'Invalid input detected'?

Make sure you typed configure terminal before entering the interface commands. You must be in global configuration mode.

Double check the interface name is exactly GigabitEthernet0/0.10 with no spaces around the dot.

Help me troubleshoot my router subinterface configuration.

Enable the physical interface

Subinterfaces depend on their parent physical interface. Until you bring GigabitEthernet0/0 up, all three subinterfaces remain in a down state.

  • In the same R1 CLI tab, enable the physical interface by entering these commands:
configure terminal
interface GigabitEthernet0/0
no shutdown
end

Why is no shutdown needed?

Cisco router interfaces are administratively shut down by default. The no shutdown command removes that administrative disable, allowing the interface (and all its subinterfaces) to transition to the up state.

  • Verify the subinterfaces are up by running this command on R1:
show ip interface brief

You should see GigabitEthernet0/0 and all three subinterfaces (G0/0.10, G0/0.20, G0/0.30) showing "up" status with their assigned IP addresses.

Subinterfaces showing down/down?

Confirm the physical interface GigabitEthernet0/0 shows "up" in the Status column. If it still shows "administratively down", re-enter no shutdown on GigabitEthernet0/0.

Also check that the cable from R1 GigabitEthernet0/0 to S1 GigabitEthernet0/1 has green triangles at both ends. An orange triangle means the link is still converging. Wait a few seconds for STP to finish.

Why are my router subinterfaces stuck in down status?

Assign IP addresses to PCs

Each PC needs an IP address in its VLAN's subnet and a default gateway pointing to the router subinterface for that VLAN. Without the gateway, PCs can talk within their own VLAN but cannot reach other VLANs.

  • Click on PC1 in the workspace.
  • Go to the Desktop tab, then click IP Configuration.
  • Enter the following values for PC1:
  • IP Address: 192.168.10.10
  • Subnet Mask: 255.255.255.0
  • Default Gateway: 192.168.10.1
  • Repeat the same process for PC2. Click on PC2, go to Desktop > IP Configuration, and enter:
  • IP Address: 192.168.20.10
  • Subnet Mask: 255.255.255.0
  • Default Gateway: 192.168.20.1
  • Repeat for PC3. Click on PC3, go to Desktop > IP Configuration, and enter:
  • IP Address: 192.168.30.10
  • Subnet Mask: 255.255.255.0
  • Default Gateway: 192.168.30.1
  • Finally, configure PC4. Click on PC4, go to Desktop > IP Configuration, and enter:
  • IP Address: 192.168.10.20
  • Subnet Mask: 255.255.255.0
  • Default Gateway: 192.168.10.1

Why do PC1 and PC4 share a gateway?

PC1 and PC4 are both in VLAN 10 (Sales), even though they are on different switches. They share the same subnet (192.168.10.0/24) and the same default gateway (192.168.10.1). The trunk link between S1 and S2 carries their VLAN 10 traffic so they can communicate without needing the router.

Not sure which gateway to use?

The default gateway for each PC must match the IP address of the router subinterface for that PC's VLAN. VLAN 10 PCs use 192.168.10.1, VLAN 20 PCs use 192.168.20.1, and VLAN 30 PCs use 192.168.30.1.

Help me understand how to assign the right default gateway to each PC.

✔️ Awesome, I've got everything!

Great. Double check that all four PCs have their IP, subnet mask, and gateway filled in correctly before moving on.

ⓧ I'd like to double check the full configuration

Here is the complete router configuration and PC addressing for this step:

R1 subinterface commands (entered in the CLI tab):

enable
configure terminal
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
interface GigabitEthernet0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
interface GigabitEthernet0/0
no shutdown
end

PC IP assignments (configured via Desktop > IP Configuration on each PC):

  • PC1: IP 192.168.10.10, Subnet Mask 255.255.255.0, Default Gateway 192.168.10.1.
  • PC2: IP 192.168.20.10, Subnet Mask 255.255.255.0, Default Gateway 192.168.20.1.
  • PC3: IP 192.168.30.10, Subnet Mask 255.255.255.0, Default Gateway 192.168.30.1.
  • PC4: IP 192.168.10.20, Subnet Mask 255.255.255.0, Default Gateway 192.168.10.1.

Your router is now ready to route traffic between all three VLANs. Next up, you will test the network end-to-end with ping tests to prove that inter-VLAN routing actually works.

Verify and Troubleshoot Inter-VLAN Routing

Your router subinterfaces are up, your PCs have IP addresses, and your trunk links are carrying VLAN traffic. The entire network is wired and configured.

Now it's time to prove it actually works. In this step, you'll run ping tests to verify that PCs in different VLANs can communicate through the router. You'll also use show commands on R1 to confirm the routing table has all three subnet routes.

In this step, get ready to:
  • Test same-VLAN connectivity across the trunk link between switches.
  • Test inter-VLAN connectivity between all three department VLANs.
  • Verify the router's routing table and interface status with show commands.
Test same-VLAN connectivity

Before testing inter-VLAN routing, you need to confirm that basic same-VLAN communication works. PC1 and PC4 are both in VLAN 10, but they're connected to different switches (S1 and S2).

A successful ping between them proves that the trunk link between S1 and S2 is correctly carrying VLAN 10 traffic.

  • Click on PC1 in your topology.
  • Go to the Desktop tab.
  • Click Command Prompt.
  • Ping PC4 by running this command:
ping 192.168.10.20

What does this test?

PC1 (192.168.10.10) and PC4 (192.168.10.20) are both in VLAN 10 but connected to different switches. The ping traffic travels from PC1 to S1, across the trunk link on Fa0/24 to S2, and down to PC4.

If this works, you know your trunk link is carrying VLAN 10 frames correctly.

You should see replies from 192.168.10.20 with 0% packet loss.

First ping might time out

The first ping packet may time out due to ARP resolution and STP convergence. This is normal in Packet Tracer. Wait a few seconds and try again if all four packets time out.

You can also click the fast-forward time button in the bottom toolbar to speed up convergence.

All pings timing out?

If all four packets fail even after waiting and retrying:

  • Click on S1, open the CLI, and run show vlan brief. Confirm Fa0/1 is in VLAN 10.
  • Click on S2, open the CLI, and run show vlan brief. Confirm Fa0/2 is in VLAN 10.
  • Run show interfaces trunk on S1 and verify Fa0/24 shows as a trunking port with VLAN 10 in the active list.

Help me troubleshoot why my same-VLAN ping between PC1 and PC4 is failing across my trunk link in Packet Tracer.

Test inter-VLAN connectivity

Same-VLAN connectivity only proves the trunk link works. Inter-VLAN routing is the real test. Traffic between VLANs must travel up to the router, get routed to the correct subinterface, and travel back down to the destination VLAN.

  • Still on PC1's Command Prompt, ping PC2 (VLAN 20) by running:
ping 192.168.20.10

What path does this traffic take?

PC1 sends the packet to its default gateway (192.168.10.1 on R1's G0/0.10 subinterface). R1 checks its routing table, finds VLAN 20's subnet on G0/0.20, and forwards the packet back down the trunk tagged with VLAN 20. S1 delivers it to PC2 on Fa0/2.

You should see replies from 192.168.20.10. This confirms inter-VLAN routing is working between VLAN 10 and VLAN 20.

  • Now ping PC3 (VLAN 30, on a different switch) by running:
ping 192.168.30.10

This ping crosses both VLANs and switches. The packet goes from PC1 on S1, up to R1, gets routed to VLAN 30, travels back down to S1, crosses the trunk to S2, and reaches PC3. You should see replies from 192.168.30.10.

  • For the final test, click on PC3 in your topology.
  • Go to the Desktop tab, then click Command Prompt.
  • Ping PC2 (VLAN 20) by running:
ping 192.168.20.10

You should see replies from 192.168.20.10. This proves that any VLAN can reach any other VLAN through the router.

Inter-VLAN pings failing?

If same-VLAN pings work but inter-VLAN pings fail, the problem is almost always on the router side:

  • Check that the PC's default gateway matches the router subinterface IP for its VLAN. PC1's gateway should be 192.168.10.1, not 192.168.20.1 or 192.168.30.1.
  • On R1, run show ip interface brief and confirm all subinterfaces show "up" in both the Status and Protocol columns.
  • On S1, run show interfaces trunk and confirm GigabitEthernet0/1 (the link to R1) is listed as a trunking port.

Help me troubleshoot why inter-VLAN pings are failing in my Router-on-a-Stick setup.

Use show commands to verify the routing

Ping tests confirm connectivity, but the router's routing table tells you exactly how R1 knows where to send traffic. Checking the routing table is an essential verification step in any network deployment.

  • Click on R1 in your topology.
  • Go to the CLI tab.
  • View the routing table by running this command:
show ip route

What should I see?

You should see three connected routes marked with a C (for "connected"):

  • 192.168.10.0/24 via GigabitEthernet0/0.10.
  • 192.168.20.0/24 via GigabitEthernet0/0.20.
  • 192.168.30.0/24 via GigabitEthernet0/0.30.

These connected routes are automatically created when you assign an IP address to an active subinterface. R1 uses them to determine which subinterface to forward traffic to for each VLAN's subnet.

  • Confirm all subinterfaces are operational by running:
show ip interface brief

You should see GigabitEthernet0/0, G0/0.10, G0/0.20, and G0/0.30 all showing "up" in both the Status and Protocol columns, along with their assigned IP addresses.

Why do both columns need to show up?

The Status column shows the physical layer (Layer 1) state. The Protocol column shows the data link layer (Layer 2) state. If Status is "up" but Protocol is "down", the interface has power but cannot communicate. Both must be "up" for routing to work.

Subinterface showing down/down?

  • Make sure the physical interface GigabitEthernet0/0 has no shutdown applied. Subinterfaces inherit the physical interface state.
  • Verify the cable between R1 GigabitEthernet0/0 and S1 GigabitEthernet0/1 is connected. Check for green triangles on both ends of the link in Packet Tracer.
  • If the link indicators are orange, STP is still converging. Click the fast-forward time button and wait a moment.

Help me figure out why my router subinterface is showing down/down.

✔️ All pings succeeded and routes are visible

Your inter-VLAN routing is fully operational. All three department VLANs can communicate through the router, and the routing table confirms the correct subnet-to-subinterface mappings.

ⓧ Some pings failed

Work through this checklist on the switches and router:

  • On both switches, run show vlan brief and confirm each PC's port is in the correct VLAN.
  • On S1, run show interfaces trunk and confirm both Fa0/24 and Gig0/1 appear as trunking ports.
  • On S2, run show interfaces trunk and confirm Fa0/24 is trunking.
  • Click on each PC, go to Desktop > IP Configuration, and verify the default gateway matches the router subinterface IP for that VLAN.
  • On R1, run show ip interface brief and confirm all subinterfaces show up/up.

Your multi-VLAN corporate network is fully operational. Three departments can communicate through a single router interface using Router-on-a-Stick. Ready for a bonus challenge? The Secret Mission adds a Management VLAN and hardens your trunk links to carry only the VLANs you specify.

Secret mission

Add a Management VLAN and Restrict Trunk Traffic

Your network is segmented and routing works, but there's no way to remotely manage the switches. In production, network engineers SSH into switches for maintenance. That requires a dedicated Management VLAN with IP addresses on the switches themselves. Can you add one and harden the trunk links while you're at it?

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely in Cisco Packet Tracer, so there are no ongoing costs or cloud resources to worry about. Decide whether to keep your project file, pause by saving and closing, or delete everything entirely.

Resources you used:

  • Cisco Packet Tracer project file (.pkt) containing your VLAN network topology.
  • Cisco Packet Tracer application installed on your computer.

Keep everything running

No action needed. Choose this if you want to keep experimenting with your VLAN network or use it as a reference for future labs.

  • Save your project by pressing Ctrl+S (Windows) or Cmd+S (macOS) in Packet Tracer.
  • Your Cisco Packet Tracer application stays installed for future networking labs.
  • Your NetAcad or Skills for All account remains active for accessing additional courses and resources.

Pause - I'll come back to this later

Save your work and close Packet Tracer to free up system memory. You can reopen the file anytime to pick up where you left off.

  • Save your project file by pressing Ctrl+S (Windows) or Cmd+S (macOS).
  • Note the save location so you can find the .pkt file later.
  • Close Cisco Packet Tracer to free up RAM.

Delete - I don't want to use this again

Remove the project file and optionally uninstall Packet Tracer if you no longer need it for networking labs.

  • Close Cisco Packet Tracer without saving, or delete your saved .pkt file from your computer.
  • To uninstall Cisco Packet Tracer on Windows: open Settings, select Apps, then Apps & features, find Cisco Packet Tracer in the list, click it, and select Uninstall.
  • To uninstall on macOS: open Finder, navigate to Applications, and drag Cisco Packet Tracer to the Trash.

Nice Work!

Nice Work!

Nice work! You just built a production-style corporate network from scratch in Cisco Packet Tracer. Your network segments traffic for three departments using VLANs and routes between them through a single router interface.

You've learned how to:

  • Built a multi-switch, multi-VLAN network topology with three department VLANs (Sales, HR, IT) and IEEE 802.1Q trunk links carrying tagged traffic between switches and to the router.
  • Implemented Router-on-a-Stick inter-VLAN routing using subinterfaces with dot1Q encapsulation, enabling controlled communication between isolated VLANs.
  • Verified full inter-VLAN connectivity using ping tests and show commands (show vlan brief, show interfaces trunk, show ip route, show ip interface brief) to confirm every layer of the configuration.
  • Secret Mission: Added a Management VLAN with SVIs for remote switch management, and hardened trunk links by restricting allowed VLANs.

Ready to quiz yourself?