A host belonging to a VLAN attached to a specific physical port, for example, VLAN 10 in port FastEthernet0/10 is usually not able to communicate to a host attached to another VLAN, for example, VLAN11 attached to port FastEthernet0/11. They belong to different networks, different broadcast domains and switches do not know how to forward packets from one network to another. The process of forwarding packets from a network to another is called routing and you must use a router to accomplish this.

In classic networks that are using multiple VLANs, routing is performed by connecting multiple physical interfaces on the router to multiple physical interfaces on the switch. The switch ports are connected to the router in access mode, and a different static VLAN is assigned to every interface. An access mode switch port can belong to only one VLAN and is usually used to connect to an end-user device.

Usually, this is not the desired behavior because you end up using too many physical interfaces, and sooner or later you will run out of interfaces. A typical switch can have up to 48 ports. This means you can use that switch to route traffic between VLANs for up to 48 VLANs. In smaller networks, this may be enough, but in larger enterprise networks, 48 VLANs may not be enough.

“Router-on-a-stick” is a type of router configuration in which you are able to use a single physical interface to route traffic between multiple VLANs. The router interface is configured as a trunk link and is connected to a trunk switch port. The router is accepting the tagged traffic on the trunk interface and routes it internally using subinterfaces. Trunk links are able to accept multiple VLANs on one physical interface. Switches are able to recognize the VLAN used for a specific packet through the use of encapsulation protocols that encapsulate or tag the frames. The protocols used are 802.1Q or Cisco’s proprietary Inter-Switch Link (ISL). To find out more about these encapsulation protocols check the Trunking Concepts lessons from our Cisco CCNA exam preparation series.
Subinterfaces are virtual interfaces associated with a single physical interface. These subinterfaces have their own IP address and VLAN assignment to be able to operate on a specific VLAN.

However, if your switch is capable of doing Layer 3 functions, you don’t need a router anymore. The switch will handle the Inter-VLAN routing decisions too. These switches are called multilayer switches.

The router acts as a Gateway for devices on a VLAN. The subinterface configured for a particular VLAN has an IP assigned from the range of IPs used in that VLAN. The other devices on the VLAN are sending packets for devices in other VLANs through the router. The router then takes the routing decision and sends the packet to the destination.

Usually, when you configure a router, you assign IPs to interfaces, and once the IPs are assigned, the routing table shows how to reach the networks those IPs are part of.

Router(config)#interface Fa0/0
Router(config-if)#ip address 172.16.10.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#interface Fa0/1
Router(config-if)#ip address 172.16.30.1 255.255.255.0
Router(config-if)#no shutdown
Router(config-if)#end
Router#show ip route
Codes: C – connected, S – static, R – RIP, M – mobile, B – BGP
D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
E1 – OSPF external type 1, E2 – OSPF external type 2
i – IS-IS, su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2
ia – IS-IS inter area, * – candidate default, U – per-user static route
o – ODR, P – periodic downloaded static route
Gateway of last resort is not set
172.16.0.0/24 is subnetted, 2 subnets
C    172.16.10.0/24 is directly connected, FastEthernet0/1
C    172.16.30.0/24 is directly connected, FastEthernet0/1

As you can see, the only chance to route traffic between those two networks is to connect both interfaces to the switch. This could be a solution if you have a small number of VLANs on your network and you are sure your network will never evolve, but if you have for example 120 VLANs what would you do?

The solution is to use subinterfaces. When you use subinterfaces,
Router(config)#interface Fa0/0.10
Router(config-if)#encapsulation dot1q 10
Router(config-if)#ip address 172.16.10.1 255.255.255.0
Router(config-if)#interface Fa0/0.30
Router(config-if)#encapsulation dot1q 30
Router(config-if)#ip address 172.16.30.1 255.255.255.0
Router(config-if)#interface Fa0/0
Router(config-if)#no shutdown
Router(config-if)#end
Router#show ip route
Codes: C – connected, S – static, R – RIP, M – mobile, B – BGP
D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
E1 – OSPF external type 1, E2 – OSPF external type 2
i – IS-IS, su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2
ia – IS-IS inter area, * – candidate default, U – per-user static route
o – ODR, P – periodic downloaded static route 
Gateway of last resort is not set
172.16.0.0/24 is subnetted, 2 subnets
C    172.16.10.0/24 is directly connected, FastEthernet0/0.10
C    172.16.30.0/24 is directly connected, FastEthernet0/0.30

As you can see in this example, we use only the FastEthernet 0/0 interface for both VLANs. We have created the Fa0/0.10 and Fa0/0.30 subinterfaces, specified the encapsulation type dot1q which is IEEE’s 802.1Q, and the VLAN they belong to and we assigned an IP address. In this case, the physical interface, FastEthernet 0/0, does not need an IP address configuration, the only thing you must do is to use the no shutdown command so that the interfaces comes up.

If you use a multilayer switch, to enable to routing features you must also enable ip routing.
Switch(config)#ip routing

However, a different issue may arise when you use Inter-VLAN Routing. A switch for example can have an incorrect VLAN assigned to a switch port or the switch port may be configured in access mode instead of trunk mode. A router also can have the wrong VLAN  assigned to an interface or subinterface or the wrong encapsulation type. Assigning an IP address belonging to a class not used in that specific VLAN will also cause Inter-VLAN routing to not function properly. If your network is not working as expected, these are the most common places to look for errors.

This concludes our lesson. When you’ll take your Cisco CCNA certification exam, you must be able to correctly configure and troubleshoot a network using Inter-VLAN Routing. Practicing is the best way to learn how things work and we hope you found our hands-on example a great starting point.