First, the essential ideas
- Inter-VLAN routing
- Routing moves an IP packet between different networks, including networks attached to separate VLANs. A trunk alone carries VLAN frames but does not make that routing decision.
- Router-on-a-stick
- One router Ethernet interface uses several logical subinterfaces, each associated with a VLAN. The shared cable carries traffic toward the router and back toward the destination VLAN.
- Subinterface and parent
- A subinterface is a logical subdivision of a physical parent interface, such as Gi0/0.10. The suffix is a local label; encapsulation dot1q 10, not the suffix itself, selects VLAN 10.
- Gateway and default route
- A gateway is the next-hop router for an off-subnet destination. Our IOSv test endpoints use an explicit default route to mimic that host choice; their command syntax differs from a desktop gateway setting.
- Connected route
- A connected route describes a network attached to an operational IP interface. R1 can route between its two connected /24 networks without a static route for either one.
- ARP and frame replacement
- ARP discovers a local next-hop MAC for IPv4. The router removes the incoming frame and builds a new outgoing frame; the end-to-end IP destination remains H2 in this no-NAT lab.
- Native VLAN
- The native VLAN classifies untagged traffic under this lab's default behavior. VLAN 999 matches at both trunk ends and has no user IP address; VLANs 10 and 20 are tagged.
- Console and rollback
- Console provides direct access independent of the data cable. Rollback restores the exact known change, here a single subinterface shutdown, before repeating the original traffic test.
Follow H1's off-subnet choice first, then the router's routing decision, then H2's reply. The same physical cable is used in two logical VLAN contexts. This is routing through a router, not a shortcut that merges the VLANs.
See the idea
Two VLANs, one routing decision
R1 routes between VLANs; SW1 carries each local frame to the correct attachment.
Reach the local gateway
H1 sends its off-subnet packet to R1 through SW1's VLAN 10 access and tagged trunk path.
What this model leaves out: One physical SW1 is shown. The router cable carries both VLAN contexts; this simplified path omits ARP details and does not show Internet or firewall services.
Full visual explanation and references
H1 and H2 connect to SW1 in different VLANs. One trunk connects SW1 to R1. The request reaches H2 through R1, and the reply returns to H1.
One physical SW1 is shown. The router cable carries both VLAN contexts; this simplified path omits ARP details and does not show Internet or firewall services.
- Reach the local gateway
H1 sends its off-subnet packet to R1 through SW1's VLAN 10 access and tagged trunk path.
www.cisco.com - Route into VLAN 20
R1 builds a new VLAN 20 frame. It returns over the same trunk to SW1, which delivers it to H2.
www.cisco.com - Require the reply path
H2 replies through its VLAN 20 gateway. R1 routes back through SW1 to H1 in VLAN 10.
www.cisco.com
One idea at a time
Start with something familiar.
Write H1's subnet beside VLAN 10 and H2's different subnet beside VLAN 20. Put R1's .1 address in each subnet. Each endpoint first reaches its own local .1 gateway, not the remote endpoint's MAC address.
Why learn this?
A trunk can be perfectly configured while the router maps a subinterface to the wrong VLAN or a host has no return path. Following one boundary at a time makes these different failures understandable.
An everyday comparison
A shared reception desk serves two departments through separate labeled queues. A visitor enters one queue, the desk checks the destination department, and the visitor leaves through the other queue.
What happens in a network
The shared desk represents one router interface with separate VLAN subinterfaces. The destination decision represents IP routing, while the queue labels represent local VLAN delivery.
Where the comparison stopsThe router does not forward the original Ethernet wrapper unchanged or merge the departments into one broadcast domain. Real frames and IP routing have precise rules beyond this analogy.
Follow one worked example
- Choose the local gateway for an off-subnet destination.
H1's /24 comparison identifies H2 as remote. H1 resolves R1's VLAN 10 MAC and sends the frame toward that gateway.
Why: The first Ethernet destination is the next hop, not H2's remote interface.
- Route between logical interfaces.
R1 receives VLAN 10 traffic, looks up H2's IP network and selects its connected VLAN 20 subinterface.
Why: The routing table, not the switch's VLAN number alone, determines the outgoing IP path.
- Verify the return direction.
H2 sends the reply through R1's VLAN 20 gateway, and R1 routes it back toward H1 in VLAN 10.
Why: An echo exchange requires both directions; one received request is not successful connectivity.
Your first small task
On paper, compare subinterface Gi0/0.77 with encapsulation dot1q 20. State its local suffix and the VLAN it receives, then identify which setting must agree with the switch's VLAN 20 carriage.
Show a hint
Matching suffixes are a naming convention that helps humans, not the mechanism that puts a VLAN ID on frames.
Check the expected result
77 is the local subinterface label; the encapsulation setting maps it to VLAN 20.
Pause and explain it in your own words
Can R1 route these two subnets without static routes on R1?
Show a hint
Inspect which networks belong to its operational gateway interfaces.
Show the explanation
Yes. Both networks are directly connected to R1's operational subinterfaces. The endpoint default routes are a separate requirement for reaching destinations outside their local subnet.
Short answer
What should you understand today?
Router-on-a-stick uses one physical router link with a logical subinterface per VLAN. Each subinterface needs the correct 802.1Q VLAN mapping and an IP address in that VLAN's subnet. Hosts use their local router address for other networks. Verify access VLANs, trunk carriage, subinterface state, connected routes and both directions of the endpoint exchange.
Before you begin
Learning targets
- Complete access VLAN and 802.1Q trunk lessons.
- Understand local versus off-subnet IPv4 decisions and IOS command modes.
- Use an existing entitled CML 2.10 lab with fresh IOSvL2 and IOSv nodes.
- Map each VLAN to its router subinterface and unique IP subnet.
- Distinguish a subinterface suffix from its encapsulation VLAN ID.
- Configure the parent link, gateways and endpoint return paths.
- Correlate interface state with connected routes and peer tests.
- Disable and restore only one isolated subinterface without claiming hardware performance.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
Inter-VLAN routing
Routing moves an IP packet between different networks, including networks attached to separate VLANs. A trunk alone carries VLAN frames but does not make that routing decision.
Router-on-a-stick
One router Ethernet interface uses several logical subinterfaces, each associated with a VLAN. The shared cable carries traffic toward the router and back toward the destination VLAN.
Subinterface and parent
A subinterface is a logical subdivision of a physical parent interface, such as Gi0/0.10. The suffix is a local label; encapsulation dot1q 10, not the suffix itself, selects VLAN 10.
Gateway and default route
A gateway is the next-hop router for an off-subnet destination. Our IOSv test endpoints use an explicit default route to mimic that host choice; their command syntax differs from a desktop gateway setting.
Connected route
A connected route describes a network attached to an operational IP interface. R1 can route between its two connected /24 networks without a static route for either one.
ARP and frame replacement
ARP discovers a local next-hop MAC for IPv4. The router removes the incoming frame and builds a new outgoing frame; the end-to-end IP destination remains H2 in this no-NAT lab.
Native VLAN
The native VLAN classifies untagged traffic under this lab's default behavior. VLAN 999 matches at both trunk ends and has no user IP address; VLANs 10 and 20 are tagged.
Console and rollback
Console provides direct access independent of the data cable. Rollback restores the exact known change, here a single subinterface shutdown, before repeating the original traffic test.
Make one physical connection serve two gateways
The router parent provides the physical connection. Logical subinterfaces provide VLAN-specific IP attachments. In this design the parent has no IP address, VLAN 10 uses 192.0.2.1/24 and VLAN 20 uses 198.51.100.1/24. Each prefix is different and each endpoint has the corresponding local gateway.
- Keep the parent enabled and verify its cable state.
- Do not place overlapping subnets on different gateway subinterfaces.
Trace the complete request and reply
H1 sends an off-subnet packet inside a frame addressed to its local gateway. SW1 carries the VLAN 10 frame to R1. R1 makes an IP routing decision, then builds a new VLAN 20 frame toward H2. SW1 delivers that through H2's access port. The return takes the corresponding reverse routing decisions.
- The physical router cable carries both arrival and departure traffic.
- A reply needs H2's correct local gateway as well as H1's.
A router trunk is deliberately configured
The switch must carry both data VLANs and agree with the router on any native classification. R1 does not rely on DTP to create its subinterfaces. This lab uses explicit trunk mode and no negotiation on SW1, with unused native VLAN 999 matched by an unaddressed native subinterface.
- An up/up subinterface is not proof that the remote VLAN is carried correctly.
- Native VLAN 999 has no endpoint or IP service in this experiment.
Use connected-route evidence carefully
A connected route indicates R1's local network attachment is operational from its perspective. It does not prove that every host in that prefix is reachable or that the switch trunk is correctly carrying the VLAN. Use show ip interface brief, the interface configuration and show ip route together with gateway and peer tests.
- No static route is needed on R1 for either directly connected subnet.
- Endpoint IOSv default routes are included because these test nodes otherwise lack an off-subnet path.
Know what the model does not establish
One shared cable is a dependency for both gateways. Its capacity and hardware forwarding behavior depend on real equipment, while CML virtual images have performance limitations. Do not use this exercise to quote production throughput, convergence time or firewall effectiveness. Routing also permits traffic unless additional policy constrains it.
- No gateway redundancy or security policy is configured here.
- Only actually executed results can be reported as observations.
Real-world walkthrough
Local gateway replies, but the other department does not
In a hypothetical training branch, users in VLAN 10 can ping their local gateway while VLAN 20 is unreachable. A recent configuration change disabled only one router subinterface. The physical trunk remains up, so inspecting only the cable status misses the actual changed boundary.
- Record H1's exact source address, local gateway result and failed remote destination.
- Inspect access membership and the switch trunk before assuming the router is at fault.
- Read R1's parent and subinterface state, then compare connected routes with the baseline.
- Restore only the documented subinterface shutdown and allow normal neighbor discovery.
- Retest H1's gateway and H2, then retain the evidence and the untested application scope.
Guided GNS3 lab
Two routed VLANs on one router cable
Configure a fresh router-on-a-stick topology, verify local and remote destinations, then disable and restore only R1's VLAN 20 gateway. Expected results are source-grounded predictions, not an author-run transcript.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| H1 | Gi0/0 | 192.0.2.10/24; next hop 192.0.2.1 | VLAN 10 endpoint |
| H2 | Gi0/0 | 198.51.100.20/24; next hop 198.51.100.1 | VLAN 20 endpoint |
| R1 | Gi0/0.10 | 192.0.2.1/24 | VLAN 10 gateway |
| R1 | Gi0/0.20 | 198.51.100.1/24 | VLAN 20 gateway |
| R1 | Gi0/0.999 | No IP; native 999 | Match unused native classification |
Set up the lab
- Create the four fresh CML nodes using existing licensed images. Record show version and preserve the starting lab before configuration.
- Cable exactly the three links listed and retain Console access. Decline the initial setup dialog if shown; stop on unexpected credentials or port names.
- Do not reuse a lab with NAT, ACLs, bridging or routes from another exercise. Those would introduce additional variables.
- Without entitlement, trace the packet and configuration relationships on paper and mark all runtime outcomes unperformed.
Create the three VLAN contexts
In CML, select SW1, open its Console tab and connect before typing. At SW1's Console inspect the fresh image, then create data VLANs 10 and 20 and the unused native VLAN 999.
enable
show version
configure terminal
vlan 10
exit
vlan 20
exit
vlan 999
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
show version- Record the exact virtual switch build.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
vlan 10- Create H1's local domain.
exit- Return to global configuration.
vlan 20- Create H2's separate local domain.
exit- Return to global configuration again.
vlan 999- Create the unused native classification.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- All three VLANs exist on SW1 without enabling routing.
- Why this step matters
- VLAN creation supplies the local domains but does not itself provide gateways.
Assign access port 0/0
In CML, select SW1, open its Console tab and connect before typing. Select only the mapped endpoint cable. This is an access interface, so its attached IOSv endpoint sends ordinary untagged Ethernet.
configure terminal
interface GigabitEthernet0/0
switchport mode access
switchport access vlan 10
no shutdown
endWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select the endpoint port identified in the cable map.
switchport mode access- Make ordinary untagged data access explicit.
switchport access vlan 10- Associate the endpoint's untagged frames with its planned VLAN.
no shutdown- Enable this access link.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- The endpoint port is enabled in VLAN 10.
- Why this step matters
- The router's VLAN classification is useful only if the endpoint enters the matching switch domain.
Assign access port 0/1
In CML, select SW1, open its Console tab and connect before typing. Select only the mapped endpoint cable. This is an access interface, so its attached IOSv endpoint sends ordinary untagged Ethernet.
configure terminal
interface GigabitEthernet0/1
switchport mode access
switchport access vlan 20
no shutdown
endWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/1- Select the endpoint port identified in the cable map.
switchport mode access- Make ordinary untagged data access explicit.
switchport access vlan 20- Associate the endpoint's untagged frames with its planned VLAN.
no shutdown- Enable this access link.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- The endpoint port is enabled in VLAN 20.
- Why this step matters
- The router's VLAN classification is useful only if the endpoint enters the matching switch domain.
Build the router-facing trunk
In CML, select SW1, open its Console tab and connect before typing. Select Gi0/2, the only cable to R1. The parent router interface does not negotiate a Cisco switch trunk through DTP.
configure terminal
interface GigabitEthernet0/2
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
switchport trunk native vlan 999
switchport trunk allowed vlan 10,20,999
no shutdown
end
show interfaces trunkWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/2- Select the router-facing switch port.
switchport trunk encapsulation dot1q- Choose 802.1Q on IOSvL2.
switchport mode trunk- Make tagged multi-VLAN carriage explicit.
switchport nonegotiate- Disable dependence on DTP negotiation.
switchport trunk native vlan 999- Use the same unused native VLAN as R1.
switchport trunk allowed vlan 10,20,999- Permit exactly the planned VLANs.
no shutdown- Enable the router cable.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces trunk- Inspect actual mode, native ID and allowed/active/forwarding lists.
- What you should see
- Gi0/2 is the planned 802.1Q trunk when both physical ends are up.
- Why this step matters
- A tagged router attachment requires matching switch carriage, not just router IP addresses.
Enable the parent and match native behavior
In CML, select R1, open its Console tab and connect before typing. Inspect R1 before configuration. The fresh parent must have no existing IP configuration to preserve; stop if it does.
enable
show version
configure terminal
interface GigabitEthernet0/0
no ip address
no shutdown
exit
interface GigabitEthernet0/0.999
encapsulation dot1q 999 native
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
show version- Record the exact IOSv router build.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select the physical parent cabled to SW1 Gi0/2.
no ip address- Keep the parent unaddressed in this subinterface design.
no shutdown- Enable the shared physical parent.
exit- Return to global configuration.
interface GigabitEthernet0/0.999- Create the unused native logical attachment.
encapsulation dot1q 999 native- Match SW1's untagged native VLAN 999.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- The physical parent is enabled and native 999 has no IP address.
- Why this step matters
- The shared parent and native convention are separate from the two addressed data gateways.
Configure both tagged gateways
In CML, select R1, open its Console tab and connect before typing. Create one nonoverlapping IP network per VLAN mapping. Do not assume the numerical suffix alone selects the VLAN.
configure terminal
interface GigabitEthernet0/0.10
encapsulation dot1q 10
ip address 192.0.2.1 255.255.255.0
exit
interface GigabitEthernet0/0.20
encapsulation dot1q 20
ip address 198.51.100.1 255.255.255.0
end
show ip interface briefWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0.10- Select the logical VLAN 10 gateway.
encapsulation dot1q 10- Associate this subinterface with tagged VLAN 10.
ip address 192.0.2.1 255.255.255.0- Assign H1's local gateway address.
exit- Return to global configuration for the next subinterface.
interface GigabitEthernet0/0.20- Select the logical VLAN 20 gateway.
encapsulation dot1q 20- Associate this subinterface with tagged VLAN 20.
ip address 198.51.100.1 255.255.255.0- Assign H2's local gateway address.
end- Return to privileged EXEC without saving or reversing the configuration.
show ip interface brief- Inspect parent and both gateway states.
- What you should see
- Both addressed subinterfaces can become up/up through the enabled parent.
- Why this step matters
- The encapsulation and prefix together define each VLAN's Layer 3 attachment.
Configure H1 and its gateway route
In CML, select H1, open its Console tab and connect before typing. This IOSv node is a single-interface test endpoint. The explicit default route represents an off-link gateway choice; a real desktop uses its operating system's gateway setting.
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.10 255.255.255.0
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 192.0.2.1
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select this endpoint's only data interface.
ip address 192.0.2.10 255.255.255.0- Assign the endpoint address in its distinct /24 network.
no shutdown- Enable the endpoint's access cable.
exit- Return to global configuration to set a route.
ip route 0.0.0.0 0.0.0.0 192.0.2.1- Send destinations without a more specific route to this local R1 gateway.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- The endpoint has its local address and a route toward the correct local gateway.
- Why this step matters
- A route back from H2 is essential; receiving a request alone is not a successful echo exchange.
Configure H2 and its gateway route
In CML, select H2, open its Console tab and connect before typing. This IOSv node is a single-interface test endpoint. The explicit default route represents an off-link gateway choice; a real desktop uses its operating system's gateway setting.
enable
configure terminal
interface GigabitEthernet0/0
ip address 198.51.100.20 255.255.255.0
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 198.51.100.1
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select this endpoint's only data interface.
ip address 198.51.100.20 255.255.255.0- Assign the endpoint address in its distinct /24 network.
no shutdown- Enable the endpoint's access cable.
exit- Return to global configuration to set a route.
ip route 0.0.0.0 0.0.0.0 198.51.100.1- Send destinations without a more specific route to this local R1 gateway.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- The endpoint has its local address and a route toward the correct local gateway.
- Why this step matters
- A route back from H2 is essential; receiving a request alone is not a successful echo exchange.
Verify local and routed baselines
In CML, select H1, open its Console tab and connect before typing. Allow discovery and repeat initial losses once. Both tests must succeed before the deliberate fault; otherwise investigate without changing extra variables.
ping 192.0.2.1
ping 198.51.100.20What each command means
ping 192.0.2.1- Test H1's local VLAN 10 gateway.
ping 198.51.100.20- Test H2 through R1 and the return path.
- What you should see
- Expect local-gateway and remote-peer replies.
- Why this step matters
- The second test extends the first through routing and H2's return gateway.
Record the route and interface baseline
In CML, select R1, open its Console tab and connect before typing. Read the router's own evidence after traffic succeeds. Do not treat the predicted route entries as an observed transcript.
show ip route connected
show interfaces GigabitEthernet0/0.20
show arpWhat each command means
show ip route connected- Inspect the two directly attached /24 networks.
show interfaces GigabitEthernet0/0.20- Record VLAN 20 encapsulation and operational state.
show arp- Inspect local neighbor mappings in each attached network.
- What you should see
- Expect connected entries for both operational gateway networks.
- Why this step matters
- Connected route state and actual endpoint tests complement one another.
Disable only the VLAN 20 gateway
In CML, select R1, open its Console tab and connect before typing. Keep Console access and the physical parent enabled. This deliberate fault is only a subinterface shutdown; do not save it.
configure terminal
interface GigabitEthernet0/0.20
shutdown
end
show ip interface brief
show ip route connectedWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0.20- Select only the H2-side logical gateway.
shutdown- Administratively disable that subinterface without disabling the parent.
end- Return to privileged EXEC without saving or reversing the configuration.
show ip interface brief- Record the selective administrative state.
show ip route connected- Compare the missing VLAN 20 connected route with the retained VLAN 10 route.
- What you should see
- Expect VLAN 20 gateway disabled and VLAN 10 still operational.
- Why this step matters
- The narrow fault allows a local control test while removing the remote gateway path.
Compare local success with remote failure
In CML, select H1, open its Console tab and connect before typing. Repeat exactly the two baseline destinations. Do not infer application health or change the endpoint default route.
ping 192.0.2.1
ping 198.51.100.20What each command means
ping 192.0.2.1- Verify the unaffected VLAN 10 gateway remains reachable.
ping 198.51.100.20- Observe the affected routed peer exchange.
- What you should see
- Expect the local gateway to reply and the remote H2 exchange to fail.
- Why this step matters
- This symptom pair is explained by the known subinterface state, not by a guessed cable failure.
Restore the selected gateway
In CML, select R1, open its Console tab and connect before typing. Undo only the known shutdown and inspect the same route state. If the baseline differs, stop rather than broadening the restoration.
configure terminal
interface GigabitEthernet0/0.20
no shutdown
end
show ip interface brief
show ip route connectedWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0.20- Select the exact subinterface changed by the fault.
no shutdown- Restore its enabled baseline state.
end- Return to privileged EXEC without saving or reversing the configuration.
show ip interface brief- Confirm the parent and both gateway states.
show ip route connected- Confirm the intended connected networks return.
- What you should see
- Expect the VLAN 20 route and interface state to recover.
- Why this step matters
- A successful inverse command must still be followed by the original endpoint exchange.
Retest both paths after restoration
In CML, select H1, open its Console tab and connect before typing. Repeat the local and remote tests after normal discovery. Retain actual output and mark unrelated services untested.
ping 192.0.2.1
ping 198.51.100.20What each command means
ping 192.0.2.1- Recheck the local gateway control.
ping 198.51.100.20- Recheck the full routed request and reply through R1.
- What you should see
- Expect both baseline destinations to reply again.
- Why this step matters
- The restoration is complete only when configuration and selected behavior agree.
Verify
- Match each access VLAN, trunk VLAN and router encapsulation ID.
- Verify both endpoint gateway choices and unique /24 prefixes.
- Record local and remote baseline tests before the fault.
- Compare selective subinterface state and connected-route changes.
- Repeat both original tests after restoring the exact gateway.
Troubleshoot
- If a local gateway fails, inspect that access VLAN, trunk allowance, encapsulation ID and local address before diagnosing remote routing.
- If only the remote destination fails, confirm both connected networks on R1 and the endpoint's return route; receiving a request is not a completed ping.
- If a subinterface is up but traffic fails, compare its encapsulation ID with SW1. Parent state alone cannot validate tag carriage.
- If the shared parent goes down, both logical gateways may be affected. Restore the intended lab cable or administrative state without resetting unrelated interfaces.
Use an existing Cisco Modeling Labs 2.10 entitlement and its bundled reference images inside CML only. GNS3 does not provide Cisco images; use images there only when a separate applicable license permits that environment. Do not share or redistribute image files. A CML subscription alone does not authorize exporting its Cisco images to GNS3. Without entitlement, use the explicitly labeled paper exercises; they do not establish hands-on competence.
- Leave R1 Gi0/0.20 enabled and verify both original destinations before stopping the lab.
- Keep private configuration/evidence notes and the original snapshot. Do not distribute Cisco images or save the deliberate shutdown.
Practice set
Answer before you reveal
01What actually selects a subinterface's VLAN?
The local suffix is a readable naming choice, not the mapping mechanism.
02What MAC does H1 resolve for remote H2?
H2 is off-subnet, so H1 sends the first frame to the next hop rather than directly to H2's remote MAC.
03Why does H2 need a gateway route?
A request reaching H2 is not sufficient; the reply also requires an off-subnet next hop.
04Does a connected route prove host reachability?
The switch VLAN path and endpoint still need verification even when the router installs the connected prefix.
05What stays unchanged without NAT?
The router builds a new Ethernet frame and updates routing-related IP fields, but no address translation is configured.
06What is the shared physical dependency?
A parent failure can affect both subinterfaces, unlike the deliberately selective shutdown used here.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- A router subinterface provides a VLAN-specific Layer 3 attachment.
- The encapsulation VLAN ID matters more than the suffix convention.
- The same trunk cable carries ingress and egress VLAN contexts.
- Connected routes do not replace endpoint tests.
- Return gateway configuration is part of successful connectivity.
- Selective failure evidence should lead to a selective restoration.