Understanding VLANs: From Basics to Inter-VLAN Routing with ROAS and Multilayer Switches

If you've ever wondered how networks stay organized and efficient even with dozens or hundreds of devices, the answer often involves VLANs.
In this blog, we’ll break down what VLANs are, how they work, and why they’re useful in managing traffic and reducing broadcast domains. You’ll also learn how to configure them using Cisco CLI, connect multiple switches with trunk links, and route between VLANs using two common methods: Router-on-a-Stick (ROAS) and Multilayer Switches.
I’ll walk you through three examples with step-by-step explanations, real CLI outputs, and images so you can follow along or try it yourself in Packet Tracer.
Before we get deeper into VLANs, it helps to understand what a LAN is in the first place. A Local Area Network (LAN) is basically a group of connected devices like computers, printers, or phones that share a common network within a limited area, such as an office, home, or school. All these devices can talk to each other, share files, and access shared resources like the internet or a printer.
Now, imagine a big company where hundreds of devices are all part of the same LAN. Without some form of separation or control, things can get messy, slow, and even insecure. That’s where VLANs come in.
A broadcast domain is the part of a network where a broadcast message can reach all connected devices. For example, when one device sends out a message to find another device’s MAC address, that message is sent to everyone in the same broadcast domain. Every device receives it, even if it’s not the intended recipient.
In small networks, this isn’t a big deal. But in larger setups, constant broadcasts can slow things down and expose devices to unnecessary traffic. It’s like shouting in a crowded room everyone hears you, even if you’re only trying to talk to one person.
By default, all devices connected to the same switch are in the same broadcast domain. This is where VLANs come in. They let us split a single switch into multiple broadcast domains, keeping traffic more organized and secure.
You might be wondering, is a LAN just a broadcast domain? Not exactly, but they’re closely related.
A LAN refers to a physical or logical network where devices are connected and can communicate. It includes all the devices, cables, switches, and everything that makes up the local network in a certain area like a home or office.
A broadcast domain, on the other hand, is more about how traffic flows inside that LAN. It defines the group of devices that will receive broadcast messages from one another. By default, all devices connected to the same switch (without VLANs) are part of the same broadcast domain.
So, while a LAN can contain one broadcast domain, it’s not limited to just that. If you don’t use VLANs, then yes, a LAN might be just one big broadcast domain. But once you start adding VLANs, you can have multiple broadcast domains within a single LAN.
Think of it like this:
The LAN is the building.
The broadcast domains are the rooms inside it.
VLANs let you build walls between those rooms.
Example 1: VLAN Setup Using One Switch, One Router, and Separate Cable Connections
Let’s start with a basic VLAN setup. In this example, we’ll use one switch, one router, and three VLANs. Each VLAN will be connected to the router through a separate physical cable. This method is sometimes called router-on-a-stick without trunking, or simply using separate interfaces per VLAN.
Here’s how it works:
The switch is where all the end devices (like PCs or printers) are connected.
The router handles communication between VLANs.
Each VLAN is assigned to its own port on the router using individual cables.
So for 3 VLANs, we need 3 Ethernet cables running from the switch to the router one for each VLAN. Each cable connects to a different router interface, and each interface is configured with its own IP address (gateway) for the VLAN it serves.
This setup is easy to understand and works well for small networks, but it’s not scalable. Imagine needing 10 VLANs, you’d need 10 physical router ports and 10 cables just to make it work.
In the image, you’ll notice that I used the interface range
command along with the VLAN configuration commands. This is a quick way to configure multiple ports at once, instead of doing them one by one.
Here’s what each part does:
interface range
This command lets you select a group of ports in one line. For example:interface range fa0/1 - 3
means you’re applying the next commands to ports FastEthernet 0/1 to 0/3 all at once. It saves time and helps keep things consistent.
switchport mode access
This sets each of those ports to access mode, so they only carry traffic for a single VLAN.switchport access vlan [VLAN_ID]
This assigns all the selected ports to the specified VLAN. For example, if it’s VLAN 10, all the ports in the range will now be part of VLAN 10.
This method is especially useful when you have several PCs or router interfaces that belong to the same VLAN. It’s clean, fast, and avoids having to repeat the same commands over and over for each port.
Now that we’ve configured the ports and assigned them to their respective VLANs, it’s important to check if everything is set up correctly. One of the easiest ways to do that is by using the show vlan brief
command.
This command gives you a quick summary of all the VLANs on the switch and which ports are assigned to each one. It's a great way to confirm that your configuration worked as expected and to spot any ports that might have been missed or left in the default VLAN by accident.
Example 2: Introducing Trunking, VLAN Tagging, Native VLAN, and Router-on-a-Stick (ROAS)
In this setup, we're moving to a more scalable and efficient way of handling VLANs. Instead of using multiple physical cables for each VLAN like we did in the first example, we’re now introducing a few important concepts that are common in real-world networks: Trunking, VLAN tagging, Native VLAN, and ROAS (Router-on-a-Stick).
What’s different here?
Instead of needing one cable for each VLAN, we’re using trunk ports, which can carry traffic from multiple VLANs over a single physical connection. This is possible through a process called VLAN tagging, where each frame is labeled with a VLAN ID as it travels across the trunk.
We’re also introducing the concept of the Native VLAN, which is used for any untagged traffic crossing the trunk. By default, VLAN 1 is the native VLAN, but you can change this if needed.
Lastly, instead of assigning separate interfaces on the router for each VLAN, we’ll configure sub-interfaces on one physical port. This setup is known as Router-on-a-Stick (ROAS). Each sub-interface is assigned to a VLAN, and the router uses them to route traffic between VLANs.
Before We Configure Anything: What Is a Trunk Port?
Now that we’ve laid out the new topology, you might be wondering how a single cable between switches or between a switch and a router can carry traffic from multiple VLANs. That’s where trunk ports come in.
Trunk ports are special switch ports that carry traffic for more than one VLAN at a time. Unlike access ports (which are assigned to just one VLAN), trunk ports are used to connect switches to each other or to a router in a setup like Router-on-a-Stick.
What About VLAN Tagging?
When a trunk port carries traffic from multiple VLANs, the switch needs a way to keep track of which frame belongs to which VLAN. That’s where VLAN tagging comes in.
VLAN tagging is the process of adding a small piece of information to each Ethernet frame as it leaves the switch. This tag includes the VLAN ID, so when the frame reaches another switch or router, it knows which VLAN it belongs to.
There are two main trunking protocols used for VLAN tagging:
1. ISL (Inter-Switch Link)
This is a Cisco proprietary protocol, which means it only works between Cisco devices.
It adds the VLAN tag by encapsulating the entire Ethernet frame with an extra ISL header.
It’s considered outdated and not commonly used anymore.
2. 802.1Q (Dot1Q)
This is an open standard, so it works on both Cisco and non-Cisco devices.
Instead of encapsulating the whole frame, it simply inserts a VLAN tag inside the Ethernet frame header.
It’s the most widely used VLAN tagging protocol today, especially in modern networks.
For this example, we’ll be using 802.1Q since it's supported by most devices and is the current standard.
In the image, you can see how the 802.1Q VLAN tag fits into a regular Ethernet frame. It’s not a huge change. It just adds 4 extra bytes to the frame.
Here’s what happens:
Normally, an Ethernet frame has:
Destination MAC → Source MAC → EtherType → Payload → FCSWith 802.1Q tagging, it becomes:
Destination MAC → Source MAC → VLAN Tag → EtherType → Payload → FCS
That image breaks down the 4-byte VLAN tag that’s inserted into an Ethernet frame when it's sent across a trunk link. Here's what each part does:
TPID (Tag Protocol Identifier) – 16 bits:
- Always set to 0x8100, this tells all devices on the network that the frame is using 802.1Q tagging.
TCI (Tag Control Information) – 16 bits total:
This field is split into three smaller parts:PCP (Priority Code Point) – 3 bits:
Used by IEEE 802.1p to prioritize traffic. Values range from 0 (lowest priority) to 7 (highest).DEI (Drop Eligible Indicator) – 1 bit:
Previously known as CFI. This bit signals if a frame can be dropped during congestion. In modern Ethernet, it’s almost always set to 0.VID (VLAN Identifier) – 12 bits:
Specifies which VLAN the frame belongs to. IDs range from 1 to 4094 (0 and 4095 are reserved).
Putting this all together, the TPID + TCI adds just 4 bytes to the Ethernet frame, but gives switches the information they need to properly carry and segregate multiple VLANs over a single trunk connection.
VLAN ID Ranges
The VID (VLAN Identifier) is 12 bits long, which gives a total of 4096 possible VLAN IDs (0–4095). But not all of them are usable.
Here’s how they’re categorized:
VLAN 0 – Reserved for internal use (used to indicate no VLAN tag in some cases).
VLANs 1–1005 – These are standard (or normal range) VLANs:
VLAN 1 is the default VLAN.
VLANs 2–1001 are user-configurable.
VLANs 1002–1005 are reserved for legacy purposes like FDDI and Token Ring.
VLANs 1006–4094 – These are extended range VLANs:
Supported only when VTP is set to transparent mode or not used.
Mainly used in larger or more customized networks.
VLAN 4095 – Reserved and cannot be used.
So, in practice, the usable VLAN IDs for normal use are:
2–1001 (normal range)
1006–4094 (extended range, with some limitations)
What Happens on a Trunk Port?
Trunk ports are designed to carry traffic for multiple VLANs across a single cable. But how the switch handles each frame depends on a few conditions especially whether the VLAN tag is present, if it matches the native VLAN, or if the VLAN exists on the other side of the link.
1. Tagged Traffic (802.1Q)
When a frame leaves a trunk port, the switch adds a VLAN tag that includes the VLAN ID. This tag tells the receiving switch which VLAN the frame belongs to.
If the receiving switch has that VLAN configured, it accepts the frame and forwards it based on that VLAN. If it doesn’t have that VLAN, the frame is dropped and the switch has no idea where it should go.
So always make sure both ends of the trunk have the same VLANs configured.
2. Untagged Traffic (Native VLAN)
Not all frames are tagged. Frames that belong to the native VLAN are sent without a tag across the trunk.
By default, VLAN 1 is the native VLAN on Cisco devices. But you can change it if needed.
Here’s the important part:
If both switches agree on the same native VLAN, then untagged traffic is correctly handled.
If the native VLANs don’t match, untagged frames may end up in the wrong VLAN on the other switch. That can cause connectivity problems or security risks.
Best practice: Match the native VLAN on both sides of a trunk port or avoid using it by tagging everything explicitly.
3. VLAN Doesn’t Exist on the Other Switch
Even if a frame is properly tagged, it will be dropped by the receiving switch if the VLAN ID isn’t configured there. The switch doesn’t forward traffic for unknown VLANs.
This usually happens if:
The VLAN was created on one switch but not the other
You’re using VTP and it’s not set up correctly
You simply forgot to add it manually
Always double-check that all relevant VLANs exist on both ends of the trunk.
After understanding how trunk ports work, the next step is learning how to actually configure one. On a Cisco switch, the command that tells an interface to behave as a trunk is:
switchport mode trunk
This command forces the interface into trunking mode, meaning it will now carry traffic for multiple VLANs instead of just one. It also enables 802.1Q tagging by default, which is how the switch keeps VLAN traffic separated over that single link.
By using switchport mode trunk
on both sides (In this example, SW1 and SW2), we’re telling each switch:
"This link will carry multiple VLANs. Tag the frames using 802.1Q."
This step is critical for making sure VLAN traffic can travel between switches properly. Without trunking, the switches would treat the connection like a regular access port, and VLAN separation would break.
After configuring a trunk port, it’s always a good idea to check if the trunking is working correctly. That’s where the show interfaces trunk
command comes in.
This command gives you a quick overview of all trunk ports on the switch and shows important details like:
Port – The interface currently operating as a trunk
Mode – Whether the trunk is on, off, or in desirable/auto mode (if using dynamic trunking)
Encapsulation – The tagging protocol in use (usually
802.1q
)Native VLAN – The VLAN that sends untagged frames
Allowed VLANs – The VLANs allowed to pass through this trunk link
This is one of the go-to commands when you want to verify if trunking is active and which VLANs are being carried across the link.
Controlling Which VLANs Can Cross the Trunk
By default, once you configure a trunk port, it allows all VLANs to pass through. But in most networks, you don’t want that. It’s more secure and efficient to limit the trunk to only the VLANs that need to communicate between switches.
That’s where this command comes in:
switchport trunk allowed vlan
You can use it to manually specify which VLANs are allowed on the trunk link. This helps reduce unnecessary traffic and prevents unwanted VLANs from reaching the other switch.
Security Tip: Use an Unused VLAN as the Native VLAN
By default, Cisco switches use VLAN 1 as the native VLAN. That means any untagged traffic on a trunk link is treated as belonging to VLAN 1. The problem is:
VLAN 1 is often used by default for many things like CDP, VTP, STP messages, and even user ports if you're not careful.
For security reasons, it’s recommended to avoid using VLAN 1 and to assign a native VLAN that is not used anywhere else in your network.
For example:
interface fa0/1
switchport trunk native vlan 999
Here’s why this helps:
Prevents VLAN hopping attacks: Some attacks try to take advantage of mismatched native VLANs or untagged frames being accepted by the wrong VLAN.
Isolates untagged traffic: If any untagged frames accidentally enter your trunk, they won’t be placed in a production VLAN.
Makes misconfigurations easier to spot: If VLAN 999 is not used by any devices, untagged traffic will stand out during troubleshooting.
Best practice: Create a dedicated VLAN (like 999), assign it as the native VLAN on trunk ports, and don’t assign any access ports to it.
Difference Between show vlan brief
and show interfaces trunk
show vlan brief
Shows all VLANs on the switch and the access ports assigned to them.
✅ Good for checking VLAN membership.
❌ Does not show trunk ports.show interfaces trunk
Shows trunk ports, the VLANs allowed, and the native VLAN.
✅ Good for verifying trunk links.
❌ Does not show access ports.
Let's Talk About ROAS (Router-on-a-Stick)
VLANs are great for segmenting networks, but by default, devices in different VLANs can’t talk to each other because they're isolated. That’s where inter-VLAN routing comes in.
One way to enable communication between VLANs is by using a method called Router-on-a-Stick, or ROAS. It lets a single router interface handle traffic for multiple VLANs using subinterfaces and trunking.
ROAS allows a single physical interface on a router to route traffic between multiple VLANs. This is done by creating subinterfaces, where each one is assigned to a different VLAN.
Each subinterface is treated like a separate logical interface. You assign it an IP address (which becomes the default gateway for that VLAN) and bind it to a VLAN using 802.1Q tagging.
Basic Steps to Configure ROAS
Let’s say the router is connected to the switch on interface G0/0, and we have VLANs 10, 20, and 30.
On the router:
interface g0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface g0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
interface g0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
g0/0.10
is a subinterface for VLAN 10.encapsulation dot1Q 10
tells the router this subinterface handles VLAN 10 traffic using 802.1Q tagging.The
ip address
command sets the gateway for that VLAN.
Don’t forget to enable the physical interface:
interface g0/0
no shutdown
Important Notes:
The switch port connected to the router must be a trunk port.
PCs in each VLAN should have their default gateway set to the router’s IP in their VLAN.
Make sure all VLANs are properly created on the switch.
You don't have to use the VLAN number as the subinterface number, but doing so makes your configuration easier to read and manage. It helps you quickly see which subinterface matches which VLAN.
Native VLAN in ROAS
In a Router-on-a-Stick setup, every VLAN that needs to be routed is usually assigned a subinterface with encapsulation dot1Q
and a VLAN ID. But what if you want the router to handle untagged traffic. Traffic that doesn't belong to any VLAN?
That’s where the native VLAN comes in.
To configure a native VLAN on ROAS, you just omit the VLAN ID in the encapsulation
line. Here's what it looks like:
interface g0/0.99
encapsulation dot1Q 99 native
ip address 192.168.99.1 255.255.255.0
In this case:
VLAN 99 is set as the native VLAN.
Any untagged frames arriving at the router through the trunk interface will be processed by this subinterface.
This works just like other ROAS subinterfaces but tells the router to expect untagged traffic for VLAN 99.
Don’t forget to configure the switch trunk port to match:
interface fa0/1
switchport trunk native vlan 99
This ensures both sides agree on which VLAN is native, avoiding miscommunication or dropped frames.
There are two ways to configure the native VLAN, depending on what device you're working with:
1. On a Switch (Trunk Port)
You set the native VLAN so that untagged traffic on a trunk link is assigned to a specific VLAN.
Command:
interface fa0/1
switchport trunk native vlan 99
This tells the switch:
"If a frame comes in untagged on this trunk, treat it as part of VLAN 99."
2. On a Router (ROAS – Subinterface)
You configure the router to handle untagged traffic by marking one of its subinterfaces as the native VLAN.
Command:
interface g0/0.99
encapsulation dot1Q 99 native
ip address 192.168.99.1 255.255.255.0
This tells the router:
"This subinterface will handle untagged frames for VLAN 99."
Important: The native VLAN must match on both ends of the trunk link (router and switch). If not, it could lead to dropped packets or VLAN mismatch warnings.
Now that we've covered how a router handles inter-VLAN communication through ROAS, let’s look at a more efficient approach especially for larger or faster networks.
This brings us to the Multilayer Switch, a device that combines the functions of a switch and a router. Instead of relying on an external router, it can perform inter-VLAN routing on its own. Let's break down what it is and how it works.
What Is a Multilayer Switch?
A Multilayer Switch (MLS) works like a regular switch at Layer 2, forwarding frames based on MAC addresses. But it also has Layer 3 capabilities, meaning it can route packets between VLANs, just like a router.
This means you don’t need a separate router for inter-VLAN communication. The multilayer switch can do it all internally, making the setup simpler and faster.
How It Works with Inter-VLAN Routing
Instead of using subinterfaces like in ROAS, a multilayer switch uses SVIs (Switched Virtual Interfaces). These are virtual interfaces that act as the default gateways for VLANs.
Each VLAN gets its own SVI with an IP address. The switch then routes traffic between these SVIs.
Here’s a basic example:
interface vlan 10
ip address 192.168.10.1 255.255.255.0
no shutdown
interface vlan 20
ip address 192.168.20.1 255.255.255.0
no shutdown
These IPs become the default gateways for the devices in VLAN 10 and VLAN 20.
Example 3: Using a Multilayer Switch as SW2
In this final example, we’re keeping the same network layout, but with one important change: we're replacing the traditional Layer 2 switch (SW2) with a Multilayer Switch.
We’re not removing the router (R1). It will still be part of the network and will handle traffic going outside the LAN, such as internet-bound packets.
The new SW2 (our Multilayer Switch) will take over inter-VLAN routing within the local network using SVIs. Then, we'll configure a default route on SW2 pointing to R1, so any traffic that isn’t meant for the local VLANs gets forwarded to the router.
This setup gives us the best of both worlds:
Fast local routing between VLANs handled by SW2
External routing handled by R1
Now that we’ve updated our topology and introduced the use of a Multilayer Switch, let’s talk about how it actually handles routing between VLANs.
This is done through a method called Inter-VLAN Routing via SVI short for Switched Virtual Interface. It’s a simpler and more efficient alternative to ROAS when you're working with a Multilayer Switch.
What Is Inter-VLAN Routing via SVI?
An SVI (Switched Virtual Interface) is a virtual interface configured on a switch for a specific VLAN. It acts like a gateway for devices within that VLAN. When you configure an IP address on an SVI, the switch can route traffic between that VLAN and others that also have SVIs.
In simpler terms:
Instead of using a router and physical or subinterfaces, the Multilayer Switch itself handles the routing internally using these virtual interfaces.
With R1 now set up, we’ll configure a default route on SW2 pointing to 192.168.1.194
. This way, any traffic that doesn’t belong to the local VLANs will be forwarded to the router for further handling. Let’s go ahead and set that up next.
What’s Happening Here?
ip routing
turns on Layer 3 routing features so the switch can route between VLANs and other networks.no switchport
convertsfa0/6
from a Layer 2 port to a Layer 3 port, allowing it to have an IP address like a router interface.ip address 192.168.1.193 255.255.255.0
sets the IP for the routed port. This address will be used as the gateway from SW2 to R1.
This output helps verify that fa0/6
is no longer operating as a Layer 2 port. Since we used the no switchport
command earlier, it has been converted to a Layer 3 interface, which allows it to have an IP address and forward packets like a router.
With this in place and the default route configured, SW2 can now route both within VLANs and out to external networks via R1.
Now that the link between SW2 and R1 is ready, the next step is to add the default route on SW2. Let’s move on to that.
What Does This Do?
The command:
ip route 0.0.0.0 0.0.0.0 192.168.1.194
Tells SW2:
“Send all traffic that doesn’t match any specific route to 192.168.1.194,” which is the IP address of R1.
This completes our setup. Inter-VLAN routing is handled locally by the Multilayer Switch, and any non-local traffic is sent out through the router.
Now that the routed link between SW2 and R1 is set up and the default route is in place, the next step is to configure the IP addresses for each VLAN on SW2.
This is done by creating SVIs (Switched Virtual Interfaces) for each VLAN. These SVIs will act as the default gateways for devices within their respective VLANs.
These IP addresses will be used by hosts in each VLAN as their default gateway, allowing them to send traffic to other VLANs through the Multilayer Switch. With ip routing
already enabled, SW2 can now perform routing between all configured VLANs internally. SVI’s are shutdown by default, so remember to use no shutdown.
Our configuration is now complete. SW2 is fully set up to route between VLANs 10, 20, and 30, and it can send traffic outside the LAN through R1.
But before we wrap things up, let’s try something interesting.
Let’s say we decide to add VLAN 40 on one of the switches, even though it doesn’t exist in our current topology. There are no PCs assigned to it, and no SVI or routing setup for it either.
Why This Happens
An SVI (like interface vlan 40
) will only come up when at least one port assigned to that VLAN is active and connected to a device. Since VLAN 40 doesn't exist in the actual network (no ports, no hosts), the switch sees no reason to bring the interface up.
This is a good reminder that just creating a VLAN and assigning an IP isn't enough—it also needs active devices using that VLAN for the SVI to work properly.
To make sure a VLAN interface (SVI) is up and working properly, all of the following conditions must be met:
The VLAN must exist on each switch.
If the VLAN isn’t created on the switch, it can’t be used at all. You can check this using theshow vlan brief
command.There must be at least one access port assigned to the VLAN in an up/up state, or a trunk port allowing the VLAN that is also up/up.
The SVI only comes up if the VLAN is actually active on the switch. That means a port in that VLAN needs to be connected to a powered-on device, or a trunk link that allows the VLAN must be active.The VLAN itself must not be shutdown.
A VLAN can be administratively shut down using theshutdown
command under VLAN configuration. Make sure it’s not disabled.The SVI (Switched Virtual Interface) must be no shutdown.
By default, SVIs are in a shutdown state. You need to use theno shutdown
command under the VLAN interface to bring it up.
If any one of these is missing, the VLAN interface will remain down/down, even if you assigned it an IP address. It's a common issue when troubleshooting why inter-VLAN routing or host communication isn’t working.
What This Confirms
The routing table confirms that SW2 has direct knowledge of VLAN 10, 20, and 30. Since we created SVIs for each VLAN and assigned IP addresses, these VLANs automatically appear in the routing table as connected networks.
This is a good sign that inter-VLAN routing is working correctly. Any device in one VLAN can now communicate with devices in another VLAN thanks to the Multilayer Switch and the proper configuration of SVIs.
Wrapping It Up
In this blog, we explored VLANs from both basic and more advanced setups starting with simple port assignments all the way to trunking, ROAS, and even using a Multilayer Switch for inter-VLAN routing.
We looked at how VLANs help manage broadcast domains, how trunk ports and VLAN tagging work, and what happens when VLANs aren’t set up properly. You also saw how important it is to configure SVIs correctly and ensure VLANs are active and present across the network.
If you're just starting out with networking or working toward your CCNA, experimenting with VLANs in Packet Tracer is a great way to build a solid foundation. Try adjusting the examples, break things on purpose, and troubleshoot. It’s the best way to learn.
Keep exploring, stay curious, and don’t be afraid to test and learn from mistakes. I’m not a professional and just someone learning and sharing what I’ve picked up along the way. Hope this helped you out, and if it did, feel free to check out my other blogs!
See you in the next one.
Subscribe to my newsletter
Read articles from Pits directly inside your inbox. Subscribe to the newsletter, and don't miss out.
Written by
