Router-on-a-stick vs L3 switch SVIs for inter-VLAN routing — when do I use which?

Question

I've got inter-VLAN routing working two ways in the NetForge lab and I'm not sure when each is the "right" choice.

1. **Router-on-a-stick**: one trunk from a switch up to a router, then subinterfaces with `encapsulation dot1Q` per VLAN.
2. **Layer-3 switch**: `ip routing` on, then an `interface vlan X` SVI per VLAN.

Both let hosts in different VLANs ping each other, so functionally they seem the same. Is one just outdated? Is it a performance thing, a cost thing, or does it depend on the size of the network? Trying to build the right mental model instead of just picking whatever I set up first. Thanks!

ben31833 · Accepted Answer

Rule of thumb: **router-on-a-stick (ROAS) for tiny/lab setups, L3 switch with SVIs for anything real.**

**ROAS** — one trunk to the router, a subinterface per VLAN, 802.1Q tagging:
```
interface g0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface g0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
```
Keep the physical `g0/0` up with no IP. For the native VLAN, add `native`: `encapsulation dot1Q 1 native`. The catch: **every** inter-VLAN packet hairpins across that single uplink, and the router routes in software — so link bandwidth and CPU are your ceiling.

**L3 switch** — one SVI per VLAN, routed in the ASIC at wire speed:
```
ip routing
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
interface vlan 20
 ip address 192.168.20.1 255.255.255.0
```
No single-link bottleneck, scales to many VLANs. An SVI only goes up/up when the VLAN exists in the DB and at least one access port in it is up (or it's carried on an up trunk).

Pick ROAS when you have one router, a couple VLANs, low traffic. Pick SVIs whenever performance or VLAN count matters. In the lab, wire a router to a switch and trunk the link for ROAS, or drop an L3 switch and add the SVIs — then ping across and watch the ARP resolve on the cable.

Shira Sivroni · Answer

Adding the troubleshooting angle, since both break in predictable ways.

**ROAS gotchas:**
- Subinterface `encapsulation dot1Q <vlan>` number must match the switch's VLAN ID. Mismatch = silent black hole.
- The switch link must be a **trunk**, not access. If it stays access you only get one VLAN through.
- Native VLAN mismatch across the trunk floods logs and drops the native subnet. Tag it explicitly or make both ends agree.
- The physical interface has to be `no shutdown` — subinterfaces inherit its state.

**L3 switch gotchas:**
- `ip routing` is off by default — the classic "SVIs are up but nothing routes" bug.
- An SVI shows `down/down` until the VLAN exists **and** a member port is up. Create the VLAN, plug in a host, then it comes up.

Quick check either way: `show ip route` should list all your VLAN subnets as connected. If a subnet's missing, that's your broken side. In the NetForge lab, run `show ip interface brief` after wiring — an SVI stuck admin-down or a subinterface with no matching VLAN shows up immediately.

Router-on-a-stick vs L3 switch SVIs for inter-VLAN routing — when do I use which?

2 Answers

Your answer