VLANs can't talk to each other on their own — each is a separate subnet and needs a Layer 3 device to route between them. Router-on-a-stick (ROAS) is the cheapest way to do that with the gear you already have: one router and one trunked link.

The idea

Instead of dedicating a physical router port to each VLAN (you'd run out fast), you use one physical interface and slice it into subinterfaces — virtual interfaces like g0/0.10 and g0/0.20. Each subinterface handles one VLAN, tagged with 802.1Q, and holds that VLAN's gateway IP.

The config

R1(config)# interface g0/0
R1(config-if)# no shutdown
R1(config)# interface g0/0.10
R1(config-subif)# encapsulation dot1q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config)# interface g0/0.20
R1(config-subif)# encapsulation dot1q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0

And the switch port facing the router must be a trunk:

SW(config-if)# switchport mode trunk

The gotchas

  • Each host's default gateway must point at its VLAN's subinterface IP.
  • The physical interface (g0/0) needs no shutdown; the subinterfaces inherit its state.
  • If you use a native VLAN, tag it explicitly with encapsulation dot1q <vlan> native to avoid mismatches.

ROAS vs a Layer 3 switch

ROAS is simple and cheap but the single link can become a bottleneck. On larger networks you'd use a Layer 3 switch with SVIs instead, which routes in hardware. Both are fair game on the CCNA.