Router on a Stick: Missing Encapsulation
Two subinterfaces, both up/up, both correctly addressed, and only one of them serves anybody. Find the missing half, live, right below.
Symptom
Subinterfaces are addressed and up, yet one VLAN has no working gateway. Work out which half of the subinterface configuration is missing.
Your mission
Inspect, recover, then verify
Format
Cisco IOS CLI
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: R1
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
Hosts in VLAN 20 cannot reach their default gateway, while VLAN 10 works normally. The router's subinterfaces both show up/up with correct addresses, and the switch trunk allows both VLANs.
What you'll practice
- Read subinterface configuration and encapsulation state
- Explain the role of encapsulation dot1q on a router subinterface
- Recognise when the native keyword is required
- Restore and verify inter-VLAN routing for the affected VLAN
1. Read subinterface configuration and encapsulation state
show running-config interface and show vlans on the router reveal which tag each subinterface actually claims, which is not visible from show ip interface brief.
2. Explain the role of encapsulation dot1q on a router subinterface
Without it the subinterface has no VLAN association at all, so tagged frames for that VLAN are dropped even though the address and line protocol look correct.
3. Recognise when the native keyword is required
Frames in the trunk's native VLAN arrive untagged. Only a subinterface configured with encapsulation dot1q <vlan> native will accept them.
4. Restore and verify inter-VLAN routing for the affected VLAN
You will confirm the fix from the host side with a gateway ping and a cross-VLAN ping, not just from the router's own configuration.
The topology
One router connects to an access switch over a single 802.1Q trunk, with a subinterface per user VLAN acting as that VLAN's default gateway.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show running-config | section interface GigabitEthernet0/0show ip interface briefshow vlansTopology diagram
Fact-checked references
The commands and behaviour in this lab were checked against these primary references.
Frequently asked
Why does the subinterface show up/up if it cannot pass traffic?
A subinterface inherits its line state from the physical interface. As long as the physical port is up, the subinterface reports up/up whether or not it has an encapsulation statement to match frames against.
Does the native VLAN need a subinterface at all?
Only if that VLAN needs a routed gateway. If it does, its subinterface must carry the native keyword, otherwise the router expects a tag that the untagged frames will never carry.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.