What is the difference between router-on-a-stick and SVIs for inter-VLAN routing?
Show the answer
Say this first
Router-on-a-stick routes between VLANs with one router interface split into 802.1Q subinterfaces over a trunk. It is cheap and simple, but every inter-VLAN packet crosses that one link twice and the router's forwarding rate is the ceiling. A layer 3 switch gives each VLAN an SVI and routes in hardware at line rate with no hairpin. Campus networks use SVIs; router-on-a-stick fits a small branch or a lab.
Go deeper
Side by side
| Router-on-a-stick | SVI on a layer 3 switch | |
|---|---|---|
| Gateway lives on | Router subinterface | interface VlanN |
| Forwarding | Router CPU or network processor | Switch ASIC |
| Path between VLANs | Up the trunk and back down | Inside the switch |
| Bottleneck | Trunk bandwidth and router throughput | Rarely the switch |
| Extra features in the path | NAT, firewall, VPN on the router | Usually only ACLs |
Configurations
! Router-on-a-stick
interface GigabitEthernet0/0/0.10
encapsulation dot1Q 10
ip address 10.10.0.1 255.255.255.0! Layer 3 switch
ip routing
interface Vlan10
ip address 10.10.0.1 255.255.255.0The hairpin
A packet from VLAN 10 to VLAN 20 goes up the trunk tagged 10 and comes back down tagged 20. The trunk carries all inter-VLAN traffic plus everything headed to the WAN, so it saturates early.
They will ask next
When is router-on-a-stick still the right answer?
In a small branch where the router already does NAT, firewalling or VPN, or where you want those features applied between VLANs. A few hundred megabits of internal traffic fits easily.
How do you handle the native VLAN on a router subinterface?
encapsulation dot1Q 1 nativeon the subinterface for that VLAN tells the router to send and expect those frames untagged.
Traps
- Thinking the subinterface number must match the VLAN. Only the VLAN in
encapsulation dot1Qmatters.