In router on stick , I face a problem is that when I create two sub-interfaces with two different networks each for a specified VLAN, the devices in those VLANs although they are in different VLANs and subnets, they can see each.

I don't know why, if those devices in different VLANs they can't see each other even if they are in same subnet IP, so why here with different subnets for each VLAN they see each other ?!!

I think it related to automatic routing that router by default does for its interfaces.

Thanks in advance to anyone that can help me.

The same result in both packet tracer and GNS3 !![router on stick]1

  • What issue are you trying to solve? Do you want hosts on vlan’s 10 and 20 to be able to route out (say, to the Internet) but not reach each other?
    – rnxrx
    Dec 31 '17 at 10:28
  • these hosts mustn't see each other as they both in different VLANs and networks but here in emulator they pinged and see each other! when hosts be in different VLANs and same subnets, they can't see each other so why here see other I need to know and how to stop them.
    – menyo
    Dec 31 '17 at 22:50
  • As others have pointed out, the default behavior of routers is to route between known subnets. The two VLAN's in this case are directly connected routes and, as such, a packet from one network bound to the other and sent to the local gateway will find itself to the other subnet. The ways to stop this are to either disconnect the routed interface to one (or both) of the subnets, disable routing altogether, look into a multi-vrf/cross-import setup with dummy routes or - most simply and preferably - use an ACL to deny traffic between the two subnets while permitting everything else.
    – rnxrx
    Jan 2 '18 at 3:45
  • thank you eng.rnxrx for all possible solutions you had mentioned.
    – menyo
    Jan 2 '18 at 9:06

Routers will route packets. That's what they're designed to do -- so it shouldn't be a surprise. You can turn off this default behavior with the command

no ip routing
  • but what if i need my router to route to other networks, for example default route with ISP router then I can't write this command ! I need to get advantage of "Router-ON-Stick" too.
    – menyo
    Dec 31 '17 at 10:16
  • 1
    In that case, you need to add an access list to filter traffic between the two subnets.
    – Ron Trunk
    Dec 31 '17 at 15:22
  • Thank you eng.Ron, your answered is so helpful so far to me.
    – menyo
    Dec 31 '17 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.