Courseiva
VLANSubinterface Config

encapsulation dot1Q [vlan-id]

Configures IEEE 802.1Q VLAN encapsulation on a subinterface to enable trunking and route traffic for a specific VLAN.

Definition: encapsulation dot1Q [vlan-id] is a Cisco IOS subinterface config command. Configures IEEE 802.1Q VLAN encapsulation on a subinterface to enable trunking and route traffic for a specific VLAN.

Overview

The `encapsulation dot1Q [vlan-id]` command is a fundamental Cisco IOS configuration command used on subinterfaces to enable IEEE 802.1Q VLAN trunking. It allows a single physical router interface to route traffic for multiple VLANs by creating logical subinterfaces, each associated with a specific VLAN ID. This command is essential for inter-VLAN routing, often called 'router-on-a-stick,' where a router connects to a switch via a trunk link and performs routing between VLANs.

The command configures the subinterface to accept and transmit frames tagged with the specified VLAN ID, stripping or adding the 802.1Q tag as needed for routing. Without this encapsulation, the subinterface will not process VLAN-tagged frames, and traffic for that VLAN will be dropped. The command is typically used in scenarios where a router must route between VLANs without a Layer 3 switch, or when connecting to a service provider that uses 802.1Q trunks.

Alternatives include using a Layer 3 switch with switched virtual interfaces (SVIs), which is more efficient for high-performance routing, but the router-on-a-stick approach is cost-effective for small networks or lab environments. In the broader configuration workflow, this command is applied after creating the subinterface (e.g., `interface GigabitEthernet0/0.10`) and before assigning an IP address to that subinterface. The command takes effect immediately and is written to the running configuration.

It requires privileged EXEC mode (enable) and global configuration mode. A common mistake is forgetting to configure the physical interface as a trunk (e.g., `switchport trunk encapsulation dot1q` and `switchport mode trunk` on the switch side), or mismatching VLAN IDs between the router and switch. The command does not buffer output; it directly modifies the running config.

Understanding this command is critical for CCNA and CCNP candidates as it appears in both exam topics and real-world network designs.

Syntax·Subinterface Config
encapsulation dot1Q [vlan-id]

When to Use This Command

  • Router-on-a-stick inter-VLAN routing: configure a subinterface on a router trunk link to route between VLANs.
  • Connecting a router to a switch trunk port to provide Layer 3 gateway for multiple VLANs.
  • Segmenting traffic on a WAN link by assigning different VLANs to different subinterfaces.
  • Enabling VLAN tagging on a subinterface for a specific VLAN ID to match incoming frames.

Parameters

ParameterSyntaxDescription
vlan-id<1-4094>Specifies the VLAN identifier for which the subinterface will handle traffic. Valid values are from 1 to 4094, excluding reserved VLANs 0 and 4095. Common mistakes include using VLAN 1 (default VLAN, often discouraged for security) or using a VLAN ID that does not exist on the switch. Ensure the VLAN ID matches the switch configuration.

Command Examples

Basic VLAN encapsulation on subinterface

interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0
Router(config)# interface GigabitEthernet0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config-subif)# end
Router# show running-config interface GigabitEthernet0/0.10
Building configuration...

Current configuration : 107 bytes
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
end

The subinterface GigabitEthernet0/0.10 is created. 'encapsulation dot1Q 10' tells the router to accept and send frames tagged with VLAN 10. The IP address 192.168.10.1/24 is assigned as the default gateway for VLAN 10 hosts.

Native VLAN encapsulation

interface GigabitEthernet0/0.100 encapsulation dot1Q 100 native ip address 192.168.100.1 255.255.255.0
Router(config)# interface GigabitEthernet0/0.100
Router(config-subif)# encapsulation dot1Q 100 native
Router(config-subif)# ip address 192.168.100.1 255.255.255.0
Router(config-subif)# end
Router# show running-config interface GigabitEthernet0/0.100
Building configuration...

Current configuration : 118 bytes
!
interface GigabitEthernet0/0.100
 encapsulation dot1Q 100 native
 ip address 192.168.100.1 255.255.255.0
end

The 'native' keyword indicates that VLAN 100 is the native VLAN. Frames for this VLAN are sent untagged on the trunk. The router expects untagged frames on this subinterface. The IP address 192.168.100.1/24 is assigned.

Understanding the Output

The output from 'show running-config interface [subinterface]' displays the configuration lines. The 'encapsulation dot1Q [vlan-id]' line shows the VLAN ID assigned to the subinterface. If 'native' appears, it means the subinterface handles the native VLAN (untagged frames).

The IP address line shows the Layer 3 gateway for that VLAN. In a production network, you should verify that the VLAN ID matches the switch trunk allowed VLAN list. A common issue is mismatched VLAN IDs between router and switch, causing connectivity loss.

Also, ensure the native VLAN is consistent on both ends to avoid VLAN hopping or misrouting.

Configuration Scenarios

Router-on-a-Stick for Inter-VLAN Routing

A small office has two VLANs (10 and 20) on a single switch, and a router is needed to route between them. The router has one physical interface connected to the switch trunk port.

Topology

Router(Gi0/0)---Trunk---Switch(Gi0/1) Switch has VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24)

Steps

  1. 1.Step 1: Enter global configuration mode: Router> enable then Router# configure terminal
  2. 2.Step 2: Create subinterface for VLAN 10: Router(config)# interface GigabitEthernet0/0.10
  3. 3.Step 3: Configure encapsulation: Router(config-subif)# encapsulation dot1Q 10
  4. 4.Step 4: Assign IP address for VLAN 10: Router(config-subif)# ip address 192.168.10.1 255.255.255.0
  5. 5.Step 5: Exit and create subinterface for VLAN 20: Router(config-subif)# exit then Router(config)# interface GigabitEthernet0/0.20
  6. 6.Step 6: Configure encapsulation: Router(config-subif)# encapsulation dot1Q 20
  7. 7.Step 7: Assign IP address for VLAN 20: Router(config-subif)# ip address 192.168.20.1 255.255.255.0
  8. 8.Step 8: Ensure the physical interface is not shut down: Router(config)# interface GigabitEthernet0/0 then Router(config-if)# no shutdown
Configuration
!
interface GigabitEthernet0/0
 no shutdown
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
!

Verify: Use 'show ip interface brief' to verify subinterfaces are up/up. Use 'show vlans' to see VLAN encapsulation status. Expected output: subinterfaces show as up, IP addresses assigned.

Watch out: Forgetting to configure the switch port as a trunk (switchport mode trunk) will cause the router to receive only untagged frames, breaking communication. Also, ensure the native VLAN on the switch trunk matches the router's native VLAN (default VLAN 1) or use 'encapsulation dot1Q 10 native' if needed.

Connecting to a Service Provider over 802.1Q Trunk

A branch office router connects to an ISP via a single physical link. The ISP provides two VLANs: one for internet access (VLAN 100) and one for VoIP (VLAN 200). The router must route traffic for both VLANs.

Topology

BranchRouter(Gi0/0)---Trunk---ISP Router VLAN 100: 10.0.0.0/30, VLAN 200: 10.0.1.0/30

Steps

  1. 1.Step 1: Enter global configuration mode: Router> enable then Router# configure terminal
  2. 2.Step 2: Create subinterface for VLAN 100: Router(config)# interface GigabitEthernet0/0.100
  3. 3.Step 3: Configure encapsulation: Router(config-subif)# encapsulation dot1Q 100
  4. 4.Step 4: Assign IP address: Router(config-subif)# ip address 10.0.0.2 255.255.255.252
  5. 5.Step 5: Create subinterface for VLAN 200: Router(config)# interface GigabitEthernet0/0.200
  6. 6.Step 6: Configure encapsulation: Router(config-subif)# encapsulation dot1Q 200
  7. 7.Step 7: Assign IP address: Router(config-subif)# ip address 10.0.1.2 255.255.255.252
  8. 8.Step 8: Configure default route via ISP: Router(config)# ip route 0.0.0.0 0.0.0.0 10.0.0.1
Configuration
!
interface GigabitEthernet0/0
 no shutdown
!
interface GigabitEthernet0/0.100
 encapsulation dot1Q 100
 ip address 10.0.0.2 255.255.255.252
!
interface GigabitEthernet0/0.200
 encapsulation dot1Q 200
 ip address 10.0.1.2 255.255.255.252
!
ip route 0.0.0.0 0.0.0.0 10.0.0.1
!

Verify: Ping the ISP gateway addresses (10.0.0.1 and 10.0.1.1) to verify connectivity. Use 'show ip route' to confirm the default route is present.

Watch out: Ensure the ISP's switch port is configured as a trunk with allowed VLANs 100 and 200. Also, the native VLAN mismatch can cause issues; if the ISP uses a different native VLAN, configure 'encapsulation dot1Q 100 native' on the subinterface that matches the native VLAN.

Troubleshooting with This Command

When troubleshooting the `encapsulation dot1Q` command, the first step is to verify that the subinterface is up/up using `show ip interface brief`. If the subinterface is down, check the physical interface status and ensure it is not administratively down. A common issue is that the physical interface is shut down; use `no shutdown` on the physical interface.

Next, use `show vlans` to see the VLAN encapsulation status. Healthy output shows the subinterface with the correct VLAN ID and encapsulation type (802.1Q). If the VLAN ID is missing or shows 'none', the encapsulation command may not have been applied correctly.

Also, check `show running-config interface [subinterface]` to confirm the encapsulation line is present. Another key command is `show interfaces [subinterface] trunk` (on switches) or `show interfaces trunk` to verify trunking status on the switch side. If the router is not receiving traffic, use `debug dot1q events` (with caution in production) to see if frames are being tagged correctly.

Common symptoms include: inability to ping hosts in other VLANs, which often indicates a missing or incorrect encapsulation, or a mismatch in VLAN IDs between router and switch. Also, check the native VLAN: if the switch trunk port has a native VLAN different from the router's native VLAN (default VLAN 1), the router may drop untagged frames. To fix, either change the switch native VLAN to match or use the `native` keyword on the router subinterface (e.g., `encapsulation dot1Q 1 native`).

Another issue is that the subinterface IP address may be in the wrong subnet; verify with `show ip interface brief` and `show ip route`. If the router has multiple subinterfaces, ensure they are on different subnets. Correlate with `show arp` to see if the router is learning MAC addresses from the switch.

If ARP entries are incomplete, the switch may not be forwarding frames due to VLAN pruning or allowed VLAN lists. Use `show interfaces trunk` on the switch to verify allowed VLANs. In summary, a systematic approach: check physical interface, subinterface status, encapsulation config, IP addressing, switch trunk config, and ARP table.

CCNA Exam Tips

1.

CCNA 200-301: Remember that 'encapsulation dot1Q' is only used on subinterfaces, not on physical interfaces.

2.

CCNA 200-301: The native VLAN must match on both ends of a trunk; use the 'native' keyword on the router subinterface.

3.

CCNA 200-301: You can configure multiple subinterfaces on one physical interface, each with a different VLAN ID.

4.

CCNA 200-301: The VLAN ID range is 1-4094; VLANs 1002-1005 are reserved and cannot be used.

Common Mistakes

Mistake 1: Applying 'encapsulation dot1Q' to a physical interface instead of a subinterface — results in an error.

Mistake 2: Forgetting to configure the native VLAN on the router subinterface when the switch trunk uses a non-default native VLAN — causes untagged frames to be dropped.

Mistake 3: Using the same VLAN ID on multiple subinterfaces of the same physical interface — only one subinterface per VLAN is allowed.

encapsulation dot1Q [vlan-id] vs show vlan

Both commands relate to VLANs on Cisco IOS devices, but they serve different purposes: 'encapsulation dot1Q' configures trunk encapsulation on a subinterface (typically on a router for inter-VLAN routing), while 'show vlan' displays the VLAN database (usually on a switch). They are often considered together because both involve VLAN identification, but one is a configuration command and the other is a verification command.

Aspectencapsulation dot1Q [vlan-id]show vlan
ScopeSpecific subinterface encapsulation for a single VLANGlobal VLAN database across the switch
Configuration modeSubinterface configuration (config-subif)Privileged EXEC (show commands)
PersistenceWritten to running-config and saved to startup-configDisplay only; no configuration change
PrecedenceApplies to the specific subinterface for routingShows all VLANs regardless of interface configuration
Typical useEnable 802.1Q trunking on a subinterface for router-on-a-stickVerify VLAN creation, names, status, and port assignments

Use 'encapsulation dot1Q [vlan-id]' when configuring a router subinterface to route traffic for a specific VLAN on a trunk link.

Use 'show vlan' when you need to verify the current VLAN configuration and which ports are assigned to each VLAN on a switch.

Platform Notes

In IOS-XE (e.g., on Catalyst 9000 switches or ISR 4000 routers), the `encapsulation dot1Q` command syntax is identical to classic IOS. However, on IOS-XE switches operating in Layer 3 mode, you may use `interface Vlan [vlan-id]` (SVI) instead of subinterfaces for inter-VLAN routing, which is more common. The subinterface approach is still valid on routers.

On NX-OS (e.g., Nexus switches), the equivalent command for subinterfaces is `encapsulation dot1q [vlan-id]` (note the lowercase 'q'). NX-OS also supports `interface vlan [vlan-id]` for SVIs. For ASA firewalls, the command is `interface [physical-name].[subinterface]` followed by `vlan [vlan-id]` (e.g., `interface gigabitethernet0/0.10` then `vlan 10`).

ASA does not use the `encapsulation dot1Q` command; instead, the VLAN is assigned directly. In IOS-XR (e.g., ASR 9000), the command is `encapsulation dot1q [vlan-id]` (lowercase 'q') under the subinterface configuration mode. Note that IOS-XR uses a different configuration hierarchy (prefixed with 'interface GigabitEthernet0/0/0/0.10').

Between IOS versions, the command has remained consistent from 12.x to 16.x, but newer versions may support additional options like `encapsulation dot1Q [vlan-id] second-dot1q [vlan-id]` for QinQ. Always verify with `?` in the CLI.

Related Commands

show interfaces trunk

Displays all trunk ports including the trunking encapsulation (802.1Q or ISL), the native VLAN, VLANs allowed on the trunk, VLANs in the spanning tree forwarding state, and VLANs active in the management domain.

show vlan

Displays the current VLAN configuration on the switch, including VLAN IDs, names, status, and ports assigned to each VLAN, used to verify VLAN creation and port assignments.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions