In which configuration mode is encapsulation isl [vlan-id] used?

The encapsulation isl [vlan-id] command is entered in Subinterface Config mode on Cisco IOS devices.

VLANSubinterface Config

encapsulation isl [vlan-id]

Enables ISL encapsulation on a subinterface for inter-VLAN routing on a router-on-a-stick configuration, assigning the subinterface to a specific VLAN.

Definition: encapsulation isl [vlan-id] is a Cisco IOS subinterface config command. Enables ISL encapsulation on a subinterface for inter-VLAN routing on a router-on-a-stick configuration, assigning the subinterface to a specific VLAN.

Overview

The `encapsulation isl [vlan-id]` command is used in Cisco IOS to enable Inter-Switch Link (ISL) encapsulation on a subinterface, which is a crucial step in configuring inter-VLAN routing using the router-on-a-stick (ROAS) model. ISL is a Cisco proprietary protocol that tags Ethernet frames with VLAN information as they traverse a trunk link between a switch and a router. This command assigns the subinterface to a specific VLAN, allowing the router to route traffic between VLANs by encapsulating frames with the appropriate VLAN ID.

The concept behind this command is VLAN trunking: a single physical router interface is divided into multiple logical subinterfaces, each associated with a different VLAN. When a frame arrives on the trunk link, the router examines the ISL header to determine the VLAN, processes the frame on the corresponding subinterface, and then routes it to another VLAN if needed. This approach is cost-effective and simplifies network design by eliminating the need for multiple physical interfaces.

You would use this command when you have a legacy switch that only supports ISL (common in older Catalyst switches like the 2900XL or 3500XL) and you need to perform inter-VLAN routing. However, ISL has largely been replaced by the IEEE 802.1Q standard, which is more widely supported and offers features like native VLAN support. The alternative is the `encapsulation dot1Q [vlan-id]` command for 802.1Q trunking.

In modern networks, 802.1Q is preferred, but understanding ISL is still relevant for CCNA/CCNP exams and for maintaining legacy equipment. The command fits into the configuration workflow after creating the subinterface (e.g., `interface GigabitEthernet0/0.10`) and before assigning an IP address. Important IOS behavior: ISL encapsulation is only supported on certain interface types (e.g., FastEthernet, GigabitEthernet) and not on all router platforms; it requires the subinterface to be in no shutdown state; the VLAN ID must match the VLAN configured on the switch; and the command is not available in IOS-XE or NX-OS (which use 802.1Q exclusively).

The command affects the running configuration immediately, and there is no buffered output. Privilege level 15 (enable) is required to enter global configuration mode and subinterface configuration mode. The command is typically used in conjunction with `interface` commands and IP address assignment.

Syntax·Subinterface Config

encapsulation isl [vlan-id]

When to Use This Command

Configuring a router-on-a-stick to route between VLANs using ISL trunking on a FastEthernet interface.
Connecting a router to a Catalyst switch that only supports ISL trunking for inter-VLAN routing.
Setting up legacy inter-VLAN routing where the switch uses ISL encapsulation.
Migrating from ISL to 802.1Q trunking by first configuring ISL encapsulation for testing.

Parameters

Parameter	Syntax	Required	Description
vlan-id	<1-1005>	Required	Specifies the VLAN ID to which the subinterface belongs. Valid values are from 1 to 1005, which are the standard VLAN range on Cisco switches. Common mistake: using VLAN IDs outside this range (e.g., 1006-4094) which are not supported by ISL; also, ensure the VLAN exists on the switch.

Command Examples

Basic ISL encapsulation on subinterface

Router(config-subif)# encapsulation isl 10

This command configures the subinterface to use ISL encapsulation and assigns it to VLAN 10. No output is displayed upon successful configuration.

Verifying ISL encapsulation configuration

Router# show running-config interface fastEthernet 0/0.10

interface FastEthernet0/0.10
 encapsulation isl 10
 ip address 192.168.10.1 255.255.255.0

The output shows the subinterface configuration: 'encapsulation isl 10' confirms ISL encapsulation for VLAN 10, and the IP address is assigned for that VLAN.

Understanding the Output

The 'encapsulation isl [vlan-id]' command does not produce output when entered; it simply configures the subinterface. To verify, use 'show running-config' or 'show interfaces [interface]'. In the running config, look for the 'encapsulation isl' line under the subinterface.

A correct configuration shows the VLAN ID after 'isl'. If missing, the subinterface may not be trunking correctly. Also check that the parent interface is not shutdown and has an IP address assigned if needed.

Configuration Scenarios

Configure Router-on-a-Stick with ISL for Two VLANs

A small office has a single router (Router1) and a switch (Switch1) that only supports ISL trunking. The network has two VLANs: VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The goal is to enable routing between these VLANs using a single physical link.

Topology

Router1(Gi0/0)---ISL Trunk---(Gi0/1)Switch1
Switch1 ports: Fa0/1 (VLAN10), Fa0/2 (VLAN20)

Steps

1.Step 1: Enter global configuration mode: Router1> enable
2.Step 2: Enter global configuration mode: Router1# configure terminal
3.Step 3: Create subinterface for VLAN 10: Router1(config)# interface GigabitEthernet0/0.10
4.Step 4: Enable ISL encapsulation and assign VLAN 10: Router1(config-subif)# encapsulation isl 10
5.Step 5: Assign IP address for VLAN 10: Router1(config-subif)# ip address 192.168.10.1 255.255.255.0
6.Step 6: Exit subinterface: Router1(config-subif)# exit
7.Step 7: Create subinterface for VLAN 20: Router1(config)# interface GigabitEthernet0/0.20
8.Step 8: Enable ISL encapsulation and assign VLAN 20: Router1(config-subif)# encapsulation isl 20
9.Step 9: Assign IP address for VLAN 20: Router1(config-subif)# ip address 192.168.20.1 255.255.255.0
10.Step 10: Exit and enable the physical interface: Router1(config-subif)# exit
11.Step 11: Ensure physical interface is up: Router1(config)# interface GigabitEthernet0/0
12.Step 12: Enable the interface: Router1(config-if)# no shutdown

Configuration

! Router1 configuration
interface GigabitEthernet0/0
 no shutdown
!
interface GigabitEthernet0/0.10
 encapsulation isl 10
 ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0.20
 encapsulation isl 20
 ip address 192.168.20.1 255.255.255.0

Verify: Use `show interfaces trunk` on the switch to verify the trunk is up and ISL is the encapsulation. On the router, use `show ip interface brief` to see that subinterfaces are up/up. Use `ping` from a host in VLAN 10 to the gateway of VLAN 20 (192.168.20.1) to test connectivity.

Watch out: A common mistake is forgetting to enable the physical interface with `no shutdown`. The subinterfaces will not come up if the physical interface is administratively down.

Add a Third VLAN to an Existing ISL Trunk

A company has an existing router-on-a-stick configuration with ISL trunking for VLANs 10 and 20. They need to add a new VLAN 30 (192.168.30.0/24) for a new department. The switch already has VLAN 30 configured and ports assigned.

Topology

Router1(Gi0/0)---ISL Trunk---(Gi0/1)Switch1
Existing subinterfaces: Gi0/0.10 (VLAN10), Gi0/0.20 (VLAN20)

Steps

1.Step 1: Enter global configuration mode: Router1> enable
2.Step 2: Enter global configuration mode: Router1# configure terminal
3.Step 3: Create subinterface for VLAN 30: Router1(config)# interface GigabitEthernet0/0.30
4.Step 4: Enable ISL encapsulation and assign VLAN 30: Router1(config-subif)# encapsulation isl 30
5.Step 5: Assign IP address for VLAN 30: Router1(config-subif)# ip address 192.168.30.1 255.255.255.0
6.Step 6: Exit: Router1(config-subif)# end
7.Step 7: Verify the new subinterface is up: Router1# show ip interface brief

Configuration

! Router1 configuration (partial)
interface GigabitEthernet0/0.30
 encapsulation isl 30
 ip address 192.168.30.1 255.255.255.0

Verify: Use `show interfaces trunk` on the switch to confirm VLAN 30 is allowed on the trunk. On the router, `show ip route` should show the new subnet. Test with ping from a host in VLAN 30 to the router's IP address.

Watch out: Ensure the switch trunk allows VLAN 30. If the switch trunk does not have VLAN 30 in the allowed list, the subinterface will remain up but traffic will not pass. Use `switchport trunk allowed vlan add 30` on the switch.

Troubleshooting with This Command

When troubleshooting ISL encapsulation issues, the primary goal is to ensure that the router subinterface is correctly associated with the VLAN and that the trunk link is operational. Healthy output from `show interfaces` on the router subinterface should indicate 'up/up' status and show ISL encapsulation. For example, `show interfaces GigabitEthernet0/0.10` should display 'Encapsulation ISL, VLAN 10'.

Problem indicators include 'down/down' status, which often points to a physical layer issue or the parent interface being shut down. If the subinterface is 'up/down', the issue is likely with the encapsulation or VLAN mismatch. Focus on the 'Encapsulation' field: if it shows '802.1Q' instead of 'ISL', the command was misconfigured.

Another key field is 'VLAN ID' – ensure it matches the switch configuration. Common symptoms this command helps diagnose include: hosts in different VLANs cannot ping each other, or a host cannot reach its default gateway. The diagnostic flow a network engineer would follow: 1) Verify physical connectivity: check link lights and use `show interfaces` on the physical interface to ensure it is up/up. 2) Check subinterface status: `show ip interface brief` to see if subinterfaces are up/up. 3) Verify encapsulation: `show interfaces [subinterface]` and look for 'Encapsulation ISL'. 4) Check the switch trunk: `show interfaces trunk` on the switch to confirm the trunk is up, encapsulation is ISL, and the VLAN is allowed. 5) Verify VLAN exists on switch: `show vlan brief`. 6) Test with a ping from the router to a host's IP address.

Correlate this command's output with `debug interface` commands (e.g., `debug ip packet`) cautiously in production. Also, use `show running-config` to verify the configuration is saved. If the subinterface shows 'Encapsulation ISL, VLAN 10' but traffic fails, check for native VLAN mismatch (ISL does not have a native VLAN concept, but ensure the switch port is configured as trunk and not access).

Another common issue is that the router may not support ISL on certain interface types; check the hardware documentation.

CCNA Exam Tips

ISL is a Cisco proprietary trunking protocol; 802.1Q is the open standard. CCNA focuses on 802.1Q, but ISL may appear in legacy questions.

ISL encapsulation uses a 30-byte header and does not support native VLANs; all VLANs are tagged.

On CCNA exam, you may need to identify that 'encapsulation isl' is used on subinterfaces for router-on-a-stick with older switches.

Remember that ISL encapsulation is configured per subinterface, not on the main interface.

Common Mistakes

Mistake: Using 'encapsulation isl' on the main interface instead of a subinterface. Consequence: The command is rejected or misapplied.

Mistake: Forgetting to assign an IP address to the subinterface after encapsulation. Consequence: The subinterface cannot route traffic.

Mistake: Using ISL encapsulation when the switch port is configured for 802.1Q trunking. Consequence: Mismatch causes no connectivity.

encapsulation isl [vlan-id] vs encapsulation dot1Q [vlan-id]

Both 'encapsulation isl' and 'encapsulation dot1q' are used on subinterfaces for inter-VLAN routing (router-on-a-stick), but they differ in encapsulation type and interoperability. ISL is Cisco proprietary and legacy, while 802.1Q is the open IEEE standard. They are often confused because both assign a subinterface to a specific VLAN for trunking.

Aspect	encapsulation isl [vlan-id]	encapsulation dot1Q [vlan-id]
Encapsulation type	ISL (Inter-Switch Link) – adds 30-byte header	802.1Q – inserts 4-byte tag into Ethernet frame
Standard	Cisco proprietary	IEEE open standard
VLAN range support	1–1005 (standard range only)	1–4094 (includes extended VLANs)
Interoperability	Cisco devices only	Multi-vendor environments
Modern relevance	Legacy; deprecated on many platforms	Current standard; widely supported
Platform support	Older Cisco switches/routers (e.g., CAT1900, 2600 series)	All modern Cisco devices and most other vendors

Use encapsulation isl [vlan-id] when you need to maintain backward compatibility with legacy Cisco switches that only support ISL trunking.

Use encapsulation dot1Q [vlan-id] when designing a standards-based network, for mixed-vendor interoperability, or for support of extended VLANs (1006–4094).

Platform Notes

In IOS-XE (e.g., on Catalyst 9000 switches or ISR 4000 series routers), the `encapsulation isl` command is not available; only 802.1Q encapsulation is supported. The equivalent command is `encapsulation dot1Q [vlan-id]`. On NX-OS (e.g., Nexus switches), the concept of subinterfaces for routing is similar, but the command is `encapsulation dot1Q [vlan-id]` as well; ISL is not supported.

For ASA firewalls, subinterfaces are used for VLAN trunking, but the command is `vlan [vlan-id]` under the subinterface, and the encapsulation is implicitly 802.1Q; ISL is not supported. In IOS versions, the command exists in 12.x and 15.x, but in 16.x (IOS-XE), it is deprecated. For IOS-XR (e.g., ASR 9000), subinterfaces use `dot1q vlan [vlan-id]` and ISL is not supported.

Therefore, this command is only relevant for legacy IOS platforms. When migrating from ISL to 802.1Q, note that the native VLAN concept changes: ISL does not have a native VLAN, while 802.1Q does. Also, ISL encapsulates the entire frame (including the original FCS), while 802.1Q inserts a tag.

These differences can affect interoperability with non-Cisco devices. In summary, the `encapsulation isl` command is specific to older Cisco IOS routers and switches; modern platforms use 802.1Q exclusively.

Related Commands

encapsulation dot1Q [vlan-id]

Configures IEEE 802.1Q VLAN encapsulation on a subinterface to enable trunking and route traffic for a specific VLAN.

show interfaces trunk

Displays all trunk ports including the trunking encapsulation (802.1Q or ISL), the native VLAN, VLANs allowed on the trunk, VLANs in the spanning tree forwarding state, and VLANs active in the management domain.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions