3

I have never used VLANs before, so I'd like confirmation that it will work as I think. We have three Netgear GS724T and a fortinet router. If I configure a port to be Untagged on VLAN 1 with a PVID set to 1, and Trunk on VLAN 2, will it accept and transmit untagged packet on VLAN 1 and accept and transmit Tagged packet on VLAN 2 ? I would like to keep the current default configuration of every port untagged on VLAN 1 and start to add new VLAN as needed without breaking the Internet access or access to the ESX virtual machines. My first test would be to put the ESX Ethernet port Trunk on VLAN 2 to test with a single VM on VLAN 2, and the other VMs still untagged on VLAN 1.

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 9, 2017 at 2:03

2 Answers 2

Reset to default
5

Here's one way to think about it:

A port with more than one VLAN associated with it is called a Trunk. A Trunk can have exactly ONE untagged vlan (also called the Native VLAN), and one or more Tagged VLANS. If you set a VLAN to be untagged on a port, there is no PVID associated with it; there is no PVID field in the Ethernet frame.

If a trunk port is configured with VLAN1 untagged, and VLAN 2 tagged, then all devices that use untagged frames (PCs etc) will communicate on VLAN 1 and be blissfully unaware of any other VLANs. If a device can tag frames with a PVID =2, then it can communicate on VLAN 2.

Improve this answer
1
  • That's perfect, thank you. I just tested it, my ESX is now untagged on VLAN 1 and Tagged on VLAN 2, the VMs continued to work perfectly and the VM I plugged on a VLAN 2 vNetwork is only accessible on VLAN 2. Now I just have to try that with the fortinet :)
    – Ulrar
    Commented Aug 25, 2014 at 8:26
1

I don't know if I understood your question correctly, but if I did, you can't use both tagged and untagged packets at the same interface on end devices. It's either tagged or untagged, unless you have two (or more) interfaces at the same host.

This is usually called a management interface. One interface with restrictive firewall rules and VLAN for host management and another for data. You don't change the configuration for this management network for all of your hosts and then you don't lose access to yjt machine, no matter how unusual this or that requirement for the host.

Improve this answer
1
  • I needed both tagged and untagged on the same interface but for two different VLAN, and as Ron answered that works perfectly. Thanks anyway !
    – Ulrar
    Commented Aug 25, 2014 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.