4

I've seen similar spins on this question before but not one that adequately answers it.

In the following (paraphrased, not literal) config on a Cisco SF300:

FastEthernet1
Port mode General
General access VLAN 20 tagged
General access VLAN 10 untagged
PVID 10

If I plug a PC into this port, any untagged packets entering the port will internally enter VLAN 10. Any traffic on VLAN 10 will exit that port untagged. This I completely accept since I use it on a daily basis.

What's the purpose of setting untagged access without setting PVID? Is untagged ingress traffic going to just go nowhere? If so, what's the purpose of having an untagged VLAN that can't communicate bidirectionally?

Improve this question

2 Answers 2

Reset to default
6

Without getting into NDA territory, a lot of it has to do with the switch (chip) internals. Of course anyone with a clue codes their UI and configuration language to handle these things automatically. You'd think something with a Cisco logo on it would be better, but you'd be wrong -- that switch grew out of the Linksys Small Business product line and has never seen the same engineering effort behind IOS, for example.

While it makes little sense, it's a valid configuration to set a PVID of 20 in your example. Untagged traffic handed to the switch would forward in VLAN 20. (no one in their right mind would(should) do that.)

[Note: even in switch IOS, one can set the native VLAN to something that isn't in the allowed list. And it's 100% valid.]

Improve this answer
2
  • Wow, so it really just doesn't make any sense. Is that to say that I could set native 30, untagged 20, and have untagged ingress/egress traffic go to totally different VLANs, creating an effectively unusable port?
    – DTD
    Commented Nov 8, 2014 at 2:04
  • 1
    YES. (if it does no validation)
    – Ricky
    Commented Nov 8, 2014 at 3:29
1

why does everyone assume TCP and/or some kind of reply or acknowledgement when considering these sorts of configuration options on switches? what if you're broadcasting over a network, and you only want to allow data to propagate one direction? it's not nonsense... it makes perfect sense, and it's a valid configuration, though it's not very useful for typical TCP IP networks. video broadcast is probably the most common example of this being used, another is port mirroring for monitoring.

unidirectional network topologies are perfectly valid and have real use.

https://en.wikipedia.org/wiki/Unidirectional_network

https://www.sans.org/reading-room/whitepapers/firewalls/tactical-data-diodes-industrial-automation-control-systems-36057 (pdf)

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.