Since I'm a noob, I'm unable to post a follow up question on the following question... Why and how are Ethernet Vlans tagged?


In my image, I believe I have correctly depicted how tagged networking works, going from the switch to a device. If v10, v20, and v30 are tagged, then that traffic is allowed to pass through to the client device. Since, v50 isn't tagged on this port, it's traffic would not be allowed to pass. The client device would, then, determine how to handle the traffic of the different vlans (such as an Access Point that has multiple SSID's for multiple vlans or a Host running virtual computers and the guest computers are on different vlans).

Since many devices (such as our home computers) do not (to the best of my limited knowledge) have the ability to apply the 802.1Q tagged header to their traffic (basically setting the computer's network card to where it sends it's traffic using a tagged network, such as the v10, v20, or v30), the traffic coming from the computer would be rejected.


In this instance, an untagged network is required.

It could still pass traffic on the v10, v20, or v30, but it would require that...

1.A That the vlan be untagged at the switch (such as v20)

2.A The device has the proper IP address (such as 10.0.20.XXX)


1.B The device is able to tag it's traffic (such as a VoIP Phone)

2.B The device has the proper IP address (such as 10.0.20.XXX)

Tagged & Untagged

In this final image, I believe I have depicted how a tagged & untagged switch set up functions correctly. The switch has 3 tagged and 1 untagged networks. The host computer's traffic travels on the untagged network (such as acquiring an Auto DHCP, Internet, etc). The host computer, through user set up, uses the tag within the header to route the traffic correctly.

The guest networks then send their tagged traffic back through to the host server, who then relay's their traffic to the switch.

  1. Does this accurately depict (in basic terms) how tagged & untagged traffic works?
  2. If this is all true, then how does the host computer send tagged traffic to the switch? Does it...

A. Send it via the untagged network and the switch routes the tagged traffic accordingly?

B. Send it via the tagged network not utilizing the untagged network.

If B is correct, then (in this scenario) does the host computer have to have an untagged network for the guest computers to pass traffic? Could the host computer have no tagged or untagged networks and still be able to pass the tagged traffic from the guest servers?

Thank you for your help with this!


UPDATE: The system is requesting that I update this question addressing why this is different than the Why and how are Ethernet Vlans tagged?. I would have added a comment to that question, but being a noob I don't have enough reputation points to post on it. While it does address my questions to some degree, part of this was trying to clarify my understanding and to ask a follow up question.

  • Did any answer help you? If so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Mar 23 at 14:56

Tags are only attached to frames on trunk ports. Access ports, while members of a VLAN, do not tag frames as they exit the port.

Typically, end devices are attached to access ports, so they do not receive frames with tags. There are exceptions to this since some servers can deal with tags and are attached via a trunk port.

  • VoIP phones also receive/transmit tagged frames. – Ryan Foley Jun 15 '15 at 16:01
  • 1
    @Ryan Foley, that is correct, but VoIP phones actually negotiate a trunk (using CDP or LLDP) from the switch to the phone, and the phone acts as both a switch and an end device. – Ron Maupin Jun 15 '15 at 16:19
  • Does the negotiation of the port type preclude it from being relevant to this question? – Ryan Foley Jun 15 '15 at 18:08
  • @Ryan Foley, no, but I addressed trunk ports in my answer. A phone will modify an access port into a trunk port. Tagged frames still only go out trunk ports. I just don't see the difference. For that matter, you can say that routers can send and receive tagged frames if they are configured to do so, for example: a router-on-a-stick. It is still a trunk port. – Ron Maupin Jun 15 '15 at 18:14
  • Ron & Ryan, thank you for your comments. The question was more of a clarification question on how a device that communicated on tagged and untagged vlans works. How a VM server, for example, handles tagged vs untagged traffic. If I understand what is being said correctly (and through other readings) one is not dependent on the other (the untagged packet is not a carrier for the tagged packet). – frog22 Jun 16 '15 at 15:28

No, that does not accurately reflect how tagged and untagged traffic works.

First off, 802.1q VLAN tagging is done on layer 2 in Ethernet frames, so IP addresses have no bearing on the behavior of tagged or untagged frames. Second, tagging is not a system for allowing or denying traffic to or from specific VLANs. A frame should not generally be rejected simply because it has or does not have a tag.

VLAN tags are only a way for frame to specify what VLAN it is intended for. That's pretty much it (there are other things but let's get the basics down for now).

For an interface that does not process VLAN tags (or has the processing of tags disabled), all frames coming into that interface are considered to be on the same VLAN. For devices that do not understand VLANs, frames coming into any interfaces are just on the one network (VLAN) that the device sees.

For interfaces that do process VLAN tags, the tag tells the interface what VLAN the frame is for. Most of the time, when an interface is configured to process VLAN tags, one of the VLANs available on that interface is configured to be the destination for any frames that do not have a tag. That VLAN is often called the "untagged VLAN", "default VLAN", or "native VLAN". Untagged packets arriving at an interface with a default VLAN configured will be accepted and passed on to that VLAN. Not having a tag does not necessarily result in the frame being rejected or dropped. Sometimes for security purposes, there will be no default VLAN for an interface, or untagged packets will be explicitly dropped.

Also, VLANs are not entirely tagged or untagged. Interfaces are configured to use tags on all or all but one of the VLANs available on that interface, but which VLAN frames are tagged can vary from interface to interface.

Suppose you have two VLANs, VLAN 10 and VLAN 20, one switch that supports tagging, one firewall that supports tagging, and two computers that do not support tagging. On the switch, you can configure port 1 to be on VLAN 10 only with VLAN 10 as the default VLAN, port 2 to be on VLAN 20 only with VLAN 20 to be the default vlan, and port 3 to be on both VLAN 10 and 20 with VLAN 10 as the default VLAN and 802.1q tagging configured for VLAN 20 on port 3.

Then you could configure the firewall to have two virtual interfaces on its "inside" port. One virtual interface could be configured untagged and on VLAN 10, and the other virtual interface tagged for VLAN 20.

Plug computer A into port 1 and computer B into port 2. Now when computer A sends a frame to the switch, the switch accepts it on port 1 and therefore knows it's for VLAN 10 and sends it out of port 3 without a VLAN tag. The firewall gets the frame on its "inside" port and since it has no tag, assumes it's for VLAN 10 and processes it using the VLAN 10 virtual interface.

When computer B sends a frame to the switch, the switch accepts it on port 2 and knows it's for VLAN 20 and sends it out of port 3 with a VLAN tag added to it for VLAN 20. The firewall gets the frame, sees the tag and knows the frame is for VLAN 20 and therefore processes the frame using the VLAN 20 virtual interface.

Hopefully that clears it up a little bit.

  • Todd, thank you for your comment! They are very helpful. I apologize, images and information may not have been as clear as I wanted it to be. The IP addresses were more for me and I meant to remove them prior to submitting this. To clarify the the "rejected" traffic, I didn't clearly explain that. Image 1 was to show that if the switch did not have the v50 tagged or untagged on that port, it would not allow that traffic through. In the second image, I was trying to depict what would happen to untagged traffic if the port did not have an untagged vlan associated with it. – frog22 Jun 16 '15 at 15:40

When an Ethernet frame traverses a trunk link, a special VLAN tag is added to the frame and sent across the trunk link.

As it arrives at the end of the trunk link the tag is removed and the frame is sent to the correct access link port according to the switch's table, so that the receiving end is unaware of any VLAN information.

Not the answer you're looking for? Browse other questions tagged or ask your own question.