I've read through some of the differences between a subnet and VLAN but I'm having a hard time figuring out if I'm actually utilizing a VLAN properly.

My switch by default is on the network. It is considered an untagged network because there's no VLAN on it. Any computer can join this subnet and read broadcast traffic. Am I correct to assume the last sentence is right?

I then create on the switch say VLAN 10 with a network of I set a static IP of on my computer and on another computer. Lets say both are Mac running OS X 10.10. The switch port for both Macs are set to all (4096).

Since I did not "tag" the NIC of either Mac, how am I still able to talk to the other Mac through file sharing, SSH, etc? Isn't this VLAN 10 I created on required to have both Mac's tagged to access it?

Now lets say if I add a third device, a linux box, with its interface tagged for VLAN 10. It has an IP of Can I ssh into either Mac?

What is the difference between tagging a switch port vs NIC? Can a tagged NIC still talk on the same subnet of other untagged devices?

  • When you created VLAN 10 on the switch, did you assign any ports on the switch to VLAN 10? Making a subnet or IP range does not create a VLAN and making a VLAN does not make a subnet or even require a separate subnet or IP range to be created in all situations. They are not really related. Commented Jul 8, 2015 at 13:54
  • I did not. The thought behind this was if I tagged my two Mac computers with VLAN 10 on the physical switch, then I could not communicate with other VLANs or the Untagged network. Lets say I created VLAN 20 and put a server on If the port of the server was on was tagged VLAN 20 and the port the Mac was on VLAN 10, they could not talk, correct?
    – deb771x84
    Commented Jul 8, 2015 at 14:02
  • What you want to do is assign VLAN 10 to at least two ports of the switch, configure those ports to not tag VLAN 10, and plug the Macs into those two ports. Then the Macs will be on VLAN 10 and no tags will be used. If you don't assign the VLAN to any ports, then no devices will be communicating over that VLAN. Commented Jul 8, 2015 at 14:05
  • @ToddWilcox Ok, I have assigned the VLAN 10 to both ports the Mac is on. I assigned VLAN 20 to the port my server is on. At this point, I need a route between the two VLANs?
    – deb771x84
    Commented Jul 8, 2015 at 14:17
  • I think it's better to discuss this in chat: chat.stackexchange.com/rooms/11177/… Commented Jul 8, 2015 at 14:18

1 Answer 1


Let's see if I can make things clearer.

First, VLANs are a layer 2 construct, and subnets are a layer 3 construct. It is true that in most cases there is a 1:1 relationship between them (i.e., one VLAN per subnet, and vice versa), but that doesn't mean they are the same thing.

Switches, being a layer two device, forward packets based on MAC addresses and never look at IP addresses. So in the context of a switch, it's wrong to say that a VLAN has a particular subnet on it. The switch doesn't know or care.

It is the end devices (hosts or routers) on a VLAN that define the IP subnet. If they're all configured for the network , then that's what it is. If you change the IP subnet on your hosts, you have changed the subnet for that VLAN.


The term "tagging" applies to the 802.1q protocol, which is a variation of "standard" ethernet protocol. In fact most PCs, Macs, etc, can not understand the 802.1q protocol -- they simply ignore it. So when you say

My Mac is tagged on VLAN 10

That doesn't quite make sense. The switch port your Mac is plugged into accepts untagged frames, and if you've configured it, also tagged frames (802.1q frames). Your Mac however only sends and receives untagged frames, regardless of how many different VLANs are tagged on that port. In other words, it is unaware that there are tagged frames being sent out that port, because it doesn't understand them.

Whatever VLAN is untagged on the port you MAC is plugged into, is the VLAN your MAC is on.

So for example, unless you've changed the configuration, VLAN 1 is untagged on all ports. So, by default, any port you plug a MAC or PC into will send and receive frames on VLAN 1, because that VLAN is untagged on all the ports.

Now, if you want to create a new VLAN (10), and only have some devices use it, you will set those ports to send VLAN 10 untagged (In the Cisco world, you set VLAN 10 as the "native" VLAN on the ports).

If two PCs are on switch ports 1 and 2, and you set only those ports to have VLAN 10 untagged, then they will only be able to send frames to each other. All other ports will still use VLAN 1 (untagged). Hosts on VLAN 1 and hosts on VLAN 10 can't talk to each other

The default VLAN (usually VLAN 1) is still a VLAN, and has the same properties as any other. VLANS are tagged or untagged when one talks about port configuration. The same VLAN can be tagged on one port and untagged on another. There is no such thing as a "tagged" or "untagged" network.

  • So my Mac could be tagged on VLAN 10 and my Server could be on the same subnet, and not tagged, and the two will still communicate? I'm assuming in this situation that the frames would be visible to everyone on that subnet still? I'm having a hard time understanding this tag/untag concept. Maybe an illustration or example would further clarify.
    – deb771x84
    Commented Jul 8, 2015 at 14:09
  • 1
    @deb771x84 The word "subnet" in your first sentence of you comment should be "VLAN". Subnets are totally different things from VLANs. You could have the Mac "tagged" (sort of) on VLAN 10 and the server "untagged" (sort of) on VLAN 10 also and they could communicate to each other, but there's no reason to do that. At least 95% of the time, VLAN tags are used between two switches. For your Macs and servers and stuff, don't even think about tagging. Also you should get a better grip on what VLANs are in the first place before you think about tagging or not. Commented Jul 8, 2015 at 14:12
  • @deb771x84 I added more info to my answer to address your comments
    – Ron Trunk
    Commented Jul 8, 2015 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.