Please forgive VLAN noobishness.

I'm trying to segregate traffic on a network using VLANs. I want all users to be able to receive and transmit to the internet, so I have a VLAN for this.

I also have three other VLANs which should only see ports on the same VLAN, plus the internet VLAN. As far as I can see I need to use an asymmetric VLAN arrangement for this.

The problem I seem to be having is that some devices will not see any packets leaving a port that are tagged, while others do.

Ideally, I'd like to set more than one VLAN to be untagged for certain ports, but not all of my switches support this.

I had assumed that the tag would be ignored by any device not looking for tagged frames, but it seems that some just ignore the tagged frames completely, while processing untagged frames normally.

Am I just going to have to fork out for switches that support multiple untagged VLANs exiting a port?

  • 1
    You need a router.
    – Ron Trunk
    Aug 16, 2016 at 13:28
  • To expand -- using VLANs alone is not sufficient. You need to be able to route between VLANs and apply ACLs (access lists) to filter traffic between VLANs.
    – Ron Trunk
    Aug 16, 2016 at 13:43
  • Just to expand a bit more. You can also use a layer 3 switch that supports routing. Create VLAN interfaces on the switch that will do the routing ( these will also in turn become the gateway for each VLAN subnet) and apply access control lists on the VLAN interfaces to block access going from one VLAN to another (or multiple). All other switches only need to support VLAN's and do not need to route. You need to use a device that can route so that you can move data between VLAN's.
    – SleepyMan
    Aug 16, 2016 at 14:15
  • Routing between VLANs is one option, but I think a better option is Private VLANs (as @NetworkMeister explained) and/or Switchport Protected.
    – Eddie
    Nov 14, 2016 at 18:05
  • Just to expand a little on certain manufacturers providing asymetrical vlans. First see Veniamin's answer here serverfault.com/questions/555427/… and also dlink.com/uk/en/support/faq/switches/layer-2-gigabit/dgs-series/….
    – nick fox
    May 16, 2017 at 9:41

2 Answers 2


There is a solution that does exactly what you are asking for, but its implementation depends on the vendor. Cisco calls it Private VLANs or PVLANs.

PVLANs provide layer 2 isolation between ports within the same broadcast domain. There are three types of PVLAN ports:

  • Promiscuous A promiscuous port can communicate with all interfaces, including the isolated and community ports within a PVLAN.
  • Isolated An isolated port has complete Layer 2 separation from the other ports within the same PVLAN, but not from the promiscuous ports. PVLANs block all traffic to isolated ports except traffic from promiscuous ports. Traffic from isolated port is forwarded only to promiscuous ports.
  • Community Community ports communicate among themselves and with their promiscuous ports. These interfaces are separated at Layer 2 from all other interfaces in other communities or isolated ports within their PVLAN.

In your case, you would configure 3 communities and one promiscuous port.


Normally, you only tag on trunk ports between networks devices (switch-to-switch or switch-to-router). Most hosts don't understand VLAN tags, so access ports don't get tagged, and you only use one untagged VLAN on an access port. Some servers can understand VLAN tags, and they can be configured to use a trunk port. As @RonTrunk pointed out, you need a router (a layer-3 switch has a router built into it, so as @SleepyMan pointed out, you could use one of those) to route between VLANs.

Switches switch on one LAN. VLANs create virtual switches, one for each VLAN. Routers route between networks (VLANs).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.