1

Consider the network with the following trivial topology, which is a subset of a real network:

enter image description here

Server A is on VLAN 1, physically connected to port 1 on the switch. Server B is on VLAN 2, physically connected to port 8 on the switch. There is also an uplink/trunk port connected to port 4 on the switch.

The configuration of the switch is given in the screenshot below:

enter image description here

Server A is given PVID 1, but is also a member of tagged VLAN ID 2 (2T). Thus it should allow egress and ingress of frames tagged with VLAN ID 2 on physical port 1.

Server B is given PVID 2, which should tag all frames with VLAN ID 2 on ingress.

With this in mind I'm expecting server B to be able to ping server A. But this is not the case, server B cannot reach server A. Traffic on port 4 with tagged VLAN ID 2 also cannot reach server B.

My question is what is it with this configuration that prevents the switch from passing along tagged VLAN ID 2 traffic to port 1? Is it my misunderstanding of how VLAN works? If so, what is wrong with my understanding, and what is the correct setup?

It did occur to me that port 8 is only a member of VLAN ID 2, and traffic tagged with VLAN ID 1 (as in the ICMP echo reply which it is waiting for) would not pass through, making the connection unidirectional. But even after tagging port 8 with VLAN ID 1 (making it 1T,2U) there was no difference. Server B still couldn't ping server A.

Improve this question
5
  • 1
    Devices on different layer-2 VLANs require the intervention of a layer-3 device (router) to communicate.
    – Ron Maupin ♦
    Aug 29, 2016 at 1:38
  • Is server A's NIC configured for trunking? Does it have a sub-interface in vlan2 and is B pinging the ip address of that sub-interface? If any of the answers is NO then Ron Maupin's comment and Ron Trunk's answer are correct.
    – hertitu
    Aug 29, 2016 at 7:10
  • As for "Traffic on port 4 with tagged VLAN ID 2 also cannot reach server B." -> who is sending that traffic and is it tagging it correctly?
    – hertitu
    Aug 29, 2016 at 7:11
  • @hertitu server A's NIC is not configured for trunking. The traffic arriving on port 4 is tagged with VLAN ID 2 by the access port of the host sending the traffic (on the remote switch) being also set to PVID 2.
    – AttributedTensorField
    Aug 29, 2016 at 21:09
  • I hope all the comments and the answer of @RonTrunk explain why B cannot ping A (unless there is a router routing between the 2 vlans), but that leaves the question why "Traffic on port 4 with tagged VLAN ID 2 also cannot reach server B". It should be able to reach B so you may want to post a separate question for that (including more details about the other switch and how you are testing exactly). Or did you mean "Traffic on port 4 with tagged VLAN ID 2 also cannot reach server A"? Then the answer is the same as for the ping from B to A.
    – hertitu
    Aug 30, 2016 at 8:19

1 Answer 1

Reset to default
2

You need to understand the difference between tagged and untagged frames. Tagged frames use the 802.1q frame format, which is different than "standard" ethernet. Other than switches, few devices understand 802.1q format.

When server B sends a frame on VLAN2, it sends it as a standard Ethernet (i.e. untagged) frame. But because you have configured port 1 to tag VLAN 2, the frame will exit port 1 in 802.1q format. Server A doesn't understand that format and ignores the frame.

A port can have only one untagged VLAN, but many tagged VLANs.

Improve this answer
6
  • While I agree that it's probably the case here, "Server A doesn't understand that format and ignores the frame." is an assumption, not a fact. Most current day servers/NICs can be configured to understand 802.1q.
    – hertitu
    Aug 29, 2016 at 7:14
  • Server B has PVID 2, but you're saying that this does NOT tag the frame with VLAN ID 2?
    – AttributedTensorField
    Aug 29, 2016 at 13:21
  • Unless you've configured your server to use 802.1q as @hertitu mentions, your server sends untagged frames. It is the switch that tags frames based on the port configuration. So if your switch receives a frame on port 4 with a PVID of 2, it will forward that frame as a tagged frame on port 1, but as an untagged frame on port 8.
    – Ron Trunk
    Aug 29, 2016 at 13:41
  • Also, see if this blog post by @eddie helps: practicalnetworking.net/stand-alone/vlans
    – Ron Trunk
    Aug 29, 2016 at 13:52
  • If this was only a problem with server A not understanding tagged frames, then switching to PVID 2 on port 1 and 8 (and 2U on both) should not allow server A and B to communicate either, but this works. Unless PVID doesn't actually tag frames at all.
    – AttributedTensorField
    Aug 29, 2016 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.