1

Consider the network with the following trivial topology, which is a subset of a real network:

enter image description here

Server A is on VLAN 1, physically connected to port 1 on the switch. Server B is on VLAN 2, physically connected to port 8 on the switch. There is also an uplink/trunk port connected to port 4 on the switch.

The configuration of the switch is given in the screenshot below:

enter image description here

Server A is given PVID 1, but is also a member of tagged VLAN ID 2 (2T). Thus it should allow egress and ingress of frames tagged with VLAN ID 2 on physical port 1.

Server B is given PVID 2, which should tag all frames with VLAN ID 2 on ingress.

With this in mind I'm expecting server B to be able to ping server A. But this is not the case, server B cannot reach server A. Traffic on port 4 with tagged VLAN ID 2 also cannot reach server B.

My question is what is it with this configuration that prevents the switch from passing along tagged VLAN ID 2 traffic to port 1? Is it my misunderstanding of how VLAN works? If so, what is wrong with my understanding, and what is the correct setup?

It did occur to me that port 8 is only a member of VLAN ID 2, and traffic tagged with VLAN ID 1 (as in the ICMP echo reply which it is waiting for) would not pass through, making the connection unidirectional. But even after tagging port 8 with VLAN ID 1 (making it 1T,2U) there was no difference. Server B still couldn't ping server A.

  • 1
    Devices on different layer-2 VLANs require the intervention of a layer-3 device (router) to communicate. – Ron Maupin Aug 29 '16 at 1:38
  • Is server A's NIC configured for trunking? Does it have a sub-interface in vlan2 and is B pinging the ip address of that sub-interface? If any of the answers is NO then Ron Maupin's comment and Ron Trunk's answer are correct. – hertitu Aug 29 '16 at 7:10
  • As for "Traffic on port 4 with tagged VLAN ID 2 also cannot reach server B." -> who is sending that traffic and is it tagging it correctly? – hertitu Aug 29 '16 at 7:11
  • @hertitu server A's NIC is not configured for trunking. The traffic arriving on port 4 is tagged with VLAN ID 2 by the access port of the host sending the traffic (on the remote switch) being also set to PVID 2. – AttributedTensorField Aug 29 '16 at 21:09
  • I hope all the comments and the answer of @RonTrunk explain why B cannot ping A (unless there is a router routing between the 2 vlans), but that leaves the question why "Traffic on port 4 with tagged VLAN ID 2 also cannot reach server B". It should be able to reach B so you may want to post a separate question for that (including more details about the other switch and how you are testing exactly). Or did you mean "Traffic on port 4 with tagged VLAN ID 2 also cannot reach server A"? Then the answer is the same as for the ping from B to A. – hertitu Aug 30 '16 at 8:19
2

You need to understand the difference between tagged and untagged frames. Tagged frames use the 802.1q frame format, which is different than "standard" ethernet. Other than switches, few devices understand 802.1q format.

When server B sends a frame on VLAN2, it sends it as a standard Ethernet (i.e. untagged) frame. But because you have configured port 1 to tag VLAN 2, the frame will exit port 1 in 802.1q format. Server A doesn't understand that format and ignores the frame.

A port can have only one untagged VLAN, but many tagged VLANs.

  • While I agree that it's probably the case here, "Server A doesn't understand that format and ignores the frame." is an assumption, not a fact. Most current day servers/NICs can be configured to understand 802.1q. – hertitu Aug 29 '16 at 7:14
  • Server B has PVID 2, but you're saying that this does NOT tag the frame with VLAN ID 2? – AttributedTensorField Aug 29 '16 at 13:21
  • Unless you've configured your server to use 802.1q as @hertitu mentions, your server sends untagged frames. It is the switch that tags frames based on the port configuration. So if your switch receives a frame on port 4 with a PVID of 2, it will forward that frame as a tagged frame on port 1, but as an untagged frame on port 8. – Ron Trunk Aug 29 '16 at 13:41
  • Also, see if this blog post by @eddie helps: practicalnetworking.net/stand-alone/vlans – Ron Trunk Aug 29 '16 at 13:52
  • If this was only a problem with server A not understanding tagged frames, then switching to PVID 2 on port 1 and 8 (and 2U on both) should not allow server A and B to communicate either, but this works. Unless PVID doesn't actually tag frames at all. – AttributedTensorField Aug 29 '16 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.