I've read where frames are tagged only when going over a trunk and that Access ports do not tag frames. But don't Access ports actually tag frames? When I configure a particular port to be in a particular vlan (for example vlan 5), when traffic comes into the Access port from a PC, isn't that frame then being tagged with the respective vlan configured for that port? If the frame is not tagged by the switch's Access port (assuming that the Access port is not configured with a native vlan, but another vlan (for example Vlan 5), then how would a trunk know what tag (vlan 5) to put on that frame as it sends it across the trunk. If I'm able to configure a switch's Access port to belong to a particular vlan, then why wouldn't the switch tag the frame as it enters the switch Access port? Isn't this the point of configuring an access port with a certain (non native) vlan - to tag the frame to delimit where the frame can travel? Also, wouldn't the frame need to be tagged when entering the switch Access port from the PC, so then the switch would know (if it was a broadcast) to where the broadcast should be delimited to (only ports within that vlan)?

  • 1
    No. Tags are used on trunks in order to tell the other end of the link which frames are on which VLAN. A switch receiving frames on an access interface already knows to which VLAN the frames belong. – Ron Maupin Apr 17 '17 at 0:48
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 3:13

I think you're confusing what goes on internally on the switch. How it keeps track of which ports are in which VLAN is up to the manufacturer.

It's important to remember that 802.1q frames are a different format than "standard" Ethernet (802.3). Standard Ethernet frames do not have VLAN IDs. A PC or other device transmits and receives Ethernet frames (802.3).

When a switch transmits frames on a trunk, it uses 802.1q framing, which includes a VLAN tag. If the switch is transmitting frames with tags, then that port is a trunk port. Most hosts do not understand 802.1q frames, so they ignore them. That is why you can have tagged and untagged frames on the same port. But it's still a trunk port.


access links are presented to any device without tags. when traffic leaves that vlan going into the switch for a destination not on the same vlan it gets a tag of the vlan added to each frame, to allow the switch to forward it correctly. When you speak of a native vlan, it is the common vlan that two devices agree to send non tag packets. the default vlan on cisco switches is vlan 1. Devices need a common untag network to communicate on. Tags are for forwarding purposes. They provide no value within a vlan.


So lets imagine have an access port associated with VLAN5 as per your question. When a device connects to this access port, the ethernet switching table updates the MAC address and correlates it with the associated VLAN (in this case VLAN5) that the interface is configured to. When a frame is sent - it's still untagged when it enters the access port - and remains so until it reaches the TRUNK port. Now, when the trunk port receives the frame, it simply does a lookup of the MAC address in the ethernet switching table and sees what VLAN its associated with and THEN it is tagged.

Hopefully this clarifies it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.