I've read that frames are tagged only when going over a trunk port and that access ports do not tag frames passing through them. But don't access ports actually tag frames? When I configure a particular port to be in a particular VLAN (for example VLAN 5), when traffic comes into the access port from a PC, isn't that frame then being tagged with the respective VLAN configured for that port? If the frame is not tagged by the switch's access port (assuming that the access port is not configured with a native VLAN, but another VLAN, for example VLAN5), then how would a trunk know what tag (VLAN 5) to put on that frame as it sends it across the trunk. If I'm able to configure a switch's access port to belong to a particular VLAN, then why wouldn't the switch tag the frame as it enters the switch access port? Isn't this the point of configuring an access port with a certain (non native) VLAN - to tag the frame to delimit where the frame can travel? Also, wouldn't the frame need to be tagged when entering the switch access port from the PC, so then the switch would know (if it was a broadcast) to where the broadcast should be delimited to (only ports within that VLAN)?
-
4No. Tags are used on trunks in order to tell the other end of the link which frames are on which VLAN. A switch receiving frames on an access interface already knows to which VLAN the frames belong.– Ron Maupin ♦Apr 17, 2017 at 0:48
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.– Ron Maupin ♦Feb 19, 2018 at 3:13
4 Answers
I think you're confusing what goes on internally on the switch. How it keeps track of which ports are in which VLAN is up to the manufacturer.
It's important to remember that 802.1q frames are a different format than "standard" Ethernet (802.3). Standard Ethernet frames do not have VLAN IDs. A PC or other device transmits and receives Ethernet frames (802.3) when they send/receive it to/from an access port of a switch.
When a switch transmits frames on a trunk, it uses 802.1q framing, which includes a VLAN tag. If the switch is transmitting frames with tags, then that port is a trunk port. Most hosts do not understand 802.1q frames, so they ignore them. That is why you can have tagged and untagged frames on the same port. But it's still a trunk port.
-
Comments are not for extended discussion; this conversation has been moved to chat.– Ron Maupin ♦Apr 12, 2019 at 18:34
Access links (ports) are presented to any device without tags. When traffic leaves that VLAN going into the switch for a destination not on the same VLAN it gets a tag of the VLAN added to each frame, to allow the switch to forward it correctly. When you speak of a native VLAN, it is the common VLAN that two devices agree to send non tag packets. The default VLAN on cisco switches is VLAN 1. Devices need a common untag network to communicate on. Tags are for forwarding purposes. They provide no value within a VLAN.
So lets imagine have an access port associated with VLAN5 as per your question. When a device connects to this access port, the ethernet switching table updates the MAC address and correlates it with the associated VLAN (in this case VLAN5) that the interface is configured to. When a frame is sent - it's still untagged when it enters the access port - and remains so until it reaches the TRUNK port. Now, when the trunk port receives the frame, it simply does a lookup of the MAC address in the ethernet switching table and sees what VLAN its associated with and THEN it is tagged.
Hopefully this clarifies it.
There is good information here but I want to add another perspective. VLANs are simple but for some reason the literature describing them is often oblique and confusing. There are exceptions to what I'm about to describe, but not for simple/typical situations.
There are two different identities at play when discussing an access port, and that is leading to your confusion. One is the VLAN tag of an 801.2q frame, and the other is the VLAN association (often called a PVID, for Port Vlan ID) of the port. They're not related or used for the same purpose.
The PVID of a switch port is for internal switch purposes only. It is used to associate an access port with other ports on the switch. A port can have multiple PVIDs at once.
A VLAN tag comes into play when a trunk port needs to transmit a frame to another device. It is not used for directing frames within the switch that received the frames. Frames on access ports are typically untagged when received by the port.
Here's the story of a frame with VLAN 5. It originates from a PC on an access port and has no tag, so it does not yet belong to a VLAN. The access port is configured as untagged (meaning it won't add tags to frames it transmits) and with PVID 5. Once this frame is received by the access port (often called "ingress"), the switch directs the frame to the proper destination port(s) on VLAN 5. Note that the frame has not been tagged; the switch used its PVID table, not a VLAN tag, to make this association. Meanwhile, there is a trunk port on this switch, which is a called a trunk because it has been configured as tagged and with a PVID of 5 (and possibly other VLANS too). Since it belongs to VLAN 5 by virtue of its PVID, if the switch decides that it is necessary, it will direct this untagged frame to the trunk port, and since it is a trunk, a tag will be added to it, converting it from 802.3 to 801.2q. The newly minted, tagged frame is transmitted ("egress") from the trunk port, and the device on the other end of the trunk line will decide what to do with it upon reception, probably untagging it and directing it to a port with a PVID of 5. Note that the trunk port, upon receiving a VLAN 5-tagged frame that was sent from another switch, will strip the tag and direct it to an appropriate VLAN5 port.
Now to answer your questions specifically:
But don't access ports actually tag frames?
No, not usually.
If the frame is not tagged by the switch's access port..., then how would a trunk know what tag (VLAN 5) to put on that frame as it sends it across the trunk
Because it knows the PVID of the port which sent the packet, which corresponds to the VLAN value in the tag.
If I'm able to configure a switch's access port to belong to a particular VLAN, then why wouldn't the switch tag the frame as it enters the switch access port?
Because the tag is not needed for internal switch routing. PVIDs are used for that.
Isn't this the point of configuring an access port with a certain (non native) VLAN - to tag the frame to delimit where the frame can travel?
"Sort of." From your perspective, yes, but from the switch's perspective, the only purpose of a PVID is to associate it with other ports on this switch. Keep in mind that "configuring an access port with a... VLAN" means setting its PVID, not a tag. In the case of a non-native VLAN (one not used by other access ports on the switch), a trunk line will have to share a PVID with the ingress port in order for this to be a useful configuration.
Also, wouldn't the frame need to be tagged when entering the switch access port from the PC, so then the switch would know (if it was a broadcast) to where the broadcast should be delimited to (only ports within that VLAN)?
No. The switch will use the access port's PVID to decide where to direct the frame.
-
Many things are correct in your answer, but many details are also wrong. an 801.2q packet - L2 PDUs are called "frames". "PVID" is just vendor jargon, you're likely causing more confusion that what you're explaining away. port routing should be "switching", and yes, the VLAN tag or associaton is used for that. copies the packet to all of its ports - no, that's not what a switch does. converting it from 802.3 to 801.2q, there's no conversion. 802.1q is a frame type used in 802.3 Ethernet. repeat it to any of its own ports - again, that's a repeater, not a switch.– Zac67 ♦Dec 10, 2021 at 20:03
-
Thanks for your useful comment, I've edited my answer to make it more precise. - Although the 802.1Q standard does not use the acronym PVID, it does use VID in similar contexts, and PVID is used by Cisco, Zyxel, D-Link, Netgear, and other major OEMs. This term is used throughout general literature and formal documentation. - "...there's no conversion..." What is a more accurate succinct description of the process by which a VLAN tag is added or removed from an ethernet frame without modifying the other data in that frame? Dec 13, 2021 at 21:27