If I configure one switch with all access ports in VLAN 10 and connect it to a switch with all access ports in VLAN 20, a host on the first switch will be able to communicate with a host on the second switch if both hosts are in the same subnet. However, if I have one switch with two hosts connected to it in the same subnet but on different VLANs, they are unable to communicate. Could anyone explain how this works to me? Thanks!

  • I don't think 2 devices in different VLANS across switches can communicate only because they are in the same subnet. Also there is not much difference between using a single switch with multiple VLANS or a 2 switches each with one VLAN. The forwarding operation will be the same
    – john
    Commented Jun 14, 2017 at 23:28
  • These articles will help you understand the concept of VLANs.
    – Eddie
    Commented Jun 15, 2017 at 5:37
  • Those articles were amazing Eddie, thanks for writing those!
    – Thomas K
    Commented Jun 15, 2017 at 18:32

2 Answers 2


The key is probably how you are connecting the switches - sounds like NOT a trunk that preserves VLAN10 and VLAN20. With more detail from you, more detail might be possible, but that would seem to be the likely cause.

  • You are correct, I connected the two switches with a crossover cable and they were not connected via trunk ports, but still using the access ports in VLANs 10 and 20. Is this the cause?
    – Thomas K
    Commented Jun 14, 2017 at 23:33
  • 1
    Yes - an access port knows nothing of VLANs, and has no tagging. So from switch A everything on Switch B is on VLAN10, and from switch B, everything on switch A is on VLAN20 - because those are the access ports they are plugged into on each switch, and you did not set up a trunk with tagging to keep the traffic separated in each switch.
    – Ecnerwal
    Commented Jun 14, 2017 at 23:37
  • Okay, that makes perfect sense then. Thank you for explaining. I seem to be confused about how VLAN tagging works then. I was under the belief that an access port would tag the frame with the VLAN it's set to, for example an access port in VLAN10 would be tagged as such, and then a trunk port would carry the VLAN tagging from all the access ports on the switch. If you wouldn't mind, could you correct me on how this actually works? Thanks so much!
    – Thomas K
    Commented Jun 14, 2017 at 23:43
  • 2
    That is how it works - if you use a trunk port. If you "trunk" by connecting two access ports, the tags are stripped as the frames leave the port, because it's an access port...then new tags are added as it enters the other access port. A trunk port has to be set as such (how varies with switch maker and switch OS.)
    – Ecnerwal
    Commented Jun 14, 2017 at 23:52
  • 2
    Start at a computer. A frame, untagged, leaves the computer. it enters an access port and is tagged. In the switch it is tagged. If it leaves the switch on a trunk port, it's still tagged. If it enters another switch on a trunk port, it's still tagged, only when it leaves (some switch) via another access port is it untagged, as it goes to final delivery at another computer connected to that access port.
    – Ecnerwal
    Commented Jun 15, 2017 at 0:10

A trunk port adds a header that identifies the VLAN to all but the Native VLAN. An access port strips the header off. As traffic passes the access port, it assumes the VLAN based on what was assigned locally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.