I'm having troubles understanding how untagged frames are managed by switches. Supposing a network topology as the following:

network topology

With the following router configuration: router configuration

How are untagged frames with destination H1/H2 managed by switches? Such frames may be a package coming from internet to R1 with H1 as destination, or even a package with source H2 and destination H1, which gets its tag removed when passing though R2's Fe1 interface.

These frames reach SW1 untagged, since both R1's Fe0 and SW1's Fe2 are trunk ports: do they get forwarded to H1 (which is on VLAN1)?


Frames that are not tagged on a trunk are in the native VLAN, which is usually VLAN 1. The tags on a trunk are to allow a device on the other end to differentiate which frames belong to which VLAN. That means that one VLAN can send untagged frames. That VLAN is called the native VLAN, and the receiving switch knows that any untagged frames received on an interface blong to the native VLAN.

Also, understand that the hosts send and receive untagged frames (most hosts do not understand VLAN tags and will drop tagged frames). The access interfaces on a switch do not tag the frames. Tags are only used on trunks where there may be multiple VLANs, but that is not the case for access interfaces.

The router will create the frames for the correct VLAN based on the destination address. If a packet coming into the router is destined for an untagged VLAN on the router interface, then the router will not place a tag on the frame containing that packet, but if the packet is destined for a VLAN that is tagged on the router interface, then the router will place a tag on the frame containing that packet.

  • Thank you, now I've understood. I have a last question though: you said that access interfaces do not tag frames: isn't this what happens with port-based VLAN assignment having a host which doesn't understand VLAN tags? – RVKS Jul 6 '17 at 16:24
  • No. Access interfaces do not use tags; only trunk interfaces use tags, and that is only because the tags are to differentiate which frames belong to which VLANs. That is not necessary on an access interface where all frames belong to the same VLAN. The switch inherently knows that any frames sent or received on an access interface belong to the VLAN assigned to that interface, but that is not the case on a trunk interface, hence the creation of VLAN tags. – Ron Maupin Jul 6 '17 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.