VLAN tags are always at interface level or 'NIC' level.
What it means is, when a switch receives a tagged packet on an interface. It checks if the VLAN id on the packet is the same as the one allowed on the interface.
- If the tag matches, the packet is stipped off the tag and sent for further processing. If not the packet is rejected.
Here is what happens in 'further processing'. If the switch is pure L2, it will look in the forwarding table of the particular VLAN to find the outgoing interface for the packet (say for eg the incoming packet came with VLAN tag 10), It will try to find the outgoing interface for the dest MAC in the forwarding table of VLAN 10.
Once the packet is on the outgoing interface, if that interface is a trunk port - a VLAN tag of 10 will be added on the frame. If that port is VLAN 10 access port, the packet will be sent from the interface without any tagging.
Now, if the switch is not pure L2 - i.e. uses VLAN interfaces,
The incoming packet is again checked for VLAN tag, the packet is sent to the corresponding vlan interface.
Here the interface looks for L3 forwarding table - also known as the routing table to find the outgoing interface for the packet.
Again once the outgoing interface is determined if that interface is a trunk port the packet is tagged with VLAN ID, if not the packet is sent without any tagging