VLAN based subnets, where should I untag a VLAN?

Question

I have attempted to search this problem but I don't really know how to explain it properly (possibly a sign I've taken on more project than I can handle).

Anyway I am currently working on chopping our giant one subnet network into multiple subnets. I'm using VLANs to achieve this.

Each geographically different site will be its own subnet / VLAN.

I've got everything working properly on my test subnet in my office and it's going quite well.

However I'm not quite sure what the best practice is for the VLAN configuration on the switches. In particular the switches at each site (subnet) that service the devices / computers.

Should I be tagging / trunking the VLANs through to the switches that service the users and then untagging the VLAN on each port (other than the trunk port) on that switch.

Or should I be untagging the VLAN on the upstream port (i.e. the fibre port that goes off to the subnet / site) and then just using the native VLAN on the switches at the sites / subnets?

Any help is appreciated. I'm sure I've broken at least 20 obscure Stack Exchange rules with this post, so apologies in advance.

Answer 1

Inter-Switch Links

A good general rule is: tag all your inter-switch links (ISLs) so you can easily add more VLANs in the future without confusing problems.

Unmanaged switches

The exception is "unmanaged switches," for example, low-budget SOHO devices that don't support VLANs at all. You may find use for these in branch office environments to aggregate connections from workstations and phones.

---

Access Ports

Don't tag ports going to workstations or phones.

Voice VLAN

An exception to this access port rule is voice VLANs, which are configured for access ports serving a VOIP phone which is then itself serving a PC. In these situations, configuring the voice VLAN causes the phone's traffic to be tagged with the voice VLAN ID, and the workstation's traffic is untagged. The switch sends out LLDP or CDP packets which are understood by the phone, and that tells the phone what is the voice VLAN.

An example of voice VLAN configuration for Cisco IOS switches is:

interface GigabitEthernet1/0/1
 description to cubicle 1A
 switchport access vlan 50
 switchport mode access
 switchport voice vlan 60

Answer 2

Basically, it doesn't matter whether you tag all VLANs between switches or untag one of them.

Sometimes handling can be simplified by keeping one untagged VLAN, e.g. when you want to add new switches without preconfiguring them or when there is a much more important segment and only minor other ones.

However, it all depends on what you're comfortable with. Generally tagging all VLANs on trunks might provide a more consistent logic. Whatever you choose, stick with it throughout the network. Wrongly configured VLANs interrupt connectivity and bring down part of your network.