I have attempted to search this problem but I don't really know how to explain it properly (possibly a sign I've taken on more project than I can handle).

Anyway I am currently working on chopping our giant one subnet network into multiple subnets. I'm using VLANs to achieve this.

Each geographically different site will be its own subnet / VLAN.

I've got everything working properly on my test subnet in my office and it's going quite well.

However I'm not quite sure what the best practice is for the VLAN configuration on the switches. In particular the switches at each site (subnet) that service the devices / computers.

Should I be tagging / trunking the VLANs through to the switches that service the users and then untagging the VLAN on each port (other than the trunk port) on that switch.

Or should I be untagging the VLAN on the upstream port (i.e. the fibre port that goes off to the subnet / site) and then just using the native VLAN on the switches at the sites / subnets?

Any help is appreciated. I'm sure I've broken at least 20 obscure Stack Exchange rules with this post, so apologies in advance.

  • 1
    Switches tag and untag the frames on the trunk interfaces. You do not need to worry about that. The access interfaces (where you connect the users) will not have tags. A router for the site will strip off the entire frame (tags too) in order to route the packets to a different site.
    – Ron Maupin
    Commented Feb 19, 2020 at 22:38
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Commented Dec 17, 2020 at 15:41

2 Answers 2


Inter-Switch Links

A good general rule is: tag all your inter-switch links (ISLs) so you can easily add more VLANs in the future without confusing problems.

Unmanaged switches

The exception is "unmanaged switches," for example, low-budget SOHO devices that don't support VLANs at all. You may find use for these in branch office environments to aggregate connections from workstations and phones.

Access Ports

Don't tag ports going to workstations or phones.

Voice VLAN

An exception to this access port rule is voice VLANs, which are configured for access ports serving a VOIP phone which is then itself serving a PC. In these situations, configuring the voice VLAN causes the phone's traffic to be tagged with the voice VLAN ID, and the workstation's traffic is untagged. The switch sends out LLDP or CDP packets which are understood by the phone, and that tells the phone what is the voice VLAN.

An example of voice VLAN configuration for Cisco IOS switches is:

interface GigabitEthernet1/0/1
 description to cubicle 1A
 switchport access vlan 50
 switchport mode access
 switchport voice vlan 60
  • In reality, the VoIP phone will use CDP or LLDP to negotiate a trunk. There are some VoIP phones or switches that do not do that, so you can manually configure the trunk to the phone. Cisco does not call it a trunk, but that is really what it is.
    – Ron Maupin
    Commented Mar 21, 2020 at 17:28

Basically, it doesn't matter whether you tag all VLANs between switches or untag one of them.

Sometimes handling can be simplified by keeping one untagged VLAN, e.g. when you want to add new switches without preconfiguring them or when there is a much more important segment and only minor other ones.

However, it all depends on what you're comfortable with. Generally tagging all VLANs on trunks might provide a more consistent logic. Whatever you choose, stick with it throughout the network. Wrongly configured VLANs interrupt connectivity and bring down part of your network.

  • Thanks, that's a great answer...I've upvoted it but my rep isn't good enough for it to show up. Commented Feb 20, 2020 at 17:57
  • Did the answer help you? If so, you should accept it so that the question doesn't keep popping up forever, looking for an answer.
    – Zac67
    Commented Mar 21, 2020 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.