What happens if I have a switch configured with an accessport on vlan 20 and someone uses a static ip in a different subnet. vlan 20 has the subnet in the router. Suppose the ip used is, which in the router is vlan 30. Now packets arrive at the router from ip with a vlan tag of 20. What happens? Does the packet simply get dropped?


The router processes packets based on the destination address, not the source. So the router will still forward the packet based on the destination address, regardless of the source address.

If the destination address is in the router's forwarding table, it will forward the packet -- otherwise it will drop it.

The router strips off layer 2 information (like VLAN tags), so it won't have any bearing on the router's actions.

Of course any return traffic won't arrive at the right host, since it's on the wrong subnet.

  • When does the router then add a vlan tag if a switch is wired to an interface via a trunk port? – schgab Oct 23 '20 at 19:32
  • If the router is connected to a trunk port, the router will add the tag for the outgoing subinterface. – Ron Trunk Oct 23 '20 at 19:39
  • Just for my understanding: The router decides based on destination address where the packet needs to go and before it leaves the router the tag gets addes for the appropriate subnet to which the packet is sent to – schgab Oct 23 '20 at 19:41

The router would see nothing because the misconfigured machine would not be able to reach its gateway -- it will be arp'ing for a node that isn't there. The packets from 30.10 would never reach anything at 20.x because it isn't connected to that network.

(If someone set a static MAC entry for the gateway to the correct 20.x device, then the traffic would reach the vlan20 router. If the router is doing any sort of source verification, it would drop the alien packet, otherwise it would route like any other packet. Of course any replies would never come back to the misconfigured host.)

  • If I understand correctly the router receives the arp request but the response does not reach the sender? – schgab Oct 24 '20 at 6:46
  • 30.10 would have a default gw of 30.something. If you set it to 20.something, it won't do anything because you don't have an interface in that network. The vlan20 router will never see an arp for it's address. – Ricky Oct 24 '20 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.