CCNA online course

IEEE 802.1Q VLAN Tagging Overview

Learn how IEEE 802.1Q VLAN tagging carries multiple VLANs across Ethernet trunks, including tag fields, VLAN IDs, native VLANs, ISL comparison, and troubleshooting.

IEEE 802.1Q is the IEEE standard for identifying VLAN membership in Ethernet frames. A VLAN, or virtual LAN, is a logical Layer 2 network segment that separates broadcast domains. The 802.1Q tag allows one physical Ethernet link to carry traffic for multiple VLANs.

This topic assumes familiarity with the OSI reference model, Ethernet frames, MAC addresses, Layer 2 switching, access ports, and trunk ports.

What IEEE 802.1Q Does

A trunk is a link that transports traffic for multiple VLANs. For example, a trunk between two switches might carry VLANs 10, 20, and 30 over one cable. The switches distinguish those traffic streams by using VLAN tags.

802.1Q is used between switches and other VLAN-aware devices, such as routers, firewalls, wireless controllers, and virtualization hosts. When a frame leaves a trunk for a non-native VLAN, the sending device normally inserts an 802.1Q tag. The receiving device reads the VLAN Identifier and associates the frame with the corresponding VLAN.

An access link normally carries traffic for one VLAN and generally sends frames untagged. A trunk carries multiple VLANs and normally tags frames so the receiving device can preserve their VLAN identity.

Why 802.1Q Supports Interoperability

802.1Q is an open IEEE standard. Equipment from different vendors can exchange VLAN traffic when both devices support compatible 802.1Q trunk behavior and use matching VLAN, native VLAN, and allowed-VLAN settings.

This differs from vendor-specific legacy trunking protocols. A proprietary protocol may work only when both endpoints support that vendor's encapsulation. Modern networks generally use 802.1Q because it is the relevant standards-based method for interoperable Ethernet trunks.

How 802.1Q Modifies an Ethernet Frame

An 802.1Q tag is a 4-byte field inserted into the original Ethernet frame. The insertion occurs between the source MAC address and the original EtherType or length field.

802.1Q does not wrap the entire original frame in a separate outer encapsulation. Instead, it adds a field inside the Ethernet header. The original EtherType or length field, payload, and Frame Check Sequence remain part of the frame, although the FCS is recalculated because the frame contents and size have changed.

802.1Q Tag Fields

The 4-byte tag consists of a 16-bit Tag Protocol Identifier (TPID) followed by 16 bits of Tag Control Information (TCI).

TPID

The TPID identifies the presence of an VLAN tag. Its usual value is 0x8100. A receiving device uses this value to recognize the following bits as 802.1Q tag information rather than as the original EtherType or length field.

TCI

The TCI is a 16-bit section containing PCP, DEI, and VID:

• PCP: The 3-bit Priority Code Point supports Layer 2 quality-of-service markings. Values range from 0 through 7, with the interpretation depending on the QoS design.
• DEI: The 1-bit Drop Eligible Indicator marks a frame as eligible for preferential dropping during congestion. This bit is historically associated with the Canonical Format Indicator concept.
• VID: The 12-bit VLAN Identifier identifies the VLAN to which the frame belongs.

VLAN ID Capacity and Valid Ranges

The VID field has 12 bits, so it represents 2¹² = 4096 numerical values. VLAN IDs 0 and 4095 are reserved and cannot be used as normal VLAN membership identifiers. Therefore, 4094 VLAN IDs are normally available, numbered 1 through 4094.

Trunk Link Behavior

Consider two switches connected by a trunk carrying VLANs 10, 20, and 30. When a frame from VLAN 20 leaves the first switch, the switch adds an 802.1Q tag with a VID of 20. The second switch reads that VID and forwards the frame only within VLAN 20.

Frames from non-native VLANs are normally transmitted with tags. The receiving switch uses each tag to maintain the frame's VLAN identity as it crosses the trunk.

Native VLAN

The native VLAN is the VLAN associated with untagged frames on a conventional 802.1Q trunk. By default, frames belonging to the native VLAN are sent without an 802.1Q tag. When a trunk port receives an untagged frame, it assigns that frame to its configured native VLAN.

VLAN 1 is the common default native VLAN on Cisco switches. A production design should normally use a dedicated native VLAN instead of relying on VLAN 1.

Native VLAN Example

Suppose both trunk endpoints use VLAN 99 as the native VLAN. A VLAN 99 frame is transmitted without a tag under default native-VLAN behavior. The receiving trunk port sees the untagged frame and classifies it into VLAN 99.

The native VLAN assignment must match at both ends. If one endpoint uses VLAN 99 and the other uses VLAN 1, an untagged frame sent by the first endpoint can be placed into VLAN 1 by the second endpoint. This can cause traffic to land in an unintended VLAN and commonly produces a native-VLAN mismatch warning.

802.1Q Compared with ISL

ISL, or Inter-Switch Link, is a legacy Cisco-proprietary VLAN trunk encapsulation method. ISL adds an outer encapsulation around the original Ethernet frame. In contrast, 802.1Q inserts a 4-byte tag into the Ethernet frame after the source MAC address.

Frame Size Implications

Inserting the 4-byte tag increases the Ethernet frame size. A device on a trunk path must support tagged Ethernet frames and the adjusted maximum frame size. If a device or link cannot handle the additional bytes, tagged frames may be rejected or otherwise malfunction.

Configuration Example

The following is a conceptual Cisco IOS example. Exact command availability and syntax vary by switch platform and software release.

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,30,99

The trunk peer should use the same native VLAN and a compatible allowed-VLAN list. VLAN 99 must exist if it is used as the native VLAN, and the VLANs required by the design must be active on both switches.

Verification Commands

show interfaces trunk
show interfaces GigabitEthernet0/1 switchport
show vlan brief

• show interfaces trunk helps verify operational trunk status, native VLAN, and permitted VLANs.
• show interfaces GigabitEthernet0/1 switchport displays switchport mode and VLAN-related details for the interface.
• show vlan brief helps confirm that VLANs exist and identifies access-port membership.

Operational and Security Considerations

• Explicitly configure the native VLAN and make the assignment identical on both trunk endpoints.
• Do not generally use the default VLAN for ordinary user traffic or as the native VLAN in a production design. Use a dedicated, unused native VLAN according to the organization's design.
• Limit each trunk's allowed VLAN list to only the VLANs required on that link.
• Improper handling of untagged and double-tagged frames can contribute to VLAN hopping, in which traffic attempts to cross VLAN boundaries without authorization.
• Use appropriate switchport modes, disable or secure unused interfaces, and review native-VLAN and allowed-VLAN settings as part of the switch hardening process.

Troubleshooting 802.1Q Trunks

VLAN Devices Cannot Communicate Across the Link

Possible causes include a link that is not operating as a trunk, a missing VLAN from the allowed list, a VLAN that is missing or inactive on one switch, or incorrect VLAN association caused by trunk configuration.

1. Verify that the link is operationally trunking.
2. Verify that the VLAN is allowed on both trunk endpoints.
3. Verify that the VLAN exists and is active on both switches.
4. Confirm that the VLAN ID is consistent throughout the path.

Native VLAN Mismatch Warning

The usual cause is different native VLAN settings on the two trunk endpoints. Compare the configured and operational native VLAN on both ports, then set both to the same dedicated native VLAN according to the network design.

Cross-Vendor Trunk Failure

If a trunk works between same-vendor switches but fails between vendors, check for incompatible encapsulation or tagging settings, mismatched native VLAN behavior, or dependence on a vendor-specific feature.

1. Confirm that both devices use IEEE 802.1Q.
2. Compare VLAN IDs, native VLAN treatment, and allowed VLANs.
3. Check whether the remote platform requires explicit trunk or tagging configuration.

Unexpected VLAN Traffic on a Trunk

A trunk may allow more VLANs than necessary, or the default VLAN and native VLAN design may be too permissive. Restrict the allowed VLAN list, move the native VLAN away from normal user VLANs, and review switchport modes and unused-port configuration.

Key Points to Remember

• 802.1Q is an IEEE standard for identifying VLAN membership in Ethernet frames.
• A trunk carries multiple VLANs over one physical link.
• The 4-byte tag is inserted between the source MAC address and the EtherType or length field.
• The tag contains TPID, PCP, DEI, and VID information.
• The 12-bit VID provides 4094 normally usable VLAN IDs because 0 and 4095 are reserved.
• Non-native VLAN frames are normally tagged; native VLAN frames are normally untagged.
• Both trunk endpoints must agree on the native VLAN.
• 802.1Q is standards-based and interoperable, while ISL is a legacy Cisco-proprietary encapsulation.
• Use a dedicated native VLAN and restrict allowed VLANs to reduce configuration and security risks.