Frame Tagging Explained: VLAN Tags, Trunks, and 802.1Q

Learn how 802.1Q frame tagging identifies VLANs across trunk links, how native VLANs handle untagged traffic, and how to troubleshoot Cisco VLAN trunks.

Frame tagging adds VLAN-identification information to Ethernet traffic. It allows one physical link, such as a switch-to-switch connection, to transport several logically separate VLANs without mixing their broadcast domains.

This lesson assumes familiarity with Ethernet MAC addresses, switch forwarding, VLAN creation, access-port assignment, and basic Cisco IOS interface configuration. For foundational context, review the OSI reference model and computer network basics.

Why Ethernet Frames Need VLAN Tags

A VLAN is a logical Layer 2 broadcast domain. Devices in VLAN 10 receive broadcasts for VLAN 10, while devices in VLAN 20 remain in a separate broadcast domain. A switch can assign an endpoint-facing port to one VLAN, but a shared link between switches may need to carry frames from many VLANs.

The receiving switch needs a way to identify the VLAN for each frame. An 802.1Q tag supplies the VLAN ID, also called the VID. The switch uses that information to keep VLAN 10 traffic in VLAN 10 and VLAN 20 traffic in VLAN 20.

An access port is normally assigned to one VLAN. Ordinary endpoint traffic enters and leaves without an 802.1Q tag.
A trunk port carries traffic for multiple VLANs. Frames for nonnative VLANs normally include an 802.1Q tag.

Tagging preserves VLAN separation over switch-to-switch links and over links between a switch and a router, firewall, or hypervisor. The physical cable is shared, but the Layer 2 broadcast domains remain logically distinct.

VLAN IDs, VLAN Numbers, and Port Membership

A VLAN ID is a number used to identify a VLAN in switching operations. In ordinary Cisco discussions, “VLAN 10,” “VLAN number 10,” and “VLAN ID 10” usually refer to the same identifier. A switch port's access-VLAN configuration determines which VLAN receives untagged ingress traffic on that port.

VLAN membership can be represented in two ways:

On an access port, membership is configured on the port. An untagged frame arriving there is classified into the configured access VLAN.
On a trunk, the tag's VID identifies the VLAN as the frame crosses the link. The trunk must also be configured to carry that VLAN.

VLAN IDs do not replace MAC addresses. Normal source and destination MAC addressing, MAC learning, and switching decisions still apply to a tagged Ethernet frame.

The IEEE 802.1Q Frame Format

IEEE 802.1Q is the standard VLAN-tagging method used on modern Ethernet trunks. The switch inserts a four-byte field between the source MAC address and the original EtherType or length field.

Destination MAC | Source MAC | TPID 0x8100 | TCI | EtherType/Length | Payload | FCS

The tag consists of a 16-bit Tag Protocol Identifier and a 16-bit Tag Control Information field.

Field	Bit Length	Typical Value or Range	Purpose
TPID	16 bits	0x8100	Marks the following field as an IEEE 802.1Q tag.
PCP	3 bits	0–7	Priority Code Point used for Layer 2 Class of Service marking.
DEI	1 bit	0 or 1	Drop Eligible Indicator; identifies traffic that may be dropped during congestion.
VID	12 bits	1–4094 for conventional VLANs	VLAN Identifier used to identify the frame's VLAN.

The 12-bit VID field can represent 4096 values. VID 0 is reserved for priority information without ordinary VLAN membership, and VID 4095 is reserved. The conventional usable VLAN ID range is therefore 1 through 4094. VLAN 1 is valid, but it is the default VLAN on many Cisco devices and is commonly avoided for user traffic and native-VLAN use in hardened designs.

How Switches Process Tagged Frames

The ingress interface receives a frame and classifies it. An access port normally classifies an untagged frame into its configured access VLAN. A trunk uses the received 802.1Q VID for tagged traffic.
The switch checks whether the VLAN exists and is active on the relevant switching system and whether the outgoing trunk permits that VLAN.
The switch makes normal Layer 2 forwarding decisions using the destination MAC address and VLAN context.
The egress port determines the wire format. A nonnative VLAN crossing a trunk normally remains tagged. Delivery through an ordinary access port normally removes the tag.

Access Ports and Trunk Ports

Port Type	Inbound Untagged Frame Handling	Outbound Frame Handling	Typical Use
Access port	Classified into the configured access VLAN.	Sent untagged to an ordinary endpoint.	PC, printer, camera, or other single-VLAN endpoint.
802.1Q trunk for nonnative VLAN	Tagged frames are classified by VID; untagged frames are classified into the native VLAN.	Required VLAN traffic is sent with an 802.1Q tag.	Switch-to-switch, switch-to-router, or switch-to-firewall link.
802.1Q trunk for native VLAN	Untagged frames are classified into the configured native VLAN.	Native-VLAN frames are usually sent untagged.	Compatibility with devices or designs using untagged trunk traffic.
Voice-enabled access port	Untagged data traffic is classified into the access VLAN; tagged phone traffic can be classified into the voice VLAN.	Data is normally untagged and voice is commonly tagged for the phone.	IP phone with a workstation connected through the phone.

Some specialized endpoints, including IP phones, servers, hypervisors, and virtual switches, can send or receive tagged frames. This does not make every endpoint-facing interface a general-purpose trunk. The interface should be configured for the device's intended behavior.

Native VLAN and Untagged Trunk Traffic

The native VLAN is the VLAN associated with untagged traffic on an 802.1Q trunk. In the usual Cisco behavior, frames belonging to the native VLAN cross the trunk without an 802.1Q tag. The receiving trunk interface assigns an untagged received frame to its locally configured native VLAN.

Both ends of a trunk must use the same native VLAN. For example, if Switch A treats untagged traffic as VLAN 99 but Switch B treats it as VLAN 1, an untagged frame can enter one VLAN on one side and a different VLAN on the other side. Cisco devices can report a native-VLAN mismatch warning, and connectivity may be unexpected.

A common operational and security practice is to use an unused, nondefault VLAN as the native VLAN, such as VLAN 99, and to avoid placing end-user devices on it. This reduces accidental participation in untagged trunk traffic and makes configuration mistakes easier to identify. It is not a substitute for correct trunk and access-port security.

Cisco platforms that support it can be configured to tag native-VLAN traffic with:

vlan dot1q tag native

This is optional behavior. Use it only where supported, and configure compatible behavior on every device connected by the trunk. A mismatch between native tagging expectations can itself cause interoperability problems.

Trunk Operation and Allowed VLANs

A trunk can be formed through negotiation, such as Cisco Dynamic Trunking Protocol concepts, or by statically configuring both interfaces as trunks. Static configuration is generally more predictable and avoids relying on negotiation with devices that do not support it. See how to configure trunk ports for a configuration-focused lesson.

An allowed VLAN list limits which VLANs a trunk can carry. For example, a trunk allowing VLANs 10, 20, and 99 will not forward VLAN 30 over that link. Restricting the list reduces unnecessary broadcast traffic and limits the VLANs exposed to a link.

For a VLAN to cross a trunk successfully, the VLAN normally must:

Exist and be active on the relevant switch.
Be included in the trunk's allowed VLAN list.
Be permitted by any intermediate trunk or pruning mechanism.
Have appropriate port membership on the source and destination switches.

If a VLAN is not allowed, it is pruned, or it is absent or inactive on a trunk endpoint, frames for that VLAN cannot cross that part of the path. Devices in the same VLAN may communicate locally while failing to communicate with devices in that VLAN on another switch.

Practical Example: Two Switches and Two VLANs

Switch A has users in VLAN 10 and servers in VLAN 20. Switch B has corresponding users in VLAN 10 and servers in VLAN 20. The link between the switches is a trunk.

A VLAN 10 host sends an untagged frame to its access port.
Switch A classifies the frame into VLAN 10.
When the frame leaves on the trunk, Switch A adds an 802.1Q tag with VID 10, assuming VLAN 10 is not native.
Switch B reads VID 10 and keeps the frame in VLAN 10 while forwarding it toward the destination access port.
Switch B removes the tag before sending the frame to an ordinary endpoint-facing access port.

VLAN 20 follows the same process with VID 20. The tags allow both VLANs to share the physical trunk without merging their broadcast domains.

Voice VLAN Behavior

A voice VLAN is commonly used on a switch port connected to an IP phone. The workstation connected through the phone sends untagged data traffic for the access VLAN, such as VLAN 10. The phone sends voice traffic tagged for the voice VLAN, such as VLAN 20.

interface gigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20

The port is still configured as an access-mode endpoint port, but the switch is explicitly prepared to handle the phone's controlled tagged voice traffic. The access VLAN and voice VLAN are separate concepts: the access VLAN serves ordinary data, while the voice VLAN serves the phone's voice traffic.

Frame Tagging Does Not Route Between VLANs

Tags preserve separation; they do not allow a host in VLAN 10 to communicate directly with a host in VLAN 20. Communication between different VLANs requires a Layer 3 gateway and routing policy.

Router-on-a-Stick

Router-on-a-stick uses multiple router subinterfaces over one switch trunk. Each subinterface is associated with a VLAN ID, and hosts use the appropriate subinterface address as their default gateway.

interface gigabitEthernet0/0
 no shutdown
interface gigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.0.2.1 255.255.255.0
interface gigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 198.51.100.1 255.255.255.0

The switch-to-router link must be a trunk that permits VLANs 10 and 20. The router receives tagged frames, maps them to the matching subinterfaces, and performs Layer 3 forwarding. See configure router-on-a-stick for a dedicated walkthrough.

Multilayer Switch SVIs

A multilayer switch can route between VLANs using Switched Virtual Interfaces, or SVIs. An SVI provides a Layer 3 interface and default gateway for a VLAN. In this design, the switch performs the inter-VLAN routing rather than sending every routed frame to an external router.

802.1Q Compared with ISL

Characteristic	802.1Q	ISL
Standardization	IEEE standard.	Legacy Cisco-proprietary protocol.
Tagging method	Inserts a four-byte tag inside the original Ethernet frame.	Encapsulates the original frame with an ISL header and trailer.
Native VLAN behavior	Normally sends native-VLAN frames untagged.	Does not use the same 802.1Q native-VLAN untagged mechanism because ISL encapsulates frames.
Modern relevance	Current standard expected in modern CCNA study and deployments.	Legacy and generally encountered only in older environments.
Interoperability	Supported across equipment from different vendors that implements 802.1Q.	Limited by its proprietary design and device support.

Frame Size and Interoperability

An 802.1Q tag adds four bytes to the Ethernet frame. A device on a tagged link must support the resulting tagged-frame size. Some equipment describes this as support for a larger-than-standard or “baby giant” frame.

The tagged packet is still an Ethernet frame. The source and destination MAC addresses remain present, and normal MAC learning and forwarding continue to operate within the VLAN identified by the tag.

Cisco IOS Configuration Examples

Create VLANs and Configure an Access Port

vlan 10
 name USERS
vlan 20
 name SERVERS
interface gigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10

Configure a Restricted Trunk and Nondefault Native VLAN

vlan 99
 name NATIVE_UNUSED
interface gigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,99

The native VLAN is included in the allowed list in this example because the trunk is explicitly configured to use it. Whether it needs to carry any user traffic is a separate design decision; in this design it is intended to remain unused.

Verification Commands

show vlan brief displays VLAN existence, status, and access-port membership.
show interfaces trunk displays trunk state, native VLAN, allowed VLANs, and VLANs currently active or forwarding on the trunk.
show interfaces gigabitEthernet1/0/24 switchport displays administrative and operational mode, access VLAN, native VLAN, and trunk details for one interface.
show running-config interface gigabitEthernet1/0/24 displays the configured interface commands.

Systematic Troubleshooting

Use a hop-by-hop process instead of beginning with packet captures. First verify the local classification, then verify the Layer 2 path, and finally verify Layer 3 routing when required.

Verify the endpoint port VLAN. Confirm the device is connected to the intended interface and that an access port has the correct access VLAN.
Verify VLAN existence and status. Use show vlan brief on each relevant switch.
Verify trunk state. Confirm that the inter-switch or switch-to-router link is operationally trunking.
Verify allowed VLANs. Confirm every required VLAN is allowed on every trunk in the path.
Verify native VLAN consistency. Compare both trunk ends. Untagged traffic must map to the same native VLAN, or compatible native tagging must be configured.
Verify Layer 3 configuration. For cross-VLAN traffic, check SVIs or router subinterfaces, IP addresses, routing, and host default gateways.

Symptom	Likely Cause	Verification Focus	Correction
VLAN cannot communicate across switches	Link is not a trunk; VLAN is missing, inactive, or not allowed; port membership is wrong.	`show vlan brief`, `show interfaces trunk`, and switchport settings on both ends.	Create or activate the VLAN, configure the link as a trunk, allow the VLAN, and correct port membership.
Native VLAN mismatch warning	Trunk ends use different native VLAN IDs.	Compare trunk output and interface configurations at both endpoints.	Use the same unused native VLAN at both ends or consistently use supported native-VLAN tagging.
A host enters the wrong VLAN	Wrong access VLAN, accidental trunk connection, or untagged traffic mapped to a trunk's native VLAN.	Inspect `show interfaces switchport`, port mode, access VLAN, and native VLAN.	Set the intended port mode and VLAN; do not use a user-facing port as a trunk unless required.
Only some VLANs cross a trunk	Allowed VLAN list or pruning excludes the missing VLAN, or the VLAN is absent at an endpoint.	Check allowed and active VLAN lists on every trunk.	Permit the VLAN consistently and create or activate it where needed.
Inter-VLAN routing does not work	Trunk failure, missing allowed VLAN, mismatched router subinterface encapsulation, or wrong host gateway.	Check trunk output, `encapsulation dot1Q` values, gateway addresses, and host addressing.	Align VLAN IDs, trunk permissions, subinterfaces or SVIs, and default gateways.

Exam-Relevant Notes

Access ports normally send and receive ordinary endpoint frames without VLAN tags.
Trunks normally tag nonnative VLAN frames so the receiving switch can identify their VLAN.
Native-VLAN traffic is normally untagged on an 802.1Q trunk unless native tagging is explicitly enabled and consistently configured.
Both trunk ends must agree on the native VLAN.
The 802.1Q tag is four bytes: 16-bit TPID plus 16-bit TCI.
Within the TCI, PCP is 3 bits, DEI is 1 bit, and VID is 12 bits.
802.1Q inserts a tag inside the Ethernet frame; ISL encapsulates the original frame and is legacy Cisco technology.
Tags separate VLANs but do not perform inter-VLAN routing. Routing requires an SVI, router subinterfaces, or another Layer 3 gateway.