CCNA online course

VLAN Frame Tagging Explained: IEEE 802.1Q, Native VLANs, and Trunk Links

Learn how IEEE 802.1Q VLAN tagging works, including access ports, trunk links, native VLANs, allowed VLANs, frame fields, verification, and troubleshooting.

What VLAN Frame Tagging Solves

A VLAN is a logical Layer 2 network segment and broadcast domain identified by a VLAN ID. Multiple VLANs can share the same physical switches and cabling while remaining logically separate.

On an access link, a frame normally belongs to one VLAN because the switchport is assigned to one access VLAN. A link between two VLAN-aware devices may need to carry traffic for many VLANs, however. Without a way to preserve VLAN identity, the receiving switch could not determine whether a frame belongs to Sales, Engineering, voice, management, or another VLAN.

Frame tagging adds VLAN-identification information to Ethernet traffic. The receiving device uses that information to associate the frame with the correct VLAN and apply the appropriate forwarding, broadcast-containment, and security policy.

For example, an inter-switch link can carry VLAN 10 and VLAN 20 over one cable. A VLAN 10 frame is marked with VLAN ID 10, while a VLAN 20 frame is marked with VLAN ID 20. The physical path is shared, but the Layer 2 broadcast domains remain separate.

Access Ports and Trunk Ports

An access port is a switch interface assigned to one access VLAN. It is commonly connected to a PC, printer, camera, or other endpoint. When an untagged frame enters an access port, the switch associates it with that port's configured access VLAN.

A trunk port is a VLAN-aware interface that transports traffic for multiple VLANs between devices such as switches, routers, firewalls, hypervisors, and multilayer switches.

Characteristic | Access port | 802.1Q trunk port Number of VLANs carried | Normally one access VLAN | Multiple permitted VLANs Inbound untagged frame | Classified into the access VLAN | Classified into the native VLAN Outbound tagging | Normally sent untagged | Normally tagged, except native-VLAN traffic by default Common devices | PCs, printers, cameras | Switches, routers, firewalls, multilayer switches Purpose | Connect an endpoint to one VLAN | Extend selected VLANs between VLAN-aware devices

On egress from a typical access port, the switch removes the internal VLAN information and sends an ordinary untagged Ethernet frame to the endpoint. On a trunk, the switch generally adds an 802.1Q tag before transmission. The tag can be removed again when the frame exits an access port in the matching VLAN.

IEEE 802.1Q Encapsulation

IEEE 802.1Q is the standards-based VLAN tagging method used in modern Ethernet networks. It inserts a 4-byte tag into an Ethernet frame between the source MAC address and the EtherType or length field.

The tag contains a 2-byte Tag Protocol Identifier (TPID), normally 0x8100, followed by a 2-byte Tag Control Information (TCI) field.

Adding the tag increases the Ethernet frame size by 4 bytes. The original payload and most other frame fields remain in place, but the position of the EtherType or length field moves four bytes later.

Frame component | Untagged frame position or value | 802.1Q-tagged frame position or value | Purpose Destination MAC | First | First | Identifies the receiving Layer 2 destination Source MAC | After destination MAC | After destination MAC | Identifies the sending interface 802.1Q tag | Not present | After source MAC; 4 bytes | Carries VLAN and priority information TPID / EtherType or length | EtherType or length follows source MAC | TPID 0x8100 follows source MAC; original EtherType or length follows TCI | Identifies the tag and original frame protocol Payload | After EtherType or length | After original EtherType or length | Carries upper-layer data Frame check sequence | Final field | Final field, recalculated after insertion | Detects transmission errors

Conceptual Frame Order

An ordinary Ethernet frame can be represented as:

Destination MAC | Source MAC | EtherType/Length | Payload | FCS

An 802.1Q-tagged frame can be represented as:

Destination MAC | Source MAC | TPID | TCI | EtherType/Length | Payload | FCS

802.1Q Tag Fields

The TCI is divided into three logical parts: PCP, DEI, and VLAN ID.

Field | Bit length | Typical values | Function TPID | 16 bits | 0x8100 | Indicates an IEEE 802.1Q tag PCP | 3 bits | 0–7 | Priority Code Point for Layer 2 quality of service DEI | 1 bit | 0 or 1 | Drop Eligible Indicator; marks traffic that may be discarded during congestion VLAN ID | 12 bits | 0–4095, with reserved values | Identifies the VLAN, not an endpoint or IP subnet

PCP, sometimes associated with 802.1p priority, allows Layer 2 devices to assign traffic-priority classes. Voice traffic may receive a higher priority than ordinary data, although PCP markings are useful only when network devices are configured to honor them.

The DEI bit indicates that a frame is eligible for dropping during congestion. It does not identify the VLAN and does not itself guarantee that a frame will be discarded.

The 12-bit VLAN ID identifies the VLAN to which the frame belongs. It does not identify a particular host, MAC address, IP address, or subnet. VLAN-to-subnet mappings are design choices made by the network administrator.

VLAN ID or range | Meaning | Usage note 0 | Priority tagging | Carries priority information without identifying a VLAN; not a normal VLAN assignment 1 | Valid VLAN identifier | Common default VLAN on many platforms; avoid using it for sensitive or native traffic where practical 2–1001 | Normal VLAN range on many Cisco platforms | Commonly used for user, voice, management, and server VLANs 1002–1005 | Legacy reserved VLANs | Historically associated with legacy technologies on Cisco platforms 1006–4094 | Extended VLAN range | Usable on platforms and configurations supporting extended VLANs 4095 | Reserved | Not assigned as a normal VLAN

Switches inspect, add, remove, and forward tags according to port mode and VLAN configuration. Tagging is therefore a behavior of the link and device configuration, not a permanent property that must remain on every copy of a frame.

How VLAN-Aware Switching Works

Switches maintain VLAN-aware MAC address tables. A learned source MAC address is associated with both an interface and a VLAN. The same MAC address could theoretically appear in different VLAN contexts, so the VLAN is part of the forwarding decision.

A frame is forwarded only within its VLAN unless a Layer 3 device performs inter-VLAN routing. Broadcasts, unknown unicasts, and relevant multicasts are contained within the VLAN. A trunk does not merge VLANs; it transports their traffic while preserving their identities.

  1. A host sends an untagged frame into an access port.
  2. The switch associates the frame with the port's access VLAN and learns the source MAC in that VLAN context.
  3. If the destination is reachable across a trunk, the switch adds an 802.1Q tag containing the VLAN ID.
  4. The receiving switch reads the tag and processes the frame within that VLAN.
  5. When the frame exits a matching access port, the switch removes the tag and sends the frame untagged.

Example: Two Switches and Two Department VLANs

Switch A and Switch B each have access ports in VLAN 10 for Sales and VLAN 20 for Engineering. Their inter-switch link is an 802.1Q trunk allowing VLANs 10 and 20.

A Sales frame entering Switch A is internally associated with VLAN 10, crosses the trunk with VLAN ID 10, and leaves a VLAN 10 access port on Switch B without a tag. Engineering traffic uses the same physical trunk but carries VLAN ID 20 and remains logically separate.

Native VLANs and Untagged Trunk Traffic

The native VLAN is the VLAN associated with untagged traffic on an 802.1Q trunk. By default in many switch environments, frames belonging to the native VLAN are sent untagged across the trunk.

When a trunk receives an untagged frame, it classifies that frame into its configured native VLAN. Tagged frames are classified according to the VLAN ID in their tags.

Both ends of a trunk must agree on the native VLAN. If one end uses VLAN 999 and the other uses VLAN 1, an untagged frame is placed into VLAN 999 on one side and VLAN 1 on the other. This can cause traffic to leak into an unintended VLAN, connectivity failures, confusing broadcast behavior, and switch warnings.

A common security design is to use an unused, dedicated native VLAN such as VLAN 999 rather than a user VLAN. Where the platform and design support it, tagging native-VLAN traffic can remove ambiguity about untagged frames. The native VLAN configuration must still be consistent at both ends.

Native VLAN Example

Suppose both switches configure VLAN 999 as the native VLAN. Tagged VLANs 10, 20, and 30 cross normally, while an untagged frame received on either trunk is classified into VLAN 999. If only Switch A uses VLAN 999 and Switch B uses VLAN 1, the same untagged frame receives different VLAN classifications at the two ends.

Allowed VLANs and VLAN Pruning

A trunk can be configured with an allowed VLAN list, which is the set of VLANs permitted to cross that particular link. VLAN pruning is the practice of preventing VLANs from traversing trunks where they are unnecessary.

Limiting a trunk to required VLANs reduces unnecessary broadcast and unknown-unicast traffic, limits the extension of Layer 2 domains, and reduces the effect of configuration mistakes. If VLAN 30 is not allowed on a trunk, frames for VLAN 30 cannot cross that link even if VLAN 30 exists on both switches.

Successful traversal depends on several conditions: the VLAN must exist, be active, be carried by an operational trunk, and be included in the allowed VLAN configuration. A VLAN may exist in the database yet still be absent from the trunk's active or forwarding list.

Legacy Encapsulation: ISL

Inter-Switch Link (ISL) is a legacy Cisco-proprietary trunk encapsulation method. ISL encapsulates the entire original Ethernet frame with additional header and trailer information.

802.1Q instead inserts a 4-byte tag inside the Ethernet frame between the source MAC address and the original EtherType or length field. IEEE 802.1Q is interoperable across vendors and is the modern CCNA-focused standard. Cisco platforms commonly use 802.1Q trunks without requiring selection of an alternate encapsulation because 802.1Q is the only available option on many models.

Tagging in Common Network Designs

Switch-to-Switch Trunks

A switch-to-switch trunk may carry user, voice, management, and server VLANs over one physical link. The allowed VLAN list should include only the VLANs needed on both sides.

Router-on-a-Stick

Router-on-a-stick uses one physical router interface divided into tagged subinterfaces. Each subinterface represents one VLAN and provides that VLAN's default gateway. The router removes the incoming tag, routes between IP networks, and sends return traffic with the destination VLAN tag.

configure terminal
interface gigabitEthernet0/0
 no shutdown
interface gigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.0.2.1 255.255.255.0
interface gigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.0.2.129 255.255.255.0
end

For a native VLAN subinterface when required by the design, Cisco IOS uses the native keyword:

interface gigabitEthernet0/0.999
 encapsulation dot1Q 999 native
 ip address 192.0.2.253 255.255.255.0

Multilayer Switching

A multilayer switch can use switched virtual interfaces, or SVIs, to provide Layer 3 gateways for VLANs. Trunks still carry VLAN-tagged traffic between switches, while the multilayer switch routes between VLAN interfaces.

Voice and Data on One Port

In a common IP phone deployment, a PC connects through the phone to one physical switchport. The PC's traffic is associated with the access, or data, VLAN and is normally untagged. The phone's voice traffic is marked for the configured voice VLAN. The switch can therefore separate data and voice into different VLANs on the same physical port.

Cisco IOS Configuration Examples

Create Example VLANs

configure terminal
vlan 10
 name SALES
vlan 20
 name ENGINEERING
vlan 999
 name NATIVE-UNUSED
end

Configure an Endpoint-Facing Access Port

configure terminal
interface gigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 10
end

Configure an 802.1Q Trunk

configure terminal
interface gigabitEthernet1/0/48
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30,999
end

Apply compatible trunk settings at both ends. Some Cisco platforms do not require or support a separate trunk-encapsulation selection because 802.1Q is the only available encapsulation.

Verification and Packet Observation

Use Cisco IOS show commands to verify VLAN existence, access-port assignments, trunk state, native VLAN, allowed VLANs, and MAC learning.

show vlan brief
show interfaces trunk
show interfaces gigabitEthernet1/0/48 switchport
show running-config interface gigabitEthernet1/0/48
show mac address-table vlan 10
show interfaces status

show vlan brief helps confirm that VLANs exist and shows access-port membership. show interfaces trunk shows trunk status, native VLAN information, allowed VLANs, and VLANs that are active or forwarding. show interfaces ... switchport displays administrative and operational modes. The MAC address table command confirms whether the switch is learning addresses in the expected VLAN.

A trunk can be operational while a required VLAN is missing from its active or forwarding lists. In that case, the physical link and trunk negotiation may look healthy, but traffic for that VLAN cannot cross the link.

A packet capture taken on a trunk-capable interface can reveal the 802.1Q tag, VLAN ID, and PCP value. Captures from endpoint-facing access ports normally do not show VLAN tags because the switch removes them before transmission to the endpoint.

Security and Design Guidance

  • Explicitly configure endpoint interfaces as access ports rather than relying on dynamic negotiation.
  • Explicitly configure required inter-device interfaces as trunks and verify both administrative and operational modes.
  • Limit each trunk to the VLANs that are genuinely required.
  • Use an unused, dedicated native VLAN and keep the native VLAN identical at both ends.
  • Where supported and appropriate, tag native VLAN traffic.
  • Disable unused ports and place them in an unused VLAN before shutdown.
  • Avoid leaving unused ports active or permitting dynamic trunk negotiation where it is not required.

Improper trunk configuration, unexpected negotiation, and native VLAN inconsistencies can contribute to VLAN-hopping exposure. VLAN tagging is not a substitute for port security, access control, device hardening, or Layer 3 policy.

configure terminal
interface range gigabitEthernet1/0/1-9
 switchport mode access
 switchport access vlan 999
 shutdown
end

Common Trunk Problems

Problem | Likely symptom | Verification focus | Correction Required VLAN not allowed | Same-VLAN hosts on different switches cannot communicate | Check show interfaces trunk and allowed VLAN lists | Permit the VLAN on both trunk ends VLAN missing or inactive | Trunk is up but VLAN is absent from forwarding list | Check show vlan brief and active VLAN lists | Create or activate the VLAN where required Native VLAN mismatch | Warning messages, unexpected connectivity, or incorrect untagged classification | Compare native VLAN values on both ends | Configure the same dedicated native VLAN Supposed trunk is an access link | Only one VLAN works; interface absent from trunk output | Check administrative and operational switchport modes | Explicitly configure compatible trunk mode Wrong endpoint VLAN | Incorrect network or DHCP scope | Check access VLAN and operational VLAN | Configure the port as access in the intended VLAN Router-on-a-stick error | Local VLAN works but inter-VLAN routing fails | Check trunk, subinterface encapsulation, IPs, and gateways | Correct VLAN tags, addresses, or default gateways

Troubleshooting Workflow

A VLAN Does Not Cross a Trunk

  1. Confirm that the VLAN exists and is active on both switches.
  2. Use show interfaces trunk to inspect allowed and forwarding VLANs.
  3. Confirm that the endpoint ports are assigned to the intended VLAN.
  4. Permit the VLAN on the trunk at each end if it is absent from the allowed list.
  5. Check MAC learning with show mac address-table vlan 10 or the relevant VLAN number.

Native VLAN Mismatch

  1. Inspect native VLAN values with show interfaces trunk and show interfaces gigabitEthernet1/0/48 switchport.
  2. Compare both ends of every trunk.
  3. Set the same dedicated native VLAN on both ends.
  4. Avoid assigning user endpoints to the native VLAN and use native-VLAN tagging if supported by the design.

The Trunk Is Operating as an Access Link

If only one VLAN works and show interfaces trunk does not list the interface, verify switchport mode, administrative mode, operational mode, cabling, and whether the connected device supports trunking. Explicitly configure both sides for trunk mode.

Router-on-a-Stick Cannot Route

Confirm that the switch-to-router link is a trunk, each router subinterface has the correct encapsulation dot1Q VLAN number, IP addresses are correct, the physical interface is enabled, and hosts use the matching subinterface as their default gateway.

Exam-Relevant Notes

  • 802.1Q inserts a 4-byte tag between the source MAC address and the original EtherType or length field.
  • TPID is commonly 0x8100.
  • TCI contains PCP, DEI, and the 12-bit VLAN ID.
  • VLAN ID 0 is used for priority tagging, and VLAN ID 4095 is reserved.
  • The commonly usable VLAN ID range is 1 through 4094.
  • Access-port endpoint traffic is normally untagged; trunk traffic is normally tagged.
  • Native-VLAN traffic is normally untagged by default on an 802.1Q trunk.
  • Both trunk ends must agree on the native VLAN.
  • Allowed VLAN lists determine which VLANs can cross a trunk.
  • Inter-VLAN communication requires Layer 3 routing, such as router-on-a-stick or an SVI.
  • ISL is a legacy Cisco-proprietary full-frame encapsulation method; modern networks use IEEE 802.1Q.

Related CCNA Topics

Review trunk port configuration and router-on-a-stick configuration for focused configuration practice. For broader Layer 2 and Layer 3 context, see the OSI reference model, computer networking fundamentals, and unicast, multicast, and broadcast addressing.