VMware ESXi and vSphere Cluster Management

VLAN Frame Tagging Explained: 802.1Q, Access Ports, and Trunk Links

Learn how VLAN frame tagging works, including access ports, 802.1Q trunks, native VLANs, VLAN isolation, ISL, and troubleshooting.

VLAN frame tagging allows multiple logical Layer 2 networks to share the same physical switching infrastructure. The key idea is simple: when a frame crosses a link that carries more than one VLAN, the receiving device needs information that identifies the frame's VLAN.

This lesson explains how access ports and trunk ports handle frames, how IEEE 802.1Q inserts a VLAN tag, how switches preserve VLAN membership across trunk hops, and why traffic in separate VLANs remains isolated.

What a VLAN and a VLAN Tag Accomplish

A VLAN, or virtual local area network, is a logical Layer 2 network segment. It creates a separate broadcast domain: a scope within which Layer 2 broadcast frames are flooded.

For example, VLAN 5 and VLAN 10 can exist on the same physical switches. A broadcast generated by a host in VLAN 5 should reach other VLAN 5 ports, but it should not reach VLAN 10 ports.

A switch can associate a frame with a VLAN when the frame enters through an access port. The problem becomes more complex when two switches are connected by one link that carries VLAN 5, VLAN 10, and possibly many other VLANs. The link itself does not have a separate cable for each VLAN. The receiving switch therefore needs a VLAN identifier associated with each frame.

Frame tagging means carrying VLAN identification with an Ethernet frame so that VLAN membership is preserved over a shared link. The receiving switch reads that identification before making its forwarding decision.

Access Ports and VLAN Association

An access port is a switch interface normally assigned to one data VLAN and used for an end device such as a workstation, printer, camera, or server interface.

Typical end hosts send and receive ordinary Ethernet frames without 802.1Q tags. When an untagged frame arrives on an access port, the ingress switch associates it with the VLAN configured on that port. If the port belongs to VLAN 5, the switch treats the incoming frame as VLAN 5 traffic.

This internal association is not the same thing as adding a tag to the frame on the wire. An access port can identify a frame as belonging to VLAN 5 internally while still receiving an ordinary untagged Ethernet frame from the host.

When the switch sends traffic toward a typical end host through an access port, it normally transmits the frame without a VLAN tag. The host usually does not need to know the switch's VLAN number.

Trunk Ports

A trunk port is a link that transports traffic for multiple VLANs between network devices. Trunks commonly connect:

  • One switch to another switch
  • A switch to a router using router subinterfaces
  • A switch to a firewall
  • A switch to a hypervisor or virtual switch

Because several VLANs share one physical trunk, the devices normally use VLAN tags to identify the VLAN associated with each frame. A trunk is not automatically a connection between all VLANs. It is a Layer 2 transport link, and its configuration determines which VLANs are allowed to cross it.

An allowed VLAN list limits the VLANs that a trunk carries. A VLAN must be permitted on every relevant trunk between its source and destination. If VLAN 5 is allowed on the first trunk but omitted from the next trunk, VLAN 5 traffic cannot cross the complete path.

Access Port and Trunk Port Comparison

Characteristic | Access Port | Trunk Port

Typical connected device | End host or other device using one VLAN | Switch, router, firewall, or hypervisor

Number of carried VLANs | Normally one data VLAN | Multiple VLANs

Frame tagging behavior | Frames to and from ordinary hosts are normally untagged | VLANs are normally identified with 802.1Q tags

Typical traffic sent to an end host | Untagged Ethernet frames | Usually not connected directly to a conventional end host

Common use cases | Workstations, printers, access points, cameras | Switch uplinks and network-device links

IEEE 802.1Q Tagging

IEEE 802.1Q is the standard method for identifying VLANs on Ethernet links. It inserts a 4-byte tag into the Ethernet frame.

The tag is inserted immediately after the source MAC address and before the original EtherType or length field.

Ordinary Ethernet frame:
Destination MAC | Source MAC | EtherType/Length | Payload | FCS
802.1Q-tagged Ethernet frame:
Destination MAC | Source MAC | TPID + TCI | EtherType/Length | Payload | FCS

The 4-byte tag consists of a 2-byte Tag Protocol Identifier and a 2-byte Tag Control Information field.

  • TPID: Tag Protocol Identifier. It indicates that the frame contains a VLAN tag. The commonly used value identifies an IEEE 802.1Q-tagged frame.
  • TCI: Tag Control Information. It contains priority, drop eligibility, and VLAN identification information.
  • PCP: Priority Code Point. This is a 3-bit field used for Layer 2 priority marking.
  • DEI: Drop Eligible Indicator. This bit can mark a frame as eligible for discard during congestion.
  • VLAN ID: The 12-bit VLAN Identifier field that identifies the VLAN.

802.1Q Tag Fields

Field | Size | Purpose

TPID | 16 bits | Indicates the presence and type of the VLAN tag

PCP | 3 bits | Provides Layer 2 priority marking

DEI | 1 bit | Indicates drop eligibility during congestion

VLAN ID | 12 bits | Identifies the VLAN associated with the frame

Adding a 4-byte tag changes the frame size. A conventional untagged Ethernet frame has a maximum frame size commonly described as 1518 bytes including the Ethernet header and FCS; an 802.1Q-tagged frame can be 1522 bytes. Switches, network cards, firewalls, routers, hypervisors, and other devices on the path must support the resulting tagged-frame size.

VLAN ID Limits

The VLAN ID field is 12 bits wide, allowing values from 0 through 4095. In standard practice, VLAN IDs 1 through 4094 are usable. VLAN ID 0 is reserved for priority information without a normal VLAN assignment, and VLAN ID 4095 is reserved.

A VLAN number is a Layer 2 identifier. It is not the same as an IP subnet. Network designs often map one IP subnet to one VLAN, such as VLAN 5 with 192.0.2.0/24, but the VLAN and subnet are different concepts. The VLAN describes Layer 2 membership; the subnet describes Layer 3 addressing.

How a Frame Crosses Switches

Consider two switches connected by an 802.1Q trunk. Host C is connected to an access port in VLAN 5 on the first switch. A host on the second switch is also connected to an access port in VLAN 5. Other hosts, such as Hosts A and B, are connected to VLAN 10 ports.

  1. Host C sends an ordinary untagged Ethernet frame.
  2. The first switch receives the frame on an access port configured for VLAN 5 and internally associates the frame with VLAN 5.
  3. The switch performs VLAN-specific MAC learning and forwarding.
  4. When the frame must cross the inter-switch trunk, the first switch adds VLAN 5 identification using an 802.1Q tag, unless the traffic is handled as native-VLAN traffic.
  5. The second switch receives the frame and reads the VLAN information before making its forwarding decision.
  6. The second switch floods or forwards the frame only within VLAN 5.
  7. When the frame leaves through the destination's VLAN 5 access port, the switch normally removes the tag and transmits an ordinary untagged Ethernet frame.

Frame Journey by Link Type

Stage | Port or Link Type | VLAN Handling | Frame Seen on the Wire

Host to switch ingress | Access port | Untagged frame is associated with the port's configured VLAN | Usually untagged

Switch internal forwarding decision | Internal switching process | MAC lookup and forwarding occur within VLAN context | Internal representation is platform-dependent

Switch-to-switch connection | 802.1Q trunk | VLAN ID is carried with the frame, except for configured native-VLAN behavior | Normally tagged

Switch to destination host | Access port | VLAN association is removed from the host-facing transmission | Usually untagged

VLAN membership must be maintained across every trunk hop. If a frame crosses three switches, each trunk must carry the VLAN and each receiving switch must interpret the VLAN identification consistently.

Native VLAN and Untagged Trunk Traffic

In conventional 802.1Q trunk operation, one VLAN may be designated as the native VLAN. Native-VLAN traffic is commonly transmitted untagged by default, although exact behavior depends on the platform and configuration.

At the receiving end, an untagged frame on the trunk is associated with that end's configured native VLAN. The native VLAN setting must match at both ends of the trunk.

For example, suppose one end uses VLAN 99 as its native VLAN and the other uses VLAN 1. An untagged frame sent by the first device as native-VLAN traffic can be interpreted as VLAN 1 by the second device. The frame has therefore been placed into different VLAN contexts at opposite ends.

Native-VLAN mismatches can cause connectivity failures, unexpected broadcasts, and difficult-to-diagnose traffic leakage. They can also create security risks when devices disagree about whether traffic is tagged or untagged. Administrators commonly use an unused VLAN as the native VLAN where appropriate, avoid placing user traffic in it, and configure the same native VLAN on both trunk endpoints. This practice does not replace careful trunk hardening and verification.

VLAN Isolation and Forwarding Behavior

Switch MAC address learning and forwarding decisions are VLAN-specific. A forwarding database logically relates a destination MAC address to both a switch port and a VLAN context.

For example, the same MAC address value could appear in VLAN 20 and VLAN 30. A frame in VLAN 20 must use the VLAN 20 MAC entry, not the entry learned in VLAN 30. The VLAN context prevents one VLAN's forwarding information from being used for another VLAN.

When the destination is unknown, a switch floods an unknown unicast frame only within the originating VLAN. Broadcast traffic is also flooded only within that VLAN. Applicable multicast traffic is handled within the VLAN according to the switch's multicast behavior and configuration.

Therefore, hosts in separate VLANs do not receive one another's Layer 2 broadcasts merely because they are attached to the same physical switches. The VLAN boundary separates their broadcast domains.

Communication between VLANs requires inter-VLAN routing, which is Layer 3 forwarding between distinct VLANs. Common implementations include:

  • A multilayer switch using switched virtual interfaces, or SVIs
  • A router using subinterfaces over a trunk, often called router-on-a-stick
  • A firewall with VLAN interfaces and routing policies

A trunk transports VLAN traffic; it does not by itself route traffic between VLANs. A host in VLAN 5 that needs to reach a host in VLAN 10 sends traffic to its Layer 3 gateway, which then makes a routing decision.

Practical Example: Two VLANs Across Two Switches

Assume the following topology:

  • Host C is on an access port in VLAN 5 on Switch 1.
  • Switch 1 and Switch 2 are connected by an 802.1Q trunk.
  • Another host is on an access port in VLAN 5 on Switch 2.
  • Hosts A and B are on access ports in VLAN 10.

When Host C sends a broadcast, Switch 1 associates the untagged ingress frame with VLAN 5. Switch 1 forwards the VLAN 5 broadcast across the trunk with VLAN 5 identification. Switch 2 reads that identification and floods the broadcast only to its VLAN 5 ports. Hosts A and B in VLAN 10 do not receive it. The frame sent to the VLAN 5 end host on Switch 2 is untagged on the access port.

Practical Example: VLAN-Specific MAC Learning

Suppose a switch has learned a destination MAC address in VLAN 20. The same MAC address value later appears in VLAN 30. These are separate forwarding entries because the VLAN is part of the switching context.

A frame arriving in VLAN 20 is forwarded according to the VLAN 20 entry. A frame arriving in VLAN 30 uses the VLAN 30 entry. The switch does not treat the MAC address as one global entry shared by every VLAN.

Practical Example: Native VLAN Mismatch

One trunk endpoint is configured with VLAN 99 as its native VLAN, while the other endpoint uses VLAN 1. Untagged frames sent by the first endpoint are associated with VLAN 99 locally but can be classified as VLAN 1 by the peer.

To troubleshoot this condition, compare the native VLAN configuration on both ends and review platform-specific behavior for native-VLAN tagging. Ensure that the expected VLAN is consistently configured and that both devices agree about tagged and untagged traffic.

ISL Versus IEEE 802.1Q

Inter-Switch Link, or ISL, is a Cisco-proprietary VLAN trunking protocol that was used historically. ISL encapsulates the original Ethernet frame by adding an external encapsulation rather than inserting a 4-byte 802.1Q field into the original frame.

IEEE 802.1Q is the interoperable IEEE standard. It inserts the VLAN tag between the source MAC address and the original EtherType or length field. Modern networks normally use 802.1Q for trunking, including links between equipment from different vendors.

ISL and IEEE 802.1Q Comparison

Characteristic | ISL | IEEE 802.1Q

Standards status | Cisco-proprietary legacy protocol | IEEE open standard

Vendor interoperability | Primarily associated with Cisco equipment | Broad multi-vendor interoperability

Tagging method | Encapsulates the original Ethernet frame | Inserts a 4-byte tag into the Ethernet frame

Current deployment relevance | Legacy recognition and exam context | Normal choice for current Ethernet trunks

Cisco IOS-Style Configuration Example

The following example creates VLANs, assigns two access ports, and configures an 802.1Q trunk. Exact interface names and supported commands vary by switch model and software release.

vlan 5
 name USERS_VLAN5
vlan 10
 name USERS_VLAN10
vlan 99
 name NATIVE_UNUSED
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 5
interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 10
interface GigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk allowed vlan 5,10,99
 switchport trunk native vlan 99

In this example, GigabitEthernet1/0/1 associates untagged host traffic with VLAN 5. GigabitEthernet1/0/2 associates untagged host traffic with VLAN 10. The trunk permits VLANs 5, 10, and 99, with VLAN 99 configured as the native VLAN.

Modern Cisco switch trunks use 802.1Q. ISL configuration should not be presented as a current deployment recommendation.

Verification Commands

Use operational commands to verify both the configuration and the switch's actual behavior:

show vlan brief
show interfaces trunk
show interfaces GigabitEthernet1/0/24 switchport
show mac address-table dynamic
show interfaces status
  • show vlan brief displays VLAN existence and access-port membership.
  • show interfaces trunk displays trunk state and VLANs allowed or active on the trunk.
  • show interfaces GigabitEthernet1/0/24 switchport displays switchport mode, access VLAN, trunk settings, and native VLAN information.
  • show mac address-table dynamic helps confirm MAC learning in the expected VLAN.
  • show interfaces status helps confirm link and port status.

Troubleshooting VLAN Tagging and Trunks

Same VLAN Cannot Communicate Across Switches

Symptom: Devices in the same VLAN on different switches cannot communicate.

Likely causes include:

  • The VLAN is missing from the trunk's allowed VLAN list.
  • The inter-switch link is not operating as a trunk.
  • The VLAN does not exist or is inactive on one switch.
  • An endpoint access port is assigned to the wrong VLAN.

Check VLAN existence and access-port assignments. Then check trunk operational mode, allowed VLANs, active VLANs, link status, and MAC learning for the expected VLAN.

Traffic Appears in the Wrong VLAN

Symptom: Connectivity involving untagged trunk traffic is intermittent or traffic appears in the wrong VLAN.

A native VLAN mismatch is a common cause. One device may classify untagged traffic as VLAN 99 while its peer classifies the same traffic as VLAN 1. Compare native VLAN settings on both ends and review whether either platform is configured to tag native-VLAN traffic.

Broadcast Reaches Unexpected Hosts

Symptom: A broadcast reaches hosts that should be isolated.

Possible causes include incorrect access VLAN assignments, incorrect VLAN mapping in a virtual switch, or confusion between Layer 2 broadcasts and Layer 3 traffic that has been routed or relayed.

Verify access VLAN assignments and virtual-switch port groups. Confirm that the observed packet is truly a Layer 2 broadcast and identify its VLAN context.

VLAN Works Locally but Not Across a Trunk

Symptom: Hosts in a VLAN communicate through the same switch but not across the trunk.

Check whether the trunk permits the VLAN, whether the far-side interface is configured as a trunk rather than an access port, and whether a connected hypervisor, firewall, router, or third-party switch expects tagged or untagged traffic. Confirm that both devices agree on the VLAN ID. Trunk counters and packet captures can provide additional evidence where available.

Key Points to Remember

  • A VLAN is a logical Layer 2 segment and broadcast domain.
  • An access port normally belongs to one VLAN and usually exchanges untagged frames with an end host.
  • The ingress switch can associate an untagged access-port frame with a VLAN without adding a tag to the host-facing frame.
  • A trunk carries multiple VLANs over one physical link, normally using 802.1Q identification.
  • The 802.1Q tag is 4 bytes and is inserted after the source MAC address.
  • The tag contains TPID and TCI information, including PCP, DEI, and the 12-bit VLAN ID.
  • VLAN IDs 1 through 4094 are usable in standard practice; 0 and 4095 are reserved.
  • Native-VLAN settings must match at both ends of a trunk.
  • MAC learning, unknown-unicast flooding, broadcast flooding, and forwarding decisions are VLAN-specific.
  • A trunk preserves VLAN separation but does not perform inter-VLAN routing.
  • Communication between VLANs requires a router, multilayer switch SVI, or another Layer 3 device.
  • 802.1Q is the current interoperable standard; ISL is a legacy Cisco-proprietary technology.

For a concise reference to this lesson, see frame tagging explained.