CCNA online course

IEEE 802.1Q VLAN Tagging Overview

Learn how IEEE 802.1Q tags VLAN traffic across Ethernet trunks, including tag fields, native VLANs, VLAN ID limits, Cisco configuration, verification, and ISL comparison.

IEEE 802.1Q is the open IEEE Ethernet standard for identifying VLAN traffic on trunk links. It inserts VLAN information into Ethernet frames so switches can carry multiple logical networks over one physical connection.

A VLAN is a logical Layer 2 broadcast domain identified by a VLAN ID. A trunk is a link that transports traffic for more than one VLAN. This lesson covers how 802.1Q preserves VLAN membership, how native VLANs handle untagged traffic, and how 802.1Q compares with Cisco ISL.

Why IEEE 802.1Q tagging is needed

An access port normally connects an endpoint to one VLAN. Frames sent toward an ordinary host are usually untagged, so the host does not need to understand VLAN tagging.

A trunk port connects network devices such as switches and can carry several VLANs at the same time. Without an identifier in each frame, the receiving switch could not determine whether a frame belonged to VLAN 10, VLAN 20, or another VLAN. 802.1Q supplies that identifier.

For example, a single uplink between two switches might carry VLANs 10, 20, and 30. A frame from VLAN 20 crosses the trunk with VLAN ID 20 in its 802.1Q tag. The receiving switch uses that information when applying VLAN forwarding rules.

802.1Q is vendor-neutral. A Cisco switch and a switch from another vendor can use the same standard tagging method, making 802.1Q the normal choice for multivendor Ethernet trunks.

Access links and trunk links

When a tagged frame leaves a trunk and is delivered through an access port, the switch generally removes the VLAN tag before sending the frame to an ordinary host. The endpoint receives a normal Ethernet frame.

Where the 802.1Q tag appears

An 802.1Q tag is 4 bytes long and is inserted into the Ethernet frame header area between the source MAC address and the original EtherType or length field. It does not wrap the entire original frame with a new outer header and trailer.

The resulting order is:

Destination MAC | Source MAC | 802.1Q tag | EtherType/length | Payload | FCS

A standard Ethernet frame without a tag has a maximum size of 1518 bytes, including the FCS. Adding the 4-byte 802.1Q tag increases the maximum frame size to 1522 bytes.

802.1Q tag fields

The 4-byte tag consists of a 2-byte Tag Protocol Identifier and a 2-byte Tag Control Information field.

TPID

The Tag Protocol Identifier (TPID) normally contains hexadecimal 0x8100. This value tells the receiving device that the frame contains an IEEE 802.1Q tag.

TCI

The Tag Control Information (TCI) field contains three parts: the 3-bit Priority Code Point (PCP), the 1-bit Drop Eligible Indicator (DEI), and the 12-bit VLAN Identifier (VID).

• PCP: Provides eight Layer 2 priority values, from 0 through 7. Networking equipment can use these values when implementing quality-of-service policies.
• DEI: Indicates that a frame may be discarded during congestion. Older documentation may use the name Canonical Format Indicator, or CFI, for this bit.
• VID: Identifies the VLAN to which the tagged frame belongs.

VLAN ID range and capacity

The VID has 12 bits, so it can represent 2^12 = 4096 possible values. However, not all values are ordinary assignable VLANs.

For example, VLAN 200 is valid. VLAN 0 is reserved for priority tagging and is not an ordinary user VLAN, while VLAN 4095 is reserved.

Native VLAN behavior

The native VLAN is the VLAN whose frames are normally transmitted untagged on an 802.1Q trunk. On a receiving trunk interface, an untagged incoming frame is classified into that interface's configured native VLAN.

VLAN 1 is the commonly used default native VLAN on Cisco switch trunks. A network can use another VLAN, such as VLAN 99, as the native VLAN when that matches the design and platform configuration.

Suppose two trunk ports use VLAN 99 as their native VLAN. Untagged frames arriving on either trunk are classified into VLAN 99. Frames belonging to VLANs 10 and 20 remain tagged while crossing the trunk.

Native VLAN consistency

Both ends of a trunk must use the same native VLAN. If one endpoint uses native VLAN 99 and the other uses native VLAN 1, an untagged frame sent by the first side as native VLAN traffic can be classified into VLAN 1 by the second side. This can place traffic into the wrong broadcast domain and can produce switch warning messages.

A native VLAN mismatch can also result from inconsistent treatment of native traffic, such as tagging native VLAN frames on one side but not the other. Some platforms support tagging the native VLAN as an optional configuration, but both endpoints and the overall design must support the same behavior.

Where policy permits, a common security and operational practice is to select an unused, non-default VLAN as the native VLAN and avoid carrying user traffic on it. This reduces accidental dependence on VLAN 1, but it does not replace correct trunk configuration and monitoring.

Tagged and untagged traffic example

Consider a trunk carrying VLANs 10, 20, and 99, with VLAN 99 configured as native:

• VLAN 10 frames cross the trunk with an 802.1Q tag containing VID 10.
• VLAN 20 frames cross the trunk with an 802.1Q tag containing VID 20.
• Native VLAN 99 frames normally cross the trunk without an 802.1Q tag.
• An untagged frame arriving at the receiving trunk is assigned to that trunk's native VLAN.
• When traffic exits through an access port, the switch generally removes the tag before sending the frame to the endpoint.

802.1Q versus Cisco ISL

ISL, or Inter-Switch Link, is a historical Cisco-proprietary trunk encapsulation method. ISL encapsulates the entire original Ethernet frame, whereas 802.1Q inserts a 4-byte tag into the existing Ethernet frame header area.

802.1Q is preferred because it is standardized, widely supported, and suitable for links between different vendors' equipment. ISL may appear in older study material or legacy configurations, but it is not the normal choice for new deployments.

Cisco IOS trunk configuration

Create the VLANs

The VLANs carried by a trunk should exist on the involved switches and be active as appropriate for the platform and design.

configure terminal
vlan 10
 name USERS
vlan 20
 name VOICE
vlan 99
 name NATIVE
end

VLAN 99 is only an example native VLAN. Choose VLAN IDs according to the network design.

Configure a static 802.1Q trunk

configure terminal
interface gigabitEthernet1/0/1
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,99
 no shutdown
end

Configure compatible trunk mode, native VLAN, allowed VLANs, and native-tagging behavior on the remote endpoint. Some switch models do not provide a selectable trunk-encapsulation command because they use 802.1Q only.

Verify trunk and VLAN operation

Use these Cisco IOS commands to inspect the trunk and the VLAN database:

show interfaces trunk
show interfaces gigabitEthernet1/0/1 switchport
show vlan brief
show running-config interface gigabitEthernet1/0/1

• show interfaces trunk displays trunk status, native VLAN information, and allowed or active VLANs.
• show interfaces ... switchport displays the administrative and operational switchport modes, native VLAN, and allowed VLAN configuration.
• show vlan brief confirms VLAN existence and displays access-port membership.
• show running-config interface ... confirms the commands applied to the interface.

For a VLAN to cross a trunk successfully, verify that the inter-switch interfaces are operational, the VLAN is permitted by the allowed list on both ends, and the VLAN exists and is active on both switches as required.

Troubleshooting 802.1Q trunks

A VLAN cannot communicate across a trunk

• Confirm that both inter-switch interfaces are operational and configured as trunks.
• Verify that the VLAN is included in the allowed VLAN list on both ends.
• Verify that the VLAN exists and is active on both switches.
• Check that endpoints and access ports are assigned to the intended VLAN.

Common causes include an omitted VLAN, one side operating as an access port instead of a trunk, or a VLAN that was never created or is inactive.

A native VLAN mismatch warning appears

• Compare native VLAN values in trunk verification output at both endpoints.
• Check whether one side intentionally tags native VLAN traffic while the other side expects it to be untagged.
• Configure the same native VLAN and compatible native-tagging behavior on both ends.

A multivendor uplink fails

• Confirm that both devices use IEEE 802.1Q rather than a proprietary or unsupported trunking mode.
• Compare VLAN IDs, native VLAN settings, allowed VLAN lists, and trunk operational status.

Encapsulation incompatibility and mismatched trunk parameters are common causes when a link works between same-vendor switches but fails across vendors.

Frames unexpectedly enter VLAN 1

• Determine whether the frames are arriving untagged.
• Inspect the receiving trunk's configured native VLAN.
• Confirm that the transmitting device is tagging the expected VLAN.

Likely causes include the default native VLAN remaining VLAN 1, a missing tag from the transmitting side, or a native VLAN mismatch.

Exam-relevant summary

• 802.1Q is an open IEEE standard for VLAN tagging on Ethernet trunks.
• An access port normally carries one VLAN and sends untagged frames to endpoints.
• A trunk carries multiple VLANs and normally tags non-native VLAN traffic.
• The 802.1Q tag is 4 bytes and appears between the source MAC address and EtherType or length field.
• The TPID is normally 0x8100.
• The TCI contains PCP, DEI, and the 12-bit VID.
• A 12-bit VID provides 4096 values, with VLANs 1 through 4094 usable for normal VLAN membership.
• VLAN 0 is reserved for priority tagging, and VLAN 4095 is reserved.
• The native VLAN normally crosses an 802.1Q trunk untagged and must match at both ends.
• VLAN 1 is the common Cisco default native VLAN, but an unused non-default VLAN is often preferred where policy permits.
• ISL is a legacy Cisco-proprietary encapsulation method; 802.1Q is the modern interoperable standard.

For a concise reference, see the IEEE 802.1Q overview.