VLANs

Why it exists

A switch floods a frame it has no entry for out of every port. On one flat network that means every broadcast reaches every device, every device’s ARP traffic is everyone’s problem, and anything plugged into any port can talk to anything else. Growing such a network makes all three worse at once.

Buying a second switch for each group solves it and does not scale. VLANs solve it by making the broadcast domain a number the switch keeps against each port, so one physical network behaves as many independent ones. IEEE 802.1Q-2022 §6.9

The separation is real for flooding and for forwarding, and it is not a security boundary on its own. A misconfigured trunk, a negotiated port, or a native VLAN mismatch joins two VLANs without touching a cable.

One cable, two broadcast domains

Two VLANs share a single link between switches. The tag is added on the way out and stripped on the way in, so the hosts never see it.

How it works

An access port belongs to one VLAN. Frames arrive untagged, the port assigns the VLAN on ingress, and the frame is flooded or forwarded only among ports in that VLAN. The host is never aware of any of it. IEEE 802.1Q-2022 §6.9

A trunk carries several VLANs over one link, so each frame has to identify itself. The switch inserts four octets after the source address: two for the identifier 0x8100 and two carrying a three-bit priority, a drop-eligible bit and a twelve-bit VLAN identifier. IEEE 802.1Q-2022 §9.6

Twelve bits gives 4096 values, of which 0 and 4095 are reserved — 4094 usable VLANs. That ceiling is why data centres moved to VXLAN, which carries a 24-bit identifier and around sixteen million. IEEE 802.1Q-2022 §9.6

One VLAN per trunk is the exception: the native VLAN travels untagged. It exists so a trunk can interoperate with a device that does not understand tags at all, and it is the source of most of the trouble in this protocol. IEEE 802.1Q-2022 §9.5

Try it

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. Two VLANs behave as one across a particular trunk. Broadcasts cross, and hosts see neighbours they should not.

   Narrow it down

   1. Run `show interfaces trunk` on both ends and compare the native VLAN column.
   2. Check CDP or LLDP for a native VLAN mismatch notification.
   3. Confirm which VLAN untagged frames land in at each end.

   Cause

   The two ends disagree about the native VLAN. Each classifies untagged frames to its own, so traffic leaks between the two.

   Fix

   Match the native VLAN at both ends, and tag it so nothing crosses the trunk untagged.

   IEEE 802.1Q-2022 §9.5

2. A VLAN works on both switches but not between them. Hosts in it can reach local peers and nothing beyond.

   Narrow it down

   1. Confirm the VLAN exists in the database on both switches, not just on the ports.
   2. Read the allowed list on the trunk with `show interfaces trunk`.
   3. Check whether the VLAN is pruned, either manually or by VTP.

   Cause

   The VLAN is absent from the trunk’s allowed list, or was never created in the VLAN database on one switch.

   Fix

   Add it to the allowed list and create it in the database. Configuring a port with a VLAN does not always create the VLAN.

3. Large transfers fail while pings and small requests succeed. Often blamed on the application.

   Narrow it down

   1. Ping with a large payload and the do-not-fragment bit set, and find the size where it stops.
   2. Compare the interface MTU on every device in the path, including the trunk.
   3. Check whether the failing path crosses a tagged link.

   Cause

   The tag adds four octets. A device configured for exactly 1500 drops a full-size tagged frame while everything smaller passes.

   Fix

   Raise the MTU on tagged links to at least 1504, or lower the host MTU. Most switches accept baby-giant frames by default; routers and firewalls often do not.

4. A device connected to an access port sees no traffic, or the switch logs frames it cannot classify.

   Narrow it down

   1. Check whether the attached device is tagging its own traffic — a hypervisor, an IP phone, or a NIC with a VLAN sub-interface.
   2. Read the port mode and compare it to what the device expects.

   Cause

   A tagged frame arrived on a port configured as access. Behaviour is platform-specific: some switches drop it, some classify it to the access VLAN and forward it anyway.

   Fix

   Make the port a trunk with a restricted allowed list, or stop the device tagging. A hypervisor uplink is nearly always a trunk.

5. A port that should be an access port has become a trunk, and a device has access to VLANs it should not.

   Narrow it down

   1. Read the operational mode, not the administrative one, in `show interfaces switchport`.
   2. Check whether negotiation is enabled on the port.

   Cause

   The port was left at the default dynamic mode and the attached device negotiated a trunk.

   Fix

   Set the mode explicitly and disable negotiation with `switchport nonegotiate`. Do this on every edge port as policy, not per incident.

6. A phone works and the PC behind it does not, or the PC lands in the voice VLAN.

   Narrow it down

   1. Check which VLAN the port assigns to untagged traffic and which to tagged.
   2. Confirm the phone is tagging voice and passing PC traffic untagged.
   3. Verify the phone learned the voice VLAN, usually over CDP or LLDP-MED.

   Cause

   A voice VLAN port is a trunk with a restricted personality: untagged goes to the data VLAN, tagged with the voice identifier goes to voice. If the phone does not learn the voice VLAN it tags nothing, or tags the wrong thing.

   Fix

   Confirm the discovery protocol is running and the phone is receiving the voice VLAN, then re-check what each device is tagging.

Design notes

Do not use VLAN 1 for anything. It is the default everywhere, so an unconfigured port, a forgotten trunk, or a switch straight out of a box all land in it. Move management, the native VLAN and every user VLAN off it, and leave it empty.

Prune trunks explicitly. A trunk that allows every VLAN carries every broadcast, and a VLAN that reaches a switch with no ports in it is pure overhead and extra attack surface.

A tagged frame is 1522 octets at full size, not 1518. Equipment that has not had its MTU raised drops the largest frames while everything smaller works — which presents as an application-specific fault rather than a network one.

VLANs and subnets are a convention, not a rule. Nothing stops two subnets sharing a VLAN or one subnet spanning two, and both make troubleshooting substantially harder for no benefit.

Misconceptions

“Putting a device in its own VLAN isolates it.”

It isolates the broadcast domain. Anything routing between VLANs — and something usually is — will happily forward between them unless an access control list says otherwise. VLANs separate; firewalls enforce.

“The VLAN tag wraps the frame, like an outer header.”

It is inserted into the frame, after the source address and before the EtherType. That is why a tagged frame is exactly four octets longer and why the FCS has to be recomputed. IEEE 802.1Q-2022 §9.5

“VID 0 means VLAN 0.”

It means priority-tagged: the frame carries a class of service and no VLAN, and the receiving port assigns one. IP phones use it, which is why it turns up in captures more often than people expect. IEEE 802.1Q-2022 §9.6

“An access port strips the tag.”

There is usually nothing to strip. Traffic between hosts on the same switch in the same VLAN may never be tagged at all — tagging happens on egress to a trunk. The VLAN lives in the switch’s internal state, not necessarily on the wire.

“More VLANs is more secure.”

More VLANs is more routing, more access control lists, and more places for a rule to be missing. A VLAN nobody wrote a policy for is a broadcast domain with extra steps.

More walkthroughs

Terms

VLAN

A broadcast domain defined by configuration rather than cabling. A switch keeps a VLAN identifier against each port and scopes flooding and forwarding to it.

Access port

A port belonging to one VLAN. Frames arrive untagged and are classified on ingress; frames leave with no tag.

Trunk port

A port carrying several VLANs over one link. Each frame is tagged so the far end knows which VLAN it belongs to — except the native VLAN.

Native VLAN

The one VLAN a trunk carries untagged. It exists for interoperability with devices that do not understand tags, and it is where most VLAN misconfiguration lives.

Broadcast domain

The set of ports a broadcast frame reaches. One per VLAN, which is what VLANs are for.

Check yourself

• Where does the 802.1Q tag sit in the frame?

  • Before the destination MAC address
  • After the source MAC address, before the EtherType
  • After the payload, before the FCS
  • In the preamble
• A trunk receives an untagged frame. What happens to it?

  • It is dropped, because trunks require tags
  • It is classified to the port’s native VLAN
  • It is flooded to every VLAN
  • It is classified to VLAN 0
• Two hosts in VLAN 10 are on the same switch. Is their traffic tagged?

  • Yes, always — the VLAN has to be carried somehow
  • Not necessarily; the VLAN lives in the switch’s state and tagging happens on egress to a trunk
  • Only if the hosts support 802.1Q
  • Only for broadcast traffic
• How many usable VLAN identifiers does 802.1Q provide?

  • 1024
  • 4094
  • 4096
  • 65534
• A full-size tagged Ethernet frame is how many octets?

  • 1500
  • 1518
  • 1522
  • 9000
• What makes a double-tagging attack possible?

  • The attacker is on the trunk’s native VLAN, so the first switch strips only the outer tag
  • The switch fails to check the frame check sequence
  • The attacker has access to a trunk port
  • The VLAN database is not synchronised
• What happens to the priority code point when a tag is stripped at an access port?

  • It is copied into the IP header’s DSCP field
  • It is preserved in the frame check sequence
  • It is discarded with the tag
  • It is stored in the MAC address table
• Why is leaving VLAN 1 in production use discouraged?

  • It has a smaller MTU than other VLANs
  • It cannot be carried over a trunk
  • It is the default everywhere, so unconfigured ports and new switches land in it
  • Spanning tree cannot run on it

Related

• STP

  Keeps a switched network free of loops by disabling just enough ports to leave one active path between any two bridges.