Tagging and Untagging VLANS

jjoseph01 · ‎09-15-2006

Hi all. I think this is a terminology question more than anything, but I have a co worker that says I should configure switch with "untagging" vlans. Im not sure what he means, does he mean a access port? I would thing a trunk port "tags" vlans, but does an access port not do that? Can someone help explain this to me please? Thank you.

lgijssel · ‎09-15-2006

To tag or not to tag?

This type of question is constantly returning in this forum. A search would bring up quite some usefull info but I will make a final attempt anyway:

A switch-port can be configured as access or trunk. In access mode, incoming frames are tagged with the vlan-id that the port belongs to. An access port expects untagged frames.

In trunk mode, the port is expecting tagged frames. As you know, trunks are used to interconnect switches.

In the outgoing direction, an access port removes all tagging, a trunk preserves it.

With all this, there is one special case: the native vlan. Each port has one vlan (vlan1 by default) that is used as the native vlan. For compatability with non-vlan capable equipment, this vlan is sent & received untagged. This is hardly used as most trunks are point-to-point between vlan-capable devices. Make sure that the native vlan is set the same on both sides of the link.

Ports that connect IP phones have a mix between trunk and access. The data from the PC is forwarded on the access-vlan, the voice traffic utilizes the voice vlan as specified with the comand: switchport voice vlan, and this vlan must be tagged to preserve the 802.1p field that is part of a dot1Q tag and contains the priority info. voice is prio 5.

Hope this solves your question about to tag or not to tag.

Regards,

Leo

jjoseph01 · ‎09-18-2006

Guys, thanks. Iqijssel, great explanation. Most I knew, but now I completely understand.

tdrais · ‎09-15-2006

Tagged and Untagged are normaller referring to 802.1q trunks.

I guess techninally a access port is untagged but this is more a issue with non cisco switches.

Other vendors you add ports untagged to a vlan and then if you want to make it a trunk you add ports to additional vlans as tagged. If you only added the untagged vlan you have basically what cisco calls a access port.

Because cisco supports both 802.1q and ISL trunks and they run a trunking protocol to detemine the type of trunk they allow you to force a port to access to avoid this negotiation.

I guess if you worked at it hard enough you could define a port in cisco as a 802.1q trunk with only a native vlan (cisco name for untagged). I suspect you could get a end device to work in this port if you disable all the trunking negotiation. Not something I would try outside a test environment.

In cisco unlike other vendors a port can be either a trunk or access port depending on what you plug into it. This is the default configuration. You really want to force your access port to access to avoid issues.