One switch, separate broadcast domains
A virtual LAN (VLAN) is a Layer 2 broadcast domain. A switch can forward or flood a frame only to eligible ports in that frame’s VLAN. Communication between different VLANs requires Layer 3 forwarding, even when their hosts connect to the same switch.
An IEEE 802.1Q customer VLAN tag adds four bytes after the source MAC address. It includes a tag protocol identifier (0x8100), a three-bit priority code point, a drop eligibility bit and a 12-bit VLAN identifier.
Ingress classification and egress tagging
On ingress, an untagged frame is assigned to the port’s configured VLAN. A tagged frame can be admitted to the VLAN in its tag if that VLAN is allowed on the port. A typical host-facing access port sends frames untagged, so the host does not need to understand the switch’s VLAN configuration.
An inter-switch trunk normally sends a tag so the receiving switch knows which VLAN to use. A trunk configured to send its native VLAN untagged relies on both ends assigning those untagged frames to the same VLAN. An allowed-VLAN mismatch can block one VLAN while others still work.
Try it in a lab
- Connect two switches with a trunk and put one host on each switch in VLAN 10. Use addresses in the same subnet and confirm that the hosts can ping each other.
- Compare the frames on a host access link and the trunk. With VLAN 10 configured for tagged egress on the trunk, expect the VLAN 10 tag only on the trunk.
- Remove VLAN 10 from the trunk’s allowed list at one end. Verify that the physical link stays up while the VLAN 10 hosts lose reachability.