On this page
01 What a VLAN is
A switch floods broadcasts, unknown unicasts and multicasts to every port in the same broadcast domain. Without VLANs the whole switch, and every switch cabled to it, is one domain. A VLAN carves that space into separate Layer 2 segments that share the hardware but never see each other: the switch forwards a frame only among ports in the same VLAN.
The payoff is segmentation without new cabling. Servers, users, printers, management and voice each get a domain sized for their traffic and trust level, and faults stay contained: a looped patch cable on VLAN 30 does not touch VLAN 10. VLANs are the unit that spanning tree, 802.1X and QoS policy are usually applied to.
02 802.1Q tagging
Inside one switch the VLAN is a table entry. To carry many VLANs over one link between switches, each frame needs a label. IEEE 802.1Q inserts a 4-byte tag after the source MAC: a 16-bit tag protocol identifier (0x8100), 3 bits of 802.1p priority, 1 drop-eligible bit and a 12-bit VLAN identifier (VID). Twelve bits give 4096 values; 0 and 4095 are reserved, so 4094 are usable.
03 Access ports, trunk ports and the native VLAN
An access port carries one VLAN and sends frames untagged; the host never knows a VLAN exists. A trunk port carries several VLANs and tags every frame with its VID so the far end (a switch, router or hypervisor) can sort them. The native VLAN is the one VLAN a trunk sends untagged; frames arriving without a tag are placed into it. Most platforms default the native VLAN to VLAN 1.
Both ends of a trunk must agree on the native VLAN. If side A treats untagged frames as VLAN 1 and side B as VLAN 99, traffic leaks between the two domains. Set the same native VLAN on both ends, or tag everything and leave it empty.
04 Inter-VLAN routing
Anything that must cross a VLAN boundary is routed, and two designs exist. Router-on-a-stick connects a router to the switch over a single trunk with one subinterface per VLAN; every inter-VLAN packet goes up the trunk and back down, so the trunk is the ceiling. A Layer 3 switch gives each VLAN a virtual routed interface (an SVI, or on IronWare a ve interface) and routes in the forwarding ASIC at wire speed. The trade-offs are on the Layer 2 versus Layer 3 switch page.
Either way, the routed interface is the default gateway for the VLAN. Put a redundant pair behind one gateway address with VRRP so losing a switch does not strand the subnet.
05 A worked VLAN plan for one building
A three-floor building has one distribution pair and one access switch per floor. The plan gives every VLAN a purpose, a subnet, a gateway on a distribution SVI and a rule about which trunks carry it. VLAN 999 exists only to be the native VLAN on trunks: no subnet, no member ports, so an untagged frame arriving on a trunk lands nowhere useful.
| VLAN ID | Name | Subnet | Gateway | Carried on |
|---|---|---|---|---|
| 10 | servers | 10.10.10.0/24 | 10.10.10.1 | Server-room trunks only |
| 20 | users | 10.10.20.0/23 | 10.10.20.1 | Every access trunk |
| 999 | native, unused | none | none | Untagged on every trunk; no member ports |
switch# interface 1/24 switch# switchport mode trunk switch# switchport trunk native vlan 999 switch# switchport trunk allowed vlan 20 $ ip link add link eth0 name eth0.20 type vlan id 20 $ bridge vlan show
Each floor trunk carries VLAN 20 and nothing else, so a storm on one floor never reaches the servers, and the per-VLAN spanning tree instances on a floor switch stay few. If a tool drafted the subnet sizes, recompute them first; see subnet arithmetic for a VLAN plan.
06 Foundry's port-based VLAN model
IronWare, the operating system on Foundry FastIron, BigIron and ServerIron switches, defined VLANs by port membership rather than by a per-interface mode. A VLAN is created, named, and ports are added as untagged or tagged members. A port is an untagged member of exactly one VLAN and may be a tagged member of many. Every port starts untagged in VLAN 1, the default VLAN.
vlan 10 name servers by port untagged ethernet 1/1 to 1/12 tagged ethernet 1/24 router-interface ve 10 ! vlan 20 name users by port untagged ethernet 1/13 to 1/23 tagged ethernet 1/24 ! interface ethernet 1/24 dual-mode 20 ! interface ve 10 ip address 10.10.10.1 255.255.255.0 ! show vlan
Port 1/24 is the trunk, a tagged member of VLANs 10 and 20. The dual-mode line lets that port also carry one VLAN untagged, which is how IronWare expressed a native VLAN. The router-interface ve 10 line binds a virtual routed interface to the VLAN on Layer 3 models. The VLAN chapter of the original ServerIron and BigIron basic configuration guide was among the most linked pages on this domain; see the CLI reference. VLANs are the base layer for nearly every other topic in the switching section, from trunked bundles to dynamic VLAN assignment during port authentication.
07 Management VLAN hygiene and common mistakes
- VLAN 1 everywhere. Every unconfigured port lands in it and many platforms carry control traffic on it. Move users off it, prune it from trunks, leave it empty.
- Management on a user VLAN. Put management addresses in a dedicated VLAN reachable only from an admin network; restrict SNMP and SSH sources.
- Native VLAN mismatch. Verify with the show commands on both ends after every trunk change.
- Allowing all VLANs on every trunk. Prune trunks to the VLANs needed on the far side; flooding and spanning-tree work scale with the count.
- Oversized VLANs. A campus-wide flat VLAN is one failure domain. Size VLANs to a few hundred hosts and route between them.
08 Stacked tags, VLAN hopping and other pitfalls
IEEE 802.1ad (provider bridging, usually called QinQ) permits a second tag. The outer service tag uses TPID 0x88A8 and belongs to the carrier; the inner tag keeps TPID 0x8100 and its VID, so all 4094 customer VLANs travel inside one provider VLAN. The frame grows to 1526 bytes.
- Double-tag VLAN hopping. A host on the native VLAN sends a frame with two tags. The first switch strips the outer tag and forwards the still-tagged frame up the trunk into a VLAN the sender does not belong to. An unused native VLAN removes the path.
- Trunk auto-negotiation left on. An access port becomes a trunk for any device that asks. Set access ports explicitly.
09 Expert tips for VLANs in production
- Carry trunks over bundled trunk uplinks rather than parallel single links that spanning tree will block.
- After every trunk change, read the native VLAN and allowed list from both ends with the show commands, not from the change ticket.
Address plans for new VLANs are a frequent request to AI assistants; checking a generated VLAN subnet plan shows how to verify one.
10 Questions
How many VLANs can a switch have?
The 802.1Q VID is 12 bits, so IDs 1 through 4094 are valid; 0 and 4095 are reserved. Individual switches often support fewer active VLANs, and each costs a spanning-tree instance in per-VLAN designs, so check the platform limit.
What is the difference between a tagged and an untagged port?
An untagged (access) port sends and receives plain Ethernet frames for one VLAN. A tagged (trunk) port inserts the 802.1Q header so several VLANs share the link. In IronWare terms a port is an untagged member of one VLAN and may be a tagged member of many.
Can two VLANs talk to each other?
Not at Layer 2. Traffic between VLANs must be routed by a router subinterface or a Layer 3 switch virtual interface, which is also where access control lists belong. Two VLANs that need unrestricted communication should probably be one VLAN.
What is a dual-mode port on Foundry switches?
A dual-mode port is an IronWare tagged port that also carries one VLAN untagged: the Foundry equivalent of a native VLAN on a trunk, commonly used for IP phones passing untagged PC traffic alongside tagged voice.
Why is VLAN 1 a problem?
Every port defaults into VLAN 1, so unconfigured or forgotten ports share a domain with whatever else was left there. Several platforms also carry management protocols on it. Leaving it unused and pruned from trunks removes an easy path between segments.
What is the difference between VLAN tagging and QinQ?
802.1Q adds one tag with a 12-bit VLAN ID. QinQ (IEEE 802.1ad) adds a second, outer tag with TPID 0x88A8 so a provider can carry all of a customer VLANs inside one of its own. The frame grows to 1526 bytes and both ends must support the outer TPID.