On this page
What a VLAN is802.1Q taggingAccess ports, trunk ports and the native VLANInter-VLAN routingFoundry's port-based VLAN modelManagement VLAN hygiene and common mistakesQuestions01 /What a VLAN is
A switch floods broadcasts, unknown unicasts and multicasts to every port in the same broadcast domain. Without VLANs the whole switch, and every switch cabled to it, is one domain. A VLAN carves that space into separate Layer 2 segments that share the hardware but never see each other: the switch forwards a frame only among ports in the same VLAN.
The payoff is segmentation without new cabling. Servers, users, printers, management and voice each get a domain sized for their traffic and trust level, and faults stay contained: a looped patch cable on VLAN 30 does not touch VLAN 10. VLANs are the unit that spanning tree, 802.1X and QoS policy are usually applied to.
02 /802.1Q tagging
Inside one switch the VLAN is a table entry. To carry many VLANs over one link between switches, each frame needs a label. IEEE 802.1Q inserts a 4-byte tag after the source MAC: a 16-bit tag protocol identifier (0x8100), 3 bits of 802.1p priority, 1 drop-eligible bit and a 12-bit VLAN identifier (VID). Twelve bits give 4096 values; 0 and 4095 are reserved, so 4094 are usable.
03 /Access ports, trunk ports and the native VLAN
An access port carries one VLAN and sends frames untagged; the host never knows a VLAN exists. A trunk port carries several VLANs and tags every frame with its VID so the far end (a switch, router or hypervisor) can sort them. The native VLAN is the one VLAN a trunk sends untagged; frames arriving without a tag are placed into it. Most platforms default the native VLAN to VLAN 1.
Both ends of a trunk must agree on the native VLAN. If side A treats untagged frames as VLAN 1 and side B as VLAN 99, traffic leaks between the two domains. Set the same native VLAN on both ends, or tag everything and leave it empty.
04 /Inter-VLAN routing
Anything that must cross a VLAN boundary is routed, and two designs exist. Router-on-a-stick connects a router to the switch over a single trunk with one subinterface per VLAN; every inter-VLAN packet goes up the trunk and back down, so the trunk is the ceiling. A Layer 3 switch gives each VLAN a virtual routed interface (an SVI, or on IronWare a ve interface) and routes in the forwarding ASIC at wire speed. The trade-offs are on the Layer 2 versus Layer 3 switch page.
Either way, the routed interface is the default gateway for the VLAN. Put a redundant pair behind one gateway address with VRRP so losing a switch does not strand the subnet.
05 /Foundry's port-based VLAN model
IronWare, the operating system on Foundry FastIron, BigIron and ServerIron switches, defined VLANs by port membership rather than by a per-interface mode. A VLAN is created, named, and ports are added as untagged or tagged members. A port is an untagged member of exactly one VLAN and may be a tagged member of many. Every port starts untagged in VLAN 1, the default VLAN.
vlan 10 name servers by port untagged ethernet 1/1 to 1/12 tagged ethernet 1/24 router-interface ve 10 ! vlan 20 name users by port untagged ethernet 1/13 to 1/23 tagged ethernet 1/24 ! interface ethernet 1/24 dual-mode 20 ! interface ve 10 ip address 10.10.10.1 255.255.255.0 ! show vlan
Port 1/24 is the trunk, a tagged member of VLANs 10 and 20. The dual-mode line lets that port also carry one VLAN untagged, which is how IronWare expressed a native VLAN. The router-interface ve 10 line binds a virtual routed interface to the VLAN on Layer 3 models. The VLAN chapter of the original ServerIron and BigIron basic configuration guide was among the most linked pages on this domain; see the CLI reference.
06 /Management VLAN hygiene and common mistakes
- VLAN 1 everywhere. Every unconfigured port lands in it and many platforms carry control traffic on it. Move users off it, prune it from trunks, leave it empty.
- Management on a user VLAN. Put management addresses in a dedicated VLAN reachable only from an admin network; restrict SNMP and SSH sources.
- Native VLAN mismatch. Verify with the show commands on both ends after every trunk change.
- Allowing all VLANs on every trunk. Prune trunks to the VLANs needed on the far side; flooding and spanning-tree work scale with the count.
- Oversized VLANs. A campus-wide flat VLAN is one failure domain. Size VLANs to a few hundred hosts and route between them.
07 /Questions
How many VLANs can a switch have?
The 802.1Q VID is 12 bits, so IDs 1 through 4094 are valid; 0 and 4095 are reserved. Individual switches often support fewer active VLANs, and each costs a spanning-tree instance in per-VLAN designs, so check the platform limit.
What is the difference between a tagged and an untagged port?
An untagged (access) port sends and receives plain Ethernet frames for one VLAN. A tagged (trunk) port inserts the 802.1Q header so several VLANs share the link. In IronWare terms a port is an untagged member of one VLAN and may be a tagged member of many.
Can two VLANs talk to each other?
Not at Layer 2. Traffic between VLANs must be routed by a router subinterface or a Layer 3 switch virtual interface, which is also where access control lists belong. Two VLANs that need unrestricted communication should probably be one VLAN.
What is a dual-mode port on Foundry switches?
A dual-mode port is an IronWare tagged port that also carries one VLAN untagged: the Foundry equivalent of a native VLAN on a trunk, commonly used for IP phones passing untagged PC traffic alongside tagged voice.
Why is VLAN 1 a problem?
Every port defaults into VLAN 1, so unconfigured or forgotten ports share a domain with whatever else was left there. Several platforms also carry management protocols on it. Leaving it unused and pruned from trunks removes an easy path between segments.
Sources
- IEEE Std 802.1Q, Virtual Bridged Local Area Networks (1998, revised through 802.1Q-2022)
- IEEE Std 802.1D, MAC Bridges (learning and flooding behaviour)
- IETF RFC 3069, VLAN Aggregation for Efficient IP Address Allocation, 2001
- Foundry Networks, ServerIron and BigIron basic configuration guide, VLANs chapter (original Foundry documentation, historical, around 2001 to 2003)