Master IP Addressing and Subnetting: The Ultimate Course for Network Engineers—Limited Time Offer: $100 Course for FREE!
Hey there, fellow Network Engineers! Tired of feeling lost in the world of IP addressing and subnetting? Look no further! My course, "Mastering IP Addressing and Subnetting," is here to give you the skills and confidence you need to tackle any subnetting challenge. And the best part? For a limited time, I'm offering it for free to my website visitors and subscribers with the code "year2023" at checkout. Don't miss out on this opportunity to level up your networking game.
After reading an in-depth article about VLANs, you might still have questions about the differences between VLAN tagged vs. untagged? This blog post will discuss this topic in easy to understand language. Let’s briefly discuss the VLAN and VLAN tag and then dive into the difference between Vlan tagged vs. Untagged.
VLANs:- Virtual LANs, or Virtual Local Area Networks, works on the Data link layer of the OSI model. VLANs help create virtual separations within a switch that provide distinct logical LANs or segregated broadcast domains that each behaves as if they were configured on a separate physical switch.
Before the invention of VLANs, a switch used to serve a single LAN and maintained a single broadcast domain, due to which broadcast packets were sent to all ports.
VLAN ethernet tags enabled a single switch to serve multiple LANs by dividing a single broadcast domain into multiple broadcast domains.
What is a VLAN tag, and why do we need a VLAN tag in the network?
Layer2 Frame fields and Dot1q Header
VLAN tags are a core part of the VLANs. Therefore, packets must be “tagged.” to support VLANs.
IEEE 802.1Q is the widely used standard for setting VLAN tags on switches.
802.1Q adds a 32-bit field (4 bytes) to each Ethernet frame.
The first 16 bits identify the frame as an 802. 1Q. The remaining 16 bits are split into two parts: 12 for VLAN tags and 4 for QoS operations.
The VLAN ID is 12 bits long so that the switch can handle 4096 VLANs (2^12 = 4096), with usable numbers between 1 and 4094.
Let us look further into Untagged Port, Tagged Port, Default, and Native VLAN.
What is VLAN untagging, and what does Untagged packet mean?
VLAN Untag
Ports on the switches normally connect to the end devices that don’t understand VLAN tags, so the switch performs VLAN untagging before forwarding packets from the switch to the end device. The switch strips the VLAN tag from the frame before sending it out from the port.
Untagged frame from Laptop
Also, when a packet comes from the end device to the switchport, it is Untagged. “Untagged” traffic means that the connected host or Workstation doesn’t know which VLAN is connected to the switch port .
Frames don’t have dot1Q tags on them when they come into the switch port. Instead, the switch adds the VLAN tag, such as “200,” to the frame and sends it across the network.
In Cisco terms, the port is called Access port, and this VLAN is called Access VLAN.
In Short:- A switch port that carries traffic for one VLAN is known as an Access port by Cisco and Untagged ports by other vendors.
What is VLAN tagging?
VLAN Tagging on Tagged or Trunk Port
VLAN tagging refers to understanding tagged VLAN information and carrying multiple VLANs on a single switch port.
When an interface expects frames with VLAN tags, it is referred to as a ‘tagged port’ or “trunk” port in Cisco terminology. Tagged ports or Trunk ports connect two switches to pass multiple VLAN tags on a single port.
In Short – A switch port that carries multiple VLANs is known as a Trunk port by Cisco and VLANs Tagged ports by other vendors.
So to summarize VLAN tagging vs. Untagging, the terms “Access port” and “Trunk port” are frequently used in the context of the Cisco network. On the other hand, VLANs are an open standard, which means that other vendors will also implement them. And other Vendors call it Untagged (Access port) and Tagged (Trunk Port) ports simultaneously.
What is a Native VLAN?
Native VLAN
A native VLAN is used to identify or mark all untagged packets on a tagged or a trunk port.
Native VLANs are generally the same as the switch’s default VLAN, e.g., VLAN 1, unless you change it something else, e.g., 999.
What is Default VLAN?
Most switches that support VLANs come pre-installed with a default VLAN. Therefore, all ports on that switch will belong to the default VLAN by default.
Devices connected to the default VLAN on switch ports can access one another without configuration, creating hacking possibilities for the network. So you should always make sure you change the default VLAN to something different as per your company policies.
For example:- All cisco switches mostly come with VLAN 1 preconfigured as default VLAN on all ports.
VLAN tagged vs Untagged head to head comparison Sheet
Technology Area
VLAN Tagged
VLAN Untagged
Definition
A switch port that carries traffic for one VLAN is known as an Access port by Cisco and an Untagged port by other vendors.
A switch port that carries multiple VLANs is a Trunk port by Cisco and a Tagged port by other vendors.
VLAN Quantity can be configured on a single port
A VLAN tagged port can be configured to carry multiple VLANs simultaneously.
A VLAN Untagged port can carry One Data VLAN and one Voice VLAN at maximum.
Only tagged packets can pass; other or untagged packets will be dropped.
An Untagged packet can be marked if switchport is configured to tag the untagged packet by "switchport access vlan 100" command on cisco switches.
The switch must be configured with VLAN Tag to mark the Untagged packet coming from the end device.
Egress Rule for Packet
The packets will be passed unchanged.
Switch strips the VLAN before sending it to the end device.
VLAN Tagging and Untagging Example and Traffic Flow
Let’s take a scenario when Laptop-1 tries to ping Laptop-2. Both laptops are part of VLAN 200, so communication will work without using any layer3 device.
Laptop-1 and Laptop-2 are part of VLAN 200 and subnet 192.168.200.0/24 and their IP Address are 192.168.200.10/24 and 192.168.200.20/24 respectively.
Both switches have populated their MAC Address tables with all laptops/devices MAC addresses and their corresponding connected ports.
I have used the cisco 2900 series switches to demonstrate VLAN Tagged vs Untagged concept. But, of course, you can take any switch vendor of your choice, and the idea will remain the same.
VLAN tagged vs Untagged Traffic Flow
Ports 1 on both switches (layer2 switch-1, layer2 switch-2) are Untagged port or Access ports.
Sample config
interface Fa0/1
switchport mode access
switchport access vlan 200
Ports 2 on both switches (layer2 switch-1, layer2 switch-2) are Tagged port or Trunk ports.
Sample config
interface Fa0/2
switchport mode trunk
switchport encapsulation dot1q
switchport Trunk allowed vlan 200
Laptop-1 will forward an Untagged packet to layer2 switch-1 port1.
layer2 switch-1 port1 will Tag the frame with VLAN tag 200.
layer2 switch-1 will open the frame and look at the destination mac in its MAC Address table. It will find the mac address entry and forward the packet to port2.
layer2 switch-1 port2 will check the VLAN tag of the frame, and if it matches with the configured VLAN Tag on port2, it will forward the frame to layer-2 switch-2 port2.
Layer2 switch-2 port2 will repeat the above process.
Layer2 switch-2 will open the frame and look at the destination mac in its MAC Address table. It will find the mac address entry and forward the packet to port1.
Layer2 switch-2 port1 will remove the VLAN 200 tag or Untag the packet and send it over to Laptop-2.
Laptop-2 will receive an Untag packet.
The result of the above process will be that ping will work from Laptop-1 to Laptop-2.
Acronyms Used in the Blog
LAN:- Local Area Network
VLAN:- Virtual Local Area Network
DTP:- Dynamic Trunking Protocol
Conclusion
In conclusion, in this blog post, we started with a basic understanding of VLAN and VLAN tags, then we discussed the difference between VLAN tagged vs. Untagged. Finally, we finished the article with the traffic flow.
I hope you liked the article, please share for maximum reach.
"Hey there, network enthusiasts! My name is Afroz, and I've been a CCIE for over 14 years. I work as a Network Designer, and my true passion is teaching others about the industry and sharing my knowledge through my blog and courses. I know the struggles of navigating the complex world of networking, but I firmly believe that teaching makes you a better learner and reinforces understanding. So, whether you're just starting out or a seasoned veteran, join me on this journey of learning and discovery, it will be worth it, and who knows, you might even have some fun along the way!"
"Hey there, network enthusiasts! My name is Afroz, and I've been a CCIE for over 14 years. I work as a Network Designer, and my true passion is teaching others about the industry and sharing my knowledge through my blog and courses. I know the struggles of navigating the complex world of networking, but I firmly believe that teaching makes you a better learner and reinforces understanding. So, whether you're just starting out or a seasoned veteran, join me on this journey of learning and discovery, it will be worth it, and who knows, you might even have some fun along the way!"
