Understanding Network Infrastructure · Part 2 · How does data reach nearby devices?
How can devices share a switch without communicating directly?
Using access-port classification and 802.1Q tags to divide one physical network into multiple broadcast domains
On the same switch, ports assigned to different VLANs belong to different broadcast domains. An access port assigns an endpoint's frames to one VLAN. A trunk uses 802.1Q tags to carry multiple VLANs' frames between switches. We follow how each frame is assigned to a VLAN on arrival and departure, and where native VLAN and allowed VLAN settings can disagree.
How one switch keeps broadcast traffic in separate networks↑
A switch using VLANs looks up its MAC address table within the relevant VLAN context. VLAN 10 broadcasts and unknown unicasts are not flooded to VLAN 20 ports.
This separation limits broadcast scope and provides a starting point for policy boundaries between departments or services. A VLAN is not a complete security policy. Communication between VLANs is governed by the Layer 3 gateway, firewall, and ACLs.
Port 1 and Port 2 may be on the same physical switch, but if they belong to VLAN 10 and VLAN 20, respectively, ARP broadcasts do not cross between them. The switch does not look up a MAC address alone: it uses both the VLAN context and the MAC address. This lets it maintain separate forwarding entries for the same MAC value in isolated networks. VLANs divide the logical scope of Layer 2 forwarding and flooding, not the physical box.
One VLAN usually corresponds to one IP subnet, but the two are not the same concept. A VLAN can contain multiple IP prefixes, and disconnected VLANs can use the same prefix. These arrangements can complicate an endpoint's on-link decisions and gateway configuration, so review why they are needed and what connectivity requires. Operational documentation should record the relationships among VLAN IDs, IP prefixes, and gateways.
A VLAN is a separate forwarding domain, not a security policy in itself. Different VLANs cannot communicate directly at Layer 2, but inter-VLAN routing and a permitting policy can connect them. To translate a list of VLAN numbers into real isolation requirements, define why user, server, and management networks are separated, where the gateway sits, the broadcast and failure scope, and the Layer 3 policy for each VLAN.
Sources for this section IEEE 802.1Q-2022
What to look for in the diagram Compare how broadcasts spread through a flat network with the separate broadcast domains formed by VLANs 10, 20, and 30. Contrast the ARP request's reach in the flat network with the request confined to VLAN 10 after VLAN separation: the same request is not forwarded into the other VLANs.
↔ Scroll horizontally to explore the diagram.
Untagged frames at an access port: how the switch assigns a VLAN↑
An endpoint connected to an access port normally sends untagged Ethernet frames. The switch uses the port configuration to assign each frame to a VLAN. Internal forwarding uses the VLAN ID together with the source and destination MAC addresses.
In the other direction, an access port normally sends the endpoint a standard Ethernet frame it can understand. The user's NIC therefore does not need to see an 802.1Q tag to communicate within the VLAN.
A PC's frame has no VLAN tag, but the switch classifies it on ingress using the receiving port's access VLAN setting. The internal switching pipeline marks the frame as belonging to VLAN 10, then checks VLAN 10's MAC address table and forwarding state. When another access port sends it out, it is untagged again. The endpoint can participate in VLAN 10 without handling tags itself.
When an IP phone has a PC connected behind it, some implementations distinguish a data VLAN and a voice VLAN on the same port. The phone may use negotiated information to tag voice frames while leaving PC frames untagged. Treating this port as a simple access connection can lead to a mistaken reading of a capture. Check the platform's rules for classifying incoming frames into a VLAN and handling tags that are not permitted.
A packet capture can show the same traffic as untagged or tagged, depending on where it was taken. At a typical host's NIC, frames appear untagged; whether a trunk mirror shows the VLAN tag depends on the mirroring settings and how the capture device handles tags. Voice VLANs, authentication-based dynamic VLANs, and tagged server NICs are possible exceptions to simple access-port behavior. Check both the port mode and the actual ingress classification.
Sources for this section IEEE 802.1Q-2022 · Cisco Configure VLAN Trunking
What to look for in the diagram Compare the three switches' connections, with a separate access port and cable for each VLAN. In this example carrying untagged frames, check the VLAN 10 and VLAN 20 cables against the VLAN settings at both ends.
↔ Scroll horizontally to explore the diagram.
How multiple VLANs' frames keep their identity across one trunk↑
For a single inter-switch uplink to carry multiple VLANs, the receiving switch must identify which one each frame belongs to. The 802.1Q tag contains control information, including the VLAN identifier.
A trunk does not automatically permit every VLAN. Its allowed VLAN list may exclude a VLAN, preventing its frames from passing. Both ends of the uplink need compatible modes and allowed lists, and the required VLAN must exist.
When switch A sends a VLAN 10 frame over a trunk, it places 10 in the 802.1Q header's VLAN ID field. Switch B can then continue the lookup in the same VLAN 10 MAC context. The tag also carries priority information, but the key to VLAN separation is its 12-bit VLAN identifier. Inserting the tag changes the frame's format and length, and the FCS is recalculated for the link. A capture may show the tag or hide it because of NIC offload, depending on the capture point.
Even with a trunk at both ends, VLAN 10 frames cannot cross if one allowed list excludes it. On switch B, a missing VLAN or an STP instance blocking the uplink can cause the same symptom. “Trunk up” confirms the physical link and trunk mode, not forwarding for every VLAN. Inspect per-VLAN Tx/Rx counters and tags to see which VLANs actually pass.
A trunk does not automatically pass every VLAN. Both ends of the link need compatible trunk modes, allowed VLAN lists, and VLAN creation and activation states. If a port channel serves as the trunk, verify a consistent policy on the logical interface, not just its individual members. Trace the VLAN policy end to end to confirm that every intermediate device permits the same VLAN.
Sources for this section IEEE 802.1Q-2022 · Cisco Configure VLAN Trunking
What to look for in the diagram The IEEE 802.1Q tag's VLAN ID lets one trunk carry multiple VLANs' frames. Compare the Tag V10 and Tag V20 labels on the links with the Allowed 10,20 settings at both ends to see the two VLANs crossing the same cable.
↔ Scroll horizontally to explore the diagram.
Trunk ends with different native VLANs interpret the same untagged frame differently↑
Many Ethernet switches can send a trunk's native VLAN frames untagged. If one end assigns an untagged frame to VLAN 10 and the other assigns it to VLAN 20, broadcasts and control frames can enter an unexpected domain.
Even if the design appears not to use a native VLAN, check the device's defaults and control protocol requirements. An operational policy may require matching settings and an unused VLAN as native, but specific recommendations depend on the platform and security requirements.
If switch A uses native VLAN 10 and switch B uses 20, A's untagged VLAN 10 frame may be classified into VLAN 20 by B. The reverse direction also enters a different context, mixing ARP and control traffic into unintended broadcast domains. With little user traffic, the mismatch may initially go unnoticed and surface only with particular broadcasts or management protocols.
Some platforms can tag the native VLAN too, and control protocols may have separate rules for untagged traffic. A policy saying “we do not use a native VLAN” is not enough: verify actual tagging modes and untagged ingress handling at both ends. Assigning an unused VLAN as native does not automatically remove every risk. The trunk allowed list and the access port's tag-acceptance policy must also be consistent.
Keep the native VLAN consistent at both ends. Depending on device support, use a dedicated unused VLAN or tag every VLAN. Do not stop after clearing a native VLAN mismatch warning. Inspect the actual untagged frames and both ports' PVIDs and allowed lists to uncover unintended connections.
Sources for this section IEEE 802.1Q-2022 · Cisco Configure VLAN Trunking
VLAN extensions can also extend loops and failures↑
Multiple trunk paths can let a VLAN's frames loop. STP prevents loops by keeping some redundant Layer 2 paths on standby. Link aggregation instead presents several physical links as one logical link.
A VLAN design must consider broadcast domain size, the STP failure scope, trunk allowed lists, and gateway placement together. Extending the same VLAN everywhere may simplify mobility but increase the impact of failures and changes.
Extending one VLAN across buildings and a data center can let a single port's broadcasts or a forwarding loop affect the entire domain. STP prevents loops, but unexpected root placement or blocked links can send traffic on long detours and widen the scope of failover. Removing unneeded VLANs from a trunk limits VLAN flooding and configuration exposure, but inconsistent allowed lists can break connectivity.
Link aggregation combines parallel links into a single logical link, so STP does not treat each physical link as a separate loop path. Simply adding two trunk paths, however, makes STP keep one on standby—or creates a loop if misconfigured. A VLAN extension design must account for root placement, failure domains, the gateway, and recovery time, not just mobility. Placing the Layer 3 boundary closer to endpoints often limits the scope of failures and changes.
Decide whether to extend a VLAN based on the application's actual Layer 2 adjacency requirements, gateway placement, mobility needs, and failure-isolation goals. If the goal is to retain an IP address, first check whether DNS or load balancing could meet the requirement by retaining a service name or a virtual service address instead. If the host address itself must stay unchanged, evaluate the conditions for route mobility and other Layer 3 alternatives separately. If extension is necessary, minimize the permitted paths and document root placement, loop prevention, broadcast scale, and where to isolate a failure.
Sources for this section IEEE 802.1Q-2022
VLAN troubleshooting: compare both uplinks for the same frame's tag↑
Scenario: An endpoint on switch A's VLAN 30 can reach other endpoints on the same switch, but cannot reach switch B's VLAN 30 server. In this example, the trunk carries VLAN 30 frames with tags, and the capture is assumed to preserve those tags.
- Verify that both access ports actually belong to VLAN 30.
- Check that both ends of the uplink are in trunk mode and that VLAN 30 appears in the allowed list and VLAN database.
- Inspect the uplink's packet capture or device counters for VID 30 frames leaving and arriving.
- Check for a native VLAN mismatch, STP blocking, and inconsistent port-channel member settings.
- After the fix, verify that the ARP broadcast and unicast reply travel in both directions within the same VLAN.
Use the affected client's ARP request as a reference packet. At the access port, verify the untagged frame and its classification into VLAN 30. At switch A's uplink, check for a VID 30 tag. At switch B's uplink, look for the same source MAC and VID. Finally, switch B's access port should send out an untagged broadcast. The first of these four boundaries where it disappears narrows the problem to access classification, the allowed VLAN list, STP, or the trunk.
After the fix, verify not just the broadcast request but also the server's unicast reply and the subsequent data frames in both directions. Save a configuration diff of both uplink ends' native VLAN, allowed list, and port-channel member settings. Check whether the capture NIC's VLAN tag offload hides tags; where possible, also use the switch's SPAN capture point and VLAN counters. Do not settle for “we added VLAN 30”: verify which frames now pass in which context.
The key evidence is not “trunk up,” but the tag a specific VLAN's frame carries across each boundary. This distinguishes a disallowed VLAN, incorrect access classification, a native-VLAN mismatch, and a problem at the destination host.
Sources for this section IEEE 802.1Q-2022 · Cisco Configure VLAN Trunking
Glossary↑
Sources and verification
- IEEE 802.1Q-2022 — The current standards family for bridges, VLANs, and spanning tree
- Cisco Configure VLAN Trunking — A vendor implementation example of 802.1Q trunking
- IEEE 802.1Q Working Group — 802.1Q standards and revision information
Native VLAN and allowed VLAN defaults, as well as VLAN database behavior, vary by platform. This explanation follows frame tags and VLAN contexts rather than configuration commands.