VLAN – PVID vs. Untagged in Cisco Switches

ciscoswitchvlan

I've seen similar spins on this question before but not one that adequately answers it.

In the following (paraphrased, not literal) config on a Cisco SF300:

FastEthernet1
Port mode General
General access VLAN 20 tagged
General access VLAN 10 untagged
PVID 10

If I plug a PC into this port, any untagged packets entering the port will internally enter VLAN 10. Any traffic on VLAN 10 will exit that port untagged. This I completely accept since I use it on a daily basis.

What's the purpose of setting untagged access without setting PVID? Is untagged ingress traffic going to just go nowhere? If so, what's the purpose of having an untagged VLAN that can't communicate bidirectionally?

Best Answer

Without getting into NDA territory, a lot of it has to do with the switch (chip) internals. Of course anyone with a clue codes their UI and configuration language to handle these things automatically. You'd think something with a Cisco logo on it would be better, but you'd be wrong -- that switch grew out of the Linksys Small Business product line and has never seen the same engineering effort behind IOS, for example.

While it makes little sense, it's a valid configuration to set a PVID of 20 in your example. Untagged traffic handed to the switch would forward in VLAN 20. (no one in their right mind would(should) do that.)

[Note: even in switch IOS, one can set the native VLAN to something that isn't in the allowed list. And it's 100% valid.]