When setting up VLAN networks, we have to define whether the ports on the switch are tagged or untagged.
- What is the difference?
- How are the ports related to trunk ports and access ports?
Difference Between Untagged and Tagged Ports – VLAN Explained
transport-protocolvlan
Related Solutions
If you have more than one VLAN on a port (a "trunk port"), you need some way to tell which packet belongs to which VLAN on the other end. To do this you are "tagging" a packet with a VLAN tag (or VLAN header if you like). In reality a VLAN tag is inserted in the Ethernet frame like this:
The 802.1Q (dot1q, VLAN) tag contains a VLAN-ID and other things explained in the 802.1Q Standard. The first 16 bits contain the "Tag Protocol Identifier" (TPID) which is 8100. This also doubles as the EtherType 0x8100 for devices that don't understand VLANs.
So a "tagged" packet contains the VLAN information in the Ethernet frame while an "untagged" packet doesn't. A typical use case would be if you have one port from a router to a switch which multiple customers are attached to:
In this example customer "Green" has VLAN 10 and Customer "Blue" has VLAN 20. The ports between switch and customers are "untagged" meaning for the customer the arriving packet is just a normal Ethernet packet.
The port between router and switch is configured as a trunk port so that both router and switch know which packet belongs to which customer VLAN. On that port the Ethernet frames are tagged with the 802.1Q tag.
Here's one way to think about it:
A port with more than one VLAN associated with it is called a Trunk. A Trunk can have exactly ONE untagged vlan (also called the Native VLAN), and one or more Tagged VLANS. If you set a VLAN to be untagged on a port, there is no PVID associated with it; there is no PVID field in the Ethernet frame.
If a trunk port is configured with VLAN1 untagged, and VLAN 2 tagged, then all devices that use untagged frames (PCs etc) will communicate on VLAN 1 and be blissfully unaware of any other VLANs. If a device can tag frames with a PVID =2, then it can communicate on VLAN 2.
Best Answer
This all comes about because different vendors often choose to use different terminology or in some cases the same terminology for different concepts.
What Cisco calls a trunk port is also known as a tagged port by certain other vendors. This means that 802.1Q headers are inserted on all of the traffic for the tagged VLANs.
What Cisco calls an access port would then equate to an untagged port. Not to confuse the issue, but a tagged port generally will have zero or one untagged VLAN assigned to it as well. An untagged port is more specifically one on which no traffic is 802.1Q tagged.
In some environments (Solaris, some HP switches, etc), a trunk is used to refer to link aggregation, or what Cisco calls etherchannel. So sometimes to avoid confusion, tagged port may be preferred by some people.