Cisco – multiple vlans routed on one nic? trunk?General? or Access

Trunking just gives an interface the ability to deal with tagged frames. It doesn't give it a general ability to handle all tags.

This is where the "default" or PVID (primary VLAN ID) comes in. When you set this, the switch treats all incoming packets with tags that it isn't explicitly configured to handle as if it was an untagged packet on the PVID. The frame is then handled with that in mind -- with the 802.1q tag removed.

You have to explicitly specify which VLANs are supported on which ports. This means you have to explicitly define and configure how the VLANs are forwarded through your mesh(*) of switches. Otherwise, all tagged packets could potentially go everywhere, leading to security problems and potential bottlenecks in terms of throughput.

(*) == originally typed as "mess", but that's often an appropriate sentiment.

I have actually seen this on a cheapo-switch. Someone had connected a switch between a trunk port which had a couple vlans. The frames were forwarded with the vlan tagging intact. The other ports on that switch where able to use the un-tagged vlan.

A switch only needs the source/destination mac to decide which ports to forward the frames to, so this isn't too surprising, a tagged frame still has the source and destination macs, in the same location in the frame header.

Keep in mind that Ethernet actually supports many different frame-types on the same wire. It was designed to be pretty flexible about what it can do.