TCPDump Expression to Collect VLAN Tag ID Only – VLAN, TCPDump

No. What you propose defeats the purpose of VLANing. Assuming there was a way to get this working you would lose segregation as soon as it hit the physical switch.

You can do a couple of things, all of which would require various levels of reworking your network and/or ugliness.

Access Ports

First, and probably the most simple, would be to create the VLAN and then add a second Ethernet drop from the switch to the Hyper-V box as a normal access port (untagged) and then setup a separate virtual network for this traffic. You would also have to add another interface to your firewall to connect to another normal access port on the switch and route/firewall from there.

Hybrid Trunking/Access port

You would setup a Trunk to the firewall and use a sub-interface or Virtual interface on the firewall to act on the packets tagged with the VLANs. You would then have two access ports going to the Hyper-V box one for each VLAN.

You can swap this so the Trunk is going to the Hyper-V machine and the access ports to the firewall.

Trunking all around

You can setup trunks to both the firewall and the Hyper-V box and setup the Sub-interfaces on the firewall, seperate networks on the Hyper-V box based on these VLANs.

1) Yes, when it's connected to a trunk port, and no when it's connected to an access port. Access port is a "normal" port, so it's meant for untagged traffic to go through. Trunk port is for tagged traffic, and usually acts as an "uplink". It is also possible to send untagged data via trunk port, and it will be trated as "default vlan" data.

2) In a "normal" setup, the switches do the tagging. So the PC sends an untagged packet, and the switch adds the tag. But since you usually have the router connected to a trunk port, the router has to do the tagging too. But end-user pc's (connected to access ports) only use untagged traffic. Also some servers are connected to trunk ports, and send tagged packets (usually virtualization servers, or simmilar)

3) Access port is meant for end-devices. For example, you set the port to vlan100, and connect a pc. Computer sends a packet to the switch, and the switch knows the port is in vlan100, and tags the packet accordingly, and sends it where needed. When a packet is going to the pc, the switch knows it's an access port, and strips the vlan tag from the packet.