Untagged packets on native vlan

[darwinsanchez6774]

Hello, it's my first time posting here and I will very much appreciate your kind response guys. I was just wondering how does a switch handle untagged traffic? If an untagged tragfic from a vlan passed through a trunk going to another switch, will the receiving switch forward the untagged traffic to all the ports no matter what vlan they belong to since the traffic has no vlan mark on it? Why or why not? Thanks in advanced. :-)

-dar

[Julio E. Moisa]

Hi

By default the vlan 1 is used as native vlan on the trunks, the native vlan is the one allowed to pass untagged frames between the switches, the rest of the frames will be tagged with their respective vlans to the other end.

Now for security reason the native vlan should be a created vlan for that specific role not used for operations and the vlan 1 should be shutdown. 

[Dan Lukes]

will the receiving switch forward the untagged traffic to all the ports no matter what vlan they belong to since the traffic has no vlan mark on it?

No, untagged packets are not considered "packet belonging to no VLAN". And no, they are not subject of special processing like "broadcasted to all ports".

It's less complex than you expect.

On input - untagged packets are considered packets of native VLAN

On output - native VLAN packets are transmitted untagged.

Rest of processing is the same.

Note - native VLAN is per-port (not global) configuration option.

---

And one more "administration" note. There are so many communities on CSC. You created this discussion in "Additional communities" which is not related to the matter. This thread has been moved by moderators team to appropriate place. 

[darwinsanchez6774]

Thanks for the answer Sir Dan :-)...and im sorry about the what I've done....I still have a question, upon receipt of untagged frame, how will a switch know which port it will forward the received untagged frame?

[Dan Lukes]

As mentioned already - untagged frame is considered packets of the native VLAN.Let consider number of native VLAN to be "default tag" that's apply when there's no explicit tag is present.

The rest of "frame routing" process is exactly the same - for packet tagged as well as for packets untagged (= assigned to particular VLAN by default tag).

Or I'm still missing the matter of your question ?

[darwinsanchez6774]

Hello sir, i'm getting the concept clearer and clearer however i still have questions (pardon me). What if I create a native vlan(999) and moved the ports originally from vlan 1 into it. In it, Different ports belong to several vlans (10, 20, 30). All of those ports are using 999 as native vlan. Is that a good practice? Because untagged traffic from vlaj 10 might end up forwarded to vlan 20 and 30?

[Dan Lukes]

Because untagged traffic from vlaj 10 might end up forwarded to vlan 20 and 30?

No, it can't. You claimed native VLAN to be 999. Thus received packets with no tag are considered VLAN 999 packets.

VLAN x packets are newer fowarded to VLAN y, thus VLAN 999 packets will not be forwarded to neither VLAN 20 nor VLAN 30.

Only those ports belonging to VLAN 999 may forward VLAN 999 packets.

But there still must be a sort of misunderstanding. You mentioned:

untagged traffic from vlan 10

Packet is either tagged as VLAN 10 packet, or it's untaged. No packet can be tagged and untagged at the same time.  Thus, nothing like "untagged packet from vlan 10" can exist.

[Joseph W. Doherty]

Again, don't confuse a "native VLAN" being provided "special" VLAN forwarding treatment.

The "native VLAN" just allows one particular VLAN's frames to be sent untagged out a trunk, and likewise, when received on a trunk, "identified" as belonging to a particular VLAN.  Other than a native VLAN's frames being untagged, it's processed just as it woud be if its frames were tagged.

[Joseph W. Doherty]

I believe the other posters have well answered your questions, but just to say it another way, untagged frames, on a trunk, are still VLAN specific, just like the VLAN tagged frames.  The difference is, unlike the frame's tag indicating the frame's VLAN, the trunk's port configuration determines what VLAN untagged frames belong to.  If a trunk port does not explicitly define the VLAN for untagged frames, it's usually defaulted to VLAN 1.

BTW, if I recall correctly, a Cisco trunk port will accept native VLAN frames either untagged or tagged.

[darwinsanchez6774]

Thanks joseph :-)....how should I explicitly define it on a trunk port? Say for example i have vlan 10, 20, and 30 on both switches connected via trunk link.

[Joseph W. Doherty]

Something like:

int gig #/#
 switchport
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10 , 20, 30

[Dan Lukes]

... and native VLAN configuration for particular port:

switchport trunk native vlan 999

[darwinsanchez6774]

If i do that, the 3 vlans will utilize the same trunk so how can it be vlan specific? Untagged traffic from vlan 10 might end up in vlan 20 since they both use the same trunk and the same native vlan.

[Joseph W. Doherty]

Yes, you're correct, you can mix up VLANs using a native VLAN between different switches.  (Just as you might do with access ports.)

I.e.

If switch 1 has a port configured:

int gig #/#
 switchport
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 10
 switchport trunk allowed vlan 10 , 20, 30

While it's connected to a switch 2 port configured as:

int gig #/#
 switchport
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 20
 switchport trunk allowed vlan 10 , 20, 30

The VLAN 10 traffic on switch 1 would be processed as switch 20 traffic on the second switch (and the converse).

However, if CDP is active, it might log messages that the native VLANs differ.

[Dan Lukes]

Note that according Cisco documentation, both ends of trunk line should have same native VLAN configured. It's considered unsupported configuration with undefined behavior to have different native VLANs configured on both ends.

Thus switch is reporting it as configuration error (if it detects such condition).

But in general you are true, with such (forbidden) configuration, VLAN 10 traffic on switch 1 would be processed as switch 20 traffic on the second switch