Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a cisco asa5505 as my rtr/fw( I have vlan 1 and vlan 3.

Vlan 1 is my default all access vlan. Vlan 3 is my Guest(dmz) vlan.

I can't seem to get a dhcp ip address when my laptop is plugged into port 42 on my procurve. I have plugged my laptop directly into the firewall and it gets a dhcp ip fine(the firewall is dhcp server). the firewall is plugged into port 41. Only vlan3 needs to go over port 41.

I'm sure I have a bonehead config problem however I'm about ready to pull out what little hair I have left.

    vlan 1
       name "Computers"
       forbid 45
       untagged 1-41,43-44
       ip helper-address
       ip address
       tagged 46-48
       no untagged 42,45
   vlan 3
       name "Guest Wireless"
       ip helper-address
       ip address
       tagged 41-42,44-48
share|improve this question
According to your config Port 42 is only getting Tagged traffic. Your laptop is probably not expecting tagged traffic... I think what you want is Port 42 to be Untagged on vLAN 3. – Chris S Jul 6 '12 at 4:11
up vote 11 down vote accepted

So, you're suffering from the pretty-much-universal newbie confusion between "tagged" and "untagged" traffic. We've all been there.

The term "tagged", as applied to switch ports, means "packets that go out this port for this VLAN will have a 802.1q header saying "this is a packet for VLAN <foo>", and "I will accept packets coming into this port that have an 802.1q header saying "this is a packet for VLAN <foo>". That's great, because it's the only way you can have multiple switches all "know" that packets are on the same VLAN. It's not so great, however, when you're sending packets to a device that isn't expecting it. This most commonly happens when you're plugging in a general-purpose computer, but it can also cause problems when a switch connected to that port doesn't expect the tagged traffic.

An "untagged" VLAN, on the other hand, means "packets that go out this port for this (untagged) VLAN will not have an 802.1q header, and they will look like VLANs never happened", and "packets that come in on this port will be carried on VLAN <untagged>". In effect, this looks identical to the "dumb (VLAN-free) switch" configuration, and is typically what edge devices expect.

The question you've got to ask yourself, when thinking VLANs, is "do both devices at each end of this piece of cable know that they'll be told this traffic is part of this VLAN?". If "yes", you tag it. If not, you don't.

In your case, I'm almost certain the device you've got plugged into port 42 is not expecting VLAN-tagged traffic, and thus it's discarding those packets with a quiet "WTF?" and a raised eyebrow. You can either untag that VLAN on that port, or tell the device that it should be looking at that traffic with a VLAN perspective. End-devices can usually do that, by the way; we use it to tag VLANs all the way into our VPS servers, for instance (and tags VLANs onto Linux-based routers, firewalls, load-balancers, and some end-customer devices).

share|improve this answer

So to summarise the other answer and the comment, you need to do this:

vlan 3
    untagged 41

This will change port 41 to be untagged in VLAN 3, and will automatically remove it as an untagged port from vlan1 and as a tagged port from vlan3.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.