Okay so I'm a little new to VLANS, so forgive me if this is a silly question. I have a firewall set up with a few VLANS:

ID 1: This is the primary, and set to untagged. This will be used as a management VLAN ID 30: 'Guest' for the less trusted devices ID 40: 'iot' for our it devices. I wan them segregated for QOS and security reasons ID 50: 'Trusted' for staff to access specific resources on the LAN.

My question is this. The majority of devices connecting to VLAN 30 and 50 will be standard workstations, with NICs that don't understand VLAN tagging. If I set port-based VLAN, I still have to have it as a tagged VLAN, as that's how it's set on the firewall (The firewall is running a 'bridge' port to pipe all 4 VLANS over to the layer 2 switch), and of course, will only allow one of those VLANS to come back untagged. If I set it as a tagged VLAN, the workstation doesn't understand it and gives a 169 IP. if I set it to an untagged, same deal - I assume as the firewall is only expecting tagged traffic from those VLANS. What am I missing here?

Context: My firewall is a Watchguard, my switch is an HP Aruba

  • 3
    It should make no difference on how your interfaces on the firewall are connected, assuming the firewall is connected to a managed switch as are the rest of the devices. You should be configuring the switch ports the devices are connected to for the right VLAN and leave the workstations untagged whether they understand how to tag packets or not. Leaving security up to workstation endpoint configuration is a recipe for not having any.
    – user143703
    May 29, 2020 at 22:03
  • right, but I need workstations on different VLANS based on their users. As all the workstations don't support tagging, and I can only send one untagged VLAN to the switch, how do I assign the workstations to the tagged VLAN?
    – Tfom
    May 29, 2020 at 22:23
  • 4
    You do not assign workstations to tagged VLANs. You assign a VLAN to the switch interface as an access (untagged) interface. The traffic from a workstation to the switch will be placed in the VLAN assigned to the switch interface. VLAN tags are only used on trunks that carry multiple VLANs in order to separate the traffic. Access connections only have a single VLAN, so the frames are not tagged.
    – Ron Maupin
    May 29, 2020 at 23:15

1 Answer 1


There is a few things that aren't quite clear here in the question, and comments, so I'm hopefully going to clear up how I would expect a system link this to work (with hp aruba switches).

On the link between the firewall and the switch (the configuration on both sides):
Have VLAN 1 configured as untagged.
Have VLAN 30/40/50 configured as tagged.

On the switch ports that are leading to 'guest' devices, you would configure those ports as 'untagged' on VLAN 30.

Assuming the ports for 'guest' are ports 1-10 (and the firewall is port 50), the commands would be something like:

vlan 30
name Guest
tagged 50
untagged 1-10

The same goes for ports used by trusted staff, these would be 'untagged' on VLAN 50.

The command untagged, basically means: Any traffic arriving on a port that is not otherwise tagged, will be assigned this VLAN.

  • I found the issue! I do understand that a non VLAN compliant device will need to be on a non tagged VLAN, and everything you said, but my issue was that I was getting a 169 IP everytime, and overthinking what could be causing it. Turns out the issue was just I'd forgotten to define that tagged VLAN on my WAN port on my switch. I added a 'tagged' to port 10 (WAN) for those VLANS and it works a peach. great break down though so I'll give you the point :P
    – Tfom
    May 30, 2020 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.