TAGGED and UNTAGGED VLANS

Question

What do we mean when we say Tagged VLAN and untagged VLAN.

Suppose there is a switch and we create ACCESS and TRUNK ports on it. ACCESS port is a part of VLAN say 80 and TRUNK port is allowing VLAN 80 and 90. Now when a packet will enter inside switch from ACCESS port, will switch put a VLAN header in the packet or switch will take care of the VLAN it belongs to.

What happens when a port is configured as ACCESS and is a part of VLAN 'X' and we get a packet of VLAN 'Y' on that port? Will the switch drop it or it will add a VLAN header 'X' and forward to the respective port/ports (Double VLAN tagging).

Answer 1

If Q-in-Q is configured, you can set outer vlans, and use different VLANs inside (but this requires extra configuration.

With "normal" (single) VLANs, it really depends on the vendor/implementations. The option is either to re-tag (tag it with VLAN80 - not so smart), or drop it (better).

IEEE says that such packets should be dropped:

A port can be either a Trunk port or an Access port.  Traffic on Trunk
links is tagged (contains an 802.1Q VLAN header); traffic on Access links
is untagged.  When tagged traffic is received on Access ports, it is
discarded.

There have been security issues when a tagged packet would been included in the VLAN from the tag (disregarding the fact they came via an access port), but this issues are mostly fixed with "good", enterprise equipment.