What do we mean when we say Tagged VLAN and untagged VLAN.

Suppose there is a switch and we create ACCESS and TRUNK ports on it. ACCESS port is a part of VLAN say 80 and TRUNK port is allowing VLAN 80 and 90. Now when a packet will enter inside switch from ACCESS port, will switch put a VLAN header in the packet or switch will take care of the VLAN it belongs to.

What happens when a port is configured as ACCESS and is a part of VLAN 'X' and we get a packet of VLAN 'Y' on that port? Will the switch drop it or it will add a VLAN header 'X' and forward to the respective port/ports (Double VLAN tagging).


If Q-in-Q is configured, you can set outer vlans, and use different VLANs inside (but this requires extra configuration.

With "normal" (single) VLANs, it really depends on the vendor/implementations. The option is either to re-tag (tag it with VLAN80 - not so smart), or drop it (better).

IEEE says that such packets should be dropped:

A port can be either a Trunk port or an Access port.  Traffic on Trunk
links is tagged (contains an 802.1Q VLAN header); traffic on Access links
is untagged.  When tagged traffic is received on Access ports, it is

There have been security issues when a tagged packet would been included in the VLAN from the tag (disregarding the fact they came via an access port), but this issues are mostly fixed with "good", enterprise equipment.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.