Certopolis

CompTIA Network+ (V9)

VLANs and 802.1Q trunking explained for Network+

A VLAN is a logical network on a switch: broadcasts and unknown frames are flooded only to ports in that VLAN. An access port carries one VLAN untagged, while an 802.1Q trunk carries many VLANs between switches by adding a tag, and sends its native VLAN untagged. Traffic between VLANs must be routed, for example by a switch virtual interface (SVI) on a Layer 3 switch.

Access ports and trunks

Cisco's VLAN guide says unicast, broadcast and multicast packets are forwarded and flooded only to end stations in the VLAN. Normal-range VLAN IDs are 1 to 1005 and extended-range IDs are 1006 to 4094. VLAN 1 is the default.

An access port belongs to and carries the traffic of only one VLAN, unless it is configured as a voice VLAN port. Frames on it are untagged, so printers and PCs need no VLAN awareness.

A trunk is a point-to-point link between a switch and another switch or a router that carries traffic for multiple VLANs. Traffic between VLANs must be routed.

The 802.1Q tag and the native VLAN

IANA's IEEE 802 Numbers registry assigns Ethertype 0x8100 to the IEEE 802.1Q Customer VLAN Tag (formerly the Q-Tag). On a trunk, 0x8100 sits where the frame's type field would be, the tag follows, and the original type field comes after it. Seeing 0x8100 in a capture means 802.1Q tagging is in use.

A trunk can carry tagged and untagged traffic. The switch forwards untagged traffic in the native VLAN configured for the port, VLAN 1 by default.

Voice VLANs and SVIs

The voice VLAN feature lets an access port carry IP voice traffic from an IP phone. The phone sends voice in 802.1Q frames for the voice VLAN with a Layer 2 CoS priority, 5 by default. Untagged traffic from the PC plugged into the phone passes through the phone unchanged. The switch tells the phone which VLAN to use with Cisco Discovery Protocol.

A switch virtual interface represents a VLAN of switch ports as one interface to the switch's routing function. Only one SVI can be associated with a VLAN. Give each VLAN's SVI an IP address and it becomes that VLAN's default gateway, so a Layer 3 switch routes between VLAN 10 and VLAN 20 without an external router.

Where the exam catches people

  • Believing a voice VLAN needs the phone's port configured as a trunk: the port stays an access port with a voice VLAN added.
  • Believing the native VLAN is tagged on a trunk: the native VLAN carries the untagged traffic.
  • Believing hosts in two VLANs on the same switch can talk without routing: traffic between VLANs must be routed, for example through SVIs.
  • Believing 0x8100 marks link aggregation or jumbo frames: it is the 802.1Q VLAN tag type.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A protocol analyzer capturing on a link between two switches sees frames carrying the type value 0x8100 ahead of the original type field. Which of the following interface configurations is applied to the link?

    Right. In the game that’s Renown for your Network Implementation building.

    Not that one: C is right. In the game your Network Implementation building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    A frame is recognised as 802.1Q-tagged by that value sitting where the type field would otherwise be, with the four-byte tag following and the original type field pushed behind it.

    Written from www.iana.org/assignments/ieee-802-numbers

  2. A desk phone with a PC behind it uses one switch port; the phone's calls need their own prioritized VLAN while the PC's frames stay untagged. Which of the following should be configured on the port?

    Right. In the game that’s Renown for your Network Implementation building.

    Not that one: B is right. In the game your Network Implementation building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    The port stays an access port; the switch tells the phone which VLAN and priority to use.

    Written from www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swvoip.html

  3. Hosts in VLAN 10 and VLAN 20 connect to access ports on one Layer 3 device, which must route between them without an external router. Which of the following provides each VLAN with its default gateway?

    Right. In the game that’s Renown for your Network Implementation building.

    Not that one: B is right. In the game your Network Implementation building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    Giving that interface an IP address makes it the VLAN's gateway on the Layer 3 device itself, with no trunk to a router and no per-VLAN subinterfaces.

    Written from www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swint.html