All lessons are free · No login · No trackingStart learning
uohk.comNetwork Buddies 中

Network Stories 6 · Intermediate

One Cable, Many Zones: Trunks and 802.1Q Tags

There's only one cable between two Switches. How can it carry data for two VLANs at once?

Starring: Octo, PipAbout 10 min read

VLANTrunkSwitch

Recommended first: Story 5: “VLAN”

1. The Story

Press "Next" to go through it step by step. At each step, a character steps forward and explains what they are doing.

Prologue: a quick recap

Step 1 of 11

One Switch, two VLANs

Last time, I split my Ports into the family zone, VLAN 10, and the guest zone, VLAN 20. A Port that connects an ordinary device and belongs to just one VLAN is called an Access Port.

Animation text version (all steps)
  1. Prologue: a quick recap
  2. One Switch, two VLANs · Octo: Last time, I split my Ports into the family zone, VLAN 10, and the guest zone, VLAN 20. A Port that connects an ordinary device and belongs to just one VLAN is called an Access Port.
  3. Act 1: A new Switch upstairs
  4. S3 in the study · Octo: There's a new Switch, S3, in the upstairs study. Up there are the family's study PC (VLAN 10) and Guest PC 2 (VLAN 20). How do we connect upstairs and downstairs?
  5. One cable per VLAN? · Octo: The simplest way: one cable for VLAN 10 and one cable for VLAN 20. Both ends of each cable are Access Ports, and each cable only carries Frames for its own zone.
  6. More VLANs, more cables · Octo: 2 VLANs need 2 cables. That's still OK. But with 10 VLANs, we'd need 10 cables, using 10 Ports on each side! I'd run out of tentacles.
    • Every new VLAN needs one more cable
    • And it wastes Ports on both sides
  7. Act 2: Enter the Trunk
  8. One cable, many zones · Octo: Let's use a single Trunk instead! It can carry many VLANs at the same time. The question is: when S3 gets a Frame, how does it know which zone it belongs to?
  9. On goes the 802.1Q tag · Pip: Mac wants to send a Frame to the study PC. I have no tag when I leave Mac. Before S2 sends me onto the Trunk, it inserts an 802.1Q tag into my Header that says "VLAN 10".
    • The tag is 4 Bytes, inserted after the sender's MAC Address
    • The VLAN ID inside is 12 bits: usable values are 1 to 4094
  10. S3 reads the tag, then removes it · Octo: Got it! Delivering to the right port right now! S3 sees the "VLAN 10" tag, so it only looks for the recipient in its VLAN 10 records. Before sending the Frame to the study PC's Access Port, it removes the tag. The computer never sees it!
  11. The guest's Frame: VLAN 20 · Pip: Guest PC 1 sends a Frame to Guest PC 2. This time S2 adds a "VLAN 20" tag. On the same Trunk, Frames from both zones can take turns going through without getting mixed up.
  12. Broadcasts follow the tag too · Pip: Guest PC 1 sends a Broadcast. S2 sends it to its own VLAN 20 Ports and onto the Trunk. S3 sees the "VLAN 20" tag and only sends it to Guest PC 2. The study PC doesn't get it at all.
    • Broadcast Domains are still split by VLAN, even across two Switches
  13. The untagged Native VLAN · Octo: There's one special VLAN on a Trunk whose Frames aren't tagged. It's called the Native VLAN, and by default it's VLAN 1. Both ends must be set the same, or Frames will end up in the wrong zone.
    • Allowed VLAN: a Trunk can let through only the VLANs it needs, e.g. 10 and 20
    • Security tip: change the Native VLAN to one that no device uses
  14. Wrap-up: one cable, many zones · Octo: An Access Port belongs to one VLAN, and its Frames carry no tag. A Trunk carries many VLANs and tells them apart with 802.1Q tags. However many VLANs there are, upstairs and downstairs need just one cable!

2. Where Is the Problem

In the last story, Octo split one Switch into a family zone, VLAN (Virtual LAN) 10, and a guest zone, VLAN 20. Now there's a new Switch, S3, in the upstairs study, and Guest PC 2 has moved up there too. Upstairs has both the family's study computer and a guest's device.

The most obvious fix is to run one cable per VLAN. Both ends of each cable are Access Ports, meaning Ports that belong to just one VLAN. But the number of cables grows with the number of VLANs:

Number of VLANs Cables between upstairs and downstairs Ports used on the two Switches in total
2 2 4
10 10 20
50 50 100

Company networks can easily have dozens of VLANs. Running one more cable for every new VLAN wastes Ports and is hard to manage.

3. How the Network Solves It

Imagine a school bus route carrying students from different schools. Each student wears a school badge. At each stop, the driver checks the badges to know who should get off where.

A Trunk is a "bus route" like that: one link that carries Frames for many VLANs at the same time. Before a Switch puts a Frame onto the Trunk, it inserts an 802.1Q tag that says which VLAN the Frame belongs to. The Switch at the other end reads the tag to sort it into the right zone, then removes the tag before sending it out of an Access Port.

No matter how many VLANs there are, upstairs and downstairs only need one cable.

4. A Closer Look

Access Port vs Trunk

Access Port Trunk
How many VLANs it belongs to One Many
What it usually connects to Ordinary devices such as computers, TVs and printers Another Switch, a Router, an Access Point
Do Frames carry a tag? No Yes (except the Native VLAN)

Ordinary devices have no idea which VLAN they are in. The Switch sets up and handles all of this on its Ports.

Where does the 802.1Q tag go?

802.1Q is a standard set by the IEEE (Institute of Electrical and Electronics Engineers). It defines how to add a VLAN tag to a Frame. The tag is 4 Bytes long and is inserted right after the sender's MAC Address:

Ordinary Frame:
[Recipient MAC][Sender MAC][Type][Data......][Checksum]

Frame with an 802.1Q tag:
[Recipient MAC][Sender MAC][802.1Q tag 4 Bytes][Type][Data......][Checksum]

Inside those 4 Bytes:

Field Length Purpose
TPID 16 bits Always 0x8100, meaning "an 802.1Q tag follows"
PCP (Priority Code Point) 3 bits Marks how urgent the Frame is, so internet phone calls can go first, for example
DEI (Drop Eligible Indicator) 1 bit Marks that this Frame can be dropped first when the network is congested
VLAN ID 12 bits Which VLAN this Frame belongs to

12 bits can represent 0 to 4095. 0 and 4095 are reserved, so the usable VLAN IDs are 1 to 4094.

Because the Frame is now 4 Bytes longer, the checksum at the end has to be recalculated. The Switch does this automatically whenever it adds or removes a tag.

Pip's trip: tag on, tag off

  1. Mac sends an ordinary Frame with no tag. It enters S2 through an Access Port.
  2. S2 knows this Port belongs to VLAN 10. The recipient, the study computer, is on the other side of the Trunk, so S2 inserts a "VLAN 10" tag and sends it onto the Trunk.
  3. S3 reads the tag and only looks for the recipient in its VLAN 10 records.
  4. S3 removes the tag and sends an ordinary Frame to the study computer's Access Port.

Broadcasts work the same way. When Guest PC 1's Broadcast crosses the Trunk, it carries a "VLAN 20" tag, and S3 only sends it to VLAN 20 Ports. So even across two Switches, each VLAN is still its own separate Broadcast Domain.

Native VLAN and Allowed VLAN

  • Native VLAN: the only VLAN on a Trunk that isn't tagged. By default it is VLAN 1. When a Switch receives an untagged Frame on a Trunk, it treats it as belonging to the Native VLAN. Both ends must use the same Native VLAN. Otherwise S3 might treat a VLAN 1 Frame from S2 as belonging to another VLAN, and it would end up in the wrong zone.
  • Allowed VLAN: a Trunk can let only certain VLANs through, for example only 10 and 20. VLANs that aren't needed stay off the Trunk, which saves bandwidth and is more secure.

On many Switches, the settings look roughly like this (different brands write it differently):

interface Port24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 switchport trunk native vlan 999

Here the Native VLAN is changed to VLAN 999, which no device uses. This is a common security practice. It lowers the risk of someone faking a double tag to sneak into another VLAN.

Some Switches' settings pages don't say Access and Trunk. Instead they say "Untagged" and "Tagged", which mean the same thing.

5. Try It Yourself

Mission: draw a Trunk for your school

  1. Imagine a school with three floors and one Switch per floor. The whole school has 4 VLANs: teachers, students, visitors and printers.
  2. If you run one cable per VLAN to chain the three floors' Switches together (1st floor to 2nd floor, 2nd floor to 3rd floor), how many cables do you need in total? (Answer: 4 × 2 = 8 cables.)
  3. What about with Trunks? (Answer: 2 cables.)
  4. Think about it: the printer VLAN only has devices on the 1st floor. Does the Trunk between floors need to let it through? (Hint: think about Allowed VLAN.)

Mini game

Does this Frame have an 802.1Q tag?

Does each of these Frames carry an 802.1Q tag?

  1. 1A Frame sent by Mac (Access Port)

  2. 2A VLAN 20 Frame sent by S2 over the Trunk to S3

  3. 3A Frame sent by S3 to the study computer (Access Port)

  4. 4A Native VLAN Frame sent over the Trunk

  5. 5A VLAN 10 Broadcast sent by S2 over the Trunk to S3

  6. 6A Frame received by a guest computer

6. Where the Analogy Breaks

  • The tag isn't a sticker on the outside. An 802.1Q tag is 4 Bytes of data inserted in the middle of the Frame's Header. That makes the Frame longer, and the checksum has to be recalculated.
  • A Trunk doesn't make the cable faster. A 1 Gbps Trunk is still only 1 Gbps, shared by all the VLANs. In the animation, Pips from the two zones pass through in turns; really, they are taking turns using the same cable.
  • Ordinary devices aren't completely clueless about tags. Servers, Access Points and Routers can all be set up to read and write 802.1Q tags and plug straight into a Trunk (Rue does exactly this in Story 10). It's only ordinary computers and TVs that usually never see tags.
  • The Native VLAN isn't "no VLAN". An untagged Frame still belongs to a VLAN; the tag is just left off on the Trunk.
  • Separate VLANs don't mean complete security. Trunk mistakes (such as mismatched Native VLANs, or letting unneeded VLANs through) can send Frames into the wrong zone.

7. Quiz

Question 1 of 3What is a Trunk?
Question 2 of 3How many bits is the VLAN ID in an 802.1Q tag?
Question 3 of 3Does a Frame received by the study computer (on an Access Port) carry an 802.1Q tag?

8. Key Notes

  • An Access Port belongs to only one VLAN, and its Frames carry no tag. A Trunk can carry many VLANs at the same time.
  • When a Frame crosses a Trunk, the Switch inserts a 4-Byte 802.1Q tag. Its 12-bit VLAN ID says which zone the Frame belongs to; usable values are 1 to 4094.
  • The Switch at the other end reads the tag to sort the Frame, then removes the tag before sending it out of an Access Port, so ordinary devices never see tags.
  • The Native VLAN is untagged on a Trunk, and both ends must match. The Allowed VLAN list decides which VLANs can use the Trunk.
  • With Trunks, each VLAN is still a separate Broadcast Domain, even across several Switches.

Further reading

With a Trunk, a single cable between upstairs and downstairs can carry every VLAN. But with only one cable, what if it breaks? Adding a backup cable could bring the whole LAN to a standstill! In the next story, Octo runs into a storm of lost Frames, and Professor Arpa shows everyone how STP (Spanning Tree Protocol) settles it.

Related stories