802.1Q VLAN Trunk: Architecture and Configuration

802.1Q VLANs (Virtual LANs) are the cornerstone of enterprise L2 segmentation. They use a 4-byte tag in the Ethernet header and support up to 4094 VLANs (12-bit VLAN ID). Inter-switch trunks carry multiple VLANs. This guide covers VLAN architecture, trunks, the native VLAN, common pitfalls, and the transition to VXLAN. 2026.

802.1Q Tag Structure

• TPID (Tag Protocol Identifier): 2 bytes, value 0x8100
• PCP (Priority Code Point): 3 bits, 8 802.1p priority levels
• DEI (Drop Eligible Indicator): 1 bit
• VID (VLAN ID): 12 bits, 0-4095
• VLAN 0: priority-tagged; VLAN 4095: reserved; VLAN 1: default (avoid using it)

Port Modes

• Access: a single untagged VLAN. Used for endpoints such as PCs, IP phones, and printers
• Trunk: multiple VLANs, tagged with 802.1Q. Used between switches or for connections to virtualized servers
• Hybrid (Juniper): access and trunk traffic on one port, depending on the configuration
• Router-on-a-stick: a trunk to a router that uses one subinterface per VLAN

Native VLAN

• Native VLAN = the untagged VLAN on a trunk
• VLAN 1 by default (a poor choice due to double-tagging attacks)
• Best practice: use an unused, blocked black-hole VLAN such as VLAN 999 as the native VLAN
• Cisco: switchport trunk native vlan 999
• Juniper: native-vlan-id 999

Voice VLAN

Cisco/Polycom/Yealink IP phones carry data (VLAN A tag) and voice (VLAN B tag) over the same port:

• switchport access vlan 10: data VLAN (PC)
• switchport voice vlan 20: voice VLAN (phone)
• The phone receives its VLAN configuration through CDP/LLDP-MED
• A PC connected to the phone's LAN port is assigned to VLAN 10

Private VLAN (PVLAN)

• Isolation within a VLAN
• Primary VLAN + Secondary VLAN (Isolated or Community)
• Isolated: ports cannot communicate with one another
• Community: ports in the same community can communicate, but not with other communities
• Promiscuous: can communicate with all ports, such as a router or FW
• Use cases: hotels, coworking spaces, and residential properties where each customer must be isolated

VTP / MVRP

• VTP (Cisco): synchronizes the VLAN database between switches. It is a legacy technology and can be dangerous because a misconfigured server may delete all VLANs
• Best practice: set VTP to transparent or off
• MVRP (802.1ak standard): a multi-vendor equivalent that is rarely used in practice

Campus VLAN Design

Flat (Small)

All sites share the same VLANs. This is simple but not scalable.

Hierarchical

VLANs are assigned by building/floor. Example: 10-19 for building A, floors 1-9; 20-29 for building B; and so on.

Functional

• VLAN 10-19: user data
• VLAN 20-29: voice
• VLAN 30-39: Wi-Fi
• VLAN 40-49: printers/IoT
• VLAN 50-59: servers
• VLAN 90-99: management

4094-VLAN Limit

On large campuses and in DCs, 4094 VLANs may not be enough:

• Hotels: one VLAN per room → 500 rooms = 500 VLANs
• Cloud providers: 1000+ tenants
• Solution: VXLAN (16M VNIs) or QinQ (VLAN-in-VLAN)

QinQ (802.1ad)

An 802.1Q tag nested inside another tag:

• S-tag (service provider) + C-tag (customer)
• Use case: an ISP carrying customer VLANs across its backbone
• Terminology: Metro Ethernet, provider bridging

VXLAN: Beyond 4094

VXLAN replaces VLANs in modern fabrics:

• 24-bit VNI = 16M
• L2 over L3, without STP
• See the dedicated VXLAN/EVPN-VXLAN article

VLAN Security

• VLAN hopping (double-tagging): prevent it by using a dedicated, blocked native VLAN
• Never use VLAN 1 as a user VLAN or as a trunk's native VLAN
• Enable DHCP snooping + DAI + IP Source Guard on access ports
• Port security: limits the number of MAC addresses per port

Troubleshooting

• show vlan brief: configured VLANs and their ports
• show interfaces trunk: active trunks, native VLAN, and allowed VLANs
• show interfaces Gi1/0/1 switchport: port mode
• show mac address-table vlan 10: MAC learning within the VLAN
• Common pitfall: the VLAN is not allowed on the trunk (switchport trunk allowed vlan)

Order from OPTINOC

Turnkey campus VLAN design and 802.1Q trunk configuration. Migration to VXLAN fabrics. Catalyst/Aruba/Juniper/FortiSwitch. Quote within 48 hours.