802.1Q Encapsulation Explained

(Rene Molenaar) #1

This topic is to discuss the following lesson on NetworkLessons.com:

(system) #3

so nice simply u r network genious… thanku sir…

(Prince) #4

Hi René,

I would like to thank you for the great content porvided. Good job !

i am a little be confused about tagging, so my question is :

Where the frame is tagged :

  1. At the entry of the switch port wich is assigned to a vlan with the " switchport acces " command
  2. Or when it lives the switch on the trunk port command

thks in advance

(Rene Molenaar) #5

Hi Abdelwahid,

The switch will tag the frame when it leaves the trunk. Internally, there’s no need to tag frames. In the MAC address table the switch will keep track of MAC addresses, interfaces but also the VLANs.

Hope that helps!


(Prince) #6

Yes indeed, it helps a lot

Many thanks René :slight_smile:

(Srinivasan C) #7

Hi Rene,
Can you please share your posts that explain Q-in-Q?


(Rene Molenaar) #8

Sure here it is:

(Srinivasan C) #9

Thanks Rene.

(Lokesh K) #10

Hi Rennie

How can we verify if native vlan is getting tagged? is there any show command to check that instead of looking for “vlan tag dot1q native” in running config.


(Rene Molenaar) #11

Hi Lokesh,

I think the only command to see it is “show vlan dot1q tag native”.


(Ocee E) #12

Rene -

Your diagram and illustration is spectacular! It is straight to the point and clearly defined.

Thank you,


(Rene Molenaar) #13

Thanks Ocee!

(Prince) #14

So if there is no need to tag frames at the entry of the switch (from a port assigned to a vlan with switchport access command),

why the switch will keep track of the vlans in the MAC address table ? Is it for a broadcast within the vlan ? Or is there other reasons ?

Thks in advance,



(Rene Molenaar) #15

Hi Prince,

The switch has tokeep track which MAC addresses belong to which VLAN. Also, for broadcast traffic it has to know to which interfaces it should forward it.

Tagging only occurs when you are forwarding the frame on a trunk interface, when the switch receives a tagged frame it will remove the tag and forward the frame on the required interfaces.


(Prince) #16

Thanks for the explanation René,


Have a nice day



(Oscar S) #17

Hi, what information save the mac-address table? information about vlan too

(Oscar S) #18

Hi, Can you give me an explication about the tagging in all the path if the topology is PC1 ==>(Access vlan10)SW1(trunk) ==> (trunk)SW2 (Access vlan10) ==> PC2.
and when the path is Router1 (trunk) ==> (trunk) SW1 (trunk) ==>(trunk) SW2 (trunk) ==> (trunk)Router2

(Rene Molenaar) #19

Hi Oskar,

In the MAC address table you will find the interface, MAC address and also the VLAN yes:

Switch#show mac address-table dynamic 
          Mac Address Table

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  20    c82a.141e.3332    DYNAMIC     Gi0/6
  40    0015.6524.f524    DYNAMIC     Po1

Tagging will occur only on trunk interfaces. Your PC only sends “regular” Ethernet frames without a tag. Some NICs support tagging which would allow you to form a trunk with a switch but this is not what we normally do.

In your first example you’ll see tags between SW1 and SW2 and in the second example you’ll see them everywhere.


(Kishor K) #20

Hi Rene,

Trunking is used between two switches, i.e when frame leaves switch tagging will happen.
I didn’t not understand why intervlan routing is required.

Could you please explain.


(Lazaros Agapides) #21

Hello Kishor!

When a frame is placed on a trunk, it is tagged as you mentioned. When it reaches the other switch this tag is removed and the frame is placed on the appropriate VLAN and sent out the appropriate access ports and/or on any other trunk ports on which the VLAN is included. Intervlan routing however, occurs between VLANs on the SAME switch.

First of all it is important to realise that a VLAN corresponds to a SUBNET which corresponds to a BROADCAST DOMAIN. These three entities are (almost) the same thing but are described from different points of view. A VLAN should under normal circumstances have one SUBNET in it.

So if you have a switch with 8 ports, and four of them are on VLAN 10 and four are on VLAN 20, then what you really have is two LOGICALLY separated switches each having four ports. Broadcasts on the subnet of VLAN 10 are contained within that VLAN as are broadcasts on VLAN 20. The two VLANs cannot communicate with each other.

Now in order for one subnet to communicate with another, you require routing from one subnet to the other. Such is the case even when two VLANs reside on the same switch. Intervlan routing allows communication between two subnets that are on two separate VLANs on the same switch. The switch provides a default gateway (the SVI or VLAN interface on the switch for each VLAN (i.e. the “interface vlan 10” and “interface vlan 20” commands in global configuration mode create such a SVIs, and appropriate IP addresses must be assigned to these)) and allow nodes on each VLAN to communicate with the other VLAN assuming the correct default gateways are configured on the nodes.

Keep in mind that in order to be able to configure intervlan routing on a switch, the switch must be a Layer 3 (or multilayer) switch. Otherwise, routing cannot be configured on it.

Now if we extend this to two or more switches connected via trunks, an SVI must exist on one of the switches for each VLAN that will act as a default gateway that will allow the routing between VLANs to take place.

I hope this had been helpful!