How to configure trunk on Cisco Catalyst Switch

Hello Pankaj.

Tagging occurs when a frame exits a switch on a trunk port. If you have a trunk port with VLANs 10 and 20 allowed on it for example, and you send a frame from VLAN 10 through that trunk, as it exits the physical port, a tag of “10” will be placed in the header of the frame.

So in none of your above examples is tagging being configured. The following configuration configures a trunk:

interface fastethernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20

These commands tell the switch that frames that exit fastethernet 0/1 must be tagged with the appropriate VLAN tag.

Now you mention that you read that you should not tag a frame twice. The article you read is probably referring to double tagging as a method of attacking networked resources to gain access to traffic on other VLANs that would normally not be accessible. This is a security issue that you can read more about here: https://supportforums.cisco.com/discussion/12304791/double-tagging-through-access-ports-why

There are cases where you do want to have two tags such as when you use q-in-q. You can read more about it in Rene’s lessons here: https://networklessons.com/switching/802-1q-tunneling-q-q-configuration-example/

I hope this has been helpful!

Laz