What Is VLAN Tagging?

VLAN Tagging Explainer

A virtual local area network, or VLAN, divides one switched Ethernet infrastructure into separate logical broadcast domains. Devices in different VLANs behave as though they are attached to different physical switches until a router or layer-three switch moves traffic between them. VLAN tagging lets a single cable carry frames for several of those domains. The IEEE 802.1Q method inserts a four-byte field into an Ethernet frame, including a VLAN identifier that tells each participating switch which logical network the frame belongs to.

An access port normally connects an endpoint assigned to one VLAN. Frames from the computer arrive without a tag, and the switch associates them with the port’s configured VLAN internally. Frames leaving toward that endpoint are usually untagged so an ordinary network card need not understand the VLAN. A trunk port connects switches, routers, servers, or access points that carry multiple VLANs. On the trunk, tags preserve the identity of each frame as many logical networks share the same physical link.

The tag is inserted after the source MAC address and includes a tag protocol identifier plus tag-control information. Twelve bits provide the VLAN identifier, with some values reserved, allowing thousands of possible IDs. Other bits carry a priority code point for traffic class and a drop-eligibility indication. The original EtherType moves later in the frame, and the frame check sequence must be recalculated because the contents changed. A tagged frame is slightly larger than an untagged one.

Many trunks define a native or untagged VLAN for frames without a tag. Native-VLAN mismatches can place traffic in different logical networks at opposite ends and create security or connectivity problems. Administrators limit the VLANs allowed on a trunk, avoid using default settings carelessly, and verify that both ends agree. Double-tagging and misconfigured edge ports are reasons to separate trusted trunks from user-facing access ports and to filter unexpected tags.

VLANs control layer-two forwarding, not complete security by themselves. Broadcasts and unknown destinations remain within the selected VLAN, reducing unnecessary traffic and separating address-learning tables. Communication between VLANs requires routing and can be filtered by firewalls or access-control lists. A compromised switch, incorrect trunk, shared service, or permissive router can still cross the intended boundary. Strong isolation combines VLAN design with authentication, routing policy, device hardening, and monitoring.

Tagged networks also reach virtual machines, wireless access points, and storage systems. A server interface can create multiple VLAN subinterfaces, each with its own logical network configuration. An access point may map separate wireless network names to separate VLANs over one uplink. Virtual switches apply the same identifier while frames move between guests and physical ports. Consistent documentation is crucial because the number is locally meaningful; VLAN 20 is not automatically the same organization-wide network unless the infrastructure is configured that way.

VLAN tagging is therefore a label carried inside the frame, not encryption and not a separate physical wire. Switches add, remove, inspect, and forward that label according to port roles. It allows one high-capacity link to transport several isolated layer-two domains without mixing their broadcasts or learned addresses. The simplicity is powerful, but the boundary is only as reliable as the trunk lists, native settings, routing rules, and access-port configuration that interpret the tag.