802.1Q trunking in depth: tags, native VLAN, DTP, troubleshooting and Q-in-Q

What the 802.1Q tag does

An access port belongs to one VLAN and sends ordinary, untagged frames. A trunk carries frames for many VLANs, so each frame must say which VLAN it belongs to. IEEE 802.1Q does this by inserting a 4-byte tag after the source MAC address. The older Cisco ISL method wrapped the whole frame instead; it is obsolete and most current switches no longer support it.

The 12-bit VLAN ID allows 4096 values, of which 0 and 4095 are reserved, leaving 1 to 4094. The 3-bit priority field (PCP) carries the class of service used by QoS (see QoS). Because the tag changes the frame, the switch recalculates the frame check sequence, and the largest standard frame grows from 1518 to 1522 bytes.

Configuring a trunk properly

interface GigabitEthernet1/0/48
 description Uplink to DIST-1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30,99
show interfaces trunk

The encapsulation line is only needed on older switches that also supported ISL. Allowed VLAN lists matter: by default a trunk carries every VLAN, so broadcasts from all of them cross every link. Be careful when editing the list: switchport trunk allowed vlan 40 replaces the list, while switchport trunk allowed vlan add 40 adds to it. Typing the first by mistake is a classic way to cut off a building.

The native VLAN

Frames in the native VLAN cross the trunk without a tag. A switch that receives an untagged frame on a trunk places it in its own native VLAN. If the two ends disagree, traffic leaks from one VLAN into another. Cisco switches detect this through CDP ("native VLAN mismatch" messages), and per-VLAN spanning tree blocks the inconsistent VLANs.

Good practice is to choose an unused VLAN as the native VLAN on every trunk, never put devices in it, and, where the platform supports it, tag the native VLAN as well with vlan dot1q tag native. This also defeats the double-tagging form of VLAN hopping described in Layer 2 attacks and defences.

DTP: negotiating trunks

The Cisco Dynamic Trunking Protocol (DTP) lets two ports agree whether to become a trunk.

Two ports left in dynamic auto never form a trunk, which surprises many beginners. Worse, a port that negotiates can be talked into trunking by any device that speaks DTP. Set every port explicitly to switchport mode access or switchport mode trunk and add switchport nonegotiate. Some low-cost small business switches set VLANs through a web page and use the words "tagged" and "untagged" instead: a tagged member is a trunk member, and the untagged VLAN is the access or native VLAN.

Troubleshooting VLANs and trunks

1. show vlan brief: does the VLAN exist and is the port in it? A port assigned to a VLAN that does not exist is inactive.
2. show interfaces trunk: is the link trunking, which VLANs are allowed, and which are "allowed and active" and "forwarding"? A VLAN missing from the last column is pruned or blocked by spanning tree.
3. show interfaces g1/0/48 switchport: compare the administrative and operational modes and the native VLAN on both ends.
4. Check the logs for native VLAN mismatch or err-disabled messages, then test with ping between hosts in the same VLAN before testing routing.

802.1Q tunnelling (Q-in-Q)

A service provider connecting several sites for one customer cannot reuse the customer's own VLAN numbers, because many customers use VLAN 10. Q-in-Q (IEEE 802.1ad, provider bridging) solves this by adding an outer "service" tag on top of the customer's tag. The provider's switches look only at the outer tag; the customer's tags travel through untouched.

system mtu 1504
interface GigabitEthernet1/0/10
 description Customer A site link
 switchport access vlan 3001
 switchport mode dot1q-tunnel
 l2protocol-tunnel cdp
 l2protocol-tunnel stp
 l2protocol-tunnel point-to-point lacp

The extra tag needs 4 more bytes of MTU. Layer 2 protocol tunnelling (L2PT) carries the customer's CDP, STP, VTP and even LACP or PAgP messages across the provider network, which allows a customer to build an EtherChannel between two of its sites over a Q-in-Q service.

Real-world example: a regional fibre provider links a hospital's three buildings across a town. The hospital uses VLANs 10 to 60 internally. The provider gives the hospital outer VLAN 3001 on its network, so the hospital can keep its own numbering, while another customer using the same VLAN numbers gets outer VLAN 3002. Neither can see the other's traffic.