SIGNAMAX a.s.
Office: Vlarska 22, 627 00 Brno, CZ
T:+420 533 338 854 l F:+420 533 338 883 l www.signamax.eu
104
Important VLAN Concepts for 802.1Q VLAN Configuration:
There are two key concepts to understand.
- The Default Port VLAN ID (PVID) specifies the VID to the switch port that will assign the
VID to untagged traffic from that port.
- The VLAN ID (VID) specifies the set of VLAN that a given port is allowed to receive and
send labeled packets.
Both variables can be assigned to a switch port, but there are significant differences
between them. An administrator can only assign one PVID to each switch port (since the
802.1Q protocol assigns any single packet to just one VLAN). The PVID defines the default
VLAN ID tag that will be added to un-tagged frames receiving from that port (ingress traffic).
On the other hand, a port can be defined as a member of multiple VLAN (multiple VID).
These VIDs constitute an access list for the port. The access list can be used to filter tagged
ingress traffic (the switch will drop a tagged packet tagged as belonging in one VLAN if the
port on which it was received is not a member of that VLAN). The switch also consults the
access list to filter packets it sends to that port (egress traffic). Packets will not be forwarded
unless they belong to the VLANs that the port is one of the members.
The differences between Ingress and Egress configurations can provide network
segmentation. Moreover, they allow resources to be shared across more than one VLAN.
Important VLAN Definitions:
Ingress
The point at which a frame is received on a switch and the switching decisions must be
made. The switch examines the VID (if present) in the received frames header and decides
whether or not and where to forward the frame. If the received frame is untagged, the switch
will tag the frame with the PVID for the port on which it was received. It will then use
traditional Ethernet bridging algorithms to determine the port to which the packet should be
forwarded.
Next, it checks to see if each destination port is on the same VLAN as the PVID and thus
can transmit the frame. If the destination port is a member of the VLAN used by the ingress
port, the frame will be forwarded. If the received frame is tagged with VLAN information, the
switch checks its address table to see whether the destination port is a member of the same
VLAN. Assuming both ports are members of the tagged VLAN, the frame will be forwarded.
Ingress Filtering
The process of checking an incoming frame and comparing its VID with the ingress port
VLAN membership is known as Ingress Filtering.
On the Managed Switch, it can be either enabled or disabled.
