MNS-BB
Software User Guide
-88-
¾
In switch Y:
•
VLANs assigned to ports Y1 - Y4 can all be untagged if there is only one VLAN assignment per port.
Devices connected to these single VLAN ports do not have to be 802.1Q-compliant.
•
If both the Red VLAN and the Green VLAN are assigned to port Y5, at least one of the VLANs must
be tagged for this port. In both switches: The ports on the link between the two switches must be
configured the same. Referring to figure 9-54 (above), the Red VLAN can be untagged on port X7
and Y5 and the Green VLAN can be tagged on port X7 and Y5, or vice-versa if the Red and Green
VLAN’s are both on the link.
Note:
Each 802.1Q-compliant VLAN must have its own unique VID number, and that VLAN
must
be given the
same VID in every device in which it is configured. That is, if the Red VLAN has a VID of 10 in switch X, then
10 must also be used for the Red VID in switch Y.
VLAN tagging gives you several options:
•
Since the purpose of VLAN tagging is to allow multiple VLANs on the same port, any port that has
only one VLAN assigned to it can be configured as “Untagged” (the default).
•
Any port that has two or more VLANs assigned to it can have one VLAN assignment for that port as
“Untagged”. All other VLANs assigned to the same port must be configured as “Tagged”. (There can
be no more than one Untagged VLAN on a port.)
•
If all end nodes on a port comply with the 802.1Q standard and are configured to use the correct VID,
then, you can configure all VLAN assignments on a port as “Tagged” if doing so makes it easier to
manage your VLAN assignments, or for security reasons.
16.3
Rules of Tag Vlan Operation
After you select a VLAN mode for the system and create VLAN interfaces with VLAN
characteristics such as IEEE 802.1Q or no tagging and port membership, the system determines the
details of VLAN operation by observing two main types of rules:
•
Ingress rules
- Assign an incoming frame to a specific VLAN.
•
Egress rules
- Use standard bridging rules to determine whether the frame is forwarded, flooded,
or filtered. These rules also determine the tag status of the transmitted frame.
These rules are classified in the IEEE 802.1Q standard. In addition, the system relies on some system-
specific rules.
16.3.1 Ingress
Rules
These rules determine the VLAN to which an
incoming
frame belongs. The frame is assigned to the
VLAN that matches most closely. A protocol match hierarchy is used to find the most specific match.
The ingress rules, which are classified according to your VLAN mode, use the following process to
determine the most specific match:
1 .
IEEE 802.1Q tag VID value
2 .
The default VLAN (an untagged VLAN with all ports and a VID of 1), or any port-based VLAN
Ingress Rules for VLANs
•
If the frame is an IEEE 802.1Q tagged frame, the frame is assigned to the VLAN if the VID of
the frame matches that of the VLAN. If there is no VID match, the frame is dropped.
•
If the frame is not tagged, the frame is assigned to the VLAN if the receive port is untagged (that
is, if tagging is set to none) and if the receive port of the frame matches that of the VLAN. If
there is no match, the frame is dropped.
16.3.2 Egress
Rules
These rules determine whether the
outgoing
frame is forwarded, filtered (dropped), or flooded; they
also determine the frame's tag status. The frame is forwarded out of the port in the VID 2 VLAN
(where the address is known) and with the tag status of that port.
Standard Bridging Rules for Outgoing Frames
The frame is handled according to these bridging rules:
If the transmit port is tagged and is not a member of the assigned VLAN, the frame is dropped.
If the frame's destination address matches an address that was learned on the receive port, it is
filtered
(dropped).
