2.1 VLAN Segmentation and 802.1Q Tags

VLAN Architecture & Segmentation Fundamentals

In a flat, unsegmented Layer 2 network, all connected devices share a single, monolithic broadcast domain. Whenever any network endpoint issues a broadcast frame (such as an ARP request or DHCP Discover), an unknown unicast frame, or a multicast frame—collectively referred to as BUM traffic—the switch is obligated by standard bridging rules to flood that frame out of every active physical interface within the broadcast domain, excluding the ingress port. In an enterprise environment hosting hundreds or thousands of user endpoints, servers, and IoT sensors, continuous BUM flooding consumes substantial link bandwidth and forces the network interface card (NIC) of every unconcerned host to interrupt its CPU to parse irrelevant frames.

Furthermore, flat networks lack intrinsic security boundaries. A compromised workstation or a rogue network scanner can freely sniff broadcast transmissions, spoof Layer 2 identities, or launch man-in-the-middle ARP poisoning attacks against any adjacent device. A physical bridging loop or a malfunctioning host NIC generating a broadcast storm will rapidly saturate the entire switched infrastructure, causing campus-wide denial of service.

Virtual Local Area Networks (VLANs), standardized under IEEE 802.1Q, solve these scalability and security liabilities by logically partitioning a single physical switch or a distributed campus fabric into multiple isolated broadcast domains. Although workstations in different VLANs may connect to the same physical switch chassis or share common inter-switch uplinks, their Layer 2 traffic remains strictly separated in hardware. A broadcast frame generated by a host in VLAN 10 is constrained entirely to ports associated with VLAN 10; it cannot cross into VLAN 20 without traversing a Layer 3 routing engine. This architecture yields four key operational advantages:

1. Broadcast Containment: BUM traffic is localized to relevant workgroups, preserving switch backplane capacity and host CPU cycles.
2. Security Segmentation: Sensitive business entities—such as Finance, Human Resources, Guest Wi-Fi, and Management—are isolated into distinct broadcast domains, establishing natural choke points for firewall filtering and access control lists.
3. Departmental & Functional Flexibility: Users can be grouped logically by business function rather than physical location. An engineer moving to a different floor can remain in the Engineering VLAN without rewiring patch panels.
4. Failure Domain Isolation: Spanning Tree Protocol (STP) topology changes, rogue DHCP servers, and broadcast storms originating within one VLAN are quarantined, preventing collateral degradation across other business units.

The IEEE 802.1Q Frame Format

To multiplex traffic belonging to hundreds of distinct VLANs across a single physical inter-switch link, switches must attach metadata to each Ethernet frame identifying its VLAN membership. The IEEE 802.1Q standard defines an encapsulation mechanism that inserts a 4-byte (32-bit) tag directly into the standard Ethernet II frame header. This tag is positioned immediately after the 6-byte Source MAC Address field and immediately prior to the 2-byte EtherType/Length field. Because inserting these 4 bytes alters the frame length and contents, the transmitting switch recalculates the 4-byte Frame Check Sequence (FCS) at the tail of the frame.

Standard Ethernet II Frame:
+---------------+---------------+-------------------+----------------+---------+
| Dest MAC (6B) | Src MAC (6B)  |  EtherType (2B)   |  Payload (IP)  | FCS (4B)|
+---------------+---------------+-------------------+----------------+---------+

IEEE 802.1Q Tagged Frame:
+---------------+---------------+---------+---------+----------------+---------+
| Dest MAC (6B) | Src MAC (6B)  | 802.1Q  | Ether-  |  Payload (IP)  | FCS (4B)|
|               |               | Tag(4B) | Type(2B)|                |         |
+---------------+---------------+---------+---------+----------------+---------+
                                /         \
    +--------------------------+           +--------------------------+
    |       TPID (16 bits)     |                 TCI (16 bits)        |
    |          0x8100          |  PCP (3b)  |  DEI (1b)  |  VID (12b) |
    +--------------------------+------------+------------+------------+

The 4-byte 802.1Q header is divided into two primary 16-bit fields:

1. Tag Protocol Identifier (TPID) — 16 Bits

The TPID field contains the fixed hexadecimal value 0x8100. This value signifies to any downstream Ethernet device that an 802.1Q tag header follows. If an older or non-compliant device receives this frame, it reads 0x8100 as an unsupported EtherType and drops the frame. In carrier Ethernet and QinQ (802.1ad) double-tagging architectures, service providers often configure alternative outer TPIDs (such as 0x88a8 or 0x9100), which Junos supports under the tag-protocol-id configuration hierarchy.

2. Tag Control Information (TCI) — 16 Bits

The remaining 16 bits of the 802.1Q tag govern traffic priority, drop eligibility, and VLAN identification. The TCI is subdivided into three specific fields:

• Priority Code Point (PCP) — 3 Bits: Encodes 8 distinct priority levels (0 through 7) specified by IEEE 802.1p. These bits provide Class of Service (CoS) classification directly at Layer 2. Real-time voice traffic is typically marked with PCP 5 (Expedited Forwarding), video traffic with PCP 4, and best-effort enterprise data with PCP 0.
• Drop Eligible Indicator (DEI) — 1 Bit: Historically called the Canonical Format Indicator (CFI) in Token Ring bridging. Under modern 802.1Q-2011 standards, this single bit flags frames that network switches may drop first during downstream queue congestion.
• VLAN Identifier (VID) — 12 Bits: Explicitly identifies the VLAN to which the frame belongs. With a 12-bit address space, exactly $2^{12} = 4,096$ distinct values (0 through 4095) can be represented.

Reserved and Usable VLAN Identifier Ranges

The 12-bit VID field enforces strict conventions across all enterprise switching platforms: