2.3 VLANs and IEEE 802.1Q Tagging

VLANs and IEEE 802.1Q Tagging

In a flat, unsegmented switched network, eligible broadcast and unknown-unicast traffic is flooded within the bridged domain, excluding ingress and obeying port state and policy. As networks expand to hundreds or thousands of connected hosts, this broadcast overhead consumes substantial interface bandwidth and host CPU processing power. Virtual Local Area Networks (VLANs) solve this scaling challenge by logically dividing physical Layer 2 infrastructure into isolated broadcast domains. Standardized under IEEE 802.1Q, VLAN tagging allows multiple distinct logical networks to share physical switches and high-speed trunk links without traffic bleed.

---

Virtual Local Area Network (VLAN) Fundamentals

A VLAN is a logical grouping of network devices that behave as if they were connected to the same standalone physical switch, regardless of their physical location across a campus or datacenter.

Physical Switch Fabric
+-------------------------------------------------------------+
|  VLAN 10 (Engineering)        |  VLAN 20 (Finance)          |
|  Broadcast Domain 1           |  Broadcast Domain 2         |
|  Subnet: 192.168.10.0/24      |  Subnet: 192.168.20.0/24    |
|  [Host A]    [Host B]         |  [Host C]    [Host D]       |
+-------------------------------------------------------------+
        |                               | 
        +------> NO LAYER 2 TRAFFIC <---+
            (Requires Layer 3 Router)

Core Benefits of VLAN Segmentation

1. Broadcast Containment: Broadcast frames (such as initial ARP requests and DHCP discoveries) and VLAN-scoped multicast such as IPv6 Neighbor Solicitations are confined strictly to the originating VLAN. The storm is not bridged into VLAN 20, but shared hardware or links can still be congested.
2. Security and Traffic Isolation: Hosts within different VLANs cannot communicate directly at Layer 2. Sensitive financial, medical, or management systems are isolated from general user traffic. Communication between VLANs requires passing through a Layer 3 device (such as a router or firewall) where access control lists (ACLs) and stateful inspection can be enforced.
3. Physical Topology Flexibility: Users in the same department can belong to the same logical IP subnet and broadcast domain even if they are physically situated on different floors, in different buildings, or connected to different access switches.
4. Cost Efficiency: Multiple departments and service tenants share common enterprise switch hardware, power supplies, and cabling infrastructure rather than requiring dedicated physical switching hardware.

Inter-VLAN Routing Requirement

Because switches enforce strict Layer 2 isolation between different VLANs, a host in VLAN 10 cannot send an Ethernet frame directly to a host in VLAN 20. Inter-VLAN communication mandates a Layer 3 routing device:

• Router-on-a-Stick: A single physical router interface connects to a switch trunk port using logical subinterfaces, with each subinterface terminating an 802.1Q VLAN tag.
• Multilayer Switch: A Layer 3 switch terminates VLANs internally using Switched Virtual Interfaces (SVIs), routing packets between VLANs at hardware line rate.
• Nokia Service Router Routed Interfaces: On the Nokia 7750 SR, VLANs are bound to Layer 3 interfaces within an Internet Enhanced Service (IES) or Virtual Private Routed Network (VPRN) using dot1q Service Access Points (SAPs).

---

The IEEE 802.1Q Frame Format: Deep Dive into the 4-Byte Tag

To multiplex frames from multiple VLANs across a single physical link (a trunk), the transmitting switch inserts a 4-byte (32-bit) IEEE 802.1Q header into the original Ethernet frame. The tag is inserted immediately following the Source MAC address and precedes the original EtherType/Length field.

Standard Untagged Frame:
+----------+----------+-------------------+--------------------+---------+
| DMAC (6) | SMAC (6) | EtherType (2)     | Payload (46-1500)  | FCS (4) |
+----------+----------+-------------------+--------------------+---------+

IEEE 802.1Q Tagged Frame:
+----------+----------+-------------------+-------------------+--------------------+---------+
| DMAC (6) | SMAC (6) | 802.1Q Tag (4)    | EtherType (2)     | Payload (46-1500)  | FCS (4) |
+----------+----------+-------------------+-------------------+--------------------+---------+
                      |                   |
                      +-> TPID (16 bits)  +-> TCI (16 bits)
                                              |-> PCP (3 bits)
                                              |-> DEI (1 bit)
                                              +-> VID (12 bits)

Insertion of the 4-byte tag expands the maximum legal standard Ethernet frame size from 1518 bytes to 1522 bytes without altering the 1500-byte IP payload.

Breakdown of the 4-Byte 802.1Q Header Fields

Priority Code Point (PCP / IEEE 802.1p)

The 3-bit PCP field allows switches to classify and prioritize time-sensitive traffic at Layer 2 into policy-defined priority treatments; eight PCP values do not mandate eight hardware queues:

Drop Eligible Indicator (DEI)

Originally termed the Canonical Format Indicator (CFI) in early 802.1Q standards (used to indicate Token Ring bit ordering), the IEEE repurposed this single bit as the Drop Eligible Indicator (DEI) in IEEE 802.1Q-2011. When network links experience buffer congestion, switches inspect the DEI bit. DEI can influence congestion discard eligibility when the configured policy uses it; it does not guarantee delivery for DEI = 0.

VLAN Identifier (VID) Ranges

The 12-bit VID field supports 4,096 numerical values:

• VID 0 (Priority-Tagged Frame): Indicates that the frame carries 802.1p priority information in its PCP bits, but does not belong to a specific VLAN. Receiving switches process the frame as untagged traffic on the port's native or default VLAN.
• VID 1: An ordinary usable VLAN ID. Many enterprise switches initially use it, but that is not a universal SR OS service default.
• VID 1 through 4094: Usable VLAN identifiers. Vendor “normal” and “extended” ranges are not general IEEE or Nokia rules.
• VID 4095 (Reserved): Reserved by IEEE standards for internal system implementation and cannot be configured or transmitted.

Access Ports vs. Trunk Ports: Operational Mechanics

Ethernet switch interfaces are configured into one of two fundamental operational roles:

1. Access Ports (Untagged Mode)

An access port connects to standard end-user devices (workstations, printers, IP surveillance cameras, and non-virtualized servers) that do not understand 802.1Q headers:

• An access port belongs statically to a single VLAN.
• Ingress Processing: When an end device transmits a standard untagged Ethernet frame into an access port, the switch internally attaches the port's configured VLAN ID to the frame.
• Forwarding: The switch restricts frame forwarding exclusively to ports participating in that assigned VLAN.
• Egress Processing: Before transmitting the frame out an access port to the target endpoint, the switch strips the VLAN tag. The receiving host receives a standard untagged frame.

2. Trunk Ports (Tagged / Dot1q Mode)

A trunk port interconnects VLAN-aware devices, such as switch-to-switch uplinks, switch-to-router connections, and virtualization servers running VMware ESXi or KVM hypervisors:

• A trunk port carries traffic for multiple VLANs across a single physical link.
• Preservation of Tags: When frames traverse a trunk port, the switch preserves the 4-byte 802.1Q tag on the wire. The receiving switch inspects the VID to place the frame into the appropriate VLAN.
• VLAN Pruning: Administrators can explicitly configure an allowed VLAN list (the platform-specific allowed-VLAN configuration) on trunk ports to restrict traffic to only necessary VLANs, preventing unnecessary broadcast propagation across inter-switch links.

---

Native VLAN Architecture and Security Considerations

Many enterprise switches call the untagged VLAN on a trunk the native VLAN. The underlying classification/tagging behavior is platform-specific; do not assume the same defaults or commands on Nokia SR OS:

• Native VLAN Definition: A designated VLAN configured on an 802.1Q trunk port that carries untagged traffic.
• Egress Behavior: When a switch forwards a frame belonging to the configured native VLAN across an 802.1Q trunk, it omits the 802.1Q tag, transmitting an untagged frame; 1518 is its ordinary maximum, not every frame’s size.
• Ingress Behavior: When a switch receives an untagged frame on an 802.1Q trunk port, it automatically classifies the frame into that port's configured native VLAN.
• Default Configuration: Native/untagged handling is platform-specific. On SR OS, inspect port encapsulation and SAP matching rather than assuming VLAN 1.

Security Vulnerability: Double-Tagging VLAN Hopping Attack

On vulnerable configurations that accept double-tagged access traffic and remove an outer native tag, a double-tagging attack can inject traffic into another VLAN. This behavior depends on the switch implementation and configuration:

[Attacker on Native VLAN 1]
      |
      | Crafts frame with TWO tags:
      | Outer Tag: VLAN 1 (Native) | Inner Tag: VLAN 20 (Target)
      v
[Switch A]
      |
      | Egress out Trunk: Native VLAN tag is STRIPPED
      | Frame sent onto trunk carrying ONLY Inner Tag: VLAN 20
      v
[Switch B]
      |
      | Reads Tag: VLAN 20!
      | Forwards directly to Target Host in VLAN 20 (Bypasses Router/Firewall)
      v
[Victim in VLAN 20]

1. An attacker connected to an access port on the native VLAN (e.g., VLAN 1) transmits a frame with two 802.1Q tags: an outer tag matching the native VLAN (VLAN 1) and an inner tag matching the victim's VLAN (e.g., VLAN 20).
2. Switch A receives the frame, determines that the destination lies across the trunk, and notes that the outer tag matches the trunk's native VLAN.
3. In this vulnerable configuration, Switch A strips the outer native tag before sending the frame across the trunk. Crucially, the inner tag (VLAN 20) remains intact.
4. Switch B receives the frame across the trunk, inspects the first tag it encounters (the inner tag for VLAN 20), and forwards the frame into VLAN 20.
5. The attacker successfully delivers a packet into VLAN 20 without traversing a Layer 3 firewall or router.

Mitigating Native VLAN Attacks

To secure switched infrastructure against VLAN hopping and unauthorized access, network engineers apply the following industry best practices:

• Change the Native VLAN: Reassign the native VLAN from default VID 1 to an unused, dedicated dummy VLAN ID (e.g., VLAN 999) across all trunk ports.
• Do Not Assign Endpoints: Ensure that no access ports or user devices are ever assigned to the dummy native VLAN.
• Enforce Native VLAN Tagging: Enable native VLAN tagging (the platform’s supported native-tagging configuration; these are enterprise-switch concepts, not interchangeable Nokia MD-CLI commands), forcing the switch to append an 802.1Q tag to all frames traversing trunk links, including native VLAN traffic.
• Explicitly Prune VLAN 1: Remove VLAN 1 from the allowed VLAN list on all inter-switch trunks.

---

QinQ (IEEE 802.1ad) Double Tagging in Carrier Ethernet

While enterprise networks operate effectively with standard 802.1Q tagging, service providers face a scalability bottleneck when delivering Layer 2 VPN services to enterprise customers:

• VLAN ID Exhaustion: The 12-bit VID field allows only 4,094 distinct VLANs. A service provider with hundreds of business customers rapidly exhausts this namespace.
• Customer VLAN Collisions: Two independent enterprise customers connected to the same service provider network often use the same internal VLAN IDs (e.g., both Customer A and Customer B use VLAN 10 for HR and VLAN 20 for Engineering).

The QinQ Architecture (VLAN Stacking)

Standardized under IEEE 802.1ad (Provider Bridging) and commonly called QinQ (802.1Q-in-802.1Q), double tagging solves this challenge by appending a second 4-byte 802.1Q header onto the frame:

QinQ Double-Tagged Frame Structure:
+----------+----------+--------------------+--------------------+---------------+--------------------+---------+
| DMAC (6) | SMAC (6) | S-Tag (4 Bytes)    | C-Tag (4 Bytes)    | EtherType (2) | Payload (46-1500)  | FCS (4) |
+----------+----------+--------------------+--------------------+---------------+--------------------+---------+
                      |                    |
                      +-> TPID: 0x88A8     +-> TPID: 0x8100
                          S-VID: Provider      C-VID: Customer

1. Customer-VLAN (C-Tag / C-VLAN): The inner tag, preserving the customer's private VLAN ID (1 to 4094) with TPID 0x8100.
2. Service-VLAN (S-Tag / S-VLAN): The outer tag, applied by the service provider's Provider Edge (PE) router with standardized TPID 0x88A8 (though legacy implementations sometimes use 0x8100 or 0x9100). The S-VID uniquely identifies the customer service instance across the provider metro core.

Two tags add 8 bytes to a given frame: a maximum-size 1518-byte untagged frame becomes 1526 bytes including FCS. This is a maximum-size example, not a new minimum. Add control words, labels, and outer-link overhead separately using each Nokia MTU field’s counting convention.

---

VLAN Configuration and SAPs in Nokia SR OS

On the Nokia 7750 SR, physical Ethernet ports are configured with an encapsulation type defining how VLAN tags are parsed:

• encap-type null — The whole port identifies the SAP; customer tags can remain payload rather than service delimiters.
• encap-type dot1q — Port processes single 802.1Q tagged frames.
• encap-type qinq — Port processes double-tagged 802.1ad frames.

Service Access Points (SAPs)

In Nokia SR OS, a Service Access Point (SAP) defines the physical port and encapsulation parameters where customer traffic enters a service (such as an Epipe VLL, VPLS, or IES):

## Configuring a physical port for dot1q encapsulation in SR OS Classic CLI:
A:7750-SR# configure port 1/1/1
A:7750-SR>config>port# ethernet mode access
A:7750-SR>config>port# ethernet encap-type dot1q
A:7750-SR>config>port# no shutdown

## Creating a Service Access Point (SAP) matching single-tag VLAN 100 in VPLS 10:
A:7750-SR# configure service vpls 10 customer 1 create
A:7750-SR>config>service>vpls# sap 1/1/1:100 create
A:7750-SR>config>service>vpls>sap# no shutdown

Nokia SR OS SAP Encapsulation Formats

Primary technical reference

Specification or Nokia manual, checked October 20, 2026. Examples are teaching scenarios, not captured router execution.