One switch, several networks 12 min read
VLANs, Access Ports, and Trunks
Learn how VLANs create separate Layer 2 networks, how endpoints receive untagged traffic, and how trunks carry several VLANs over one link.
- Describe a VLAN as a separate Layer 2 broadcast domain.
- Distinguish access ports from trunk ports.
- Explain tagged traffic, untagged traffic, PVIDs, and native VLANs.
- Trace one VLAN from an endpoint across a switch uplink.
One physical switch can act like several
A VLAN—Virtual Local Area Network—divides switching infrastructure into separate Layer 2 broadcast domains. Devices in different VLANs behave as though they are attached to different switches, even when they occupy adjacent physical ports.
VLAN numbers are labels, not IP networks. A clean design may pair VLAN 20 with 172.16.20.0/24, but that is an administrative convention. Routing is still required when traffic needs to cross from one VLAN and subnet to another.
Access ports hide the tags
An access port normally connects an ordinary endpoint to one VLAN. The endpoint sends and receives ordinary untagged Ethernet frames. The switch associates incoming untagged traffic with the configured access VLAN.
The PVID—Port VLAN Identifier—is the VLAN assigned to incoming untagged traffic. Many switch interfaces set the access VLAN, PVID, and untagged membership together. Others expose them as separate controls.
Trunks carry several VLANs
A trunk commonly connects switches, routers, firewalls, wireless access points, or virtualization hosts. An 802.1Q tag identifies the VLAN belonging to each frame, allowing several logical networks to share one physical link.
The same VLAN may therefore be untagged toward an endpoint and tagged across every infrastructure uplink. Both ends of the trunk must agree about the allowed VLANs and about any VLAN carried untagged.
- Access port: normally one untagged endpoint VLAN.
- Trunk: multiple VLANs, normally tagged.
- PVID: classification applied to incoming untagged frames.
- Native VLAN: a VLAN intentionally carried untagged on a trunk.
Native VLAN mismatches are sneaky
If one switch treats untagged trunk traffic as VLAN 10 while the other treats it as VLAN 20, the link may remain up while traffic quietly enters the wrong network. DHCP, management, and discovery failures can appear inconsistent because only the untagged VLAN is affected.
A practical BMT standard is to document every trunk's allowed VLANs and tagging state. When supported, tagging all operational VLANs across infrastructure links removes one category of ambiguity.
Put it in an AV system.
Dante plus control
A DSP control interface can use an access port in VLAN 20 while its Dante interface uses an access port in VLAN 30. Both VLANs cross the switch uplink as tagged traffic.
A tag-aware AV endpoint
A Visionary Solutions Duet-5 encoder can act as a VLAN-aware endpoint instead of an ordinary access-port device. Its LAN1 connection can carry tagged video traffic, Dante/AES67 audio, and a separate network assigned to the LAN2 expansion port—up to three VLANs over one physical switch connection. With tagging disabled, video, audio, control, and anything plugged into LAN2 share the same flat VLAN. That can place Dante on the wrong network and let an unauthorized device plugged into the expansion port land directly on the video network. With tagging enabled, the encoder sorts each traffic type into its configured VLAN, but the connected switch port must be configured as a trunk with the same VLAN IDs permitted and tagged. This is a useful example of an endpoint that understands 802.1Q tags itself.
One SSID, several roles
A wireless AP can assign users or private passphrases to different VLANs while transporting them over one trunk. Vendors call this PPSK, DPSK, MPSK, or similar names.
- VLAN
- Virtual LAN; a separate Layer 2 broadcast domain.
- 802.1Q
- The Ethernet VLAN-tagging standard.
- Access port
- A port normally presenting one untagged VLAN to an endpoint.
- Trunk
- A link carrying multiple VLANs, usually with tags.
- PVID
- The VLAN assigned to an incoming untagged frame.
Trace the VLAN path
Pick one AV endpoint and trace its VLAN from endpoint port to every uplink and finally to the gateway. Record where the VLAN is untagged, where it is tagged, and whether every trunk explicitly permits it.
Three quick questions.
01Does a normal endpoint need to understand VLAN tags on an access port?
Usually not. The switch adds or removes the required VLAN association.
02Can one VLAN be tagged on a trunk and untagged on an endpoint port?
Yes. Tagging describes how frames appear on a particular link.
03Do VLANs automatically prevent routed communication?
No. Routers, ACLs, and firewall policies determine what may cross between VLANs.