Tagging And Untagging; Ingress Filtering - D-Link DES-6500 User Manual

D-Link DES-6500 Layer 3 Stackable Gigabit Ethernet Switch
A switch port can have only one PVID, but can have as many VIDs as the switch has memory
in its VLAN table to store them.
Because some devices on a network may be tag-unaware, a decision must be made at each
port on a tag-aware device before packets are transmitted – should the packet to be transmitted
have a tag or not? If the transmitting port is connected to a tag-unaware device, the packet
should be untagged. If the transmitting port is connected to a tag-aware device, the packet
should be tagged.

Tagging and Untagging

Every port on an 802.1Q compliant switch can be configured as tagging or untagging.
Ports with tagging enabled will put the VID number, priority and other VLAN information
into the header of all packets that flow into and out of it. If a packet has previously been
tagged, the port will not alter the packet, thus keeping the VLAN information intact. The
VLAN information in the tag can then be used by other 802.1Q compliant devices on the
network to make packet-forwarding decisions.
Ports with untagging enabled will strip the 802.1Q tag from all packets that flow into and out
of those ports. If the packet doesn't have an 802.1Q VLAN tag, the port will not alter the
packet. Thus, all packets received by and forwarded by an untagging port will have no 802.1Q
VLAN information. (Remember that the PVID is only used internally within the switch).
Untagging is used to send packets from an 802.1Q-compliant network device to a non-
compliant network device.

Ingress Filtering

A port on a switch where packets are flowing into the switch and VLAN decisions must be
made is referred to as an ingress port. If ingress filtering is enabled for a port, the switch will
examine the VLAN information in the packet header (if present) and decide whether or not to
forward the packet.
If the packet is tagged with VLAN information, the ingress port will first determine if the
ingress port itself is a member of the tagged VLAN. If it is not, the packet will be dropped. If
the ingress port is a member of the 802.1Q VLAN, the switch then determines if the
destination port is a member of the 802.1Q VLAN. If it is not, the packet is dropped. If the
destination port is a member of the 802.1Q VLAN, the packet is forwarded and the destination
port transmits it to its attached network segment.
If the packet is not tagged with VLAN information, the ingress port will tag the packet with
its own PVID as a VID (if the port is a tagging port). The switch then determines if the
destination port is a member of the same VLAN (has the same VID) as the ingress port. If it
does not, the packet is dropped. If it has the same VID, the packet is forwarded and the
destination port transmits it on its attached network segment.
This process is referred to as ingress filtering and is used to conserve bandwidth within the
switch by dropping packets that are not on the same VLAN as the ingress port at the point of
46