• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 106
  • Last Modified:

VLAN question

We currently have a switch with a VLAN 20 in the 172.16.0.x range. We need to add a second VLAN 69 to it that is in the 10.10.69.x range.

VLAN 69 is connected to a separate router on port 5, so my question is:

Will it work if I tag port 10 in VLAN 69 and make 11,12,13,14,15 member of VLAN 69? Will they be able to communicate with the router if I tag VLAN 69 on the router? VLAN 20 and 69 need to be able to communicate with each other as well.
IT Meetjesland
IT Meetjesland
  • 3
  • 3
1 Solution
Andy MIT Systems ManagerCommented:
If your router is VLAN capable and you have it tagged on VLAN 69 and Port 5 on the switch tagged on 69 then that will communicate (if it's not VLAN capable then have port 5 untagged on VLAN 69 and it should work fine). If you have ports 11-15 either tagged (for VLAN capable devices) or Untagged (for typical devices like PC's) on VLAN 69 then they should communicate fine with the router as well.

Regarding having both VLANS communicate with each other - you'd need some sort of routing device between the networks that can provide this functionality and have that device able to see both VLANS on the switch (probably using 2 ports - one tagged for 69, one tagged for 20)
assuming your existing setup worked previously and the hosts' gateways in vlan 20 were one of the router's ip, as long as the router has an ip in the 10.10.69.x range and that ip is the gateway of the hosts on the new range, they will be able to communicate with the existing hosts.

note that you may have ACLs that block some or all of the traffic. also note that if you don't use ACLs, there is little to no point in having different vlans since basically ALL the traffic is allowed between them.
IT MeetjeslandAuthor Commented:
Ok, thanks for the info guys.

Just one more question: is tagging the same as trunking?
The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.


in vlan context, a trunk is a connection over which tagged packets are sent

when you connect a host to a switch, usually the host is not aware of the vlan it is in. packets between the host and switch are not tagged. but the switch will let tagged packets in the corresponding vlan reach that host, untagging them in the process. and reversely it will tag packets sent by the host in that same vlan.

this happens when packets enter or leave the switch so this process amount to one tagging and one untagging when 2 hosts from the same vlan communicate with each other.

with trunks, both equipments send and receive tagged packets and act accordingly usually without performing any tranformations.

so when 2 hosts on different trunked switches speak together, the packets are tagged when they enter the first switch, then sent unchanged over the trunk by the first switch, accepted unmodified by the second switch, then untagged when they leave the second switch
IT MeetjeslandAuthor Commented:
I'm a bit confused, here's it what I get:

if you have 2 switches, each with ports 1-10 in VLAN 10 and ports 11-22 in VLAN 20.

You want PC's to be in VLAN 10 and Servers to be in VLAN 20, so you would :

VLAN10 untag ports 1-10 on each switch
VLAN20 untag ports 11-22 on each switch

This sets your hosts up. You want to use interface 24 to connect the switches.

VLAN10 tag port 24
VLAN20 tag port 24

So, the Interswitch links are TAGGED and the hosts are UNTAGGED

Now I'm confused where the trunking comes in.

I'm using HP Switches for this, HPE OfficeConnect 1920 24G.
the vocabulary differs between equipments.

trunking is what happens when you use TAGGED mode.
you use a trunk between port 24 of the switches. on this trunk, you'll let trough both vlans. internally this instructs the switch to let packets through without modifying their tags as long as they are on either vlan. this is required for the switches to be able to tell which vlan a packet is in.

actually you could link the switches with 2 separate cables each in one vlan ( configured like the other ports ) and it would work in the same way. it would just be a pita to add a 3rd vlan if required.

other ports will be set in "untagged mode" in vlan 10 or 20.  internally, this instructs the switch to provide untagged packets to the host but only allow packets to/from vlan 10 or 20. so the packets will be tagged/untagged as needed when they go in/out of the switch. this is not required but is more convenient because you don't have to setup vlans on the hosts themselves.

also note that obviously you'd need some kind of router or firewall if you want the clients and servers to communicate with one another
IT MeetjeslandAuthor Commented:
Problem solved by skullnobrains
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now