Taki Sadik
Cybersecurity & IT Professional, North York, ON, Canada
Contact

VLAN Configuration with 802.1Q Trunking and Tagging

IntermediateNetworking~4 hours
802.1QtrunkCisco IOS8021q

I segmented a shared switching fabric into four 802.1Q VLANs by trust level and carried them over a single tagged trunk. Tag-based isolation kept management, production, IoT, and DMZ traffic on separate broadcast domains across one physical link.

Objective & Context

VLANs partition a switch into isolated Layer 2 domains; 802.1Q tags identify each frame's VLAN across trunk links. This lab maps the same four-zone model used in the Proxmox zero-trust build, enforcing segmentation that complements Layer 3 routing and ACLs.

Learning Objectives

  • Create 802.1Q tagged VLAN interfaces on Linux.
  • Configure Cisco access ports and trunk ports with allowed VLAN lists.
  • Verify VLAN assignment and trunk status on both platforms.
  • Explain how tagging isolates broadcast domains across shared links.
  • Map the four-zone model (Mgmt, Prod, IoT, DMZ) to VLAN IDs.

Environment & Prerequisites

Prerequisites

  • A managed switch (or Linux bridge with 8021q) and two hosts.
  • VLAN plan: 10 Mgmt, 20 Prod, 30 IoT, 40 DMZ.
  • iproute2 with the 8021q module loaded.
  • A managed switch (or a Linux bridge with 8021q) and two test hosts.
  • VLAN plan: 10 Mgmt, 20 Prod, 30 IoT, 40 DMZ.
  • iproute2 with the 8021q kernel module loaded (modprobe 8021q).
  • Root or sudo access on the Linux host; privileged access on the switch.

Step-by-Step Execution

1. Create a tagged VLAN interface on Linux [PRIVILEGED]

ip link add link eth0 name eth0.20 type vlan id 20 && ip addr add 192.168.20.1/24 dev eth0.20

Expected output:

(no output on success)

What this teaches: a VLAN subinterface tags every frame it sends, which is how one NIC participates in many broadcast domains.

The new subinterface starts DOWN. Bring it up or it silently drops traffic: ip link set eth0.20 up. Verify tagging with ip -d link show eth0.20, which lists the vlan protocol and id.

2. Cisco access and trunk ports

switchport mode access ; switchport access vlan 20
switchport mode trunk ; switchport trunk allowed vlan 10,20,30,40

Expected output:

SW1(config)# interface Gi0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 20
SW1(config-if)# exit
SW1(config)# interface Gi0/24
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20,30,40

What this teaches: access ports belong to exactly one VLAN untagged, while trunks carry many VLANs tagged.

3. Verify VLAN assignment

show vlan brief

Expected output:

VLAN Name      Status    Ports
20   PROD      active    Gi0/2
40   DMZ       active    Gi0/4

What this teaches: verification on the switch, not the host, is the authority for which VLAN a port actually carries.

How It Works

VLANs partition a switch into isolated Layer 2 domains. Ports in different VLANs cannot exchange frames at Layer 2, even on the same hardware: broadcasts stay inside the VLAN, and unicast forwarding tables are per-VLAN. Isolation is enforced by the switch, not by addressing.

802.1Q tagging is how VLANs cross shared links. A trunk port inserts a 4-byte tag (a 2-byte TPID of 0x8100 plus a 2-byte tag control field carrying priority bits and the 12-bit VLAN ID) into each frame identifying its VLAN; the receiving switch reads the tag and delivers the frame to the right VLAN. Access ports are untagged: the switch assigns arriving frames to the port's configured VLAN.

VLAN IDs run from 1 to 4094 (0 and 4095 are reserved), so the 10/20/30/40 plan used here has room for hundreds of future segments. VLAN 1 is the Cisco default for all ports, which is why a real design moves management traffic off VLAN 1 and prunes it from trunks.

The four-zone model maps trust levels to VLANs: management (10) for infrastructure access, production (20) for services, IoT (30) for untrusted devices, DMZ (40) for internet-facing hosts. Routing between zones happens at Layer 3 with ACLs, which is why the VLAN lab pairs with the routing and ACL labs.

Validation & Testing

Place two hosts in different VLANs and confirm they cannot reach each other at Layer 2 without routing. Pass criteria: intra-VLAN traffic succeeds, inter-VLAN traffic requires the router, and trunk carries all tagged VLANs.

Troubleshooting

SymptomLikely causeFix
Hosts in the same VLAN cannot pingOne host is on the wrong VLAN or the trunk prunes itVerify access VLAN on both ports and the allowed list on every trunk in the path
Tagged interface shows no traffic8021q module not loaded or the parent link is downRun lsmod | grep 8021q and confirm the parent interface is UP
Native VLAN mismatch warningsTrunk ends disagree on the native (untagged) VLANSet the native VLAN explicitly on both ends or tag everything
Inter-VLAN traffic flows without a routerA misconfigured trunk or a host with two tagged interfaces bridging zonesAudit trunk allowed lists and check hosts for accidental bridging
VLAN hopping suspectedDouble-tagging attack against the native VLANAvoid using VLAN 1 as native, prune unused VLANs from trunks, and tag the native VLAN
Advanced: Troubleshooting
  • No connectivity on a VLAN: confirm the trunk allows that VLAN ID on both ends.
  • Native VLAN mismatch: align native VLAN to avoid tag leakage.
  • Linux tag dropped: ensure the 8021q module is loaded and the NIC passes tagged frames.

Key Results

  • Isolated 4 trust domains over a single physical trunk link.
  • Verified zero inter-VLAN leakage without an explicit routing path.
  • Reduced broadcast scope per segment to a single VLAN.
  • Aligned switching segmentation to the 4-VLAN zero-trust model.

Key Takeaways

  • Tagging is the mechanism; isolation is the property; verify both.
  • Keep native VLANs consistent and never use VLAN 1 for traffic.
  • Prune trunk allowed lists to only the VLANs each link needs.
  • VLANs segment Layer 2; inter-VLAN policy still needs routing plus ACLs.

Practice Challenges

Challenge 1: Prove isolation

Goal: Put two hosts in different VLANs on the same switch and demonstrate zero Layer 2 connectivity between them.

Hint: Use ping plus tcpdump on the trunk to show no frames cross.

Challenge 2: Router on a stick

Goal: Configure a single trunk to a Linux router with subinterfaces per VLAN and route between all four zones.

Hint: Create eth0.10 through eth0.40, address each, and enable ip_forward.