1

Hey,

Many similar topics and threads on this case, but still wanted to ask a question to see if my logic holds up.

I’m using a Zyxel GS1900-48 to setup a default VLAN topology and have run into the access/trunk/tagged/untagged debacle many people seem to have.

So from my understanding, to setup a VLAN topology on a Zyxel switch I need to:

  • Define VLAN on switch and firewall
  • Define Port PVID on switch
  • Define VLAN Port to “untagged” on a port to a client PC
  • Define VLAN Port to “tagged” on the port to the firewall, to allow intervlan routing.

I’ve done this in my lab and it works, however, in the port section of Zyxel, the port connecting to the firewall, is in PVID 1 (default) and does not have VLAN Trunk enabled.

Example:

Port 1, 2, 3, 4 = PVID 10
Port 5, 6, 7, 8 = PVID 20
Port 9, 10, 11, 12 = PVID 30
Port 13, 14, 15, 16 = PVID 40

Port 48 = PVID 1

Port 1, 2, 3, 4 = UNTAGGED for VLAN 10, Excluded for all other ports except port 48
Port 5, 6, 7, 8 = UNTAGGED for VLAN 20, Excluded for all other ports except port 48
Port 9, 10, 11, 12 = UNTAGGED for VLAN 30, Excluded for all other ports except port 48
Port 13, 14, 15, 16 = UNTAGGED for VLAN 40, Excluded for all other ports except port 48

Port 48 = TAGGED for every VLAN ID

The trunk port is used for passing traffic between switches and firewalls, but how come I do not need to enable it for the port connecting to my firewall? From what I can understand, a trunk port is only necessary to carry traffic which isnt assigned a VLAN ID to the firewall. Since the port is Tagged with a known VLAN, it will send the frame through to the connecting device, but this is exactly what a trunk port is for?

5 Spice ups
2

I might be completely talking outta my a** here, but you did do “trunking” on port 48 by tagging it with every VLAN ID - all traffic from all VLAN IDs can (and should be able to) pass through here. Your firewall just needs to have rules what to allow/block regarding traffic from specific VLAN IDs.

It seems counter-intuitive to UNTAG ports for a specific ID, rather than TAGGING it for the ID of VLAN traffic it should use them for. But that might just be the way your switch does things.

3

Didn’t read the whole question, so I could be wrong with my answer…:

Trunks are the ‘big pipes’ you use to forward all the VLAN traffic to another switch or router.

Next you have ports that will automatically put a ‘sticker’ on each connection that is established over it. These ports will also only accept the traffic that is labelled with the same sticker - the VLAN TAG.

Than you have some ports that are somewhat between a full trunk and tagged port. This could be a port for an accesspoint, where you would want to allow traffic labeled for multiple VLANs. Different than on the tagged ports, on these ports the packets ariving from the accesspoint would already carry the ‘sticker’ - VLAN TAG. But than there might be some packets, that arrive without a sticker (e.g if you connect a PC to the same port). To tell the switch what VLAN ID to apply to this traffic, you would use the untagged option.

Hope it’s simple enough to understand?

4

@bojanzajc6669 ​

Your last paragraph someone gives me an answer.

The Tagged function on the Zyxel switch tells that port to only allow traffic with an already established VLAN Tag. A trunk port will also forward untagged traffic with the default VLAN ID.

5

A “tag” is just a field in the Ethernet frame. It contains either exactly nothing (0) or a number.

An Ethernet device is a software program. You give it instructions that tell it how to handle traffic going into or out of a port.

Here are some of those instructions:

Allow any frame that has a vlan tag = 40 into this port. (Port configured to accept traffic tagged on 40.)

Allow any frame that has a vlan tag = 20 to go out of this port, but set the tag to 0 before doing to. (Port configured as untagged on 20.)

Allow any frame into this port that has a vlan tag field = 0 and change the tag to 30 inside the switch. Also allow any frame that has a vlan tag of 50. (Port configured as untagged on 30 and tagged on 50.)

If my firewall’s port is untagged, and I want the frames to be considered as belonging to vlan 5 when inside my switch, I would plug the firewall into a port untagged on vlan 5. If I also tag the switch port with vlans 10, 15, and 20, the firewall will ignore them because you programmed it (by configuring its port as untagged) to ignore any frame with a vlan tag not equal to 0.

1 Spice up