Allied Telesis 2.6.1 manual Summary of Vlan tagging rules, Protected VLANs

Layer 2 Switching 79

Summary of VLAN tagging rules

When designing a VLAN and adding ports to VLANs, the following rules apply.

1.Each port, except for the mirror port, must belong to at least one static VLAN. By default, a port is an untagged member of the default VLAN.

2.A port can be untagged for zero or one VLAN. A port that is untagged for a VLAN transmits frames destined for that VLAN without a VLAN tag in the Ethernet frame.

3.A port can be tagged for zero or more VLANs. A port that is tagged for a VLAN transmits frames destined for that VLAN with a VLAN tag, including the numerical VLAN Identifier of the VLAN.

4.A port cannot be untagged and tagged for the same VLAN.

5.The mirror port, if there is one, is not a member of any VLAN.

Protected VLANs

If a VLAN is Protected, Layer 2 traffic between ports that are members of a Protected VLAN is blocked. Traffic can be Layer 3 switched to another VLAN. This feature prevents members of a Protected VLAN from communicating with each other yet still allows members to access another network. Layer 3 Routing between Ports in a Protected VLAN can be prevented by adding a Layer 3 filter. The Protected VLAN feature also allows all of the members of the Protected VLAN to be in the same subnet.

A typical application is a hotel installation where each room has a port that can be used to access the Internet. In this situation it is undesirable to allow communication between rooms.

To create a Protected VLAN, use the command:

CREATE VLAN=vlan-nameVID=2..4094 [PROTECTED]

VLAN Interaction with STPs and Trunk Groups

Each VLAN and port can only belong to one Spanning Tree entity (STP). A port cannot be added to a VLAN that is in a different STP from the VLANs to which the port already belongs, with one exception. The exception is that an untagged port in the default VLAN can be moved from the default VLAN to any other VLAN in any STP, if the port belongs only to the default VLAN as an untagged port.

All the ports in a trunk group must have the same VLAN configuration: they must belong to the same VLANs and have the same tagging status, and can only be operated on as a group.

Software Release 2.6.1 C613-02039-00 REV A