Filter
Top Products
D-Link DHS-3224V Switch User’s Guide
35
Within the switch, different PVIDs mean different VLANs. (remember that two VLANs cannot communicate
without an external router). So, VLAN identification based upon the PVIDs cannot create VLANs that extend
outside a given switch.
Every physical port on a switch has a PVID. 802.1Q ports are also assigned a PVID, for use within the switch.
If no VLANs are defined on the switch, all ports are then assigned to a default VLAN with a PVID equal to 1.
Untagged packets are assigned the PVID of the port on which they were received. Forwarding decisions are
based upon this PVID, in so far as VLANs are concerned. Tagged packets are forwarded according to the VID
contained within the tag. Tagged packets are also assigned a PVID, but the PVID is not used to make packet
forwarding decisions, the VID is.
Tag-aware switches must keep a table to relate PVIDs within the switch to VIDs on the network. The switch
will compare the VID of a packet to be transmitted to the VID of the port that is to transmit the packet. If the
two VIDs are different, the switch will drop the packet. Because of the existence of the PVID for untagged
packets and the VID for tagged packets, tag-aware and tag-unaware network devices can coexist on the same
network.
A switch port can have only one PVID, but can have as many VIDs as the switch has memory in its VLAN table
to store them.
Because some devices on a network may be tag-unaware, a decision must be made at each port on a tag-aware
device before packets are transmitted - should the packet to be transmitted have a tag or not? If the transmitting
port is connected to a tag-unaware device, the packet should be untagged. If the transmitting port is connected to
a tag-aware device, the packet should be tagged.
Tagging and Untagging Packets
Every port on an 802.1Q compliant switch can be configured as tagging or untagging.
Ports with tagging enabled will put the VID number, priority and other VLAN information into the header of all
packets that flow into and out of it. If a packet has previously been tagged, the port will not alter the packet, thus
keeping the VLAN information intact. The VLAN information in the tag can then be used by other 802.1Q
compliant devices on the network to make packet forwarding decisions.
Ports with untagging enabled will strip the 802.1Q tag from all packets that flow into and out of those ports. If
the packet doesn't have an 802.1Q VLAN tag, the port will not alter the packet. Thus, all packets received by
and forwarded by an untagging port will have no 802.1Q VLAN information. (Remember that the PVID is only
used internally within the switch). Untagging is used to send packets from an 802.1Q-compliant network device
to a non-compliant network device.
Ingress Filtering
A port on a switch where packets are flowing into the switch and VLAN decisions must be made is referred to as
an ingress port. If ingress filtering is enabled for a port, the switch will examine the VLAN information in the
packet header (if present) and decide whether or not to forward the packet.
If the packet is tagged with VLAN information, the ingress port will first determine if the ingress port itself is a
member of the tagged VLAN. If it is not, the packet will be dropped. If the ingress port is a member of the
802.1Q VLAN, the switch then determines if the destination port is a member of the 802.1Q VLAN. If it is not,
the packet is dropped. If the destination port is a member of the 802.1Q VLAN, the packet is forwarded and the
destination port transmits it to its attached network segment.
If the packet is not tagged with VLAN information, the ingress port will tag the packet with its own PVID as a
VID (if the port is a tagging port). The switch then determines if the destination port is a member of the same
VLAN (has the same VID) as the ingress port. If it does not, the packet is dropped. If it has the same VID, the
packet is forwarded and the destination port transmits it on its attached network segment.
This process is referred to as ingress filtering and is used to conserve bandwidth within the switch by dropping
packets that are not on the same VLAN as the ingress port at the point of reception. This eliminates the
subsequent processing of packets that will just be dropped by the destination port.