Ethernet Technology Basics · Topic 2 of 5

VLAN Principles and Configuration

Learn what a VLAN is, the 802.1Q tag, PVID, access, trunk and hybrid port frame handling, VLAN assignment and VRP configuration for HCIA-Datacom.

6 min

In a nutshell

The 802.1Q tag is 4 bytes: TPID 0x8100, PRI 3 bits, CFI 1 bit, VID 12 bits.
Usable VLAN IDs are 1 to 4094; VLAN 1 is the default.
The PVID is VLAN 1 by default and is used for untagged frames.

What it is

A VLAN (virtual LAN) splits one physical switched network into separate logical broadcast domains. Hosts in the same VLAN talk directly at Layer 2, while hosts in different VLANs need a Layer 3 device, such as a router or a Vlanif interface on a Layer 3 switch.

VLANs limit broadcast traffic, improve security by separating groups, and let you group users by department or service instead of by location. Switches mark which VLAN a frame belongs to with an IEEE 802.1Q tag.

How it works

The 802.1Q tag

The 4-byte tag sits between the source MAC and the Type field.

Field	Size	Meaning
TPID	16 bits	0x8100, marks the frame as tagged
PRI	3 bits	802.1p priority, 0 to 7
CFI	1 bit	Canonical format indicator, 0 on Ethernet
VID	12 bits	VLAN ID, 0 to 4095

VLAN IDs 0 and 4095 are reserved, so usable VLANs are 1 to 4094. VLAN 1 exists by default and cannot be deleted.

Links, PVID and port types

An access link usually connects a terminal and carries untagged frames. A trunk link usually connects switches and carries frames of many VLANs, mostly tagged. The PVID (port default VLAN ID) is the VLAN a port gives to untagged frames it receives; it is VLAN 1 by default.

Port type	Receiving an untagged frame	Receiving a tagged frame	Sending a frame
Access	Tags it with the PVID	Accepts only if VID equals PVID	Removes the tag
Trunk	Tags it with the PVID if the PVID is allowed	Accepts if the VID is allowed	Removes the tag if VID equals PVID, otherwise keeps it; the VID must be allowed
Hybrid	Tags it with the PVID if the PVID is allowed	Accepts if the VID is allowed	Untagged or tagged, as set per VLAN by the hybrid lists

An access port belongs to one VLAN. A trunk port allows only VLAN 1 by default and you add others. A hybrid port mixes untagged and tagged VLANs, so it can connect both a PC and another switch. The HCIA course and many older S series versions use hybrid as the default link type. Newer S series versions default to negotiation-desirable, where LNP negotiates access or trunk with the peer, so check with display port vlan.

VLAN assignment methods

Method	A frame belongs to a VLAN based on
Interface	The port it arrives on (most common)
MAC address	The source MAC address
IP subnet	The source IP subnet
Protocol	The protocol type, such as IPv4 or IPv6
Policy	A combination, such as MAC plus IP plus port

VLAN application

Plan VLANs by department, service or user type, for example one VLAN for staff, one for guests, one for voice and one for management. Give each VLAN its own IP subnet. Keep VLAN 1 out of user traffic and allow only the needed VLANs on each trunk.

Communication between VLANs needs Layer 3. On a Layer 3 switch you create interface Vlanif10 with an IP address that acts as the gateway for VLAN 10.

Configuration examples

[SW1] vlan batch 10 20
[SW1] interface GigabitEthernet0/0/1
[SW1-GigabitEthernet0/0/1] port link-type access
[SW1-GigabitEthernet0/0/1] port default vlan 10
[SW1-GigabitEthernet0/0/1] quit
[SW1] interface GigabitEthernet0/0/24
[SW1-GigabitEthernet0/0/24] port link-type trunk
[SW1-GigabitEthernet0/0/24] port trunk allow-pass vlan 10 20

A hybrid example, where the port sends VLAN 10 and 20 untagged and VLAN 30 tagged:

[SW1-GigabitEthernet0/0/2] port link-type hybrid
[SW1-GigabitEthernet0/0/2] port hybrid pvid vlan 10
[SW1-GigabitEthernet0/0/2] port hybrid untagged vlan 10 20
[SW1-GigabitEthernet0/0/2] port hybrid tagged vlan 30

vlan batch 10 to 20 creates a range. port trunk pvid vlan 10 changes a trunk's PVID. Use display vlan to see VLANs and their ports, and display port vlan to see each port's link type, PVID and allowed VLANs.

A worked example

SW1 GE0/0/1 is an access port in VLAN 10. The trunk GE0/0/24 has PVID 1 and allows VLANs 1, 10 and 20. PC1 sends an untagged frame, and GE0/0/1 tags it with VLAN 10.

On the trunk, VLAN 10 is allowed and differs from the PVID, so the frame leaves tagged. If the trunk did not allow VLAN 10, the frame would be dropped on the trunk and PC1 could not reach PCs in VLAN 10 on SW2.

How the exam asks about this

"An access port with PVID 10 receives a frame tagged VLAN 20. What happens?" → The frame is discarded.
"A trunk port with PVID 1 sends a frame of VLAN 1. Is it tagged?" → No, the tag is removed because the VID equals the PVID.
"Which port type can send frames of several VLANs untagged?" → The hybrid port.

What to remember for the exam

The 802.1Q tag is 4 bytes: TPID 0x8100, PRI 3 bits, CFI 1 bit, VID 12 bits.
Usable VLAN IDs are 1 to 4094; VLAN 1 is the default.
The PVID is VLAN 1 by default and is used for untagged frames.
A trunk allows only VLAN 1 until you add VLANs with port trunk allow-pass vlan.
Different VLANs need Layer 3, such as a Vlanif interface, to communicate.

Watch out

A port's PVID tags untagged frames, but on a trunk or hybrid port the PVID must also be allowed. Setting the PVID alone does not allow that VLAN.

Common mistakes

Using Cisco terms. VRP sets an access VLAN with port default vlan, not switchport access vlan, and uses port trunk allow-pass vlan.

Thinking a trunk carries all VLANs by default. A Huawei trunk allows only VLAN 1 until you add the others.

Forgetting VLAN creation. Assigning a port to VLAN 10 needs VLAN 10 to exist first, created with vlan 10 or vlan batch.

Check yourself

How many bits is the VLAN ID field, and which VLAN IDs can you use?
12 bits; VLAN IDs 1 to 4094 are usable, since 0 and 4095 are reserved.
What does an access port do with an untagged frame it receives?
It tags the frame with its PVID, the VLAN it belongs to.
Which command shows each port's link type and PVID?
display port vlan, while display vlan shows the VLANs and their member ports.

Topic 2 of 5 in Ethernet Technology Basics

Test yourself on Ethernet Technology Basics

The full Huawei HCIA-Datacom H12-811 question bank has 600 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.