MAC Based and Protocol Based VLAN

What it is

MAC based and protocol based VLANs assign a frame to a VLAN from what the frame contains, not from the port it came in on.

In a port based VLAN, the port decides. In these two methods, the switch chip looks at the source MAC address, or at the Ethernet protocol type, and picks the VLAN from a rule.

If no rule matches, the frame falls back to the VLAN that the port normally assigns, which is the port VLAN ID.

How it works

The chip classifies each untagged frame, using the rule tables before the default port VLAN.

Port, MAC and protocol compared

All of them end in the same result. The frame is placed in a VLAN, and the VLAN table then decides where it can go.

MAC based VLAN

A rule names a source MAC address and the VLAN to apply.

Any untagged frame from that address enters the named VLAN, whichever port it arrives on. The rules are held in a table of the switch chip, on devices that support this. Use it for a device that must always sit in one VLAN, such as an IP phone or a printer that moves around the building.

The host table of the chip still learns addresses inside each VLAN. A host that moves to another port keeps its VLAN, because the rule follows the address.

Protocol based VLAN

A rule names an Ethernet type and the VLAN to apply.

The Ethernet type is the field that tells the receiver what the payload is, such as IPv4, ARP or IPv6. A protocol rule puts all frames of that type into one VLAN. It was used to keep older protocols apart from IP traffic, and it is rare in new networks.

Protocol rules are coarse. For example, all IPv4 traffic on a port would match one rule, so there is little room to separate two IP networks.

Where the rules live

These features belong to the switch chip, and are set under the /interface ethernet switch menu.

/interface ethernet switch print
/interface ethernet switch vlan print

The rule tables depend on the chip and the RouterOS version, and not every device has them. The exact submenu and its parameters are not covered here, so check the documentation for the device in use.

Bridge VLAN filtering classifies frames by port and by tag only. If the device lacks chip support for these methods, use port based VLANs instead.

Planning points

Think about these before you choose either method.

1. The rules must be created on every switch where the device can appear.
2. The VLAN table must include the destination ports, or traffic stays on the access port.
3. Trunk ports need the VLAN tagged, so the classification result travels to other switches.
4. The fallback is the port VLAN ID, so set a sensible default.

Why these methods are uncommon

They need more management effort than port based VLANs.

Every new device needs a rule, and every replaced network card changes a MAC address. Tag based and port based VLANs are simpler to run, and they are what most networks use.