VLAN Tagging | Cloud Concepts

What is VLAN Tagging

IEEE 802.1Q VLAN tagging lets switches and routers distinguish traffic belonging to different broadcast domains on shared Ethernet infrastructure. In cloud connectivity, it commonly separates logical connections on a private circuit, while IP addressing, gateways, and routing determine which destinations each connection can reach.

VLAN tagging is a Layer 2 mechanism for carrying multiple virtual LANs over shared Ethernet links. IEEE 802.1Q inserts a four-byte tag into an Ethernet frame, including a 12-bit VLAN identifier. VLAN IDs 1 through 4094 identify ordinary VLANs; ID 0 is used for priority-tagged frames, and ID 4095 is reserved. The tag also contains priority and drop-eligibility information, but a VLAN ID primarily identifies the frame’s Layer 2 forwarding context.

Within a switched network, each VLAN normally forms a separate broadcast domain. Switches forward frames within that VLAN rather than freely mixing traffic across VLANs. An access port typically carries untagged endpoint traffic and associates it with one VLAN. A trunk carries traffic for multiple VLANs, usually using tags to distinguish them. Depending on configuration, a trunk may also carry an untagged native VLAN. Both ends must agree on tagging behavior and which VLANs are allowed.

VLAN membership does not replace IP addressing or routing. Devices in the same VLAN commonly use the same IP subnet, but VLAN IDs and IP subnet numbers have no inherent relationship. Communication between different IP subnets requires a Layer 3 forwarding device, such as a router or multilayer switch. That device can provide a default gateway through a switched virtual interface or a tagged router subinterface. Routing tables and security policies then control communication between networks.

Cloud private-connectivity services often use VLAN tags at the customer-facing Ethernet handoff. For example, an engineer can configure separate AWS Direct Connect virtual interfaces on one dedicated connection, using VLAN 101 for one interface and VLAN 102 for another. The customer router must apply the VLAN ID configured for each virtual interface. Each interface also needs appropriate IP addressing and a BGP session; tagging alone does not advertise routes or establish IP connectivity. With hosted connectivity, coordinate VLAN assignment and any tag translation with the connectivity provider.

A crucial distinction is that a tagged cloud handoff does not automatically extend an on-premises broadcast domain into a cloud virtual network. AWS Direct Connect provides routed connectivity through its virtual interfaces; an Amazon VPC subnet is not a customer-configurable VLAN trunk. Do not expect local ARP broadcasts, arbitrary Ethernet frames, or existing on-premises VLAN membership to propagate into a VPC simply because a Direct Connect virtual interface has a VLAN ID.

The main advantage is efficient separation of logical networks without requiring a physical port for each one. Trade-offs include configuration complexity, shared bandwidth, and shared physical failure domains. VLAN tags provide neither encryption nor a complete security boundary: incorrect trunk configuration can expose traffic, and routed communication still needs explicit security controls. Restrict allowed VLANs and configure untagged traffic deliberately.

For troubleshooting, verify the physical link, matching VLAN IDs, allowed-VLAN configuration, and tagged-versus-untagged expectations before investigating BGP or application traffic. A VLAN mismatch can leave the physical connection up while preventing neighbor discovery and routing sessions from forming. Account for the four-byte tag in Ethernet frame-size support, and separately validate the supported IP MTU across the complete path. Packet captures can confirm tagging, although network-interface offload may remove tags before capture software displays received frames.

Key aspects of VLAN Tagging

VLAN tagging multiplexes separate Layer 2 networks over shared Ethernet infrastructure while leaving routing, security policy, and end-to-end availability to other mechanisms.

Frame-level network identification

An IEEE 802.1Q tag identifies the VLAN associated with an Ethernet frame. Configure matching VLAN IDs across each relevant link segment, accounting for any explicit provider tag translation.

Logical separation on shared links

Trunks carry multiple VLANs over one physical connection while maintaining separate Layer 2 forwarding contexts. The VLANs still share the link’s bandwidth and physical availability.

Tagged and untagged port behavior

Access ports typically associate untagged traffic with one VLAN, while trunks distinguish multiple VLANs using tags. Native-VLAN mismatches or unexpected untagged frames can cause connectivity failures or unintended traffic placement.

Separation from IP routing

A VLAN ID is not an IP address, subnet, gateway, or route. Inter-subnet communication requires Layer 3 forwarding, and cloud private circuits commonly require BGP in addition to correct tagging.

Link-local significance

A VLAN ID must be interpreted consistently within its Layer 2 forwarding context, but it is not globally unique. Providers can translate tags, and routed boundaries do not preserve the incoming Ethernet tag as an end-to-end network identity.

Operational and security limits

Tags add Ethernet overhead and require compatible frame-size support. They do not encrypt traffic or replace firewalls, route controls, or careful trunk configuration.

Cloud services for VLAN Tagging

AWS Direct Connect, Azure ExpressRoute, and Google Cloud Interconnect apply VLAN tagging at private-connectivity boundaries to distinguish logical connections sharing Ethernet infrastructure. In a multicloud design, an on-premises router or connectivity provider can terminate the relevant VLANs and exchange routes over separately configured BGP sessions. These services do not create one common VLAN spanning the clouds: each handoff has its own tagging requirements and routed destinations. Coordinate VLAN assignments, provider translation, IP addressing, MTU, and redundant paths independently, then verify route exchange and security policy beyond the Layer 2 handoff.

AWS Direct Connect

Direct Connect uses IEEE 802.1Q VLANs to identify virtual interfaces on the customer-facing connection. Configure the corresponding tagged router interface and IP/BGP settings; a virtual interface provides routed connectivity rather than an extension of an on-premises VLAN into a VPC.

Open AWS Direct Connect →