Basic VLAN Concepts

For a Layer 2 switch, all interfaces by default belong to a single broadcast domain. This means that any PCs connected to this switch can communicate directly if they are configured within the same IP subnet. More importantly, when a node in this broadcast domain sends a broadcast frame, all other nodes in the domain receive it and consume resources to process it (even if they don't need the frame). When the broadcast domain becomes too large (many users connected to the switch), the network can be overwhelmed by excessive broadcast traffic.

In practical networks, there's often a need to isolate users connected to the same switch based on different business units or departments, allowing them to be managed as separate network segments.

To address these requirements, VLAN (Virtual LAN) technology was introduced. A VLAN is a virtual, logical LAN that allows network administrators to segment a physical network into multiple logical networks based on factors like interfaces. This enables device isolation and improved network management.

With VLAN technology, network design becomes more flexible. VLANs are virtual LANs不受地理限制 (unrestricted by geographical boundaries). We can plan VLANs according to actual business needs, such as assigning different departments to different VLANs. Additionally, VLANs can span multiple switches, providing flexibility in the placement of VLAN members like business PCs.

Key points to remember:

• All devices in a VLAN belong to the same broadcast domain; different VLANs represent different broadcast domains.
• Users within the same VLAN can communicate directly through Layer 2 communication, while users in different VLANs are isolated. Broadcast frames cannot cross VLAN boundaries, so devices in different VLANs typically cannot communicate directly without a Layer 3 routing device (such as a router, Layer 3 switch, or firewall).
• A VLAN typically corresponds to a logical subnet (or IP subnet).
• VLAN membership is usually based on switch interface assignment, where VLANs are created by assigning interfaces to specific VLANs. Some switches also support other VLAN assignment methods, such as IP-based VLANs.
• VLANs operate at Layer 2 of the OSI reference model.
• VLANs are a fundamental mechanism in switch operation.

Access Interface Types

Physical interfaces on switches are typically Layer 2 interfaces by default. A Layer 2 interface, simply put, is one that cannot directly be configured with an IP address, cannot isolate broadcasts, and cannot directly process IP packet headers. These interfaces can only process frames based on header information. On Huawei switches, Layer 2 interfaces have three link types: Access, Trunk, and Hybrid. For example, on an S9300 switch, interfaces default to Hybrid type.

VLANs are a fundamental Layer 2 technology, and various aspects of Layer 2 switch operation, including interface functionality, relate to VLANs. We need to configure switch interfaces as appropriate types based on requirements.

Access interfaces can belong to only one VLAN and are typically used to connect end devices like PCs, servers, or other devices like routers and firewalls. Access interfaces only send untagged frames and typically only receive untagged frames.

Trunk Interface Types

On a single switch, multiple VLANs can be created to correspond to different services, and interfaces can be assigned to different VLANs.

If VLANs are deployed on two separate switches with consistent planning, special consideration is needed when connecting these switches. The inter-switch link needs to carry data from multiple VLANs. When a specific VLAN's data is sent from one switch to another, how does the receiving switch determine which VLAN the data belongs to?

This requires a "tagging" mechanism. Before sending data out this interconnected interface, the data is tagged to indicate which VLAN it originated from. This allows the receiving switch to identify the VLAN based on the tag. This interconnected link is called a trunk link. The tagging mechanism is commonly known as a trunking protocol, with the well-known public standard being 802.1q (or Dot1q). As a public standard, all switch manufacturers adhere to it.

Dot1q processes data frames simply by inserting a Dot1q field into the original Ethernet frame header and recalculating the CRC. Within the Dot1q field, there's a VLAN-ID field that indicates which VLAN the frame belongs to. Frames without a Dot1q tag are called original Ethernet frames or untagged frames, while frames with a Dot1q tag are called tagged frames.

Interface Type Summary

Layer 2 interfaces on Ethernet switches support three link types. When an interface operates in Layer 2 mode, it must use one of these types:

Access:

Access interfaces are commonly used to connect to PCs, servers, or other end devices, or to routers. An Access interface can only belong to one VLAN, and once assigned to a specific VLAN, the device connected to that interface becomes a member of that VLAN.

Trunk:

Trunk interfaces are typically used for connections between switches. A trunk interface can belong to multiple VLANs and can receive and send tagged frames from multiple VLANs. When a switch's interface connects to a device (like a router or firewall) with Ethernet sub-interfaces configured, the switch's interface should also be configured as Trunk type (or Hybrid type).

Hybrid:

Hybrid interfaces can be used for connections between switches or to connect to user computers. A hybrid interface can belong to multiple VLANs and can receive and send tagged frames from multiple VLANs. It can be flexibly configured to determine whether specific VLAN frames are tagged when sent. (Trunk interfaces can only configure one VLAN to send frames untagged, while hybrid interfaces can configure multiple VLANs to send frames untagged).

Frame Processing for Different Interface Types

When a frame enters a switch interface (receiving), or when a frame is sent out from an interface (transmitting), different interface types handle frames differently. Note that all frames within the switch carry tags, which helps the switch identify the VLAN to which each frame belongs.

Access Interface Frame Reception

• If the frame is untagged, the frame is received and tagged with the interface's PVID (Port Default VLAN ID).
• If the frame is tagged and its VLAN-ID matches the interface's PVID, the frame is received; otherwise, it is discarded.

Every interface type (Access, Trunk, or Hybrid) has a PVID property associated with it. PVID is the default VLAN ID for that interface. For an Access interface, PVID is the VLAN specified in the interface view with the "port default vlan" command, which is the VLAN the interface belongs to. Trunk and Hybrid interfaces also have a PVID (defaulting to VLAN 1) that can be modified.

Access Interface Frame Transmission

When transmitting frames, the tag is stripped, and the frame is sent as an original Ethernet frame (untagged). Access interfaces typically connect to end devices that can only understand untagged frames, so they never carry tags when transmitting.

Trunk Interface Frame Reception

• If an untagged frame is received, it is tagged with the interface's PVID. If the PVID is in the interface's allowed VLAN list, the frame is received; otherwise, it is discarded.
• If a tagged frame is received and its VLAN-ID is in the interface's allowed VLAN list, the frame is received; otherwise, it is discarded.

By default, a Trunk interface's PVID is 1, and VLAN 1 is in the allowed VLAN list.

Trunk Interface Frame Transmission

• If the frame's VLAN-ID matches the interface's PVID and this VLAN is in the allowed list, the tag is removed, and the frame is sent untagged.
• If the frame's VLAN-ID differs from the interface's PVID but the VLAN is in the allowed list, the tag is preserved, and the frame is sent tagged.
• If the frame's VLAN-ID is not in the allowed list, transmission from this interface is prohibited.

Hybrid Interface Frame Reception

• If an untagged frame is received, it is tagged with the interface's PVID. If the PVID is in the interface's allowed VLAN list, the frame is received; otherwise, it is discarded.
• If a tagged frame is received and its VLAN-ID is in the interface's allowed VLAN list, the frame is received; otherwise, it is discarded.

Hybrid Interface Frame Transmission

When a frame's VLAN-ID is in the interface's allowed VLAN list, the frame is transmitted. The interface can be configured to determine whether to carry a tag when sending frames.

Basic VLAN and Trunk Configuration

Basic VLAN Configuration Commands

To create VLAN 10 on a switch and enter its configuration view:

[Switch] vlan 10
[Switch-vlan10]

(Optional) Add a description to a specific VLAN view:

[Switch-vlan10] description TechVLAN

Configure an interface as Access type and add it to a specific VLAN. The following example configures GE0/0/1 as Access and adds it to VLAN 10:

[Switch] interface gigabitEthernet0/0/1
[Switch-GigabitEthernet0/0/1] port link-type access
[Switch-GigabitEthernet0/0/1] port default vlan 10

Configure an interface as Trunk type and specify allowed VLANs:

[Switch] interface gigabitEthernet0/0/24
[Switch-GigabitEthernet0/0/24] port link-type trunk
[Switch-GigabitEthernet0/0/24] port trunk allow-pass vlan 10 20

Add VLANs 10 and 20 to the interface's allowed VLAN list.

(Optional) Configure a Trunk interface's PVID. The VLAN corresponding to the PVID will be sent untagged from the Trunk interface. If an untagged frame is received on a Trunk interface, it is considered to belong to the PVID's VLAN. By default, the PVID is 1. The following example modifies GE0/0/24's PVID to 99 (assuming it's already configured as Trunk):

[Switch-gigabitEthernet0/0/24] port trunk pvid vlan 99

Basic VLAN Configuration Example

Create VLANs 10 and 20 on a switch, assign PC1's interface to VLAN 10, and PC2's interface to VLAN 20. The configuration for Switch1 would be:

Create VLANs 10 and 20 (using the batch keyword for bulk creation):

[Switch1] vlan batch 10 20

Configure GE0/0/1 as Access and add it to VLAN 10:

[Switch1] interface gigabitEthernet0/0/1
[Switch1-GigabitEthernet0/0/1] port link-type access
[Switch1-GigabitEthernet0/0/1] port default vlan 10

Configure GE0/0/2 as Access and add it to VLAN 20:

[Switch1] interface gigabitEthernet0/0/2
[Switch1-GigabitEthernet0/0/2] port link-type access
[Switch1-GigabitEthernet0/0/2] port default vlan 20

After configuration, you can verify on Switch1:

[Switch1] display vlan
The total number of vlans is : 3
U: Up; D: Down; TG: Tagged; UT: Untagged;
MP: Vlan-mapping; ST: Vlan-stacking;

: ProtocolTransparent-vlan; *: Management-vlan;
VID Type Ports
1 common UT: GE0/0/3(D) GE0/0/4(D) GE0/0/5(D) GE0/0/6(D)
GE0/0/7(D) GE0/0/8(D) GE0/0/9(D) GE0/0/10(D)
GE0/0/11(D) GE0/0/12(D) GE0/0/13(D) GE0/0/14(D)
GE0/0/15(D) GE0/0/16(D) GE0/0/17(D) GE0/0/18(D)
GE0/0/19(D) GE0/0/20(D) GE0/0/21(D) GE0/0/22(D)
GE0/0/23(D) GE0/0/24(D)
10 common UT: GE0/0/1(U)
20 common UT: GE0/0/2(U)
VID Status Property MAC-LRN Statistics Description
1 enable default enable disable VLAN 0001
10 enable default enable disable VLAN 0010
20 enable default enable disable VLAN 0020

You can also use the "display port vlan" command to view each interface's link type and assigned VLAN information.

Basic VLAN and Trunk Experiment

Create VLANs 10 and 20 on Switch1 and Switch2. Configure interfaces connecting to PCs as Access type and add them to the specified VLANs. Then configure the inter-switch interfaces as Trunk type and allow the appropriate VLANs to enable communication between PCs in the same VLAN.

Switch1 configuration:

[Switch1] vlan batch 10 20
[Switch1] interface gigabitEthernet0/0/1
[Switch1-GigabitEthernet0/0/1] port link-type access
[Switch1-GigabitEthernet0/0/1] port default vlan 10
[Switch1] interface gigabitEthernet0/0/2
[Switch1-GigabitEthernet0/0/2] port link-type access
[Switch1-GigabitEthernet0/0/2] port default vlan 20
[Switch1] interface gigabitEthernet0/0/24
[Switch1-GigabitEthernet0/0/24] port link-type trunk
[Switch1-GigabitEthernet0/0/24] port trunk allow-pass vlan 10 20

Switch2 configuration:

[Switch2] vlan batch 10 20
[Switch2] interface gigabitEthernet0/0/1
[Switch2-GigabitEthernet0/0/1] port link-type access
[Switch2-GigabitEthernet0/0/1] port default vlan 10
[Switch2] interface gigabitEthernet0/0/2
[Switch2-GigabitEthernet0/0/2] port link-type access
[Switch2-GigabitEthernet0/0/2] port default vlan 20
[Switch2] interface gigabitEthernet0/0/24
[Switch2-GigabitEthernet0/0/24] port link-type trunk
[Switch2-GigabitEthernet0/0/24] port trunk allow-pass vlan 10 20

After completing these configurations, users within the same VLAN can communicate with each other (e.g., PC1 can ping PC3, and PC2 can ping PC4). However, communication between different VLANs is not possible without additional routing.

Hybrid Interface Configuration

Hybrid is a special type of Layer 2 interface. Similar to Trunk interfaces, Hybrid interfaces can carry frames from multiple VLANs and can flexibly configure whether frames carry tags when transmitted. Hybrid interfaces can also be used for IP-based VLAN assignment. Let's explore configuration for several use cases.

Hybrid Interface for Connecting to End Devices

In the following example, PC1 is connected to GE0/0/1 on Switch1. Configure Switch1's GE0/0/1 interface as follows:

[Switch1] interface GigabitEthernet 0/0/1
[Switch1-GigabitEthernet0/0/1] port link-type hybrid

The above command configures GE0/0/1 as a Hybrid interface. On an S5300 switch, for example, interfaces default to this type, with VLAN 1 as the PVID (default VLAN), and VLAN 1 is already configured as untagged. In this scenario, if an IP address is configured on Switch1's Vlanif1 in the 192.168.10.0/24 subnet, PC1 and Switch1 can communicate, and PC1 is considered a member of VLAN 1.

If we want to assign PC1 to VLAN 10 instead, modify the configuraton as follows:

[Switch1] interface GigabitEthernet 0/0/1
[Switch1-GigabitEthernet0/0/1] port link-type hybrid
[Switch1-GigabitEthernet0/0/1] port hybrid pvid vlan 10
[Switch1-GigabitEthernet0/0/1] port hybrid untagged vlan 10
[Switch1] interface Vlanif 10
[Switch1-Vlanif10] ip address 192.168.10.3 24

In this configuration, "port hybrid pvid vlan 10" modifies the interface's PVID to 10, so when untagged frames are received from PC1, they are considered to belong to VLAN 10.

The "port hybrid untagged vlan 10" command adds the interface to VLAN 10, allowing frames from PC1 to enter the switch through GE0/0/1. It also ensures that frames from VLAN 10 are sent from GE0/0/1 as untagged frames.

After this configuration, PC1 is considered a member of VLAN 10 and can ping Switch1's Vlanif10 interface IP address: 192.168.10.3.

Hybrid Interface for Switch-to-Switch Connections

In the following example, Switch1 and Switch2 connect to PC1 and PC2 respectively. Both switches' GE0/0/1 interfaces are configured as Access type and added to VLAN 10. Now, Switch1's GE0/0/15 is configured as Trunk type with VLAN 10 allowed:

[Switch1-GigabitEthernet0/0/15] port link-type trunk
[Switch1-GigabitEthernet0/0/15] port trunk allow-pass vlan 10

Let's see how to configure Switch2's GE0/0/15 as a Hybrid interface (this is for demonstration purposes; typically we'd configure matching interface types on both ends):

Since the peer interface (Switch1's GE0/0/15) sends VLAN 10 frames as tagged, Switch2's GE0/0/15 must also process VLAN 10 frames as tagged:

[Switch2-GigabitEthernet0/0/15] port link-type hybrid
[Switch2-GigabitEthernet0/0/15] port hybrid tagged vlan 10

The "port hybrid tagged vlan 10" command adds GE0/0/15 to VLAN 10, with frames passing through this interface as tagged.

Consider another scenario where Switch1 connects to VLANs 10, 20, and 1000 on the left side, and GE0/0/15 is configured as follows:

[Switch1-GigabitEthernet0/0/15] port link-type trunk
[Switch1-GigabitEthernet0/0/15] port trunk allow-pass vlan 10 20 1000
[Switch1-GigabitEthernet0/0/15] port trunk pvid vlan 1000

This means Switch1 sends VLAN 10 and 20 frames as tagged from GE0/0/15, but VLAN 1000 frames as untagged. If Switch2 uses a Hybrid interface to connect, its configuration should be:

[Switch2-GigabitEthernet0/0/15] port link-type hybrid
[Switch2-GigabitEthernet0/0/15] port hybrid tagged vlan 10 20
[Switch2-GigabitEthernet0/0/15] port hybrid pvid vlan 1000
[Switch2-GigabitEthernet0/0/15] port hybrid untagged vlan 1000

IP-Based VLAN Identification

Typically, VLANs are assigned based on interfaces by assigning switch interfaces to specific VLANs. However, there are scenarios where IP-based VLAN assignment is needed.

In the following network, Switch3 connects to three servers. The interfaces connecting to Server1 and Server2 are Access type interfaces added to VLAN 1, while the interface connecting to Server3 is also Access type but added to VLAN 30. The uplink interface to Switch1 is Trunk type with VLANs 1 and 30 allowed, and PVID set to 1.

Switch1 will receive three types of traffic on its GE6/0/15 interface: untagged frames from the 10.10.10.0/24 subnet, untagged frames from the 10.10.20.0/24 subnet, and tagged frames from VLAN 30. The requirement is to map these subnets to different VLANs on the core switch (CoreSwitch) and enable communication between servers. Since Switch3 cannot be directly managed, configuration must be completed on Switch1 and CoreSwitch.

The requirement is to configure Switch1 so that it identifies frames from the 10.10.10.0/24 subnet as VLAN 10, frames from 10.10.20.0/24 as VLAN 20, and frames from VLAN 30 as tagged. Switch1 should send VLAN 10 and 20 frames untagged and VLAN 30 frames tagged.

Switch1 configuration:

[Switch1] vlan batch 10 20 30
[Switch1] vlan 10
[Switch1-vlan10] ip-subnet-vlan ip 10.10.10.0 24
[Switch1] vlan 20
[Switch1-vlan20] ip-subnet-vlan ip 10.10.20.0 24
[Switch1-GigabitEthernet6/0/15] port link-type hybrid
[Switch1-GigabitEthernet6/0/15] port hybrid untagged vlan 10 20
[Switch1-GigabitEthernet6/0/15] port hybrid tagged vlan 30
[Switch1-GigabitEthernet6/0/15] ip-subnet-vlan enable
[Switch1] interface GigabitEthernet 6/0/22
[Switch1-GigabitEthernet6/0/22] port link-type trunk
[Switch1-GigabitEthernet6/0/22] port trunk allow-pass vlan 10 20 30

CoreSwitch configuration:

[CoreSwitch] vlan batch 10 20 30
[CoreSwitch] interface Vlanif 10
[CoreSwitch-Vlanif10] ip address 10.10.10.254 255.255.255.0
[CoreSwitch] interface Vlanif 20
[CoreSwitch-Vlanif20] ip address 10.10.20.254 255.255.255.0
[CoreSwitch] interface Vlanif 30
[CoreSwitch-Vlanif30] ip address 10.10.30.254 255.255.255.0
[CoreSwitch] interface GigabitEthernet 6/0/22
[CoreSwitch-GigabitEthernet6/0/22] port link-type trunk
[CoreSwitch-GigabitEthernet6/0/22] port trunk allow-pass vlan 10 20 30

QinQ Configuration

QinQ (802.1Q-in-802.1Q) is a technology that adds an additional VLAN tag to frames, enabling service providers to transparently transmit customer VLAN traffic over their networks.

In the following example, Customer Edge (CE) switches 1 and 2 both have VLAN 10 deployed. These switches connect to Provider Edge (PE) switches 1 and 2. PE switches connect to other devices in the provider network. To ensure CE1 and CE2 can communicate in VLAN 10 without conflicts with other devices, the provider has assigned outer VLAN 160 for this service.

Configure QinQ on PE1 and PE2 to enable CE1 to access CE2:

PE1 configuration:

vlan batch 160
interface GigabitEthernet0/0/1
port link-type dot1q-tunnel
port default vlan 160
interface GigabitEthernet0/0/24
description Link to PE2
port link-type trunk
port trunk allow-pass vlan 160
qinq protocol 8100

PE2 configuration:

vlan batch 160
interface GigabitEthernet0/0/1
port link-type dot1q-tunnel
port default vlan 160
interface GigabitEthernet0/0/24
description Link to PE1
port link-type trunk
port trunk allow-pass vlan 160
qinq protocol 8100

CE1 configuration:

vlan batch 10
interface GigabitEthernet0/0/24
port link-type trunk
port trunk allow-pass vlan 10
interface Vlanif10
ip address 10.1.1.1 255.255.255.0

CE2 configuration:

vlan batch 10
interface GigabitEthernet0/0/24
port link-type trunk
port trunk allow-pass vlan 10
interface Vlanif10
ip address 10.1.1.2 255.255.255.0

After this configuration, CE1 can ping 10.1.1.2. ICMP request packets captured between PE1 and PE2 will have two VLAN tags - an outer VLAN ID of 160 and an inner VLAN ID of 10.

In different network designs or from different vendors, the TPID field in QinQ frames may be set to different values. To ensure compatibility with existing network configurations, devices allow modification of the QinQ outer VLAN tag TPID value. Users can configure the TPID value sothat QinQ frames sent to the provider network carry a TPID value matching the current network configuration.

Consider another example with the following topology. The network requirement is that frames from CE1 with VLAN tag 10 should have an outer VLAN tag of 160 added, and frames with VLAN tag 20 should have an outer VLAN tag of 170 added.

PE1 configuration:

vlan batch 160 170
interface GigabitEthernet0/0/1
qinq vlan-translation enable
port hybrid untagged vlan 160 170
port vlan-stacking vlan 10 stack-vlan 160
port vlan-stacking vlan 20 stack-vlan 170
interface GigabitEthernet0/0/24
description Link to PE2
port link-type trunk
port trunk allow-pass vlan 160 170
qinq protocol 8100

PE2 configuration:

vlan batch 160 170
interface GigabitEthernet0/0/1
qinq vlan-translation enable
port hybrid untagged vlan 160 170
port vlan-stacking vlan 10 stack-vlan 160
port vlan-stacking vlan 20 stack-vlan 170
interface GigabitEthernet0/0/24
description Link to PE1
port link-type trunk
port trunk allow-pass vlan 160 170
qinq protocol 8100

CE1 configuration:

vlan batch 10 20
interface GigabitEthernet0/0/24
port link-type trunk
port trunk allow-pass vlan 10 20
interface Vlanif10
ip address 10.1.1.1 255.255.255.0
interface Vlanif20
ip address 20.1.1.1 255.255.255.0

CE2 configuration:

vlan batch 10 20
interface GigabitEthernet0/0/24
port link-type trunk
port trunk allow-pass vlan 10 20
interface Vlanif10
ip address 10.1.1.2 255.255.255.0
interface Vlanif20
ip address 20.1.1.2 255.255.255.0

Layer 2 vs Layer 3 Interfaces, PVID, and VLAN-ID Concepts

A Layer 2 interface can be understood as an interface with only Layer 2 switching capabilities, such as the physical interfaces of a Layer 2 switch, or the physical interfaces of a Layer 3 switch (which typically default to Layer 2 mode, though some models can switch to Layer 3 mode).

Layer 2 interfaces cannot directly be configured with IP addresses and do not terminate broadcast frames (frames with a destination MAC address of FFFF-FFFF-FFFF). When a Layer 2 interface receives a broadcast frame, it floods it out to all other interfaces in the same broadcast domain (VLAN).

Layer 3 interfaces maintain IP-to-MAC address mappings and terminate broadcast frames. When a Layer 3 interface receives a broadcast frame, it does not flood it but processes it directly.

When a Layer 2 interface receives a unicast frame, it queries the MAC address table for the destination MAC address and forwards the frame based on the table entry. If no matching entry is found, it floods the frame. When a Layer 3 interface receives a unicast frame, it first checks if the destination MAC address is its own MAC address. If so, it decapsulates the frame, extracts the destination IP address, and performs a route lookup and forwarding. This shows clear differences in data processing behavior between Layer 2 and Layer 3 interfaces.

Layer 2 interfaces have several types (referring to Ethernet Layer 2 interfaces): Access, Trunk, and Hybrid. Layer 3 interfaces do not have these types.

Layer 3 interfaces can be physical (like a router's physical Layer 3 port) or logical (like VLAN interfaces or Ethernet subinterfaces such as GE0/0/1.1). VLAN interfaces correspond to their associated VLAN's VLAN ID, while Ethernet subinterfaces typically bind to a VLAN ID to connect with the corresponding VLAN. Both types of typical Layer 3 interfaces can be directly configured with IP addresses.

Additional concepts:

• In an Ethernet Layer 2 switching network, VLANs are fundamental. Each VLAN is a logical broadcast domain identified by its VLAN ID.
• The interface default VLAN identifier is PVID (Port Default VLAN ID), which refers to the default VLAN ID for a Layer 2 interface (each Layer 2 interface has exactly one VLAN ID as its PVID). PVID is always the VLAN ID of a specific VLAN. When a Layer 2 interface receives traffic without any 802.1Q Tag (VLAN ID information), it considers this traffic to belong to the PVID's VLAN. PVID also affects how frames are sent from the interface. By default, all interfaces have a PVID of VLAN 1.
• For an Access interface, the default VLAN is the only VLAN it allows. Changing the allowed VLAN changes the interface's default VLAN.
• For Trunk and Hybrid interfaces, an interface can allow multiple VLANs but only has one default VLAN. Changing the allowed VLANs does not change the interface's default VLAN.
• Layer 3 interfaces do not necessarily correspond to a VLAN ID. For example, a router's physical Layer 3 interface does not require a VLAN ID configuration.
• On a Layer 3 switch (and some routers or firewalls that support VLAN interfaces), each VLAN has a corresponding VLAN interface (VLANIF), which is a logical Layer 3 interface. After a VLAN is created, its VLANIF can be assigned an IP address and has routing capabilities. One VLAN corresponds to one VLANIF, with matching identifiers. End devices in a VLAN can communicate directly with the VLAN's corresponding VLANIF at Layer 2.