Hi @Matt677 

Thanks for posting in our business forum.

Matt677 wrote

  @Clive_A 

 

Super helpful!! I took the time to research your answers thoroughlyy and it makes sense now.

 

1- I have a follow up question: So let's say I wanted to create a vlan 666 and make it untagged on the port connected to my router. And I give that port a PVID of 666. This way, untagged traffic goes to that Vlan 666 rather than vlan 1. Is my intuition flawed? Yes/No

 

2- If correct so far, then the question is whether this untagged traffic will be dropped inside Vlan 666 or will it then be forwarded out to a trunk or other? I ask since Vlan 666 is not tagged nor untagged on any other ports. What do you think?

 

 

Bunch of thanks, have a good one!

A1: Correct. No.

A2: Forward at the port. Because you configure the VLAN 666 on the router, it will forward.

If there is no other port in VLAN666, and you have the interface, it will be forwarded to the router.

It should stay in VLAN 666 and find its DST based on the table on the router. If there is no DST, will be dropped.

Hi @Matt677 

Thanks for posting in our business forum.

Matt677 wrote

  @Clive_A 

 

Thanks for your kind follow up!

 

My final follow up question on the topic. I need to know whether there is a way to disallow that untagged traffic that ended up in Vlan 666 from ever leaving that vlan. Sorta like a black hole vlan in case of untagged traffic on the trunk port (of course, for tagged traffic the trunk port will forward the traffic of any particular vlan to the router, no problem there). But how can we not get untagged traffic in Vlan 666 forwarded to the router?

My guesses below. I appreciate a comment on each so I solidify my understanding whether it may break something or achieve the goal.

1- Creating the Vlan 666 as a Vlan with no associated Interface (no IP range etc- just a Vlan defined as untagged on that single port).

2- Use ACLs on Vlan 666 to stop the untagged traffic on that port from reaching the router. But for that we need an interface with an IP range for Vlan 666 and after that a Deny All ACL.

3- Last option is Remove the layer 3 Static Routing default route entry which is the router’s IP (from 0.0.0.0 hop to router's IP). This way ip packets whose destination is undefined do not get forwarded to router.

 

 

Thanks, have a good day!

 

You probably find this helpful. So, stop this from the switch. Not on the router. Router is supposed to look them up in the tables if they arrive at the router. That's what a router is supposed to do.

ACL does not work on VLAN.

Last question does not make sense if you read the above lines.