Tagged vs. Untagged VLAN: What's the Difference?

Tagged vs. untagged VLAN configuration comes down to one question: does a switch port carry traffic for a single network, or for several at once? Both terms describe how a port handles VLAN membership, and the two behave very differently on the wire.

"Untagged" and "tagged" describe how a port handles a VLAN's frames. An untagged port, commonly called an access port, typically carries one VLAN and removes the 802.1Q tag before forwarding frames to the connected device. A tagged port, commonly called a trunk port, can carry multiple VLANs over one physical link, retaining the tags so receiving VLAN-aware equipment can distinguish the traffic.

This guide explains both port types, how PVID and the native VLAN affect untagged traffic on a trunk, and a configuration example using an Omada managed switch.

Key Takeaways

• Untagged ports (access ports) belong to one VLAN and remove the VLAN tag before sending frames to the connected device.
• Tagged ports (trunk ports) carry traffic for multiple VLANs at once and keep the 802.1Q tag so the next device knows which VLAN each frame belongs to.
• Use untagged ports for end devices such as PCs, printers, and IP cameras; use tagged ports for links between switches, access points, and routers or gateways.
• The PVID, or native VLAN setting, decides which VLAN untagged frames are assigned to on a port.
• VLAN tagging requires a managed switch; unmanaged switches cannot tag traffic.

What Is a VLAN?

A VLAN, or virtual local area network, is a logically separated network that runs on shared physical hardware. A switch groups ports into VLANs so traffic stays isolated even though it travels over the same wires, instead of requiring a separate cable for every network.

Businesses deploy VLANs for network segmentation, keeping traffic types apart for security and performance. A retail location might put point-of-sale systems on one VLAN, guest Wi-Fi on another, and VoIP phones on a third, so a compromised guest device can't reach payment systems and voice traffic doesn't compete with browsing for bandwidth.

Note that VLAN separation alone does not block traffic between VLANs; businesses must configure ACLs or firewall rules on the gateway to enforce those boundaries.

What Is VLAN Tagging? How 802.1Q Works

VLAN tagging is how a switch keeps multiple VLANs separate while sharing one physical link, using the IEEE 802.1Q standard. Without tagging, a single cable could carry only one VLAN, requiring a separate physical link for every VLAN between switches, access points, and routers.

VLAN tagging inserts a 4-byte tag into the Ethernet frame. Inside that tag, a 12-bit VLAN ID (VID) identifies which VLAN the frame belongs to, supporting up to 4,094 usable VLAN IDs. This tagging scheme lets switches sort frames from different VLANs traveling over the same trunk link without mixing traffic between them.

This is what makes VLAN tagging solution-first rather than just a spec sheet item: it lets a single trunk link between switches, or between a switch and an access point, carry many segmented networks at once, without the extra cabling and switch ports that separate physical links would require.

What Is a Tagged VLAN (Trunk Port)?

A tagged port, often called a trunk port, carries frames for multiple VLANs at once, and each frame keeps its VLAN tag so the receiving device knows where it belongs. One uplink cable can carry ten VLANs instead of ten separate cables running to the same switch.

Tagged ports typically show up in three places: switch-to-switch uplinks, switch-to-access-point links carrying multiple SSIDs, and switch-to-router or switch-to-gateway links serving several network segments at once. On many switch platforms, this same port type is labeled "trunk" rather than "tagged," so it helps to recognize that both terms describe the same configuration.

Building this kind of segmented network starts with hardware that supports 802.1Q, which is why most business deployments rely on a managed switch, such as Omada's Access Switch series, rather than basic unmanaged models.

What Is an Untagged VLAN (Access Port)?

An untagged port, or access port, belongs to exactly one VLAN and delivers frames to the connected device without a VLAN tag. The switch strips the tag before the frame leaves the port, so the device on the other end never has to process VLAN tags at all.

Most end devices need untagged traffic because they cannot read VLAN tags. A PC or printer connected to an access port sees ordinary Ethernet frames and has no idea a VLAN even exists. That is what makes untagged VLAN configuration the default choice for anything that plugs directly into the network.

PVID and Native VLAN

PVID, or port VLAN ID, is the VLAN assigned to incoming untagged frames on a port. On an access port, the PVID and the port's VLAN are the same thing: any untagged frame that arrives gets associated with that VLAN before the switch forwards it.

On a trunk port, the equivalent concept is the native VLAN: the one VLAN whose frames travel over that trunk without a tag. Every other VLAN on the trunk keeps its tag, but the native VLAN's traffic looks just like ordinary untagged traffic.

Keep the native VLAN separate from VLANs carrying user or business traffic. If an attacker can inject frames onto the native VLAN, a technique known as VLAN hopping lets that traffic cross into VLANs it should never reach. This risk is why many administrators dedicate an unused VLAN to native traffic instead of leaving the default VLAN 1 in place.

Tagged vs. Untagged VLAN: Key Differences

Tagged vs. untagged VLAN behavior comes down to these differences: how many VLANs a port carries, whether the tag stays or goes, what the port is typically called, what usually connects to it, and how PVID or native VLAN settings apply.

An untagged vs. tagged VLAN choice is really a choice about how many networks a single port needs to carry. If the answer is one, use an untagged access port; if the answer is more than one, use a tagged trunk port.

When to Use Tagged vs. Untagged Ports (How to Choose)

The decision between an access vs. trunk port follows a simple rule: connect an end device to a port, and it should be untagged; connect two pieces of network gear to each other, and it should be tagged. PCs, printers, and IP cameras plug into untagged access ports. Uplinks between switches, access points, and gateways, such as an Omada ER605, use tagged trunk ports.

A single port can carry both a tagged and an untagged VLAN at the same time. This comes up often in real deployments: a port serving a PC plus a VoIP phone can carry one untagged VLAN for the PC's PVID and one tagged VLAN for the phone's voice traffic. An access point handling multiple SSIDs works the same way, with each SSID mapped to its own tagged VLAN over a single uplink cable.

In a small office, the switch-to-gateway uplink might be tagged to carry a staff VLAN and a guest VLAN, while every desk port stays untagged on the staff VLAN. In a restaurant, an access point uplink might carry tagged VLANs for point-of-sale traffic and guest Wi-Fi over the same cable, while the point-of-sale terminal itself plugs into a separate untagged port.

How to Configure Tagged and Untagged VLANs (Omada Example)

Configuring tagged and untagged VLANs requires a managed switch, since unmanaged switches cannot read or apply 802.1Q tags. On an Omada managed switch such as the SG3428, VLAN membership can be configured per device in Standalone Mode, or managed centrally across all switches through the Omada Controller.

A typical port configuration offers three settings per VLAN, per port:

• Tagged: the port carries this VLAN's traffic with the 802.1Q tag intact, for trunk links to switches, access points, or gateways.
• Untagged: the port carries this VLAN's traffic without a tag, for end devices like PCs or printers.
• Excluded: the port does not carry this VLAN's traffic at all.

Alongside those three, a separate Native Network (PVID) setting selects a single network as the native VLAN. Traffic exiting this network is untagged, and incoming untagged traffic is assigned this VLAN ID; this sets the port's PVID.

A desk port typically has one VLAN set to untagged with the rest excluded. An uplink to another switch or router typically has several VLANs set to tagged, so all of those networks reach the connected device over one cable.

Centralized management through the controller applies these settings consistently: instead of configuring VLANs port by port on every switch across a site, an administrator pushes the same VLAN policy to every managed device at once.

For the full walkthrough, including creating VLANs and assigning them to SSIDs, see How to Configure VLAN with Omada Network. The Omada software controller supports this same VLAN configuration for deployments that prefer an on-premise controller over cloud management.

Applying Tagged and Untagged VLANs in Your Network

As a general rule, end devices belong on untagged access ports, while links connecting switches, access points, and gateways to each other belong on tagged trunk ports. Getting this right is what keeps network segmentation and security intact, rather than mixing traffic that should remain separate.

As a network grows past a handful of VLANs, switch hardware itself starts to matter more, since features like stacking, routing, and port density vary by switch tier. Choosing between L3 and L2+ switches becomes the next decision once VLANs are in place.

Whether the deployment is a five-port office switch or a multi-site rollout, the same rule applies: define VLANs once, then decide port by port whether each connection carries one network or several.

Frequently Asked Questions

What is the difference between a tagged and untagged VLAN?

An untagged VLAN, or access port, carries traffic for one VLAN and removes the tag before delivery. A tagged VLAN, or trunk port, carries traffic for multiple VLANs at once and keeps the 802.1Q tag so devices can tell VLANs apart.

Can a single port be both tagged and untagged?

Yes. A port can carry one untagged VLAN, set by its PVID, plus one or more tagged VLANs at the same time. This is common on ports serving a PC and a VoIP phone, or an access point handling multiple SSIDs over one cable.

What is the difference between a trunk port and an access port?

A trunk port is another name for a tagged port: it carries multiple VLANs and keeps the 802.1Q tag on each frame. An access port is another name for an untagged port: it belongs to a single VLAN and delivers frames without a tag.

What is PVID, and how is it related to the native VLAN?

PVID stands for port VLAN ID, and it is the VLAN assigned to untagged frames arriving on a port. On a trunk, the native VLAN plays the same role: it is the one VLAN whose traffic travels over that trunk without a tag.

Do I need a managed switch to use VLAN tagging?

Yes. VLAN tagging requires a switch that supports the 802.1Q standard and lets an administrator assign VLANs to specific ports. Unmanaged switches treat all traffic the same way and cannot read or apply VLAN tags.

Should the native VLAN be tagged or untagged?

The native VLAN is always untagged on a trunk port, by definition. Many administrators assign an unused VLAN as the native VLAN, rather than leaving the default VLAN 1 in place, to reduce the risk of VLAN hopping attacks.