VLANs - when a tagged frame arrives on an access port
When an untagged frame enters a trunk port, that frame is placed on the configured native VLAN. By definition, an access port is assigned a single VLAN and it is expecting to receive only untagged frames.
But what happens if a tagged frame arrives on an access port? How does the switch handle such a situation?
On Nexus devices, if an access port receives a packet with a VLAN tag containing a VLAN ID which is the same as that assigned to the access port, the frame will be accepted, and the tag will be stripped. If the VLAN ID is not the same as that assigned to the access port, the packet is dropped without learning its source MAC address.
On older IOS devices such as the 2950 and 3550, the same behavior is observed.
On newer devices, starting with the 2960 for example, a switchport will not accept any tagged frames. All tagged frames, even those on the actual assigned VLAN, are dropped unconditionally.
The only exceptions to this rule are:
- The use of voice VLAN
- The configuration of Q-in-Q tunneling
Ultimately, the behavior of an access port in such a situation may be slightly different on different platforms, IOS/NX-OS version, and also on different vendors' equipment.
Links:
https://community.cisco.com/t5/switching/802-1q-tag-on-access-switchport/td-p/1686159