VLANs - when a tagged frame arrives on an access port
When an untagged frame enters a trunk port, that frame is placed on the configured native VLAN. By definition, an access port is assigned a single VLAN and it is expecting to receive only untagged frames.
But what happens if a tagged frame arrives on an access port? How does the switch handle such a situation?
On Nexus devices, if an access port receives a packet with a VLAN tag in the header other than the access VLAN value, that port drops the packet without learning its MAC source address.
On older IOS devices such as the 2950 and 3550, the same behavior is observed.
On newer devices, starting with the 2960 for example, a switchport will not accept any tagged frames. All tagged frames, even those on the actual assigned VLAN, are dropped unconditionally.
The only exceptions to this rule are:
- The use of voice VLAN
- The configuration of Q-in-Q tunneling
Ultimately, the behavior of an access port in such a situation may be slightly different on different platforms, IOS/NX-OS version, and also on different vendors' equipment.
Links:
https://community.cisco.com/t5/switching/802-1q-tag-on-access-switchport/td-p/1686159