0

I'm trying to understand egress tagged rule in the context of general mode port in vlan. I have an Allied Thelesis AT-8000S switch with two PC connected (PC1<->e1, PC2<->e2). Both PCs have wireshark installed and NICs set to mode in which the vlan info is not stripped out. There is a vlan creadted (id=100) and added to these ports. Both ports are in general mode with PVID set to 100 and the ingress-filtering is on, however the acceptable frame type is set to admitAll. When I set the egress rule to untagged both PCs can comunicate to each other (ping). When i set the egress rule of e1 to tagged, I can send ICMP (ping) from PC2 to PC1 (I incomming ICMP frame with 802.1Q VLan info on PC1) but there is no response.

I have read a Virtual LANs paper by Allied Thelesis, also CLI user's Guide for AT-8000S and "google results". From my understanding, when you set the egress rule ("outgoing rule") to tagged for a general mode port, the switch should not strip the vlan information from a frame, and this is why I see this information in whireshark. The PC1 should respond with ICMP. Of course the response frame is untagged, so the switch should send this frame according to PVID value (which is 100) on the e2. The egress rule for the e2 is untagged, so the PC2 shoud receive the response frame without any vlan informations. My question is why it does not work, what am I missing?

I know that this is not a real life example and normally the PCs should be connected to access mode interfaces (and it works like a charm), but I want to have ability to sniff vlan informations on one of the porsts.

Best regards, Aleksander

Aleksander Hal
  • 1
  • 1

1 Answers1

0

As I have understand:

  • your PCs don't tag packets with VLAN id,
  • but you have configured your switch to tag packets getting out port e1

So when you ping PC1, ICMP packet reach PC1 but as packets are tagged, PC1 throw them, that is actually normal.

Solution: configure your PC1 to tag packet with VLAN id 100 and then it will answer to ICMP requests.