Simple definition
IEEE 802.1Q is the standard commonly used to identify VLANs in Ethernet frames and carry multiple logical networks over the same physical link.
Technical definition
802.1Q inserts a 4-byte tag into the Ethernet frame. The tag contains the VLAN ID (VID) as well as priority and control information. On a trunk link, several VLANs can therefore share the same interface while remaining logically separated.
How it works / role
When transmitting a frame, a device adds the tag for the VLAN being carried; the receiving switch or firewall reads that tag and assigns the frame to the correct logical network. Depending on configuration, a native VLAN may be carried untagged on some trunks, so both ends must use consistent settings.
What is it used for?
Interconnect switches, firewalls, hypervisors, or access points while carrying several VLANs over a limited number of physical links.
Practical example
A trunk between a switch and a firewall carries VLANs 10, 20, and 30. The firewall uses an 802.1Q subinterface for each VLAN to apply the appropriate routing and security policy.
Common issues
- A VLAN is allowed on one side of the trunk but not the other
- Native VLAN or PVID does not match between both ends
- An intermediate device removes or mishandles the 802.1Q tag
- MTU or encapsulation is inconsistent along the network path
Key takeaway: 802.1Q identifies VLANs on the link; inter-VLAN routing and security remain separate functions that must be configured explicitly.