A VLAN separates Layer 2 broadcast domains without requiring a separate physical switch for every network. In ISP and enterprise deployments, VLANs are commonly used for subscriber traffic, management, access points, cameras, voice, and upstream handoffs. The most common VLAN problems come from inconsistent tagging rules at different devices.
Video walkthrough
Three terms to understand first
A tagged frame carries an IEEE 802.1Q VLAN ID. A trunk port normally carries one or more tagged VLANs between switches, routers, OLTs, and access points. An access port normally presents untagged traffic to an endpoint while the switch internally maps that traffic into a specific VLAN using the port's PVID.
Plan the VLAN table before touching the router
Create a simple table with VLAN ID, purpose, gateway, DHCP or PPPoE role, tagged ports, and untagged ports. Example: VLAN 200 for PPPoE subscribers, VLAN 10 for management, and VLAN 30 for office devices. A written plan prevents accidentally making a management port inaccessible.
Create a VLAN interface when the router needs Layer 3 access
If the router itself needs an IP address or needs to provide routing/services on VLAN 200, create a VLAN interface on the correct parent interface or VLAN-aware bridge.
/interface vlan add name=vlan200-pppoe interface=bridge vlan-id=200Then bind the relevant IP service, DHCP server, or PPPoE server to the VLAN interface. Do not create duplicate VLAN interfaces with the same VLAN ID on overlapping parents.
Bridge VLAN filtering workflow
On VLAN-aware bridges, define bridge ports first, then the bridge VLAN table, verify management reachability, and enable vlan-filtering=yes only after you understand which ports remain accessible. Enabling filtering too early is a common way to lock yourself out. Use Safe Mode or an out-of-band console when changing a remote production router.
Troubleshooting tagged traffic
When a VLAN does not pass traffic, test one hop at a time. Confirm the sender tags the expected VLAN ID, the first switch permits that VLAN on the trunk, every intermediate trunk carries it, and the receiving side expects the same tag or access mapping. A mismatch between tagged and untagged expectations can look like an IP or PPPoE problem even when Layer 3 configuration is correct.
Do not confuse VLANs with bandwidth control
VLANs separate broadcast domains; they do not inherently prioritize traffic or limit speed. Bandwidth control requires queues, shaping, policing, or upstream service profiles. Keeping these functions conceptually separate makes troubleshooting much faster.
Frequently asked questions
Is VLAN 1 always bad?
Not automatically, but many operators reserve it and use explicit VLANs for management and services to reduce ambiguity.
Can the same trunk carry many VLANs?
Yes, if every device in the path is configured to allow those VLANs and the hardware can handle the traffic.
Why does PPPoE work untagged but fail on a VLAN?
Usually because the VLAN is missing, blocked, or tagged differently somewhere in the path.
Next step
Document the result of your test and keep a known-good export. If your network behaves differently from the example, diagnose the topology rather than adding more rules blindly. Continue with a related guide from the tutorial library.