Difference between tagged and untagged port

It's old but it still comes up at the top of web searches, so let me clarify:

If you want 3 VLANs that use different ports, it amounts to splitting your switch into 3 physical sub-switches. In this case, the TAGs are useless.
But if you want to interconnect 2 physical switches together, and VLANs 2 and 3 are present on both sides, how will they communicate??? You would need to connect 3 cables between your 2 switches: for VLAN 1, for VLAN 2, and for VLAN 3. That's absurd. One cable is enough.

To do this, let's say you plan to use port 1 for interconnection. Then you TAG it in all the VLANs you have created (so port 1 belongs to all the VLANs). You do the same on switch 2 for its interconnection port.
If you are only using machines that do not know how to tag in VLAN, you connect them to the physical ports you have identified as belonging to such or such VLAN, in U (untag) mode.

On the other hand, if you have an ESX server (vsphere, vmware ....) hosting a lot of machines that you want to be able to link to either VLAN 1, 2, or 3, how do you do it? The simplest answer is to take advantage of 3 network cards in your ESX, and connect each one to a port of one of the 3 VLANs. And too bad for link redundancy (???). And if your ESX has only 2 network cards?!
Then it's simple: all the cards in your ESX are connected to ports on the switch configured in all VLANs (like port 1 mentioned earlier), so TAG 2 and TAG 3 (the default VLAN cannot be tagged). Then in ESX, you define each virtual machine network (VM Network) as associated with a VLAN (--, 2 or 3), using all the shared physical cards... and it's magic!

And if your ESX wants to fetch storage using NFS or iSCSI on a filer or a storage array that doesn't know how to tag... well, you connect that storage array to a U port on your switch in VLAN 3, for example. And in ESX, you need to configure a VMKernel in a PortGroup on VLAN 3!
- the flow leaves the ESX with a TAG in VLAN 3 to connect to an NFS datastore
- the flow enters the switch with TAG 3, on a T port that belongs to VLAN 2 and 3
- the TAG 3 indicates to the switch to forward the flow only to the ports that are in TAG 3, and the ports that are in UNTAG 3
- on one of the ports in UNTAG 3 is the filer and its untagged connection
- the switch removes TAG 3 that arrives from the ESX flow, and forwards it to the NFS filer.

In return, the NFS filer sends untagged frames! (it doesn't know how to do it)
- the switch receives this on a port that belongs only to VLAN 3! In U mode!
- the switch adds TAG 3 to what it just received.
- then the switch forwards to all the physical ports tagged 3, and untagged 3
- one of these ports is connected to the ESX... which accepts, and redirects internally to the proper element.


Note that advanced versions of ESX use internal dvSwitches, that is to say, distributed virtual switches that allow you to organize all the networks and VLANs you want for all virtual machines without worrying about reconfiguring the physical switch every 2 seconds.

Great post man, even with 8 years of delay on the question, I thank you, your comment helps me a lot!

Great, I finally understood.

good explanation, we thank you