VLANs, Trunking, and Layer 2 Forwarding
VLAN behavior and trunking rules
A VLAN is a broadcast domain; the switch forwards frames only within it unless a Layer 3 SVI or routed port provides inter-VLAN routing. Access ports carry one untagged VLAN (PVID) and usually connect endpoints. Trunk ports carry multiple VLANs, tagging frames with 802.1Q except for the native VLAN, which is untagged. On ArubaOS-CX, verify vlan trunk allowed lists, native VLAN, and PVID; on ArubaOS-Switch, verify tagged/untagged membership. MAC learning populates the forwarding table; unknown unicast, broadcast, and multicast are flooded within the VLAN. IGMP snooping constrains multicast flooding.
Traps: creating a VLAN on two switches but forgetting to allow it on the inter-switch trunk; native VLAN mismatch causing untagged frames to land in different VLANs; assuming a VLAN exists just because an SVI is configured; and confusing "allowed" with "active" when STP or a LAG has not converged. Also watch voice VLAN and untagged management designs.
Worked example/rule of thumb: A frame arrives untagged on a trunk configured native VLAN 10 and allowed VLANs 10, 20, 30. It is classified into VLAN 10 and forwarded only out ports that carry VLAN 10. A frame tagged 20 is dropped if VLAN 20 is not in the allowed list. Rule: for a new VLAN across a trunk, create it, allow it on every transit trunk, and verify the forwarding database and SVI.