VLAN types: port, MAC, protocol and subnet-based membership compared

VLAN types, in the sense of how a switch decides which VLAN a frame belongs to, come in four kinds: port-based looks at the port the frame arrived on, MAC-based at its source MAC address, protocol-based at the EtherType field in the Ethernet header, and IP subnet-based at the subnet its source IP address falls in. All four share one premise: they only apply to untagged frames. If a frame already carries an 802.1Q tag, the switch uses the VLAN ID in the tag. Port-based membership is what most documentation calls a static VLAN; membership that follows the device, such as a MAC-based VLAN or a VLAN assigned after 802.1X authentication, is usually called dynamic. The table below summarizes the four types, the sections after it cover the configuration and trade-offs of each, and the last part explains why hosting data centers rely on port-based VLANs. Configuration examples use Huawei S series syntax (V200R software). H3C supports the same types with its own syntax, while other vendors use different keywords or provide dynamic membership through 802.1X instead, so check the manual for your platform.

The four VLAN types at a glance

Type	What the switch looks at	Where it is configured	Host moves to another port	Who can change membership	Typical use
Port-based	The port the frame came in on	The PVID of each port	Joins the new port’s VLAN	Only the switch administrator	Data centers, campus access, most networks
MAC-based	Source MAC address	A MAC-to-VLAN table on the switch	Stays in its VLAN	Anyone who can change the NIC’s MAC	Small office networks where devices move often
Protocol-based	EtherType field, e.g. 0x0800 for IPv4, 0x86DD for IPv6	A protocol template under the VLAN	Assigned by protocol	Whoever chooses the protocol on the host	Legacy multiprotocol networks, IPv6 pilots
IP subnet-based	The subnet of the source IP address	Subnet entries under the VLAN	Stays in its VLAN	Anyone who can change the IP address	Address migrations, lab networks

When several types are enabled on the same port, the switch checks them in a fixed order. On Huawei S series switches, MAC-based and subnet-based VLANs are matched first (which of the two wins is set per interface with vlan precedence, and MAC comes first by default), then protocol-based VLANs, and if nothing matches, the frame goes to the port’s PVID. Port-based membership is therefore always the fallback, and the other three types are exceptions layered on top of it.

Port-based VLAN: membership follows the switch port

Every port has a PVID (port VLAN ID; on a Cisco access port it is called the access VLAN), and every untagged frame that enters the port belongs to that VLAN. Configuring port default vlan 10 on a Huawei access port, or switchport access vlan 10 on Cisco, is port-based VLAN assignment. When one port has to carry several VLANs, tags tell them apart. That is the job of trunk and hybrid ports, and membership is still decided by the port plus the tag, never by anything about the host.

Pros	Cons
Membership is decided entirely by the switch configuration; nothing the host does can move it to another VLAN	Moving a device to another port needs a configuration change, or it lands in the new port’s VLAN
No extra mapping table, and every managed switch supports it	Whatever is plugged into the port joins the VLAN, so pair it with port security or MAC binding
The VLAN is fixed from power-on, independent of the operating system and IP address	Without tags, one port maps to exactly one VLAN
Easy to audit: display port vlan on Huawei or show vlan brief on Cisco shows every port on one screen	—

MAC-based VLAN: membership follows the network card

The switch keeps a table that maps MAC addresses to VLANs. When an untagged frame arrives, the switch looks up its source MAC; on a match the frame goes into the listed VLAN, otherwise it falls back to the port’s PVID. Huawei usually enables this on hybrid ports (check the release manual for supported port types), and the port must also carry the target VLANs untagged:

system-view
vlan batch 10 20 999
vlan 10
 mac-vlan mac-address 0011-2233-4401
 mac-vlan mac-address 0011-2233-4402
 quit
interface GigabitEthernet0/0/5
 port link-type hybrid
 port hybrid pvid vlan 999
 port hybrid untagged vlan 10 20 999
 mac-vlan enable
 quit

Here the PVID is 999, a guest VLAN with no gateway that is not allowed on any trunk. The two registered devices land in VLAN 10 on any port with MAC VLAN enabled; any unregistered device lands in VLAN 999 and can reach nothing.

Every weakness of this type comes from one fact: the host controls its own MAC address.

• MAC addresses can be changed. On Linux, three commands set the NIC’s MAC to an address someone else registered, which puts the host in that VLAN:

ip link set dev eth0 down
ip link set dev eth0 address 00:11:22:33:44:01
ip link set dev eth0 up

• Maintenance never stops. Every new device’s MAC has to be collected and entered before it is connected. When a NIC or motherboard is replaced under warranty, the MAC changes and the table must be updated, or the server drops off the network.
• Table size is limited. MAC VLAN entries use hardware table space on the switch, and how many fit depends on the model’s specifications.
• A port rarely has just one MAC. Every virtual machine on a hypervisor has its own MAC, and some operating systems use randomized MAC addresses for Wi-Fi by default, so the table struggles to keep up.

Subnet-based VLAN: membership follows the IP address

An untagged frame is assigned to a VLAN according to which configured subnet its source IP address belongs to. On Huawei this is also enabled on a hybrid port:

system-view
vlan 30
 ip-subnet-vlan 1 ip 192.168.30.0 24
 quit
interface GigabitEthernet0/0/6
 port link-type hybrid
 port hybrid untagged vlan 30
 ip-subnet-vlan enable
 quit

Its real use is address migration. Say a site is moving hosts off 192.168.30.0/24 onto a new range: during the transition, hosts from the old and new subnets are mixed on the same ports, and subnet-based VLANs let each group go into its own VLAN and use its own gateway. When the move is complete, you switch back to port-based VLANs. The drawbacks are just as clear:

• The host chooses its IP address. Change the address to one in another subnet and the host is in another VLAN.
• DHCP clients cannot match. A host that has not yet received an address sends packets with source address 0.0.0.0, which matches no subnet, so it falls into the PVID. This type mainly suits hosts with static addresses.
• Most switches accept only IPv4 subnet entries. IPv6 traffic from dual-stack hosts needs separate handling; check the model’s manual for what is supported.

Protocol-based VLAN: membership follows the EtherType

The switch reads the type field in the Ethernet header and sends each protocol to a different VLAN. This type dates from the days when IPX, AppleTalk and IP shared the same network. Almost all traffic is IP today, so its main remaining use is an IPv6 pilot: put IPv6 traffic in its own VLAN and hand it to a separate gateway or firewall, leaving IPv4 services untouched.

system-view
vlan 40
 protocol-vlan 1 ipv6
 quit
interface GigabitEthernet0/0/7
 port link-type hybrid
 port hybrid untagged vlan 40
 protocol-vlan vlan 40 all
 quit

Two points to watch. If you split traffic by IPv4, ARP (EtherType 0x0806) must land in the same VLAN as IPv4, or hosts cannot resolve MAC addresses; on some devices the IPv4 template includes ARP automatically, so check the manual. IPv6 neighbor discovery travels inside IPv6 packets, so the IPv6 case does not have this problem. And once a dual-stack host’s traffic is split across two VLANs, troubleshooting means checking both of them.

Pros and cons of each VLAN type

	Port-based	MAC-based	Protocol-based	IP subnet-based
Configuration effort	One line per port	One entry per device, maintained forever	One entry per protocol	One entry per subnet
Host moves to another port	Needs a config change	Follows automatically	Follows automatically	Follows automatically
Can the host change its own VLAN?	No	Yes, by changing its MAC	Yes, by switching protocol	Yes, by changing its IP
Before boot and during OS install	Already assigned	Already assigned	Already assigned	No IP yet, falls into the PVID
Switch support	Every managed switch	Some models, check the specifications	Some models, check the specifications	Some models, check the specifications
Troubleshooting effort	Low	Medium, you have to check the mapping table	Medium	Medium, you have to know the host’s current IP

Beyond these four, campus networks more often use a fifth approach: dynamic VLAN assignment through authentication. The device authenticates with 802.1X when it connects, and the RADIUS server returns a VLAN for that user in its reply, using the attributes defined in RFC 3580: Tunnel-Type set to VLAN (13), Tunnel-Medium-Type set to 802 (6), and Tunnel-Private-Group-ID set to the VLAN ID. The VLAN follows the user wherever they plug in, yet the user cannot pick it; the cost is running an authentication system. Cisco Catalyst switches usually provide dynamic membership this way, through 802.1X or MAC Authentication Bypass (MAB) for devices that cannot authenticate, rather than through static MAC, subnet or protocol tables.

Why data centers use port-based VLANs

1. Customers control the servers’ operating systems. MAC and IP addresses are in the customer’s hands. With subnet-based VLANs, a customer who sets an address from a neighbor’s subnet would be placed in the neighbor’s VLAN, and customer isolation would be gone on the spot; MAC-based VLANs have the same flaw. With port-based VLANs, nothing a customer does inside the OS can move the server out of the VLAN configured on its switch port.
2. The unit of delivery is the port. A hosting contract specifies servers, ports and bandwidth, so the mapping of customer to server to switch port has to be recorded anyway. When the VLAN follows the port, the inventory and the switch configuration agree by design.
3. Hardware swaps do not touch the network. A replaced motherboard or NIC brings a new MAC, which would mean editing a MAC table. With port-based VLANs, you plug the repaired server back into the same port and you are done.
4. There is no IP address during OS installation. A PXE-booting server gets its address over DHCP and sends its first packets from 0.0.0.0, so subnet-based VLANs cannot match at that stage; a port VLAN is fixed from the moment the server powers on.
5. A hypervisor port carries dozens of MACs. Virtualization hosts use trunk ports and tags to separate networks, which is far more reliable than registering every virtual machine’s MAC.
6. Automation is straightforward. Changing a port’s VLAN takes one or two commands on any vendor’s switch, which a management system can drive easily. MAC and subnet tables have to be kept in sync across many switches, which is much harder to automate.

MAC addresses still matter in a data center, but their role is verification, not membership. The VLAN comes from the port, and MAC binding or IP-to-MAC binding on that port means a swapped-in device fails the check. The other types appear only in corners of a facility: 802.1X dynamic VLANs on the operations office network, protocol-based VLANs during an IPv6 pilot, and subnet-based VLANs during a site move or address migration.

Managing port-based VLANs at scale

Day to day, port-based VLANs mean changing port VLANs as customers go live, move and leave, and keeping the server-to-port mapping accurate. The switch management module in Toplink DCIM ships command sets for Huawei, H3C, Cisco and other vendors: you change a port’s VLAN in the web interface, and the system translates the change into that switch’s commands and pushes them. The server list shows which switch and port each machine is connected to and which VLAN it is in. MAC verification is handled by automatic binding: server-side MACs are learned and bound on the switch, so re-cabling and migrations need no manual tracing.