Tagging/Untagging of Ports connected to ESXi-Host and APs (WAC720)

Eli,

Here some simple guidelines and check points:

1. Where a single adapter/computer should be connected a defined VLAN eg. 1234, only the VLAN 1234 is [U]ntagged on this port, and logically also the PVID must be 1234 (defining the VLAN ID untagged frames flowing to the switch will be assigned to) - that makes up an access port. No other VLAN must be be associated to this port or LAG, neither untagged nor tagged.

2. Everywhere where you have multiple VLANs over a connection or a LAG (switch stack, switch interconnection, ESXi hosts, wireless access points, ....) -  a trunk - all VLAN must be [T]agged. Only _one_ VLAN can be run untagged and again the PVID must be set to the same VLAN ID.

Time to review everything, and clean out the mess which is (sorry - obvious) in place there. All VLAN untagged on a switch interconnection is definitively wrong! You will end with wild interconnection of what re supposed to be independent networks. It's difficult to provide a general standard which VLAN should be run untagged. Sometimes, you can have devices with special requirements or limitations. Write down _exactly_ what you want to achieve, and how the switch stack, and other trunk connections are supposed to be configured. 

Have fun troubleshooting and clean-out the spaghetti network!

-Kurt