This document defines the troubleshooting and remediation process for incidents where VLAN tagged traffic is incorrectly forwarded or dropped due to unmanaged switches in the network path, causing VLAN leakage or segmentation failure.

This is a critical operational and security issue because it can cause devices to appear in the wrong network segment and may expose internal systems to unauthorized access.

Applies to:

• Managed Layer 2 switches
• POS terminals
• Guest Wi-Fi networks
• Staff devices
• CCTV and IoT devices
• Branch or restaurant LAN environments using VLAN segmentation
​

VLAN segmentation relies on 802.1Q tagging to separate traffic into different broadcast domains.

Examples of VLAN segmentation include:

• POS VLAN
• Staff VLAN
• Guest Wi-Fi VLAN
• CCTV / IoT VLAN

Managed switches understand VLAN tags and can:

• Preserve VLAN tags across trunk links
• Enforce VLAN separation
• Maintain broadcast domain isolation

However, unmanaged switches do not understand VLAN tagging.

When a trunk carrying tagged VLAN traffic passes through an unmanaged switch:

• Tagged frames may be dropped
• VLAN tags may be stripped
• Traffic from different VLANs may mix together
• Network segmentation may collapse

This results in devices being placed into incorrect network segments.

When VLAN tags are mishandled by an unmanaged switch:

• Tagged frames may be forwarded incorrectly.
• Untagged traffic may enter unintended VLANs.
• Broadcast domains may merge unexpectedly.
• Devices may receive IP addresses from the wrong subnet.

For example:

Router → Trunk → Managed Switch → Unmanaged Switch → Client

In this situation, the unmanaged switch cannot process tagged traffic correctly, leading to VLAN leakage.

Staff Reports

• Devices connecting to the wrong network
• POS systems appearing on guest network
• Guest devices accessing internal services
• Intermittent connectivity issues

Technical Indicators

• Clients receiving IP addresses from incorrect subnet
• Devices unable to reach intended gateway
• VLAN traffic appearing on unintended ports
• Broadcast traffic spreading across multiple VLANs

Note: Most unmanaged switches default to using VLAN 1 for communication. If VLAN 1 is also configured as the native VLAN in Managed switch on Pronto Router, then all traffic coming from devices connected to the unmanaged switch may end up in the native VLAN’s broadcast domain when VLAN 1 is selected.
​

• Security segmentation failure
• Exposure of internal systems to guest networks
• POS network instability
• Compliance risks
• Operational disruption

Severity Level: High (Security + Operational Impact)
​

Step 1 – Inspect Physical Topology

Review the network layout and identify all switches between Router, Managed switch and clients and affected client devices.

Common locations where unmanaged switches appear:

• Under counters
• Behind POS terminals
• Inside cabinets
• Behind network racks

Step 2 – Identify Unmanaged Switches

Confirm whether any switch in the path:

• Has no management interface
• Has no VLAN configuration capability
• Is not part of approved network hardware inventory

Presence of such devices in trunk paths is a strong indicator of VLAN leakage.
​

Step 3 – Verify Client IP Address

Check whether affected clients receive IP addresses from the correct subnet.

If a client receives an IP address from an unexpected subnet, VLAN tagging may be failing upstream.

Step 4 – Bypass Suspected Switch

Temporarily connect the client directly to the managed switch.

If correct network assignment is restored, the unmanaged switch is the root cause.

Step 5 – Verify Native VLAN Configuration

Ensure that trunk links between switches use the correct native VLAN configuration.

Mismatch in native VLAN settings can cause untagged traffic to enter incorrect VLANs.
​

Scenario A – Replace Unmanaged Switch

Remove the unmanaged switch from the network path and replace it with a managed 802.1Q capable switch.

Scenario B – Correct Port Configuration

Ensure that switch ports are configured correctly as either:

• Access ports (single VLAN)
or
• Trunk ports (multiple VLANs)
​

Scenario C – Improve Network Segmentation

Where possible:

• Terminate VLANs at distribution layer
• Avoid trunk links extending into retail floor areas
​

Confirm the following:

• Clients obtain IP addresses from correct subnet
• VLAN isolation is restored
• No unexpected cross-VLAN communication occurs
• DHCP assignments match intended VLAN design

• Avoid unmanaged switches in VLAN trunk paths
• Standardize approved switch models
• Clearly label trunk and access ports
• Maintain accurate network topology documentation
• Conduct periodic Layer 2 audits