I have a 2860ac set up with tagged and untagged VLANs as follows:

VLAN0: ports=P1, P2, SSID2, SSID3, tag=no tag, LAN=LAN4
VLAN7: ports=P1, P2, P3, tag=100, LAN=LAN1

The issue I'm seeing is that when I ping the host on P2 from a wireless device on SSID3 the router is intermittently tagging the frame with VLAN id 100 when it should always be untagged. Both the P2 host and the SSID3 device are on the same subnet (192.168.1.224/27) so no routing should be taking place.

When the mis-tagging occurs, the host on P2 sees the tagged frame coming in on its VLAN id 100 interface through which there is no reverse path to the IP address of the device on SSID3, so the traffic is dropped. This mis-tagging happens about 50% of the time seemingly randomly and applies to all traffic not just ICMP.

Any pointers as to what is happening would be gratefully received.

Jonathan.

An update on this issue -

The mis-tagging only occurs for packets send to the host on P2 where the source is a wireless device on VLAN0. Packets sent from a wired port on VLAN0 are always correctly received untagged by the P2 host.

The P2 host has two entries in the 2860's ARP table as expected: one for VLAN0 and a second for VLAN7. My view is that the issue lies in the bridging process in the 2860 from the wireless LAN to the wired LAN not looking up the destination MAC address by VID+MAC as it should but just by MAC, which results in the spurious mis-tagging.

I have a case open for this with DrayTek: hoping for a root cause and fix.