Sophos Switch: VLAN Configuration

Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.


This recommended Read aims to provide a complete guide on configuring VLANs, including both tagged and untagged ports, on a Sophos switch.

In the context of Sophos switches, it's important to note that we refer to 'tagged ports' as trunk ports, which are typically used to carry traffic for multiple VLANs, and 'untagged ports' or access ports, which are used for end devices within a single VLAN.

We will explore the process step by step to help you effectively set up and manage VLANs on your Sophos switch.



In this example, we have 2 workstation members of 2 different VLANs.

Access Switch

Ports: 2–4 Untagged Port VLAN 100

Ports: 5–7 Untagged Port VLAN 200

Port 8:

  • Tagged Port VLANs 100 and 200
  • Connected to XGS firewall to carry traffic for VLANs 100 & 200.


Member of VLAN SUPPORT-100 which resides in VLAN 100.

Connected to port 2 on the Sophos Access Switch


Member of VLAN SALES-200 which resides in VLAN 200.

Connected to port 5 on the Sophos Access Switch


Log in to Sophos Switch 


To add VLAN navigate to Configure > VLAN settings > 802.1Q  then click “+Add

In the Add VLAN window enter the details of your desired VLAN

  1. Enter your desired VLAN ID. This must be a number from 2 to 4094.
  2. Enter the desired VLAN name.
  3. Then click ‘Apply.’

Tagged Ports (Trunk Port)

  1. To configure a tagged port, navigate to Configure > VLAN settings > 802.1Q then click ‘Edit’ on the VLAN(s) created.

  1. Click the 'Tagged' box.
  2. Select your desired tagged port. In this example, choose Port 8.
  3. Click the 'checkmark' icon.

5. Then click 'Apply'.

We have successfully created a Tagged Port (Trunk Port) for VLANs 100 and 200.

Untagged Port (Access Port)

  1. Click ‘Edit’ your desired VLAN to create untagged ports. In this example we choose SUPPORT-100.


  1. Click on the ‘Untagged’ Box
  2. Click on your desired port(s). In this example ports 2, 3 and 4.
  3. Click the 'checkmark' icon.

5.Then click on ‘Apply’.


The PVID is a setting assigned to an individual switch port, specifying the VLAN ID to be assigned to incoming untagged traffic on that port.

In simpler terms, when an untagged frame arrives at a port, the switch assigns it the VLAN specified by the PVID for that particular port. In the context of Sophos switches, incoming traffic is initially set to PVID 1.

To ensure traffic is placed in the correct VLAN, it's essential to change or set the PVID to the appropriate VLAN ID on your desired port(s).

More details can found here for reference: Sophos Cloud Switch: PVID

PVID Configuration

In our example, we will be configuring PVIDs as follows:

  • PVID 100 on ports 2, 3 and 4.
  • PVID 200 on ports 5, 6 and 7.

To configure PVID navigate to

  1. Configure
  2. VLAN settings
  3. PVID and Ingress filter
  4. Choose your required port(s). In this example ports 2, 3 and 4
  5. Then click ‘Edit’

Once the PVID Window appears:

  1. Select your desired PVID, in this example 100 (SUPPORT-100).
  2. Click Apply.

Added TAGs
[edited by: Wali Tahiri at 7:27 AM (GMT -8) on 17 Nov 2023]