On Thu, Aug 18, 2016 at 6:57 PM, Alexis HAUSER < alexis.hauser(a)telecom-bretagne.eu&gt; wrote: Assuming that by 'tag' you mean the 4 byte added to the ethernet header, then see answers below. Note that you can verify this by simply running tcpdump or any other sniffer. Frames seen by this virtual interface are stripped of the vlan tag. The purpose of this interface is to abstract the vlan from upper levels. - the packets outgoing from em2 are tagged or not ? If it originated from em2.25 (from the network you defined), then they will be tagged with vlan ID 25. If they originated from em2 (itself), then no tag will exist. (Usually this occurs when you create a non-vlan network attached to em2) - the result is packets inside ovirt are tagged, but when you go out of it > and reach something from em2, are the packets still tagged ? If you created a VLAN network, then the following flow will exist: (assumed a VM network) [external network]---[em2]----[em2.25]---[bridge]---[vm vnic] [tag25]-------------------[tag25]--[no tag]-----[no tag]--[no tag] This is true for both ingress and egress traffic. For a non-vlan network, the linux bridge is connected directly to em2, and if a tag exists or not depends on the ingress and egress traffic, there is no stripping or adding of tags on the way. Thanks, Edy.