Choosing between ONU VLAN modes comes down to one axis — vlan tagged vs untagged traffic at the UNI port: transparent passes frames untouched, tag mode stamps untagged frames with the port's PVID, and translation rewrites an existing VID — while the OLT service port binds each GEM port to the right VLAN so the whole chain lines up.
Rayin (Shenzhen Rayin Technology) is a manufacturer of GPON OLTs and industrial Ethernet switches.
A broadband service crosses four VLAN processing points between the subscriber's device and the metro:
The user terminal — an enterprise switch may tag frames itself; a home router usually does not.
The ONU's UNI port — decides whether an arriving frame gets tagged, rewritten, or passed as-is.
The GEM port — the PON carrying channel. It does not understand VLANs at all; it just moves frames through the right pipe.
The OLT's service port — ties the GEM port to a VLAN and decides what leaves the uplink.
The ONU and the OLT each modify frames once, with the GEM port in between. The core troubleshooting skill is naming which of the four points a change happened at, because one broken service can be stuck at any of them.
Transparent mode changes nothing, including nothing you would rather it changed — subscriber VIDs reach the OLT raw.
Tag (PVID) mode is the home default: per-port PVID decides which service a frame belongs to; two ports sharing a PVID can see each other at layer 2 unless isolation is on.
Translation rewrites VIDs to solve numbering conflicts, at the cost of maintaining one mapping per service per household — a silently missing entry means a silently dead service.
Most "registered but no internet" cases are one end changed while the other was not: ONU PVID edited, OLT service port left on the old VID, or the uplink trunk missing the VLAN.
In transparent mode the ONU does nothing: tagged in, tagged out with the same VID; untagged in, untagged out.
The advantage is simplicity. An enterprise customer who has planned their own VLANs gets what amounts to a fiber-length patch cord. The cost is exposure — whatever the subscriber sends reaches the OLT raw:
A user rewriting their own VID can land in someone else's service VLAN.
A VLAN 1 broadcast on the subscriber side enters the PON untouched.
Multiple transparent ports on one ONU have no isolation between them — that has to happen at the OLT.
Transparent fits two cases: enterprise leased lines with competent subscribers, and deployments where QinQ upstream already wraps subscriber VLANs in an outer tag.
Tag mode — also called access or PVID mode — applies one rule to untagged frames and a policy to tagged ones: an untagged frame enters and leaves stamped with the port's PVID; a tagged frame is either dropped or forwarded depending on configuration.
This is the standard home broadband pattern. Three LAN ports configured with PVID 100, 200 and 300 carry internet, IPTV and voice respectively, and the OLT side splits on those three VIDs.
The PVID (Port VLAN ID) does two jobs: it tags untagged frames, and it defines the port's default broadcast domain. Every mode in this article is a different answer to the same question — vlan tagged vs untagged frames arriving at the UNI port — and PVID mode is the one that invents a tag where none existed. A wrong PVID is the most common provisioning fault in home FTTH, showing up as "PPP dial succeeds but no internet" or a black IPTV screen.
One side effect matters: two ports on the same ONU with the same PVID are layer-2 transparent to each other. Both set to 100, and devices on either port see each other's broadcasts. Separating them takes port isolation.
Translation rewrites the VID value: in at 100, out at 200; in at 101, out at 201.
The problem it solves is numbering conflict. Every household's ONU starts its services at VLAN 100, and the OLT cannot carry ten thousand copies of VLAN 100 — so each household must map to unique numbers somewhere. Doing it on the ONU means the OLT does not need a separate service port per household.
The price is a mapping table. Three services per household means three mappings; a thousand households means three thousand entries. A missing entry fails silently — no error, no alarm, just a subscriber saying "this feature does not work".
| Mode | Untagged frame in | Tagged (100) frame in | Per-port setting | Fits |
|---|---|---|---|---|
| Transparent | Passes as-is | Passes as-is | Almost none | Enterprise lines, QinQ upstream |
| Tag / PVID | Stamped with PVID | Dropped or passed per policy | One PVID per port | Home broadband, multi-service per port |
| Translation | Treated as default VLAN | Rewritten to the mapped VID | One mapping per service | Same numbering every ONU, unique at the CO |
Once the ONU has processed the VLAN, frames enter a GEM port — the GPON carrying channel defined in ITU-T G.984.3, identified by a 12-bit Port ID. It does not read VLANs; it moves frames into the pipe that leads to the matching OLT-side termination.
The OLT service port performs the final binding, and a complete one carries three elements:
VLAN ID — what tag the service carries on the uplink
GEM Port ID — which pipe the frames arrive through
UNI port / ONU-ID — which port of which terminal it belongs to
All three matching is what "working" means. This is the number-one reason an ONU registers yet carries no traffic: the ONU side VLAN changed, and the service port still points at the old VID.
The recurring question: three services — how many GEM ports? It depends on the VLANs:
Three services, three VLANs → three GEM ports, each bound separately.
Three services, one VLAN, differing only in 802.1p priority → one GEM port suffices; priority separates them.
Multicast (IPTV) usually gets its own GEM port because it rides the IGMP snooping multicast forwarding path.
The 12-bit Port ID allows up to 4,095 GEM ports, so per-ONU supply is never the constraint. The real ceiling is the OLT's service port table — a fully loaded 128-ONU port with three services each is 384 entries, a number worth confirming at selection time.
One ONU carries internet on VLAN 100, IPTV on 200 and VoIP on 300. Three builds, same outcome, very different maintenance.
Plan A — transparent plus OLT-side split. All three LAN ports transparent; subscriber devices tag themselves. ONU needs no PVIDs; the OLT runs three service ports binding VLANs 100/200/300 to three GEM ports. It only works if the terminals actually tag — home routers usually do not. Enterprise lines yes; homes no.
Plan B — tag mode, PVID per port. LAN1 PVID 100, LAN2 PVID 200, LAN3 PVID 300; the OLT keeps its three service ports. Subscriber devices stay untagged and the ONU does the stamping. This is the home standard: least configuration, clearest logic, and the right answer in roughly nine out of ten residential installs.
Plan C — translation with per-household mapping. All three ports accept untagged (default VLAN 1) and the ONU rewrites internally: 1→100, 1→200, 1→300 distinguished by UNI port; the OLT still runs three service ports. This fits estates where every ONU is numbered identically but the CO requires uniqueness — at the highest maintenance cost of the three.
All three plans use three GEM ports; they differ only in where the tagging happens and how much mapping table exists to maintain.
One bandwidth note that VLAN planning tends to skip: committed rates of 100 + 20 + 2 = 122 Mbps per household look harmless until you multiply — at 1:128 splitting the upstream sum is 15.6 Gbit/s against a 1.244 Gbit/s shared PON port. Committed rates cannot be stacked at full load; only DBA statistical multiplexing makes the arithmetic work. Discovering this after provisioning is an expensive way to learn it.
| Symptom | Most likely wrong point | How to verify |
|---|---|---|
| Dials up, pages will not load | Service port VLAN ≠ ONU PVID | Capture on the OLT uplink and read the VID |
| IPTV black, internet fine | Multicast VLAN unbound or IGMP snooping off | Check the multicast GEM port and multicast VLAN |
| Voice fails to register, rest works | Voice port PVID wrong, or priority untagged | Read the ONU port PVID and 802.1p marking |
| Internet works at half speed | One-direction VLAN mismatch (up ok, down broken) | Test both directions separately |
| One LAN port dead, others fine | That port's PVID unset or left at default 1 | Check PVIDs port by port |
| Many households down at once | Uplink VLAN not permitted, trunk missing | Read the uplink's allowed VLAN list |
The first three cover most real tickets, and they share one root: the change was made at one end only. The ONU's PVID moved while the OLT's service port did not — or the OLT gained a VLAN the uplink trunk never permitted.
Work top-down: fix the service VLAN plan, then the OLT service ports, then the ONU port modes. The reverse order leaves a window where the ONU is ready and the OLT is not.
Illustrative only — commands differ per platform, follow the actual CLI.
! ONU side: three LAN ports with PVIDs interface lan 1 vlan-mode tag pvid 100 interface lan 2 vlan-mode tag pvid 200 interface lan 3 vlan-mode tag pvid 300 ! OLT side: service port binding service-port 1 vlan 100 gpon 0/1 ont 15 gemport 1 service-port 2 vlan 200 gpon 0/1 ont 15 gemport 2 service-port 3 vlan 300 gpon 0/1 ont 15 gemport 3
Three verification steps, none optional:
Frame headers at the ONU — capture on a LAN port and confirm the egress VID matches the plan.
Capture on the OLT uplink — confirm the uplink frame VIDs match the plan.
Test both directions — a working uplink proves nothing about the downlink; a service port direction error breaks exactly one of them.
Rayin's XPON ONU UNI ports support transparent, tag and translation modes; paired with the L102P, a 2-port mini GPON OLT offering 1:128 splitting per PON port and an uplink of 2×GE plus 1×SFP+ 10GE, every service-port binding should be checked line by line on the OLT, and the service port table size is one of the capacity figures to confirm at selection. Specs are on the PON access page; where the uplink rides an industrial switch, the port and VLAN guidance sits under Rayin's industrial Ethernet switch range.
Should a home installation use tag mode or transparent?
Tag mode. Home routers, set-top boxes and phones send untagged frames, so in transparent mode the OLT receives untagged traffic it cannot split by VLAN. Tag mode lets the ONU stamp a PVID per port, and the OLT then binds one service port per service.
Why must the OLT side change when the ONU's PVID changes?
Because the service port binds by VLAN. Move the frames from VID 100 to 200 on the ONU and a service port still bound to 100 receives nothing — the symptom is "ONU online, service dead". VLAN changes are a two-ended operation by definition.
Can three services share a single GEM port?
Yes, provided all three ride the same VLAN and differ only by 802.1p priority. Three different VLANs require three GEM ports, because GEM ports bind per service channel. Multicast normally takes its own GEM port regardless.
Where exactly does vlan translation differ from tag mode?
Tag mode says "you have no tag, here is one"; translation says "your tag is wrong, here is another". The first handles untagged frames, the second rewrites tagged ones. Homes use tag mode; estates where every ONU is numbered identically are where translation earns its keep.
VLANs are configured and it still does not work — what gets checked first?
The uplink's allowed VLAN list. The service ports can be perfect inside the OLT, but if the uplink trunk does not permit the VLAN, frames die at the boundary with a symptom identical to a missing service port. It is the most-skipped check because nothing in the per-service configuration looks wrong.
About the author: Sara — Sara is a Customer Manager at Rayin with over 10 years of experience in the communications field. In her free time, she enjoys badminton and swimming.
About Rayin: Shenzhen Rayin Technology Co., Ltd. — Company Profile
