The ePMP radio (subscriber module) can be used to filter VLANs in a network. In this case, only the tagged traffic of specific VLANs will pass across the ePMP SM, the rest of the traffic (all untagged and VLANs that are not allowed) will be dropped at the SM.
In an ePMP installation, in some instances, as per the network requirements, on some of the SMs (downstream), we may want to have traffic of specific VLANs only. The VLAN filtering will allow us to filter out the VLAN traffic which is not required downstream of those SMs.
To do this, we will have to add the VLANs which we wish to pass, to the ePMP membership VLAN table.
Here is the explanation of Membership VLAN (in ePMP):
Membership VLAN: When the SM receives a packet tagged from either the Ethernet (LAN) or Wireless (WAN) side with a VLAN ID which is contained in the Membership VLAN Table, the packet is forwarded and sent out to the other interface. When the SM receives a packet tagged with a VLAN ID that is not present in the Membership VLAN Table, the frame is dropped (assuming there is at least one VLAN ID present in the Membership VLAN table or configured as a Data VLAN).
The option to configure Membership VLAN is on the Subscriber Module/Slave radio. Here is the path in the ePMP SM/Slave GUI:
GUI>>Configuration>>Network>>Virtual Local Area Network>>Membership VLAN
Here is a scenario in which we have used the ePMP SM to filter VLANs by configuring Membership VLANs on it:
Here, PC1 should be able to ping Router1.
PC2 should be able to ping Router2.
However, PC3 will not be able to ping Router3 as VLAN 30 is not added to the Membership VLAN table of ePMP SM. The ePMP SM will filter out traffic having a VLAN 30 tag. In this way, we can allow only tagged traffic that too of specific VLANs through the ePMP SM.
Note: The Trunk links shown in the diagram have all tagged traffic allowed.