When a tagged packet is received on a SAP configured with dot1q encapsulation, the VLAN tag must match the value configured on the SAP in order to be forwarded.