How does Mac Telnet and VLAN’s work together?

So this may be a dumb question and maybe, but I guess I’m just wondering what the “life” cycle of a Ethernet VLAN tag is.

I am messing around with the mac telnet feature and it’s pretty cool but I have all my network infrastructure on a different VLAN than where all the regular users are.

I wasn’t able to find the switch under the neighbors when on my users VLAN, which makes sense considering what I’ve researched it only shows what’s in your layer 2 broadcast domain.

I figured I could still connect to my switch manually by entering the Mac still because “why not? Surely the switch can read the frame I’m sending to it and respond”

But I always get the mac timeout message. My “allowed interfaces” is currently set to All just for troubleshooting purposes. So next I thought it had to do with the bridge needing to accept my tagged frames coming from my user VLAN but that didn’t work either.

So lastly I put a L3 VLAN interface on it with the user VLAN ID but no other configuration and both neighbor discover and MAC Telnet are now working.

I assumed the L3 interface was not needed due to MAC telnet being from what I understand as purely L2.

Can someone maybe provide some clarity on the situation? Thanks!

EDIT - Discovered that it’s not really pure L2 like RSTP for example, as it broadcasts on L3 and and uses L4 to send UDP packets to DST port 20561 which explains why it needs the L3 VLAN interface to handle the packet side of things. My assumption is that due to the switch not having a L3 interface for the User VLAN, although the frames were forwarded (via bridge rules) to the switch-cpu it was dropping the packets because it wasn’t expecting the user VLAN ID. (Hopefully someone will correct me if my assumption is wrong)

MAC telnet (application) works only with ethernet frames without VLAN tags (I suspect it’s using ethertype 0x0800 IPv4(. So it can’t be used off bridge which is trunk port, VLAN interface(s) are needed to strip/add VLAN tags.