diff --git a/pipelines/fabric/impl/src/main/resources/include/control/next.p4 b/pipelines/fabric/impl/src/main/resources/include/control/next.p4
index 0a624b2..11437b1 100644
--- a/pipelines/fabric/impl/src/main/resources/include/control/next.p4
+++ b/pipelines/fabric/impl/src/main/resources/include/control/next.p4
@@ -283,7 +283,7 @@
     }
 
     @hidden
-    action push_vlan() {
+    action push_outer_vlan() {
         // If VLAN is already valid, we overwrite it with a potentially new VLAN
         // ID, and same CFI, PRI, and eth_type values found in ingress.
         hdr.vlan_tag.setValid();
@@ -308,25 +308,37 @@
 
     /*
      * Egress VLAN Table.
-     * Pops the VLAN tag if the pair egress port and VLAN ID is matched.
+     * Pushes or Pops the VLAN tag if the pair egress port and VLAN ID is matched.
+     * Instead, it drops the packets on miss.
      */
     direct_counter(CounterType.packets_and_bytes) egress_vlan_counter;
 
+    action push_vlan() {
+        push_outer_vlan();
+        egress_vlan_counter.count();
+    }
+
     action pop_vlan() {
         hdr.vlan_tag.setInvalid();
         egress_vlan_counter.count();
     }
 
+    action drop() {
+        mark_to_drop(standard_metadata);
+        egress_vlan_counter.count();
+    }
+
     table egress_vlan {
         key = {
             fabric_metadata.vlan_id: exact @name("vlan_id");
             standard_metadata.egress_port: exact @name("eg_port");
         }
         actions = {
+            push_vlan;
             pop_vlan;
-            @defaultonly nop;
+            @defaultonly drop;
         }
-        const default_action = nop();
+        const default_action = drop();
         counters = egress_vlan_counter;
         size = EGRESS_VLAN_TABLE_SIZE;
     }
@@ -346,20 +358,14 @@
 #ifdef WITH_DOUBLE_VLAN_TERMINATION
         if (fabric_metadata.push_double_vlan == _TRUE) {
             // Double VLAN termination.
-            push_vlan();
+            push_outer_vlan();
             push_inner_vlan();
         } else {
             // If no push double vlan, inner_vlan_tag must be popped
             hdr.inner_vlan_tag.setInvalid();
 #endif // WITH_DOUBLE_VLAN_TERMINATION
-            // Port-based VLAN tagging (by default all
-            // ports are assumed tagged)
-            if (!egress_vlan.apply().hit) {
-                // Push VLAN tag if not the default one.
-                if (fabric_metadata.vlan_id != DEFAULT_VLAN_ID) {
-                    push_vlan();
-                }
-            }
+            // Port-based VLAN tagging; if there is no match drop the packet!
+            egress_vlan.apply();
 #ifdef WITH_DOUBLE_VLAN_TERMINATION
         }
 #endif // WITH_DOUBLE_VLAN_TERMINATION