VMware ESXi and vSphere Cluster Management

Access and Trunk Ports Explained

Learn how Cisco switch access and trunk ports assign VLAN membership, handle Ethernet frames, and connect endpoints, switches, routers, and other network devices.

Switch ports connect devices to a Layer 2 network. A port’s switchport mode determines how the switch associates received Ethernet traffic with a VLAN. The two central modes in basic VLAN deployments are access and trunk.

A VLAN is a logical Layer 2 network and broadcast domain identified by a VLAN ID. The VLAN is the logical network; the port mode is the operating role of the switch interface. These are related but different concepts.

Access Ports

An access port belongs to one data VLAN. It is normally used for an endpoint that does not need to receive traffic from multiple VLANs.

When an ordinary endpoint sends an untagged Ethernet frame into an access port, the switch associates that frame with the interface’s configured access VLAN. When the switch sends traffic toward the endpoint, it normally removes VLAN information and transmits an ordinary untagged Ethernet frame.

Typical access-port connections include:

  • Workstations and laptops
  • Printers
  • Servers using a standard single-VLAN NIC connection
  • Cameras, phones, and other endpoint devices when their VLAN design does not require a trunk

For example, if a workstation is connected to an interface assigned to VLAN 10, the workstation can send normal untagged Ethernet frames. The switch places those frames in VLAN 10 without requiring the workstation to understand VLAN tagging.

Trunk Ports

A trunk port carries traffic for more than one VLAN over one physical link. Trunks are commonly used between switches so that the same VLAN can span multiple switches.

Other common trunk peers include:

  • Routers using subinterfaces, as in router-on-a-stick designs
  • Firewalls with multiple VLAN interfaces
  • Hypervisors carrying traffic for multiple virtual networks
  • Wireless access points providing multiple SSIDs mapped to different VLANs
  • Servers configured to generate and receive VLAN-tagged traffic

VLAN identification on a trunk is normally carried using IEEE 802.1Q. An 802.1Q VLAN tag includes a VLAN identifier so the receiving device can preserve the separation between multiple logical LANs sharing the same physical link.

A trunk does not automatically have to carry every VLAN. An allowed VLAN list can restrict the trunk to only the VLANs required by the design.

How Frames Are Assigned to VLANs

Traffic Entering an Access Port

An endpoint usually sends an untagged frame. The switch receives it on an access-mode interface and assigns it to that interface’s access VLAN. The VLAN assignment is made by the switch; the endpoint does not need to add an 802.1Q tag.

Traffic Leaving an Access Port

When traffic from the access VLAN is sent to the attached endpoint, the switch normally transmits it without an 802.1Q tag. This is why a typical PC can use a VLAN without having VLAN-aware NIC configuration.

Traffic Crossing a Trunk

When a frame crosses a trunk, its VLAN identity is normally represented by an 802.1Q tag. The receiving switch reads the VLAN ID and forwards the frame within the corresponding VLAN.

Tags are necessary because one physical trunk carries several logical networks. Without VLAN identification, the receiving device could not reliably determine whether a frame belonged to VLAN 10, VLAN 20, or another VLAN.

Native VLAN

The native VLAN is the VLAN associated with untagged traffic on an 802.1Q trunk, subject to the platform’s behavior and configuration. Tagged traffic identifies its VLAN in the tag; native-VLAN traffic may be sent or accepted without a tag.

Both ends of a trunk should use consistent native-VLAN settings and consistent handling of untagged traffic. A mismatch can cause warnings, misplaced traffic, or connectivity problems. Native VLAN behavior should be configured deliberately rather than assumed.

Access Port and Trunk Port Comparison

Characteristic | Access Port | Trunk Port Typical VLAN count | Normally one data VLAN | More than one VLAN Typical connected device | PC, printer, single-VLAN server, or other endpoint | Switch, router, firewall, hypervisor, wireless access point, or VLAN-aware server Incoming frame handling | Untagged traffic is assigned to the access VLAN | Tagged traffic identifies its VLAN; untagged traffic is handled according to native-VLAN configuration Outgoing frame handling | Normally sent untagged toward the endpoint | VLAN traffic is normally sent with 802.1Q tags; native-VLAN treatment may be untagged Use of 802.1Q tags | Usually not visible on the endpoint link | Normally used to preserve VLAN identity across the shared link Common topology role | Extends one VLAN to an endpoint | Extends multiple VLANs across one physical connection

Frame Treatment by Port Type

Port Type | Frame Direction | Tagged or Untagged Input | VLAN Determination | Expected Output Format Access port | Endpoint to switch | Usually untagged | Configured access VLAN | Internal switch forwarding uses the assigned VLAN Access port | Switch to endpoint | The switch may process tagged traffic internally | Destination access VLAN | Normally untagged Trunk | Device to switch | Normally tagged for non-native VLANs | VLAN ID in the 802.1Q tag | Forwarded within the identified VLAN Trunk | Native-VLAN traffic | May be untagged | Configured native VLAN | Handling must match at both ends

Two-Switch Topology Example

Imagine two switches connected by one trunk. Each switch has hosts in VLAN 10 and VLAN 20:

Host A -- access VLAN 10 -- Switch 1
Host B -- access VLAN 20 -- Switch 1
                         |
                         | trunk: VLANs 10,20
                         |
Host C -- access VLAN 10 -- Switch 2
Host D -- access VLAN 20 -- Switch 2

The host-facing interfaces are access ports. The link between Switch 1 and Switch 2 is a trunk that permits VLANs 10 and 20.

Host A and Host C are both in VLAN 10, so VLAN 10 can remain one broadcast domain across both switches when the trunk permits it. Similarly, Host B and Host D can share VLAN 20 across the trunk.

The trunk does not route between VLANs. Host A in VLAN 10 and Host B in VLAN 20 require inter-VLAN routing, which is Layer 3 forwarding performed by a router or Layer 3 switch. A trunk only transports the separate VLANs; it does not make them one network.

Cisco IOS Configuration

Create the VLANs

Create VLANs before assigning access ports to them or transporting them across a trunk.

configure terminal
vlan 10
 name USERS
vlan 20
 name VOICE
end

The names are locally descriptive. The VLAN IDs, such as 10 and 20, identify the VLANs in the configuration.

Configure an Endpoint-Facing Access Port

configure terminal
interface gigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
end

This explicitly makes the interface an access port and assigns untagged endpoint traffic to VLAN 10.

Configure a Switch-to-Switch Trunk

configure terminal
interface gigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
end

The allowed VLAN list restricts this trunk to VLANs 10 and 20. If the design needs another VLAN, add it to the list and ensure that the VLAN exists and is active on the participating switches.

Configure a Native VLAN When Required

configure terminal
interface gigabitEthernet1/0/24
 switchport trunk native vlan 999
end

Use the same intended native VLAN at both ends of the trunk. The exact command availability and default behavior can vary by Cisco platform and software release, so verify the operational state.

Inspect the Configuration

show vlan brief
show interfaces trunk
show interfaces gigabitEthernet1/0/1 switchport
show interfaces gigabitEthernet1/0/24 switchport
  • show vlan brief displays VLAN presence and access-port membership.
  • show interfaces trunk displays operational trunks, native VLAN information, and allowed or active VLANs.
  • show interfaces ... switchport displays administrative and operational mode, access VLAN, trunk details, and related switchport settings.

Validation and Troubleshooting

Validate both the local VLAN configuration and the operational state of the link. A configuration line alone does not prove that the VLAN is active or that the peer is using the expected mode.

Symptom | Likely Cause | Verification | Corrective Action Host appears in the wrong VLAN | The endpoint interface has the wrong access VLAN or an unintended negotiated mode | Use show interfaces interface-id switchport and check access VLAN and operational mode | Configure the intended access mode and access VLAN Same-VLAN devices on separate switches cannot communicate | The inter-switch link is not operating as a trunk, the VLAN is not allowed, or the VLAN is missing or inactive | Use show interfaces trunk, show vlan brief, and inspect both ends | Configure matching trunk modes, create or activate the VLAN, and allow it on the trunk Unexpected untagged traffic or native VLAN warning | Native VLAN values differ or trunk and peer modes do not match | Compare native VLAN and operational mode on both ends | Configure matching native-VLAN treatment and correct the port modes Only some VLANs cross a trunk | Required VLANs are filtered by the allowed list or are absent on one switch | Review the allowed and active VLAN lists with show interfaces trunk and check show vlan brief | Permit the required VLANs and ensure they exist and are active

Common Failure Patterns

  • Wrong access VLAN: The host may receive an address from the wrong IP network, fail to reach expected local devices, or appear in the wrong broadcast domain.
  • Missing allowed VLAN: Devices in a VLAN may communicate locally on each switch but fail to communicate across the switch-to-switch link.
  • Access/trunk mismatch: One side may treat the link as a single-VLAN access connection while the other expects multiple tagged VLANs. Some VLANs may fail or traffic may be placed incorrectly.
  • Missing or inactive VLAN: A trunk command does not create the VLAN everywhere. The VLAN must be present and available on the participating switches.
  • Native VLAN mismatch: Untagged traffic can be assigned differently at each end, producing warnings or unexpected connectivity.

Operational and Security Considerations

  • Explicitly configure endpoint-facing interfaces as access ports. Do not rely on automatic trunk negotiation for ordinary endpoint connections.
  • Disable unused interfaces or place them in a controlled, unused VLAN according to the organization’s operating procedures.
  • Restrict trunks with an allowed VLAN list. This reduces unnecessary VLAN exposure and limits the impact of accidental or unauthorized traffic.
  • Verify the actual operational mode. Trunk negotiation settings, platform defaults, and command behavior vary, so inspect both ends rather than assuming the intended configuration is active.
  • Use consistent native-VLAN settings and avoid accepting unexpected untagged traffic on trunks.

Key Takeaways

  • A switchport mode defines how a Layer 2 interface handles VLAN membership and frame classification.
  • An access port assigns untagged incoming endpoint traffic to one access VLAN.
  • A trunk carries multiple VLANs and normally identifies them with IEEE 802.1Q tags.
  • The native VLAN determines how untagged trunk traffic is treated, so both ends must be configured consistently.
  • Allowed VLAN lists limit which VLANs cross a trunk.
  • Hosts in the same VLAN can communicate across switches when that VLAN is created, active, and permitted on the trunk.
  • Communication between different VLANs requires inter-VLAN routing.

For a consolidated reference, see Access and Trunk Ports Explained.