CCNA online course

Access and Trunk Ports Explained for CCNA

Learn how Cisco access and trunk ports carry VLAN traffic, including 802.1Q tagging, native VLANs, voice VLANs, DTP, configuration, verification, and troubleshooting.

Switch ports connect devices at the physical layer, but their configured mode determines how the switch handles VLAN membership at Layer 2. An access port normally carries one data VLAN for an endpoint. A trunk port carries multiple VLANs across one physical link.

This distinction is fundamental to VLAN design. A VLAN is a logical Layer 2 broadcast domain identified by a VLAN ID. The physical interface is the switch hardware connection; the VLAN assignment is the logical membership applied to traffic entering or leaving that interface. For background, review the OSI reference model and computer networking fundamentals.

Why Switch Port Modes Matter

A switch interface might connect to a PC, printer, camera, server, hypervisor, IP phone, wireless access point, router, firewall, or another switch. The appropriate port mode depends on how many VLANs the connected device or link must carry.

• An endpoint that belongs to one data VLAN normally uses an access port.
• A link between infrastructure devices often uses a trunk because several VLANs must share the link.
• An IP phone deployment may use one access interface with a separate voice VLAN, rather than a general-purpose trunk for the user-facing port.

Changing a port's access VLAN changes the broadcast domain of devices connected to that port. It does not change the physical interface; it changes the logical VLAN classification applied by the switch.

Access Ports

An access port is a Layer 2 switchport assigned to one data VLAN. A typical endpoint sends ordinary Ethernet frames without an 802.1Q VLAN tag.

Ingress behavior

When an untagged frame enters an access port, the switch associates that frame with the port's configured access VLAN. For example, if GigabitEthernet1/0/10 is assigned to VLAN 10, untagged frames received from the connected PC are classified as VLAN 10 traffic.

Egress behavior

When a frame leaves an access port toward a typical endpoint, the switch normally removes VLAN identification and sends the frame without an IEEE 802.1Q tag. The endpoint therefore does not need VLAN-tagging support.

Common uses

• Desktop and laptop computers
• Printers and cameras
• Single-VLAN servers
• Other devices that expect ordinary untagged Ethernet

If the port is changed from VLAN 10 to VLAN 30, the connected device becomes part of VLAN 30's broadcast domain. Hosts in VLAN 10 and VLAN 30 still cannot communicate directly at Layer 2; communication between different VLANs requires routing.

PC access-port example

PC1 connects to Switch1 on GigabitEthernet1/0/10. The switch can place PC1 in VLAN 10 with the following Cisco IOS or IOS XE configuration:

configure terminal
vlan 10
 name USERS
interface gigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
end

PortFast is appropriate for an eligible endpoint-facing port. Do not apply it casually to inter-switch links.

Trunk Ports

A trunk port carries traffic for multiple VLANs over one physical link. Because frames for different VLANs share the same cable, VLAN identity must be preserved as traffic crosses the link.

Common trunk connections

• Switch-to-switch links
• Switch-to-router links used for router-on-a-stick
• Switch-to-firewall links
• Switch-to-hypervisor links carrying multiple virtual networks
• Switch-to-wireless-access-point links carrying multiple SSID VLANs

An allowed VLAN list limits which VLANs may cross a trunk. Restricting the list to the VLANs required by the design reduces unnecessary VLAN propagation and limits mistakes.

A VLAN must exist, be active, and be permitted along the relevant path. A trunk can be operationally healthy while a particular VLAN still fails because that VLAN is missing or excluded from the allowed list.

Static trunk example

configure terminal
vlan 20
 name VOICE
vlan 30
 name SERVERS
vlan 999
 name NATIVE_UNUSED
interface gigabitEthernet1/0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30,999
 switchport nonegotiate
end

switchport nonegotiate disables DTP negotiation. Use it when the trunk is deliberately configured on both sides or when the peer is a non-Cisco device that does not support DTP. The peer must still support compatible 802.1Q trunking.

IEEE 802.1Q VLAN Tagging

IEEE 802.1Q is the modern standard used to identify VLAN traffic on trunk links. For tagged VLANs, the sending device inserts a VLAN tag into the Ethernet frame before transmitting it across the trunk.

The tag contains a 12-bit VLAN ID, commonly allowing VLAN IDs from 0 through 4095. VLAN 0 and 4095 have special purposes and are not ordinary configurable VLANs in typical switch operation, so usable VLAN assignments depend on the platform and design. VLAN IDs 1 through 4094 are commonly considered the usable range.

The 802.1Q tag also includes:

• Priority Code Point: three bits used for Layer 2 quality-of-service priority marking.
• Drop Eligibility Indicator: one bit that can indicate whether a frame is eligible for preferential dropping during congestion.
• VLAN ID: identifies the VLAN to which the frame belongs.

The receiving device reads the VLAN ID and maps the frame to the correct logical VLAN. The tag is an aid for the shared trunk link; it is not normally presented to an ordinary endpoint on an access port.

Native VLAN and Untagged Trunk Traffic

The native VLAN is the VLAN associated with untagged traffic on an 802.1Q trunk. In common Cisco switching behavior, native-VLAN frames are sent untagged by default, while other allowed VLANs are sent with 802.1Q tags.

When an untagged frame arrives on a trunk, the receiving switch assigns it to the configured native VLAN. Both ends of the trunk must use the same native VLAN. If one end uses VLAN 999 and the other uses VLAN 1, the same untagged frame is interpreted as belonging to different VLANs.

Many designs use an unused, dedicated native VLAN such as VLAN 999 rather than the default VLAN 1. User traffic should not be placed on this native VLAN. Some platforms support tagging native VLAN traffic. If that option is used, the policy must be consistent and supported on both ends.

Native VLAN mismatch example

Suppose Switch1 uses native VLAN 999 and Switch2 uses native VLAN 1. Tagged traffic may appear to work, but untagged traffic is classified differently at each end. Cisco devices may report a native VLAN mismatch. Configure the same native VLAN on both trunk endpoints and use a consistent native-tagging policy where supported.

Access Port Versus Trunk Port

An access port normally handles one data VLAN, but an access interface may also be configured with a voice VLAN. That special case does not make the port a general-purpose trunk.

Voice VLAN on an Access Interface

A common deployment connects an IP phone to a switchport and connects a PC through the phone's built-in PC port. The switchport can provide:

• An untagged data VLAN for the PC, such as VLAN 10.
• A tagged voice VLAN for the phone, such as VLAN 20.

The IP phone must support VLAN tagging and the configured voice VLAN mechanism. The phone marks its voice frames for VLAN 20, while PC frames normally remain untagged and are assigned to VLAN 10. This allows two logical VLANs to share one physical switch interface without turning the user-facing port into an unrestricted trunk.

configure terminal
interface gigabitEthernet1/0/15
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 spanning-tree portfast
end

Dynamic Trunking Protocol

Dynamic Trunking Protocol (DTP) is a Cisco-specific mechanism that can negotiate trunking between supported Cisco switch interfaces. The main administrative modes are:

• Access: statically operates as an access port and does not form a trunk through negotiation.
• Trunk: statically attempts to operate as a trunk.
• Dynamic desirable: actively attempts to form a trunk.
• Dynamic auto: passively waits for the peer to initiate trunk formation.

Exact behavior can vary by platform, software release, and encapsulation support. In production networks, explicit access or trunk configuration is generally preferred because it avoids surprises and reduces dependence on negotiation. Disable unnecessary DTP on a manually configured trunk with switchport nonegotiate, but only after confirming that the peer is statically configured for a compatible trunk.

Trunk Encapsulation and Cisco Platforms

802.1Q is the modern standard trunk encapsulation. Inter-Switch Link (ISL) was an older Cisco proprietary trunking method that may appear in legacy CCNA material. Many modern Cisco switch platforms support only 802.1Q and therefore do not require an encapsulation-selection command. Always follow the capabilities of the specific switch model and software release.

VLAN Creation and End-to-End Operation

Before a VLAN can normally be used as an access VLAN, it must exist or otherwise be available in the switch's VLAN database. VLAN names are optional, but descriptive names improve readability.

configure terminal
vlan 10
 name USERS
vlan 20
 name VOICE
vlan 999
 name NATIVE_UNUSED
end

For a VLAN to operate across multiple switches, use consistent VLAN numbering and permit the VLAN on every required trunk in the end-to-end path. Each VLAN is a separate Layer 2 broadcast domain, so a broadcast in VLAN 10 does not normally reach VLAN 20.

Communication between different VLANs requires Layer 3 routing. Common solutions include an SVI on a multilayer switch, a router interface, or router-on-a-stick. An SVI is a switched virtual interface that can provide the Layer 3 gateway for a VLAN. Router-on-a-stick uses one router physical interface with multiple 802.1Q-tagged subinterfaces.

Router-on-a-stick example

configure terminal
interface gigabitEthernet0/0
 no shutdown
interface gigabitEthernet0/0.10
 encapsulation dot1q 10
 ip address 192.0.2.1 255.255.255.0
interface gigabitEthernet0/0.20
 encapsulation dot1q 20
 ip address 198.51.100.1 255.255.255.0
end

The switch interface connected to the router must be a trunk that permits VLANs 10 and 20. The router subinterface VLAN IDs must match the switch's VLAN IDs.

Recommended Configuration Workflow

1. Create or identify the required VLANs and confirm their documented IDs.
2. Configure endpoint-facing interfaces as access ports and assign the intended access VLAN.
3. Configure infrastructure links as trunks.
4. Set an explicit native VLAN when required by the design, using the same value on both ends.
5. Restrict each trunk's allowed VLAN list to the minimum required set.
6. Configure a voice VLAN on an access interface when an IP phone deployment requires it.
7. Validate administrative and operational state, VLAN activity, and MAC address learning.
8. Save the validated running configuration.

copy running-config startup-config

Verification and Operational State

Administrative mode is the configured behavior, such as access, trunk, dynamic desirable, or dynamic auto. Operational mode is what the port is actually doing after negotiation, link conditions, and platform capabilities are considered. These values can differ, so configuration alone is not sufficient.

show vlan brief
show interfaces trunk
show interfaces gigabitEthernet1/0/1 switchport
show interfaces status
show mac address-table dynamic
show running-config interface gigabitEthernet1/0/1

Use show vlan brief to verify VLAN existence and access-port membership. Use show interfaces trunk for operational trunk status, native VLAN, allowed VLANs, and active VLANs. Use show interfaces ... switchport to compare administrative and operational modes. Finally, inspect the MAC address table by VLAN to confirm that the switch is learning from the expected local and remote interfaces.

Common Faults and Troubleshooting

Device connected to a trunk expects untagged traffic

A device that does not understand 802.1Q tags may fail when connected to a trunk, or it may receive only native-VLAN traffic. Place ordinary endpoints on access ports. Use a trunk only when the connected device is VLAN-aware and the VLAN tagging design is configured on both sides.

Security and Reliability Practices

• Explicitly configure endpoint ports as access ports instead of relying on DTP negotiation.
• Disable unnecessary DTP negotiation on statically configured trunks.
• Use an unused, nondefault native VLAN and avoid placing user traffic on it.
• Restrict trunk allowed VLANs to the minimum required set.
• Use port security where appropriate for endpoint-facing ports.
• Shut down unused switch interfaces and place them in an unused VLAN according to organizational policy.
• Verify both configuration and operational state after every change.

Exam-Relevant Notes

• Access ports normally carry one untagged data VLAN.
• Trunks carry multiple VLANs and use 802.1Q tags to preserve VLAN identity.
• Untagged traffic received on a trunk belongs to the native VLAN.
• The native VLAN must match on both ends of a trunk.
• dynamic desirable actively attempts to form a trunk; dynamic auto waits for the peer.
• Two dynamic-auto interfaces normally do not form a trunk.
• A voice VLAN allows tagged phone traffic and untagged PC data to share an access interface.
• Different VLANs require Layer 3 routing to communicate.
• Operational status is more authoritative than the intended administrative configuration.