Configure and Verify Cisco Switch Trunk Ports

Learn how to configure, restrict, verify, and troubleshoot Cisco switch trunk ports using IEEE 802.1Q, native VLANs, allowed VLANs, and DTP.

A trunk port is a switch interface that transports traffic for multiple VLANs over one physical Ethernet link. A VLAN is a logical Layer 2 broadcast domain. Trunks allow several broadcast domains to cross a shared link while preserving each frame's VLAN identity.

An access port normally carries traffic for one assigned VLAN and connects to an endpoint such as a workstation, printer, or server. A trunk commonly connects two switches, a switch to a router for router-on-a-stick inter-VLAN routing, or a switch to a hypervisor hosting virtual machines in multiple VLANs.

Characteristic	Access Port	Trunk Port
Typical VLAN count	One assigned VLAN	Multiple VLANs
Typical connection	Endpoint or single-VLAN device	Switch, router, firewall, or hypervisor
Frame handling	Endpoint traffic is normally untagged	802.1Q identifies VLANs across the link
Configuration focus	Access VLAN	Native VLAN and allowed VLAN list

IEEE 802.1Q tagging

IEEE 802.1Q is the modern Ethernet VLAN-tagging standard used in Cisco switching environments. When a frame crosses a trunk, an 802.1Q VLAN tag adds header information containing the VLAN identifier. The receiving switch uses that identifier to place the frame in the correct VLAN.

A tagged frame explicitly identifies its VLAN. By contrast, the native VLAN is the VLAN whose traffic is normally sent without an 802.1Q tag on an 802.1Q trunk. Untagged ingress traffic is associated with the configured native VLAN. The two trunk endpoints must agree about this value.

ISL, or Inter-Switch Link, is a legacy Cisco encapsulation that may appear in older study material. Current platforms generally use 802.1Q, and ISL is not used on current Cisco switching platforms.

Native VLAN behavior

The native VLAN is the VLAN assigned to untagged traffic on a trunk. On many Cisco switches, VLAN 1 is the default native VLAN. Production designs should normally replace the default with a dedicated VLAN that is not used for user, voice, or management traffic, such as VLAN 999.

A native VLAN mismatch occurs when the two ends of a trunk use different native VLAN IDs. Untagged traffic sent by one side can then be classified into a different VLAN by the other side. Cisco switches may report a native VLAN mismatch, and the condition can cause unexpected connectivity, spanning-tree behavior, or security exposure. Configure the same native VLAN at both ends.

Some platforms support tagging native VLAN traffic with vlan dot1q tag native. This optional practice can reduce ambiguity around untagged traffic, but it must be supported and consistently planned for every connected device. It is not a substitute for matching trunk settings.

Prepare the VLANs

Creating a VLAN is separate from configuring an interface as a trunk. The trunk configuration controls how an interface carries traffic; the VLAN database determines which VLANs exist locally. Create and activate the VLANs required by the design.

configure terminal
vlan 10
 name USERS
vlan 20
 name VOICE
vlan 99
 name MANAGEMENT
vlan 999
 name NATIVE_UNUSED
end

VLAN names are optional, but useful names improve operational clarity. A VLAN must exist and be active on the relevant switch before traffic for that VLAN can be forwarded there.

Configure a static 802.1Q trunk

Use interface configuration mode to configure a Layer 2 switch interface as a trunk. Configure both ends intentionally with compatible settings rather than relying on accidental negotiation.

configure terminal
interface gigabitEthernet1/0/1
 switchport mode trunk
end

Most current Cisco switch platforms use 802.1Q automatically and do not provide an encapsulation-selection command. Some older capable platforms expose the command below:

interface gigabitEthernet1/0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk

Use switchport trunk encapsulation dot1q only when the device supports and requires it. If IOS rejects the command, the platform may use fixed 802.1Q encapsulation. Use contextual help and platform documentation rather than treating the command as universal.

Restrict the allowed VLANs

A trunk may be configured to carry all VLANs by default. The allowed VLAN list is the set of VLANs permitted to traverse a trunk interface. Restricting this list follows least privilege: a link should carry only the VLANs required for its role, reducing unnecessary Layer 2 reachability and limiting the scope of broadcast traffic.

interface gigabitEthernet1/0/1
 switchport trunk allowed vlan 10,20,99,999

In a restricted access-layer uplink, VLANs 10 and 20 might carry user and voice traffic, VLAN 99 might carry management traffic, and VLAN 999 might be the unused native VLAN. The native VLAN should be included in the allowed list when the design requires it to traverse the link.

Use add and remove when changing an existing list. This avoids unintentionally replacing the complete list.

interface gigabitEthernet1/0/1
 switchport trunk allowed vlan add 30
 switchport trunk allowed vlan remove 20

An allowed VLAN is not automatically an existing VLAN. Conversely, an existing local VLAN is not automatically permitted on every trunk. Check both the VLAN database and the interface's allowed list.

Change the native VLAN

Configure a nondefault native VLAN explicitly and use the same value at both endpoints.

interface gigabitEthernet1/0/1
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,99,999

The native VLAN setting determines how untagged ingress traffic is classified. It does not make every frame on the trunk untagged; regular nonnative VLAN traffic remains identified with 802.1Q tags. Ensure VLAN 999 exists where needed and is not assigned to ordinary endpoints.

Dynamic Trunking Protocol

Dynamic Trunking Protocol (DTP) is a Cisco mechanism that can negotiate trunking on supported switch ports. The administrative mode is the mode configured by the administrator. The operational mode is the mode currently active after negotiation and link conditions are considered.

trunk: The administrator forces the interface to trunk.
dynamic desirable: The interface actively attempts to negotiate a trunk.
dynamic auto: The interface waits for the neighbor to request negotiation; it does not actively initiate a trunk.
access: The administrator forces the interface to operate as an access port.

Local Mode	Remote Mode	Does a Trunk Form?	Explanation
trunk	trunk, desirable, or auto	Yes	The statically configured trunk can operate with a compatible trunk-capable neighbor.
trunk	access	No	The endpoints have conflicting fixed roles.
dynamic desirable	dynamic desirable	Yes	Both sides actively negotiate.
dynamic desirable	dynamic auto	Yes	The desirable side initiates and the auto side responds.
dynamic auto	dynamic auto	No	Neither side initiates negotiation.
dynamic desirable or auto	access	No	The access side does not negotiate a trunk.
access	access	No	Both interfaces carry one access VLAN.

Static trunking is generally preferred on infrastructure links because it makes the intended role predictable. Disable DTP when policy requires no negotiation or when connecting to a device that does not use DTP.

interface gigabitEthernet1/0/1
 switchport mode trunk
 switchport nonegotiate

Important: Configure switchport mode trunk before switchport nonegotiate. DTP suppression disables negotiation; it does not disable 802.1Q data forwarding and does not turn a trunk into an access port.

Dynamic modes are useful in a controlled lab for comparing negotiation behavior:

interface gigabitEthernet1/0/2
 switchport mode dynamic desirable

Practical configuration: two-switch trunk

Suppose Switch A and Switch B are connected through GigabitEthernet1/0/1. VLANs 10, 20, and 30 must cross the link. Create those VLANs on both switches, then apply compatible trunk settings to both interfaces.

! On both switches
configure terminal
vlan 10
 name USERS
vlan 20
 name VOICE
vlan 30
 name SERVERS
vlan 999
 name NATIVE_UNUSED
interface gigabitEthernet1/0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30,999
 switchport nonegotiate
end

Test an endpoint in VLAN 10 on Switch A against an endpoint in VLAN 10 on Switch B. Repeat for VLANs 20 and 30. The physical link can be up while one VLAN still fails, so test each required VLAN rather than concluding that the entire trunk works from link lights alone.

Router-on-a-stick and other trunk designs

In a router-on-a-stick design, one switch interface connects to one router interface. The router uses multiple subinterfaces, and each subinterface has an 802.1Q VLAN identifier. The switch-facing interface must be a trunk, the VLAN must be allowed, and the router subinterface VLAN ID must match the switch VLAN.

interface gigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20

The same principle applies to hypervisors, firewalls, and non-Cisco switches: confirm which side adds tags, which VLAN is native or untagged, and which VLAN IDs are allowed. Some devices use terms such as tagged, untagged, access, or native instead of Cisco IOS terminology. Interoperability requires matching behavior, not merely matching labels.

Verify trunk operation

Use several commands because no single output proves every part of the design.

Field	Meaning	Expected Value or Diagnostic Use
Port	Interface being reported	Confirm that the intended physical interface is configured.
Status	Whether the interface is currently trunking	The expected uplink should appear in `show interfaces trunk`.
Administrative mode	Configured switchport role	Usually `trunk` for a statically configured infrastructure link.
Operational mode	Current active role	Should be `trunk`; an access result indicates negotiation or configuration failure.
Encapsulation	VLAN encapsulation in use	Expect 802.1Q or `dot1q` on modern Cisco platforms.
Native VLAN	VLAN associated with untagged traffic	Must match the remote endpoint.
Allowed VLANs	VLANs permitted by the interface	Required VLANs must be present.
Active VLANs	Allowed VLANs that are present and active	A VLAN missing here may not exist locally or may be inactive.
Forwarding VLANs	Allowed and active VLANs that are forwarding	A missing VLAN may be blocked by Spanning Tree Protocol or another Layer 2 condition.

show interfaces trunk
show interfaces gigabitEthernet1/0/1 switchport
show vlan brief
show running-config interface gigabitEthernet1/0/1
show spanning-tree vlan 10

show interfaces trunk is useful for trunk status, encapsulation, native VLAN, allowed VLANs, active VLANs, and forwarding VLANs. show interfaces ... switchport compares administrative and operational modes. show vlan brief confirms VLAN existence and access-port membership. The running configuration confirms the commands applied to the intended interface. Spanning-tree output shows whether a VLAN is forwarding or blocked.

End-to-end design considerations

Match trunk mode, encapsulation, native VLAN, and required allowed VLANs at both ends.
Create and activate required VLANs on the relevant switches.
Do not rely on VLAN 1 for user traffic or native VLAN use in production designs.
Prune VLANs that are not needed on a link.
Disable unused switch ports and place them in an unused, controlled state according to local policy.
Document the trunk endpoints, native VLAN, allowed VLAN list, and intended connected device.
When connecting Cisco equipment to a non-Cisco switch, router, firewall, or virtualization host, verify tagging and native or untagged behavior on both devices.

Troubleshoot trunk connectivity systematically

A trunk can be operational while a particular VLAN is not forwarding. VLAN pruning, an inactive VLAN, or Spanning Tree Protocol can affect one VLAN without taking down the entire physical link.

Check the physical layer: Confirm the interface is connected and not err-disabled. Inspect link state and interface errors.
Check interface role: Use show interfaces <interface> switchport to verify that the intended interface, administrative mode, and operational mode are correct.
Check trunk status: Use show interfaces trunk. If the port is absent, investigate access configuration, DTP pairing, or a configuration applied to the wrong port.
Check the VLAN database: Use show vlan brief to confirm the required VLAN exists and is active on each relevant switch.
Check the allowed list: Confirm the failing VLAN appears in the allowed, active, and forwarding sections of trunk output.
Check spanning tree: Use show spanning-tree vlan <vlan-id> to determine whether the VLAN is forwarding or blocked.
Check endpoint configuration: Confirm an access port is assigned to the expected VLAN, and verify that a router, firewall, or hypervisor tags frames as the design requires.

Symptom	Likely Cause	Verification Step	Corrective Action
Uplink is physically up but absent from trunk status	Access mode, incompatible DTP modes, or wrong interface configured	`show interfaces trunk`; `show interfaces <interface> switchport`; running configuration	Configure compatible static trunk settings on both ends; suppress DTP only after setting trunk mode.
One VLAN fails while other VLANs work	VLAN not allowed, missing, inactive, or blocked by STP	`show interfaces trunk`; `show vlan brief`; `show spanning-tree vlan <vlan-id>`	Create or activate the VLAN, allow it on the trunk, and investigate STP if it remains blocked.
Native VLAN mismatch warning	Different native VLAN IDs at the endpoints	Compare trunk output and interface configurations on both devices	Configure the same designated native VLAN at both ends.
Router-on-a-stick cannot route one VLAN	Switch link is not trunking, VLAN is not allowed, or router subinterface ID differs	Compare switch trunk output and router subinterface configuration	Make the link a trunk, permit the VLAN, and align 802.1Q identifiers.
Trunk command is rejected	Unsupported syntax, routed interface, or fixed 802.1Q platform	`show interfaces <interface> switchport` and IOS contextual help	Use supported syntax, ensure the port is a Layer 2 switchport, and omit unavailable encapsulation selection.

Exam-relevant notes

An access port normally carries one VLAN; a trunk carries multiple VLANs.
802.1Q uses tags to identify nonnative VLAN traffic across a trunk.
The native VLAN carries untagged traffic by default, and native VLAN values must match at both ends.
dynamic auto plus dynamic auto does not form a trunk; dynamic desirable plus dynamic auto does.
The allowed VLAN list, local VLAN existence, and spanning-tree forwarding state are separate checks.
DTP negotiation and 802.1Q forwarding are different functions. switchport nonegotiate stops negotiation; it does not stop trunk data forwarding.

For related fundamentals, review the computer networking explanation and OSI reference model. Cisco IOS command-mode practice is covered in Configure Passwords in IOS.