VMware ESXi and vSphere Cluster Management

Configure Allowed VLANs on Cisco Switch Trunks

Learn how to replace, add, remove, and verify allowed VLANs on Cisco IOS 802.1Q trunks, including troubleshooting and EtherChannel considerations.

What an Allowed VLAN List Does

A VLAN is a logical Layer 2 broadcast domain identified by a VLAN ID. A trunk port transports traffic for multiple VLANs, normally by using IEEE 802.1Q tags. The trunk's allowed VLAN list defines which VLAN IDs may cross that particular trunk.

Allowed VLAN filtering is a form of VLAN pruning: it prevents VLANs from crossing links where they are not needed. This can reduce unnecessary Layer 2 traffic, limit accidental extension of a VLAN to another part of the network, and enforce the intended topology.

For example, if VLAN 5 exists on two switches but is removed from the inter-switch trunk, devices in VLAN 5 on opposite sides of that link can no longer communicate through that link. Other permitted VLANs can continue to use the trunk.

Default Trunk Behavior

On Cisco IOS switches, a trunk allows all VLANs by default unless an allowed VLAN list has been configured. This default is broad: a VLAN being allowed does not prove that the VLAN exists, is active, or is in a Spanning Tree Protocol forwarding state.

Inspect the operational trunk and its default policy with:

enable
show interfaces trunk

Representative output may look similar to:

Port        Mode         Encapsulation  Status        Native vlan
Gi1/0/1     on           802.1q          trunking      1

Port        Vlans allowed on trunk
Gi1/0/1     1-4094

Port        Vlans allowed and active in management domain
Gi1/0/1     1,10,20,30,99

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/1     1,10,20,30,99

The exact output varies by IOS release and platform. The important point is that an unrestricted trunk commonly displays the complete VLAN range in the Vlans allowed on trunk section.

Cisco IOS Command Syntax

Configure the allowed VLAN policy in interface configuration mode:

enable
configure terminal
interface GigabitEthernet1/0/1
switchport mode trunk
switchport trunk allowed vlan vlan-list

A VLAN list can contain individual IDs, comma-separated IDs, and hyphenated ranges:

switchport trunk allowed vlan 10
switchport trunk allowed vlan 10,20,30
switchport trunk allowed vlan 10-12,20,30-32

The base form replaces the current list. The add and remove forms modify the current list. The special keywords all and except provide broader policies.

Command form	Effect on current allowed VLAN list	Typical use case	Risk or caution
`switchport trunk allowed vlan vlan-list`	Replaces the current list with the specified VLANs.	Define a complete, controlled policy.	Omitted VLANs are removed, including required management or native VLANs.
`switchport trunk allowed vlan add vlan-list`	Adds the specified VLANs to the current list.	Permit a new VLAN without overwriting existing permissions.	Verify that the resulting list matches the design.
`switchport trunk allowed vlan remove vlan-list`	Removes the specified VLANs from the current list.	Stop selected VLANs from crossing a trunk.	Can partition endpoints or interrupt management connectivity.
`switchport trunk allowed vlan all`	Allows all VLANs, restoring the default all-VLAN allowance.	Lab reset or a deliberate change to an unrestricted policy.	May permit more Layer 2 traffic and VLAN extension than intended.
`switchport trunk allowed vlan except vlan-list`	Allows all VLANs except those listed.	Exclude a small set from an otherwise broad policy.	New VLANs are generally included automatically, which may be less controlled than an explicit list.

Replacing the Allowed VLAN List

Use the base command when you want the trunk to carry exactly the VLANs in a defined list:

enable
configure terminal
interface GigabitEthernet1/0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,30,99

This example limits a distribution-to-access trunk to VLANs 10, 20, 30, and 99. VLAN 99 might be the management VLAN, so it must remain in the list if switch management depends on that link.

Replacing the list is not additive. If VLAN 40 was previously allowed and is omitted from the command, VLAN 40 is no longer allowed. The same problem applies to a required management VLAN or to the configured native VLAN. Before replacing a list, identify every VLAN needed on the path and account for the native VLAN design.

Adding VLANs Without Overwriting Existing Permissions

The add keyword is the safer choice when the goal is to permit additional VLANs while preserving the current list:

interface GigabitEthernet1/0/1
switchport trunk allowed vlan add 40
switchport trunk allowed vlan add 50-55

The first command adds VLAN 40. The second adds VLANs 50 through 55. Existing allowed VLANs remain in the policy. Always verify the effective result rather than relying only on the command entered.

show interfaces trunk
show running-config interface GigabitEthernet1/0/1

Removing VLANs from a Trunk

Use remove to stop selected VLANs from traversing the current trunk without replacing the rest of the list:

interface GigabitEthernet1/0/1
switchport trunk allowed vlan remove 5

This is the core example for blocking VLAN 5 on an inter-switch trunk while retaining the other currently allowed VLANs. Confirm the result with:

show interfaces trunk

Removing VLAN 5 affects Layer 2 connectivity across this link. If endpoints in VLAN 5 depend on this trunk to reach one another, the link becomes a boundary and those endpoints may be unable to communicate across it.

Allowing All VLANs and Excluding Exceptions

To return the trunk to an all-VLAN allowance, use:

interface GigabitEthernet1/0/1
switchport trunk allowed vlan all

To allow every VLAN except a selected set, use except:

interface GigabitEthernet1/0/1
switchport trunk allowed vlan except 200-210

This permits all VLANs other than VLANs 200 through 210. An explicit small allow-list is generally preferable when the trunk should carry only a known set of VLANs. For example, 10,20,30,99 makes the intended design clear and prevents later VLANs from being permitted accidentally. An all-except policy can be useful when most VLANs should cross and only a small, well-defined group must be blocked.

Verifying Trunk Status and VLAN Permissions

Begin with:

show interfaces trunk

Interpret the main sections as follows:

Output field	What it confirms	Why a VLAN might not appear
Port and trunking status	Shows whether the interface is operating as a trunk, its encapsulation, and the native VLAN.	The interface may be down, be operating as an access port, or have a trunk negotiation or configuration problem.
Vlans allowed on trunk	Shows the VLAN IDs permitted by the local trunk policy.	The VLAN was never allowed, was removed, or was omitted when the list was replaced.
Vlans allowed and active in management domain	Shows allowed VLANs that also exist and are active in the switch's VLAN database context.	The VLAN may be absent from the local VLAN database or inactive.
Vlans in spanning tree forwarding state and not pruned	Shows VLANs that are allowed, active, and currently able to forward on the interface according to STP.	STP may block the VLAN, or another pruning condition may prevent forwarding.

These sections answer different questions. A VLAN can appear in Vlans allowed on trunk but not in the active section because it does not exist locally. It can be allowed and active but absent from the forwarding section because STP is not forwarding it on that interface.

Additional useful checks are:

show running-config interface GigabitEthernet1/0/1
show vlan brief

After removing VLAN 5, verify that VLAN 5 is absent from the local trunk's allowed VLAN output. If it still appears in another section, interpret that section carefully: the VLAN database or STP state does not override the local allowed-list policy.

Understanding End-to-End Connectivity

VLAN condition	Can it traverse the local trunk?	Additional requirement for end-to-end connectivity
VLAN is allowed and active	Yes, subject to the operational trunk and STP state.	The VLAN must be allowed and active across every required trunk, and STP must provide a forwarding path.
VLAN is removed from the allowed list	No.	Restore it with `add` or define a correct explicit list if the design requires it.
VLAN is allowed but absent from the VLAN database	It is permitted by policy, but there is no active local VLAN context for normal forwarding.	Create or activate the VLAN as appropriate and verify the neighboring switches.
VLAN is allowed but blocked by STP	The policy permits it, but STP does not currently forward it on that port.	Investigate the STP topology and blocking decision.
VLAN is allowed locally but blocked on a downstream trunk	It can cross the local trunk but cannot continue beyond the downstream restriction.	Permit the VLAN on every necessary trunk in the path.

Operational Considerations

Confirm the Port Is Really a Trunk

Allowed VLAN commands affect trunk behavior. Before troubleshooting a VLAN permission issue, confirm that the interface is operating as a trunk with show interfaces trunk. If required by the platform and design, configure:

interface GigabitEthernet1/0/1
switchport mode trunk

Configure Both Ends of the Link

An inter-switch connection needs a usable path at both ends. A VLAN permitted on one switch but excluded on the neighboring trunk cannot cross the link. For multi-switch paths, check every trunk between the source and destination. The effective end-to-end policy is limited by the most restrictive link.

Protect Management and Native VLANs

Before pruning, identify the management VLAN and confirm that it remains allowed on every trunk required for remote administration. Accidentally removing it can cause loss of remote access; console access may then be required for recovery.

The native VLAN is the VLAN whose frames are typically sent untagged on an 802.1Q trunk. Keep the native VLAN design consistent at both ends and consider its allowance when changing a list. A native VLAN mismatch or accidental exclusion can cause connectivity and security problems.

Remember That Allowed VLANs and STP Are Separate

Allowed-list configuration decides whether a VLAN may cross the trunk. STP decides whether the VLAN is forwarding on that interface within the Layer 2 topology. Both conditions must permit forwarding.

Account for EtherChannel

EtherChannel is a logical bundle of physical links that can operate as one trunk. On many Cisco platforms, the operational trunk policy belongs on the logical Port-channel interface. Apply the allowed VLAN policy consistently according to the platform's configuration model and inspect both the port-channel and member interfaces if behavior is unexpected.

Practical Configuration Scenarios

Verify the Default Policy

Run show interfaces trunk.
Find the Vlans allowed on trunk section.
Confirm that the output represents the full VLAN range rather than a restricted list.
Check the active and STP-forwarding sections separately; all VLANs being allowed does not make all VLANs active or forwarding.

Block VLAN 5 While Retaining Other VLANs

enable
configure terminal
interface GigabitEthernet1/0/1
switchport mode trunk
switchport trunk allowed vlan remove 5
end
show interfaces trunk

Confirm that VLAN 5 is omitted from the allowed list. Also check the neighboring switch and any other trunks required by the VLAN's path.

Permit Only VLANs 10, 20, 30, and 99

interface GigabitEthernet1/0/1
switchport trunk allowed vlan 10,20,30,99

Use this replacement when those are the complete required set. Confirm that VLAN 99 is the intended management VLAN and account for the native VLAN before applying the change.

Add VLAN 40 Safely

interface GigabitEthernet1/0/1
switchport trunk allowed vlan add 40
show interfaces trunk

The add form preserves the existing allowed VLANs and adds VLAN 40. Verify that both the previous VLANs and VLAN 40 appear as expected.

Exclude a Guest VLAN Range

interface GigabitEthernet1/0/1
switchport trunk allowed vlan except 200-210
show interfaces trunk

This is appropriate when most VLANs should cross the trunk. Use an explicit list instead when only a small, controlled set is intended.

Restore All-VLAN Behavior

interface GigabitEthernet1/0/1
switchport trunk allowed vlan all
show interfaces trunk

Verify that the trunk again reports the full all-VLAN allowance.

Troubleshooting Allowed VLAN Problems

Devices in a VLAN Cannot Communicate Across an Inter-Switch Link

Run show interfaces trunk and check whether the VLAN is allowed.
Check whether the VLAN exists and is active with show vlan brief.
Review the interface running configuration to detect an omitted or removed VLAN.
Check equivalent trunk settings on the neighboring switch.
Verify that STP is forwarding for the VLAN on the relevant link.

Likely causes include removing the VLAN, replacing the list without including it, excluding it on another trunk, missing VLAN database entries, or STP blocking. Restore the VLAN with the add form or define a correct explicit list, then verify the entire path.

VLAN Is Allowed but Not Active or Forwarding

If a VLAN appears in the allowed section but not in the active section, inspect show vlan brief and determine whether the VLAN exists and is active locally. If it appears active but not in the STP-forwarding section, investigate the per-VLAN STP topology. Do not change the allowed list blindly; the issue may be the VLAN database or STP.

Remote Management Fails After Pruning

Identify the management VLAN and the complete path to the switch.
Verify that the management VLAN is allowed on every required trunk.
Check whether the native VLAN or another management design element was changed unintentionally.
Use console access if remote access has already been lost.

Restore the required management VLAN on each necessary trunk and validate reachability carefully.

EtherChannel Change Has No Expected Effect

Inspect the port-channel and member-interface configuration. The logical port-channel may control the operational trunk settings, while inconsistent member settings can affect bundle operation. Verify EtherChannel status with platform-appropriate commands and apply the allowed VLAN policy consistently at the logical interface level when required.

Exam-Relevant Notes

switchport trunk allowed vlan vlan-list replaces the current list.
add modifies the list without removing existing entries.
remove 5 prevents VLAN 5 from crossing that trunk; it does not delete VLAN 5.
all restores the all-VLAN allowance.
except permits all VLANs other than the specified list.
Vlans allowed on trunk, Vlans allowed and active in management domain, and Vlans in spanning tree forwarding state and not pruned describe different conditions.
End-to-end VLAN connectivity requires the VLAN to be allowed on every relevant trunk, active on the switches, and able to forward through STP.
Pruning a required management or native VLAN can cause service interruption or loss of remote access.

For related study, review allowed VLAN configuration on Cisco trunks alongside trunk modes, native VLANs, VLAN creation, STP, and EtherChannel.