VMware ESXi and vSphere Cluster Management

Configure VLAN Trunk Ports on Cisco Switches

Learn how to configure, verify, and troubleshoot a Cisco IOS VLAN trunk between two switches carrying VLAN 5 and VLAN 10.

A VLAN trunk is a Layer 2 link that carries frames from multiple VLANs. Trunks are commonly used between switches so that devices in the same VLAN can communicate even when they are connected to different physical switches.

This lesson uses Cisco IOS commands to configure a trunk between SW1 and SW2. The inter-switch link uses FastEthernet0/1 on both switches and carries VLAN 5 and VLAN 10.

Why VLAN Trunking Is Necessary

A VLAN creates a separate Layer 2 broadcast domain. For example, VLAN 5 might contain one group of users and VLAN 10 might contain another. A device in VLAN 5 remains in that VLAN even if it is connected to a different switch from another VLAN 5 device.

When multiple switches are connected, one physical link may need to transport traffic for several VLANs at the same time. A trunk provides this shared path. The switches identify the VLAN associated with each frame as it crosses the link.

An access port is normally associated with one VLAN. An endpoint usually sends ordinary untagged Ethernet frames to that port. The switch uses the port's access VLAN to classify those frames. A trunk, in contrast, transports frames for multiple VLANs across one physical connection.

Example Topology and VLAN Plan

In this example, VLAN 5 and VLAN 10 must exist on both switches. FastEthernet0/1 is the only trunk link. The other listed interfaces connect to end devices and must remain access ports.

The physical cable between SW1 FastEthernet0/1 and SW2 FastEthernet0/1 is the trunk. The endpoint links are not trunks; they are access links assigned to one VLAN each.

802.1Q Trunk Tagging

IEEE 802.1Q, also called dot1q, is the standard VLAN tagging method used by modern Cisco switches. When traffic crosses a trunk, the switch adds VLAN information to the Ethernet frame so the receiving switch knows whether the frame belongs to VLAN 5, VLAN 10, or another VLAN.

The VLAN tag is used on the shared trunk path. At an access port, the switch normally presents untagged Ethernet traffic to an endpoint. The switch adds or removes trunk tagging as needed when forwarding traffic between access ports and the trunk.

Encapsulation means the tagging format used by the trunk interface. Modern Cisco platforms commonly support only 802.1Q, so there may be no encapsulation choice to make. On those switches, configuring trunk mode is normally sufficient.

ISL, or Inter-Switch Link, is an older Cisco-proprietary trunk encapsulation. It is found only on certain legacy devices. Do not expect to configure ISL on newer Cisco switches that support only 802.1Q.

Create VLAN 5 and VLAN 10

Each switch must have the VLANs available locally. Create them on SW1 and repeat the same configuration on SW2 if they do not already exist.

configure terminal
vlan 5
 name VLAN5
vlan 10
 name VLAN10
end

Matching VLAN availability matters because a trunk cannot forward useful traffic for a VLAN that is absent or inactive on one side.

Configure Host-Facing Access Ports

Host-facing interfaces should use access mode. In this example, SW1 FastEthernet0/10 and SW2 FastEthernet0/5 belong to VLAN 5. SW1 FastEthernet0/11 and SW2 FastEthernet0/6 belong to VLAN 10.

On SW1, configure the two endpoint interfaces as follows:

configure terminal
interface fastethernet0/10
 switchport mode access
 switchport access vlan 5
interface fastethernet0/11
 switchport mode access
 switchport access vlan 10
end

On SW2, configure its endpoint interfaces as follows:

configure terminal
interface fastethernet0/5
 switchport mode access
 switchport access vlan 5
interface fastethernet0/6
 switchport mode access
 switchport access vlan 10
end

The switchport access vlan command determines the VLAN membership of an access port. This is different from a trunk, which transports multiple VLANs rather than assigning the endpoint link to one VLAN.

Configure the Inter-Switch Trunk

Configure FastEthernet0/1 on both switches. The settings at both ends must be compatible. The permanent trunk command is switchport mode trunk.

On SW1:

configure terminal
interface fastethernet0/1
 switchport mode trunk
end

Apply the corresponding configuration on SW2:

configure terminal
interface fastethernet0/1
 switchport mode trunk
end

On a modern switch that supports only 802.1Q, the command may be rejected if you try to select an encapsulation manually. Omit that command and configure trunk mode instead.

Legacy Encapsulation Selection

Some older, multi-encapsulation Cisco switches provide an encapsulation command. On such a platform, select 802.1Q before enabling trunk mode:

configure terminal
interface fastethernet0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
end

ISL can be selected only on a legacy device that explicitly supports it. The two ends of the link must use compatible trunk operation and encapsulation.

Verify the Trunk

Use the detailed switchport command on SW1 FastEthernet0/1:

show interfaces fastethernet0/1 switchport

Run the command on both switches when troubleshooting. Important fields include the following:

The output may also show an Access Mode VLAN field. This field is relevant to access operation and often displays the default access VLAN even when the interface is currently operating as a trunk. Do not confuse it with the trunk's active VLAN list.

For a concise view of trunking interfaces and VLAN carriage, use:

show interfaces trunk

This summary can show which interfaces are trunking, the native VLAN, VLANs allowed on the trunk, VLANs active in the management domain, and VLANs forwarding on the link. Confirm that FastEthernet0/1 is trunking and that VLAN 5 and VLAN 10 are active and forwarding.

Scope of VLAN Carriage

With the example configuration, the trunk can carry both VLAN 5 and VLAN 10 between SW1 and SW2. Therefore, a VLAN 5 endpoint on SW1 can communicate at Layer 2 with a VLAN 5 endpoint on SW2, assuming the endpoint addressing and other switch settings are correct. The same applies to VLAN 10.

A trunk can also be restricted to a selected list called the allowed VLANs. This limits which VLANs may use that trunk. Detailed allowed-VLAN configuration is a separate design and security topic, but verification output should still be checked whenever VLAN traffic is missing.

Troubleshooting Common Problems

Same-VLAN devices on different switches cannot communicate

• Run show interfaces fastethernet0/1 switchport on both switches and confirm that the operational mode is trunk.
• Run show interfaces trunk and check whether VLAN 5 and VLAN 10 are active and forwarding.
• Use show vlan brief to confirm that the required VLAN exists on both switches.
• Verify that each endpoint interface is assigned to the intended access VLAN.
• Check the physical interface state and confirm that the cable connects the expected FastEthernet0/1 interfaces.

The encapsulation command is rejected

The switch probably supports only 802.1Q. Omit switchport trunk encapsulation dot1q, configure switchport mode trunk, and confirm the active encapsulation with the switchport status command.

Only one side reports trunking

• Compare the administrative and operational modes on both ends.
• Confirm that both interfaces are connected to each other and are physically up.
• Check that VLAN 5 and VLAN 10 exist and are active on both switches.
• Look for an allowed-VLAN restriction that excludes the expected VLAN.
• Ensure that the trunk encapsulation and other trunk settings are compatible.

An endpoint link forwards multiple VLANs

The host-facing interface may have been configured as a trunk accidentally. Inspect it with show interfaces <interface> switchport. Set it to access mode and assign the intended VLAN:

configure terminal
interface fastethernet0/10
 switchport mode access
 switchport access vlan 5
end

Exam-Relevant Notes

• A trunk carries multiple VLANs; an access port normally carries one data VLAN.
• The switch-to-switch interface is the trunk in this topology. The endpoint-facing interfaces remain access ports.
• 802.1Q, or dot1q, is the current standard trunk tagging method.
• ISL is a legacy Cisco-proprietary encapsulation and is unavailable on most modern switches.
• Administrative mode describes the configured mode; operational mode describes the mode currently in use.
• The native VLAN is the VLAN associated with untagged traffic on an 802.1Q trunk.
• Both switches need the required VLANs, compatible trunk settings, and permission for those VLANs to cross the link.

For a compact reference, see Configure Trunk Ports.