Access and Trunk Switch Ports Explained

Learn how Cisco-style access and trunk ports carry VLAN traffic, use 802.1Q tags, and are configured, verified, and troubleshot.

Switch ports connect devices at Layer 2, but a port also has a VLAN-related role. That role determines which VLANs the port can carry and how the switch handles Ethernet frames. The two fundamental roles are access and trunk.

A VLAN is a logical Layer 2 network segment and broadcast domain identified by a VLAN ID. Devices in different VLANs are separated at Layer 2, even when they connect to the same physical switch. A router or multilayer switch is required for communication between VLANs.

Why switch port roles matter

An endpoint-facing link usually carries traffic for one VLAN. For example, a workstation might belong to VLAN 20. A link between switches may need to carry VLANs 10, 20, and 30 at the same time. Configuring both links identically would not work: the endpoint port should normally be an access port, while the inter-switch link should normally be a trunk.

Port mode therefore affects segmentation, broadcast domains, and connectivity between switches. A physical port can be assigned an administrative mode such as access or trunk, and the port also has an operational state that shows how it is currently functioning.

Access ports

An access port normally carries traffic for one VLAN. Typical connections include PCs, printers, servers, and other single-VLAN endpoints. An IP phone deployment may also use an access port for the phone's data VLAN, with a separate voice VLAN feature where supported.

Most ordinary endpoint devices send and receive untagged Ethernet frames. When an untagged frame enters an access port, the switch associates it with the port's configured access VLAN. When traffic leaves that port toward the endpoint, the switch normally removes any internal VLAN identification and sends an untagged frame.

Access VLAN and default VLAN

The access VLAN is the VLAN assigned to an access port. On many Cisco switches, a new access port initially belongs to VLAN 1. VLAN 1 is also commonly the default native VLAN and has special historical behavior. Relying on defaults can make a design unclear and can expose unnecessary management or user traffic.

Assign the intended VLAN explicitly, and use a deliberate design for management and unused ports. The VLAN must exist and be active before the port can provide useful connectivity.

Administrative mode versus operational VLAN

Switchport mode describes how the interface is configured to behave: access, trunk, or dynamic. The access VLAN describes the VLAN membership used by an access port. These are different settings. A port can be administratively configured with switchport mode access and assigned to VLAN 20 with switchport access vlan 20. Its operational mode is then access, and its operational VLAN is VLAN 20.

Trunk ports

A trunk port is a link that transports traffic for more than one VLAN. Common trunk peers include switches, routers using router-on-a-stick, firewalls, virtualization hosts, wireless access points, and certain IP telephony deployments.

Trunks are essential when a VLAN spans multiple switches. For example, if VLAN 20 users connect to both Switch A and Switch B, the link between the switches must carry VLAN 20. If VLANs 10, 20, and 30 are needed on that link, the trunk carries all three while preserving their separate broadcast domains.

802.1Q tagging and frame handling

IEEE 802.1Q is the modern standard for identifying VLANs on Ethernet trunk links. A switch inserts an 802.1Q field into a tagged Ethernet frame. The field is located after the source MAC address and before the EtherType or length field. It includes a VLAN ID that identifies the VLAN associated with the frame.

When the receiving switch examines the tag, it places the frame into the corresponding VLAN before applying normal Layer 2 forwarding logic. The switch uses both VLAN membership and its learned destination MAC address. A MAC address learned in VLAN 20 is treated separately from the same address, or another address, learned in VLAN 30.

Tagged trunk frames contrast with ordinary endpoint traffic. An endpoint connected to an access port usually sends untagged frames. The first switch internally associates those frames with the access VLAN, tags them when they leave through a trunk, and removes the tag before sending them out another access port.

Example: a frame crossing two switches

A workstation sends an untagged frame into an access port assigned to VLAN 20 on Switch A.
Switch A associates the frame with VLAN 20 and learns the source MAC address in VLAN 20.
Because the destination is reachable through the inter-switch link, Switch A sends the frame on the trunk with an 802.1Q VLAN 20 tag.
Switch B reads the tag, forwards the frame within VLAN 20, and removes the tag before sending the frame through a VLAN 20 access port.
The destination workstation receives an ordinary untagged Ethernet frame.

Native VLAN

The native VLAN is the VLAN associated with untagged traffic on an 802.1Q trunk. In many Cisco environments, native VLAN traffic is sent untagged by default, while other VLAN traffic is tagged.

Both ends of a trunk must use the same native VLAN. If one end treats an untagged frame as VLAN 999 and the other treats it as VLAN 1, the frame can enter different VLANs on the two switches. Cisco switches may report a native VLAN mismatch, and the mismatch can cause lost connectivity, unexpected broadcast traffic, or security problems.

A common design is to select a dedicated, unused native VLAN, such as VLAN 999, configure it consistently on both ends, and avoid using VLAN 1 for user traffic, native traffic, or management unless there is a deliberate reason to do so. Changing the native VLAN is not a complete security solution by itself; trunk exposure and allowed VLANs must also be controlled.

Allowed VLANs and pruning

A trunk can often carry all VLANs by default. An allowed VLAN list restricts the trunk to a selected set. Limiting the list reduces unnecessary broadcast, multicast, and unknown-unicast traffic and narrows the VLANs exposed on the link. This is a form of VLAN pruning.

A VLAN must exist, be active, and be allowed on every necessary trunk in the path. Removing VLAN 20 from one trunk does not necessarily affect VLANs 10 and 30, but it breaks the Layer 2 path for VLAN 20 across that link. The same issue occurs if VLAN 20 is missing from an intermediate switch.

Traffic Type	Outbound Frame Behavior	Receiving Switch Treatment
Allowed non-native VLAN traffic	Sent with an 802.1Q tag containing the VLAN ID	Uses the tag to place the frame in the correct VLAN
Native VLAN traffic	Normally sent untagged by default	Places the untagged frame into the configured native VLAN
VLAN not allowed on trunk	Not forwarded over that trunk	No traffic for that VLAN is received through the link
Untagged frame received on trunk	Already untagged	Associates it with the native VLAN

Access port versus trunk port

Characteristic	Access Port	Trunk Port
VLANs carried	Normally one data VLAN	More than one VLAN
Frame treatment	Endpoint frames are normally untagged	Frames are usually tagged; native VLAN frames may be untagged
Typical peer device	PC, printer, server, or ordinary endpoint	Switch, router, firewall, access point, or virtualization host
Common deployment	Connecting an endpoint to its VLAN	Extending VLANs between network devices
Need for 802.1Q tags	Usually no endpoint tagging is needed	Required to identify most VLANs crossing the link
Security configuration focus	Force access mode, assign the VLAN, and disable negotiation	Use a deliberate native VLAN and restrict allowed VLANs

Choose the mode based on the requirements of the link, not merely on the physical type of the connected device. A server may need an access port if it uses one VLAN, but a virtualization host may need a trunk if its virtual machines use several VLANs. A router needs a trunk when one physical interface uses multiple tagged subinterfaces.

Static and negotiated trunking

Static trunking explicitly configures a link as a trunk. It is preferred for predictable infrastructure links because both the intended mode and the permitted VLANs are visible in the configuration.

Dynamic Trunking Protocol (DTP) is Cisco-specific and negotiates trunk operation between compatible Cisco devices. It should not be assumed on multivendor links.

Mode	Purpose	Negotiates Trunking	Typical Use
`access`	Forces the port to operate as an access port	No trunk formation	Fixed endpoint-facing port
`trunk`	Forces the port to operate as a trunk	May send DTP unless disabled	Fixed infrastructure trunk
`dynamic desirable`	Actively attempts to form a trunk	Yes	Legacy Cisco negotiation
`dynamic auto`	Passively forms a trunk if the peer requests it	Yes	Legacy passive negotiation

For an untrusted endpoint-facing port, use static access mode and disable DTP with switchport nonegotiate. Unexpected trunk formation can expose multiple VLANs and contribute to VLAN hopping risk. Do not configure a user wall jack as a trunk unless the connected device and security design explicitly require it.

Cisco IOS configuration workflow

1. Create or verify the VLANs

configure terminal
vlan 10
 name USERS
vlan 20
 name ENGINEERING
vlan 999
 name NATIVE_UNUSED

Verify that the VLANs are present before assigning ports or permitting them on trunks.

2. Configure an endpoint-facing access port

interface gigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 20
 switchport nonegotiate
 spanning-tree portfast

spanning-tree portfast is commonly used on an end-device port, not on a switch-to-switch trunk. Apply it only where the connected device is known to be an endpoint.

3. Configure an inter-switch trunk

interface gigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,999
 switchport nonegotiate

Configure compatible settings on the peer interface. If VLAN 30 is later required without replacing the existing list, use:

interface gigabitEthernet1/0/24
 switchport trunk allowed vlan add 30

4. Save and verify

show vlan brief
show interfaces trunk
show interfaces gigabitEthernet1/0/24 switchport
show interfaces status
show mac address-table dynamic

Save the configuration after testing with the platform's normal configuration-save procedure, such as copy running-config startup-config.

Verification and traffic testing

Use show vlan brief to check VLAN existence, status, and access-port membership. Use show interfaces trunk to inspect operational trunk status, native VLAN, allowed VLANs, and active VLANs. The active list is important: a VLAN can be permitted in configuration but still be unavailable if it is not created or active.

Use show interfaces gigabitEthernet1/0/24 switchport to compare administrative mode with operational mode and to inspect access, native, and trunk settings. Use show interfaces status to confirm link state and basic port mode. Use show mac address-table dynamic to confirm that MAC addresses are being learned in the expected VLAN.

Test same-VLAN communication with hosts attached to different switches. A successful physical link only proves that the interface has electrical or optical connectivity; it does not prove that the correct VLAN is created, allowed, active, and forwarded on every trunk.

Common misconfigurations and troubleshooting

Symptom	Likely Cause	Verification	Correction
Hosts in the same VLAN cannot communicate across switches	Wrong access VLAN, missing VLAN, or VLAN absent from a trunk path	Check access membership, VLAN status, trunk state, allowed VLANs, and every intermediate trunk	Correct endpoint assignments and create or permit the VLAN consistently
Native VLAN mismatch warning	Different native VLAN IDs at the two ends	Inspect native VLAN settings on both interfaces	Set the same deliberate native VLAN on both ends
Unexpected trunk formation	Endpoint port left in dynamic negotiation mode	Inspect switchport mode and DTP behavior	Force access mode, assign the VLAN, and use `switchport nonegotiate`
A specific VLAN fails while others work	VLAN removed from an allowed list, pruned, missing, or blocked for that VLAN	Review allowed and active VLAN lists and spanning-tree state	Restore the VLAN consistently across the required path
Endpoint receives connectivity in the wrong VLAN	Incorrect access VLAN or port mistakenly configured as a trunk	Check the interface's switchport details and VLAN membership	Set static access mode and assign the intended access VLAN

Focused troubleshooting sequence

Check that the interface is physically up on both sides.
Confirm the endpoint port is an access port and has the intended access VLAN.
Confirm the VLAN exists and is active on each switch.
Confirm the inter-device link is operationally trunking.
Compare native VLAN settings on both ends.
Confirm the required VLAN appears in the trunk's allowed and active lists.
Check every intermediate trunk when more than two switches are involved.
Inspect the MAC address table to confirm VLAN-specific learning.
Test with hosts in the same VLAN before testing communication between different VLANs.

Security considerations

Do not leave untrusted endpoint-facing ports able to negotiate trunks.
Use static access mode and an explicit access VLAN for ordinary user ports.
Restrict trunk allowed VLANs to those required by the link.
Use a dedicated native VLAN that is not used for ordinary client traffic, and match it on both ends.
Avoid using VLAN 1 for management, native traffic, or users unless the design deliberately requires it.
Disable or otherwise secure unused ports rather than leaving them available for arbitrary connections.
Remember that trunking exposed to an untrusted endpoint can contribute to VLAN hopping attacks.

Exam-relevant summary

Next steps

Review Cisco IOS access configuration, then connect these concepts to IP routing and inter-VLAN routing. Understanding MAC addresses also makes VLAN-specific MAC table verification easier.