Access Ports and Trunks: How VLANs Cross Switches

Which group does the laptop join?

An access port puts this endpoint's ordinary untagged data into one configured VLAN. Untagged means the Ethernet frame does not carry an 802.1Q VLAN field on the cable. The switch still knows the VLAN internally because it knows which port received the frame.

The laptop is 192.168.10.11/24 on SW1 Gi1/0/1. Its destination PC is 192.168.10.13/24 on SW2 Gi1/0/1. These are IP addresses in the same subnet; the port names identify physical switch interfaces. Both ports must also belong to VLAN 10 for the intended direct Ethernet path.

A trunk extends VLANs between devices; it does not route between those VLANs. The guest phones stay in VLAN 20 even while their frames share the same cable.

Access ports at the edge

Situation: a laptop is plugged into Gi1/0/1. What happens: it sends ordinary, untagged frames, and the switch places them in the port's access VLAN. Why: endpoints don't need to know about VLANs; the port configuration decides membership.

Port	Device	Mode	Access VLAN
Gi1/0/1	Employee laptop	access	10
Gi1/0/2	Printer	access	10
Gi1/0/3	Guest laptop	access	20

How to verify

Illustrative Cisco Catalyst IOS XE output, written for this lesson

SW1#show interfaces Gi1/0/1 switchport
Name: Gi1/0/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Access Mode VLAN: 10 (EMPLOYEES)
...

Operational Mode: static access confirms it's an access port; Access Mode VLAN: 10 is the VLAN its device joins.

Trunks: following a VLAN 10 frame between switches

A trunk carries multiple VLANs. For the non-native VLAN 10 traffic here, SW1 adds a tag identifying VLAN 10 before sending through Gi1/0/23. SW2 receives it on Gi1/0/24, reads the VLAN and forwards within that group. The source and destination MAC addresses remain those of the two hosts while switches carry the frame.

Situation: employees and guests work on two floors, each with its own switch. VLAN 10 and VLAN 20 must exist on both. Instead of one cable per VLAN, one trunk link carries them all. Pick where the employee laptop sends a frame:

The employee laptop (VLAN 10) sends to:

Device key: SW1 · Floor 1, SW2 · Floor 2 (switch) · Employee, Guest (laptop) · Employee PC (computer) · Guest phone (mobile device)

Lines show the example’s network connections. Thick links: uplinks/WAN, as labelled. The coloured path and envelope follow the current step; its text identifies the sender, receiver and traffic type.

Reading the addresses

IP labels identify interfaces or destinations. Subnet labels identify networks; /n is the prefix length. A router ID (RID) identifies a routing process and need not be a reachable interface.

An IP address alone is not a URL. A web URL includes a scheme such as https://; an address on a router or printer does not imply a website.

MAC addresses identify link-layer interfaces or destination groups. They are not IP addresses or website URLs.

Employee: Gi1/0/1
Guest: Gi1/0/3
Employee PC: Gi1/0/1
Guest phone: Gi1/0/3

1. Into an access port: the laptop sends an ordinary frame. SW1 knows it's VLAN 10 only because Gi1/0/1 is an access port in VLAN 10.
2. Tagged on the trunk: the destination is through the trunk, so SW1 inserts a 4-byte 802.1Q tag with VLAN ID 10.
3. Out of an access port: SW2 reads VLAN 10 from the tag, looks the MAC address up in its VLAN 10 table, removes the tag and sends the frame out Gi1/0/1. The PC receives an ordinary untagged frame.

In this example, VLANs 10 and 20 are allowed, active and forwarding; native VLAN 99 is unused.

Why it works: the receiving switch reads the tag for non-native traffic. Untagged traffic uses the receiving trunk's native VLAN. Both ends must agree on that native VLAN and permit the data VLANs.

Inspect a frame on each cable to compare access and trunk tagging.

Trunks: following a VLAN 10 frame between switches

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

Configure fixed port roles

vlan 10 creates or selects the VLAN; switchport access vlan 10 assigns a port to it. Those are separate tasks. switchport mode trunk fixes the uplink's role. switchport nonegotiate stops DTP (Dynamic Trunking Protocol) negotiation on this explicitly configured link. The peer must also be configured as a trunk.

Example commands for SW1, starting in global configuration mode. VLANs 10 and 20 must also exist on SW2.

vlan 10
 name EMPLOYEES
vlan 20
 name GUESTS
vlan 99
 name NATIVE
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
interface GigabitEthernet1/0/23
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,99
 switchport nonegotiate

Configure the far end as a static trunk too. Use the same native VLAN and the intended allowed list on both ends.

On SW2, create the same VLAN IDs and configure its Gi1/0/24 uplink with the same native VLAN and allowed list. Its employee-facing Gi1/0/1 is access VLAN 10. The differing uplink numbers are intentional: SW1 uses 23, SW2 uses 24.

Allowed VLANs

A trunk only carries the VLANs on its allowed list. Creating VLAN 30 on both switches is not enough: if the trunk allows only 10 and 20, VLAN 30 camera data cannot cross that trunk. The allowed list is only the first check: the VLAN must also exist, be active, and be forwarding in spanning tree without pruning.

Read the forwarding evidence

Run show interfaces trunk on both switches. First confirm the actual trunk port and operational trunk status, then read all three VLAN lists. A configured intention is not proof of an operating trunk.

Illustrative Cisco Catalyst IOS XE output, shortened and written for this lesson

SW1#show interfaces trunk
Port        Mode         Encapsulation  Status        Native vlan
Gi1/0/23    on           802.1q         trunking      99

Port        Vlans allowed on trunk
Gi1/0/23    10,20,99

Port        Vlans allowed and active in management domain
Gi1/0/23    10,20,99

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/23    10,20,99

VLAN 10 is permitted, exists locally as an active VLAN, and is eligible to forward on this link. Spanning Tree Protocol (STP) prevents Ethernet loops by controlling which paths forward. Do not disable STP to force a blocked redundant path into use. These lists still do not test host addressing or application policy.

Short lab: repair one missing VLAN

Build the two-switch baseline above and confirm both employee devices are in VLAN 10 and the same /24 subnet. Use their actual interfaces in your simulator. Test their local reachability.
On the isolated SW1 uplink, enter switchport trunk allowed vlan remove 10. VLAN 20 can remain allowed while the employee path breaks. Compare the three trunk lists on both ends.
Restore the intended membership with switchport trunk allowed vlan add 10, then verify forwarding and retest. The word add preserves the existing list; switchport trunk allowed vlan 10 replaces it and can remove VLANs 20 and 99.
If VLAN 10 is allowed but missing from the active list, inspect show vlan brief. If active but absent from forwarding, investigate STP and pruning. Repair the observed cause rather than adding the same allowed command repeatedly.

Check the path

Predict · scenario 1

SW1's laptop sends an untagged data frame into access VLAN 10. What tells SW1 its VLAN?

Predict · scenario 2

VLAN 10 appears allowed and active, but not in the trunk's forwarding list. What should you investigate next?

Predict · scenario 3

You need to restore VLAN 10 without replacing allowed VLANs 20 and 99. Which interface command fits?

Cisco reference

Cisco: configuring VLAN trunks