In which configuration mode is show interfaces switchport used?

The show interfaces switchport command is entered in Privileged EXEC mode on Cisco IOS devices.

VLANPrivileged EXEC

show interfaces switchport

Displays the administrative and operational status of a switch port, including VLAN membership, trunking mode, and access VLAN, used to verify VLAN configuration and port security settings.

Definition: show interfaces switchport is a Cisco IOS privileged exec command. Displays the administrative and operational status of a switch port, including VLAN membership, trunking mode, and access VLAN, used to verify VLAN configuration and port security settings.

Overview

The 'show interfaces switchport' command is a critical diagnostic tool for Cisco switch administrators, providing a detailed view of the Layer 2 configuration and operational state of switch ports. It displays both administrative (configured) and operational (active) settings, including VLAN membership, trunking mode, access VLAN, voice VLAN, and port security status. This command is essential for verifying VLAN assignments, troubleshooting connectivity issues, and ensuring that ports are operating as intended.

Unlike 'show vlan' which shows VLAN databases, or 'show interfaces trunk' which focuses only on trunk links, 'show interfaces switchport' gives a per-port granularity that is invaluable for access ports and trunk ports alike. It fits into the workflow after initial VLAN configuration, when troubleshooting a host that cannot communicate, or when auditing switchport security settings. The command runs in Privileged EXEC mode and does not affect the running configuration.

Output can be lengthy on switches with many ports, so using the '| include' or '| begin' filters is common. Understanding the output fields—such as 'Administrative Mode', 'Operational Mode', 'Access Mode VLAN', and 'Trunking Native Mode VLAN'—is key to interpreting the switch's behavior. This command is supported across Cisco IOS, IOS-XE, and some NX-OS platforms, though syntax and output may vary slightly.

For CCNA and CCNP candidates, mastering this command is fundamental to VLAN and switchport configuration verification.

Syntax·Privileged EXEC

show interfaces switchport

When to Use This Command

Verify that a port is in the correct access VLAN after configuring a new VLAN.
Check if a trunk port is using the correct native VLAN and allowed VLAN list.
Troubleshoot why a host cannot communicate across VLANs by confirming port mode and VLAN assignment.
Audit switch ports for security compliance, ensuring unused ports are in shutdown or access mode with a black-hole VLAN.

Parameters

Parameter	Syntax	Required	Description
interface-id	e.g., GigabitEthernet0/1, FastEthernet0/1	Optional	Specifies a particular interface to display. If omitted, all switchports are shown. Common mistake: using the wrong interface type or number, or forgetting that the command only applies to switchports (not routed ports).

Command Examples

Verify Access Port VLAN Assignment

show interfaces switchport

Name: Fa0/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 10 (VLAN0010)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative Private VLAN Host Association: none
Administrative Private VLAN Mapping: none
Administrative Private VLAN Trunk Native VLAN: none
Administrative Private VLAN Trunk Native VLAN tagging: enabled
Administrative Private VLAN Trunk Encapsulation: negotiate
Administrative Private VLAN Trunk Normal VLANs: none
Administrative Private VLAN Trunk Private VLANs: none
Operational Private VLANs: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL
Protected: false
Unknown unicast blocked: false
Unknown multicast blocked: false
Appliance trust: none

Name: Fa0/1 — interface being examined. Switchport: Enabled — port is a Layer 2 switchport. Administrative Mode: static access — configured as access port. Operational Mode: static access — actually operating as access port. Access Mode VLAN: 10 (VLAN0010) — port is assigned to VLAN 10. Trunking Native Mode VLAN: 1 — native VLAN is default VLAN 1 (not used on access ports). Voice VLAN: none — no voice VLAN configured. Protected: false — port protection not enabled.

Verify Trunk Port Configuration

show interfaces GigabitEthernet0/1 switchport

Name: Gi0/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 99 (VLAN0099)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative Private VLAN Host Association: none
Administrative Private VLAN Mapping: none
Administrative Private VLAN Trunk Native VLAN: none
Administrative Private VLAN Trunk Native VLAN tagging: enabled
Administrative Private VLAN Trunk Encapsulation: negotiate
Administrative Private VLAN Trunk Normal VLANs: none
Administrative Private VLAN Trunk Private VLANs: none
Operational Private VLANs: none
Trunking VLANs Enabled: 10,20,30
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL
Protected: false
Unknown unicast blocked: false
Unknown multicast blocked: false
Appliance trust: none

Administrative Mode: trunk — configured as trunk. Operational Mode: trunk — actually trunking. Administrative Trunking Encapsulation: dot1q — using 802.1Q. Trunking Native Mode VLAN: 99 — native VLAN is 99. Trunking VLANs Enabled: 10,20,30 — only VLANs 10, 20, 30 allowed on trunk. This output confirms the trunk is correctly configured with a non-default native VLAN and limited allowed VLANs.

Understanding the Output

The 'show interfaces switchport' command provides a detailed view of a switch port's Layer 2 configuration and operational state. Key fields include: 'Name' — the interface identifier; 'Switchport' — indicates if the port is a Layer 2 switchport (Enabled/Disabled); 'Administrative Mode' — the configured mode (access, trunk, dynamic desirable, dynamic auto); 'Operational Mode' — the actual mode negotiated (access or trunk); 'Access Mode VLAN' — the VLAN assigned to an access port; 'Trunking Native Mode VLAN' — the native VLAN on a trunk (should be changed from default VLAN 1 for security); 'Trunking VLANs Enabled' — list of VLANs allowed on the trunk (should be pruned to only necessary VLANs). For access ports, verify the Access Mode VLAN matches the intended user VLAN.

For trunk ports, check that the native VLAN is not VLAN 1 and that only required VLANs are allowed. The 'Operational Mode' should match the 'Administrative Mode'; if not, there may be a DTP negotiation issue. Also watch for 'Protected: false' — if port security or private VLANs are expected, those fields will show relevant values.

In a real network, this command is essential for troubleshooting VLAN connectivity and ensuring trunk ports are secure.

Configuration Scenarios

Verify Access Port VLAN Assignment

A new employee workstation is connected to port Gi0/5 and cannot reach the network. The port should be in VLAN 10 (Sales). Use 'show interfaces switchport' to verify the port's VLAN assignment and operational mode.

Topology

Switch(S1)---Gi0/5---PC (VLAN 10)

Steps

1.Step 1: Connect to the switch via console or SSH and enter privileged EXEC mode: enable
2.Step 2: Run the command: show interfaces GigabitEthernet0/5 switchport
3.Step 3: Examine the output fields: 'Administrative Mode: static access', 'Operational Mode: static access', 'Access Mode VLAN: 10', 'Trunking Native Mode VLAN: 1 (default)'

Configuration

! No configuration needed for verification; if VLAN is wrong, configure:
Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

Verify: show interfaces GigabitEthernet0/5 switchport | include Access Mode VLAN Expected: Access Mode VLAN: 10

Watch out: If the port is in trunk mode, the access VLAN field may show '1' even if configured for VLAN 10. Ensure the port is in access mode.

Troubleshoot Trunk Port VLAN Issues

Two switches are connected via trunk link Gi0/1, but VLANs 20 and 30 are not passing traffic. Use 'show interfaces switchport' to verify trunking status and allowed VLAN list.

Topology

Switch1(Gi0/1)---trunk---(Gi0/1)Switch2

Steps

1.Step 1: On Switch1, enter privileged EXEC mode: enable
2.Step 2: Run: show interfaces GigabitEthernet0/1 switchport
3.Step 3: Check 'Administrative Trunking Encapsulation: dot1q', 'Operational Trunking Encapsulation: dot1q', 'Administrative Mode: trunk', 'Operational Mode: trunk', 'Trunking VLANs Enabled: ALL' or specific list

Configuration

! If VLANs are missing, configure allowed VLAN list:
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport trunk allowed vlan 20,30

Verify: show interfaces GigabitEthernet0/1 switchport | include Trunking VLANs Enabled Expected: Trunking VLANs Enabled: 20,30

Watch out: If the native VLAN mismatch exists, the port may show 'Operational Mode: trunk' but traffic may fail. Check 'Trunking Native Mode VLAN' on both ends.

Troubleshooting with This Command

When troubleshooting connectivity issues, 'show interfaces switchport' is often the first command to run after verifying physical connectivity. Healthy output for an access port shows 'Administrative Mode: static access', 'Operational Mode: static access', and the correct 'Access Mode VLAN'. For a trunk port, look for 'Administrative Mode: trunk', 'Operational Mode: trunk', and 'Trunking VLANs Enabled' listing the expected VLANs.

Problem indicators include: 'Operational Mode: down' (port is not up), 'Operational Mode: trunk' when access was intended (misconfiguration), 'Access Mode VLAN: 1' when a different VLAN was configured (port may be in trunk mode or not configured), or 'Trunking Native Mode VLAN: 1' when a different native VLAN is expected. Common symptoms this command helps diagnose: host cannot ping default gateway (check access VLAN), inter-switch VLAN traffic not passing (check trunk allowed VLAN list), or unexpected VLAN access (port might be in trunk mode). A step-by-step diagnostic flow: 1) Check 'Operational Mode' to see if port is access or trunk as expected. 2) For access ports, verify 'Access Mode VLAN' matches the intended VLAN. 3) For trunk ports, verify 'Trunking VLANs Enabled' includes the needed VLANs and 'Trunking Native Mode VLAN' matches the peer. 4) If port is in 'dynamic desirable' or 'dynamic auto' mode, the operational mode may differ from administrative mode; ensure both ends negotiate correctly.

Correlate with 'show interfaces status' for link state, 'show vlan brief' for VLAN existence, and 'show interfaces trunk' for trunk-specific details. If the port is err-disabled, 'show interfaces switchport' will show 'Operational Mode: down' and you need to check 'show interfaces status err-disabled' for the cause. Remember that 'show interfaces switchport' does not show port-security violations; use 'show port-security interface' for that.

CCNA Exam Tips

CCNA exam may ask: 'Which command shows the operational mode of a switch port?' — answer: show interfaces switchport.

Know that 'Administrative Mode' is the configured setting, while 'Operational Mode' is what is actually running after DTP negotiation.

Be able to identify that a trunk port with 'Trunking VLANs Enabled: ALL' is a security risk; the exam may test best practice of limiting allowed VLANs.

Remember that the native VLAN on a trunk should not be VLAN 1; the exam may present a scenario where changing the native VLAN to an unused VLAN improves security.

Common Mistakes

Confusing 'Access Mode VLAN' with 'Trunking Native Mode VLAN' — access VLAN is for access ports, native VLAN is for trunk ports.

Assuming 'Operational Mode' always matches 'Administrative Mode' — DTP misconfiguration can cause a port to operate in a different mode.

Forgetting that a trunk port with 'Trunking VLANs Enabled: ALL' allows all VLANs, which can lead to VLAN hopping attacks if not pruned.

show interfaces switchport vs show vlan

Both commands display VLAN-related information, but they focus on different perspectives: 'show interfaces switchport' provides per-port operational details, while 'show vlan' shows the global VLAN table.

Aspect	show interfaces switchport	show vlan
Scope	Per-port (specified or all ports)	Global VLAN table
Output focus	Administrative and operational port status (mode, access vlan, trunking)	VLAN IDs, names, status, member ports
Detail level	Detailed per-port including native VLAN, trunk encapsulation, etc.	Summary of each VLAN and associated ports
Persistence	Operational status (dynamic)	Static configuration (VLANs must be created)
Utility	Troubleshooting port-specific VLAN issues	Verifying VLAN creation and port membership

Use show interfaces switchport when you need to verify the operational VLAN settings and trunking mode on a specific interface.

Use show vlan when you want to view all configured VLANs and which ports are assigned to them.

Platform Notes

In IOS-XE (e.g., Catalyst 3650/3850/9300), the output is similar to classic IOS but may include additional fields like 'Switchport: Enabled' and 'Administrative Mode: trunk' with 'Operational Mode: trunk'. The command syntax is identical. For NX-OS (e.g., Nexus 9000), the equivalent command is 'show interface switchport' (note: no 's' on interface).

The output format differs: it shows 'Switchport: Enabled', 'Administrative Mode: trunk', 'Operational Mode: trunk', 'Access VLAN: 10', 'Native VLAN: 1', and 'Allowed VLAN List: 1-4094'. NX-OS also supports 'show interface <interface> switchport' for a specific interface. For ASA firewalls, there is no direct equivalent as ASAs are Layer 3 devices; use 'show interface' for IP info.

In IOS-XR (e.g., ASR 9000), the command does not exist; instead, use 'show ethernet trunk' or 'show vlan' for similar information. Between IOS versions (12.x vs 15.x vs 16.x), the output is largely consistent, but newer versions may add fields like 'Voice VLAN' or 'Port Security'. Always check the specific platform documentation for any nuances.

Related Commands

show interfaces trunk

Displays all trunk ports including the trunking encapsulation (802.1Q or ISL), the native VLAN, VLANs allowed on the trunk, VLANs in the spanning tree forwarding state, and VLANs active in the management domain.

show vlan

Displays the current VLAN configuration on the switch, including VLAN IDs, names, status, and ports assigned to each VLAN, used to verify VLAN creation and port assignments.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions