In which configuration mode is switchport mode access used?

The switchport mode access command is entered in Interface Config mode on Cisco IOS devices.

Layer 2Interface Config

switchport mode access

Force a port to access mode for end-host connections, preventing VLAN hopping attacks and unintended trunk formation.

Definition: switchport mode access is a Cisco IOS interface config command. Statically configures a switch port as an access port, disabling all DTP negotiation so the port permanently carries traffic for a single VLAN and can never negotiate to trunk mode.

Overview

The `switchport mode access` command is a fundamental Cisco IOS interface configuration command that explicitly sets a switch port to operate as an access port. An access port belongs to a single VLAN and carries traffic for that VLAN only, with no VLAN tagging (802.1Q) on the frames. This command is essential for connecting end devices such as PCs, printers, IP phones, or servers that expect untagged traffic.

Understanding when to use this command versus `switchport mode trunk` or `switchport mode dynamic desirable/auto` is critical for proper VLAN segmentation and network security. In a typical configuration workflow, after creating VLANs globally with `vlan <vlan-id>`, you assign a port to a VLAN by first setting the mode to access and then using `switchport access vlan <vlan-id>`. The command is executed in interface configuration mode, and it immediately changes the operational state of the interface; the running configuration is updated instantly.

There is no buffered output—the command either succeeds or returns an error (e.g., if the interface is already a trunk). Privilege level 15 (enable mode) is required. The command is irreversible without explicitly changing the mode again.

It is a best practice to always set the mode explicitly rather than relying on Dynamic Trunking Protocol (DTP) to avoid trunk negotiation vulnerabilities. In a network troubleshooting context, verifying that a port is in access mode (using `show interfaces switchport`) helps confirm that VLAN assignment is correct and that no unwanted trunking is occurring. The command is supported on all Cisco switches running IOS, including Catalyst 2960, 3560, 3650, 3850, and 9000 series.

It is also available in IOS-XE and NX-OS (with slight syntax differences).

Syntax·Interface Config

switchport mode access

When to Use This Command

Connect PCs, printers, and servers to a switch with a fixed VLAN assignment
Security hardening — disable DTP on end-user ports to prevent VLAN hopping
Force a port to stay as access even if the far end sends DTP frames
Required before switchport access vlan takes a guaranteed static effect

Command Examples

Configure access port with VLAN assignment

Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# spanning-tree portfast
Switch(config-if)# end
Switch# show interfaces GigabitEthernet1/0/1 switchport
Administrative Mode: static access
Operational Mode: static access

Understanding the Output

Administrative Mode: static access confirms the manual configuration. Operational Mode: static access confirms it is actually operating as access. Access Mode VLAN shows which VLAN the port is in.

If Operational Mode shows trunk, check that the far end is not DTP dynamic desirable.

Configuration Scenarios

Assign a PC to VLAN 10 on a Catalyst 2960

A new employee PC needs to be connected to the network and placed in the Sales VLAN (VLAN 10). The switch port Gi0/1 is currently in default VLAN 1 and must be configured as an access port.

Topology

PC1 --- Gi0/1 (Switch) Gi0/2 --- Trunk to Core

Steps

1.Step 1: Enter global configuration mode: Switch> enable
2.Step 2: Enter interface configuration mode for Gi0/1: Switch# configure terminal
3.Step 3: Set the port to access mode: Switch(config)# interface gigabitEthernet 0/1
4.Step 4: Assign VLAN 10: Switch(config-if)# switchport mode access
5.Step 5: Exit and verify: Switch(config-if)# switchport access vlan 10
6.Step 6: Save the configuration: Switch(config-if)# end

Configuration

!
interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
!

Verify: Use `show interfaces gigabitEthernet 0/1 switchport` and look for 'Administrative Mode: static access' and 'Access Mode VLAN: 10'. Also `show vlan brief` should show Gi0/1 in VLAN 10.

Watch out: If the port was previously a trunk, you must first shut down the interface, change the mode, then no shut, because changing mode from trunk to access may cause the port to go into errdisable state due to configuration mismatch.

Secure an unused port by placing it in a black-hole VLAN

To prevent unauthorized access, an unused switch port should be placed in a VLAN that has no Layer 3 interface or is not routed, effectively black-holing any traffic. This is a common security practice.

Topology

Unused Port Gi0/24 (Switch) --- No device connected

Steps

1.Step 1: Create a black-hole VLAN (e.g., VLAN 999): Switch(config)# vlan 999
2.Step 2: Enter interface configuration for Gi0/24: Switch(config)# interface gigabitEthernet 0/24
3.Step 3: Set mode to access: Switch(config-if)# switchport mode access
4.Step 4: Assign to black-hole VLAN: Switch(config-if)# switchport access vlan 999
5.Step 5: Optionally shut down the port: Switch(config-if)# shutdown
6.Step 6: Exit and save: Switch(config-if)# end

Configuration

!
vlan 999
 name BLACKHOLE
!
interface GigabitEthernet0/24
 switchport mode access
 switchport access vlan 999
 shutdown
!

Verify: `show interfaces gigabitEthernet 0/24 switchport` should show 'Access Mode VLAN: 999'. `show vlan id 999` should list Gi0/24 as an active member. If the port is shut down, it will show as down/down.

Watch out: Simply setting the access VLAN to an unused VLAN is not enough if the VLAN exists and has an SVI; ensure the VLAN has no Layer 3 interface or that the SVI is administratively down to truly black-hole traffic.

Troubleshooting with This Command

When troubleshooting connectivity issues on an access port, the `show interfaces switchport` command is the primary tool. Healthy output for an access port shows 'Administrative Mode: static access', 'Operational Mode: static access', and 'Access Mode VLAN: <vlan-id>'. The 'Trunking Native Mode VLAN' should be '1' (default) and 'Trunking VLANs Enabled' should be 'ALL' but this is irrelevant for access ports.

Problem indicators include: 'Operational Mode: trunk' (meaning the port is trunking despite being configured as access, often due to DTP misconfiguration), 'Access Mode VLAN: 1' (if you intended a different VLAN), or 'Voice VLAN: none' (if you expected a voice VLAN). Common symptoms: a PC cannot obtain an IP address via DHCP—check if the access VLAN matches the DHCP server's scope; if the port shows 'errdisable' state, it may be due to a port-security violation or BPDU guard. A step-by-step diagnostic flow: 1) Verify physical connectivity with `show interfaces status` (look for 'connected' or 'notconnect'). 2) Check the port's VLAN assignment with `show interfaces switchport`. 3) Confirm the VLAN exists with `show vlan brief`. 4) If the port is trunking unexpectedly, disable DTP with `switchport nonegotiate`. 5) If the device is an IP phone, ensure the voice VLAN is configured with `switchport voice vlan <vlan-id>`.

Correlate with `show mac address-table interface <interface>` to see if the device's MAC address is learned in the correct VLAN. If the MAC appears in a different VLAN, there may be a VLAN mismatch or the device is sending tagged frames. Use `debug switchport` with caution in a lab environment to see real-time mode changes.

Remember that changing the mode from trunk to access may cause the interface to flap; always shut/no shut after mode change to avoid errdisable.

CCNA Exam Tips

CCNA exam: memorise the DTP mode interactions. dynamic auto + dynamic auto = access. dynamic auto + dynamic desirable = trunk. static access + anything = always access. switchport mode access disables DTP entirely. switchport nonegotiate also disables DTP but leaves the mode as configured

For maximum security on host ports use both switchport mode access AND switchport nonegotiate

Common Mistakes

Setting switchport access vlan without switchport mode access — port defaults to dynamic auto and may negotiate trunk

Not running this on all host-facing ports, leaving them vulnerable to VLAN hopping via DTP

Confusing switchport mode access (configures mode) with switchport access vlan (assigns the VLAN)

switchport mode access vs spanning-tree portfast

Although switchport mode access and spanning-tree portfast are both applied in interface configuration mode on Cisco switches, they address entirely different Layer 2 concerns. switchport mode access statically designates a port as an access port, disabling Dynamic Trunking Protocol (DTP) so it never becomes a trunk, while spanning-tree portfast bypasses Spanning Tree Protocol (STP) convergence delays, allowing a port to transition directly to forwarding state. They are commonly considered together because best practice dictates enabling portfast on all access ports to avoid unnecessary STP delays.

Aspect	switchport mode access	spanning-tree portfast
Scope	Configures VLAN membership and disables trunk negotiation	Controls STP state transition timing
Configuration mode	Interface configuration	Interface configuration
Persistence	Persists in running-config; static setting	Persists in running-config; does not affect trunking
Precedence	Overrides DTP; access port cannot become trunk	Overrides default STP timers; does not affect port mode
Typical use	End-user or server ports requiring single VLAN	Any port connected to a single host or switch where STP delay is unnecessary

Use switchport mode access when you need to explicitly disable trunk negotiation on a port that will only carry traffic for a single VLAN, such as for an end-user device.

Use spanning-tree portfast when a port connects to an end host or other device that does not create loops, to eliminate the 30-second STP listening and learning delays.

Platform Notes

In IOS-XE (e.g., Catalyst 3650/3850/9300), the syntax is identical: `switchport mode access`. However, the output of `show interfaces switchport` may include additional fields like 'Operational Mode: down' if the port is not connected. In NX-OS (e.g., Nexus 9000), the equivalent command is `switchport mode access` as well, but the interface configuration context is `interface ethernet 1/1`.

NX-OS also uses `switchport access vlan <vlan-id>` similarly. One difference: NX-OS requires `feature interface-vlan` to enable SVI functionality, but this does not affect access port configuration. On ASA platforms, the concept of access ports does not apply; ASA interfaces are Layer 3 by default and use `nameif` and `security-level`.

There is no `switchport mode access` equivalent. In IOS 12.x vs 15.x vs 16.x, the command behavior is consistent, but older IOS versions (12.2) may not support certain features like `switchport nonegotiate` on all platforms. IOS-XR (e.g., ASR 9000) does not support `switchport mode access` because it is a router platform; instead, interfaces are configured as Layer 3 with `ipv4 address` or as Layer 2 using `l2transport` and VLAN subinterfaces.

Always verify the specific platform documentation for any nuances.

Related Commands

show interfaces trunk

Displays all trunk ports including the trunking encapsulation (802.1Q or ISL), the native VLAN, VLANs allowed on the trunk, VLANs in the spanning tree forwarding state, and VLANs active in the management domain.

show vlan brief

Displays a summary of all VLANs in the switch database including VLAN ID, name, status, and the access ports assigned to each VLAN.

spanning-tree portfast

Bypasses the STP Listening and Learning states on a port, moving it directly to Forwarding after the link comes up. Eliminates the default 30-second STP convergence delay for ports connected to end hosts.

switchport nonegotiate

Disables DTP (Dynamic Trunking Protocol) frame generation on a switch port, preventing the port from actively negotiating trunk mode with the connected device.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions