In which configuration mode is switchport mode trunk used?

The switchport mode trunk command is entered in Interface Config mode on Cisco IOS devices.

VLANInterface Config

switchport mode trunk

Configures a switch interface as a trunk port, allowing multiple VLANs to traverse the link using IEEE 802.1Q tagging.

Definition: switchport mode trunk is a Cisco IOS interface config command. Configures a switch interface as a trunk port, allowing multiple VLANs to traverse the link using IEEE 802.1Q tagging.

Overview

The `switchport mode trunk` command is a fundamental Cisco IOS interface configuration command used to set a switch port into trunking mode, enabling it to carry traffic for multiple VLANs using IEEE 802.1Q encapsulation. Trunk ports are essential in modern switched networks because they allow VLAN segmentation to extend across multiple switches, routers, or even servers, without requiring a separate physical link for each VLAN. This command is typically applied on interfaces that connect switches to each other (interswitch links) or to routers that support VLAN routing (router-on-a-stick).

The concept behind trunking is that each frame traversing the trunk is tagged with a VLAN identifier (VID) in the 802.1Q header, allowing the receiving device to know which VLAN the frame belongs to. Without trunking, each VLAN would need its own dedicated link, which is inefficient and costly. The `switchport mode trunk` command is used when you need to carry multiple VLANs over a single link.

Alternatives include `switchport mode access` for single-VLAN ports, or `switchport mode dynamic desirable/auto` for DTP-based negotiation. However, for deterministic and secure configurations, manually setting trunk mode is recommended. In the broader configuration workflow, trunk ports are often configured after VLANs are created and before configuring VLAN interfaces (SVIs) or routing.

Important IOS behaviors: the command is available in privileged EXEC mode (config-if), requires no special privilege level beyond 15, and immediately modifies the running configuration. The command may cause the interface to briefly go down and come back up as the trunking state changes. Also, by default, all VLANs are allowed on the trunk; you may want to restrict allowed VLANs using `switchport trunk allowed vlan`.

The command is stored in the running-config and startup-config. Understanding trunking is critical for CCNA and CCNP candidates because it directly impacts VLAN propagation, STP behavior, and Layer 3 routing between VLANs.

Syntax·Interface Config

switchport mode trunk

When to Use This Command

Connecting two switches to carry traffic for multiple VLANs between them.
Connecting a switch to a router for inter-VLAN routing (router-on-a-stick).
Connecting a switch to a server that supports 802.1Q trunking for VLAN tagging.
Connecting a switch to a wireless LAN controller that requires trunk links for multiple SSID VLANs.

Command Examples

Basic trunk configuration on an interface

interface GigabitEthernet0/1
switchport mode trunk

Switch(config-if)# switchport mode trunk
Switch(config-if)#

The command is entered in interface configuration mode. No output is shown if successful; the prompt returns without error.

Verifying trunk status after configuration

show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1       on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/1       1-4094

Port        Vlans allowed and active in management domain
Gi0/1       1,10,20,30

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       1,10,20,30

The output shows that Gi0/1 is in trunking mode with 802.1Q encapsulation. The native VLAN is 1. All VLANs (1-4094) are allowed, but only VLANs 1,10,20,30 are active and forwarding.

Understanding the Output

The 'show interfaces trunk' command displays trunk status. The 'Port' column lists the interface. 'Mode' shows the trunking mode: 'on' means trunking is enabled statically, 'desirable' or 'auto' are DTP modes.

'Encapsulation' is always 802.1q for modern switches. 'Status' should be 'trunking' for a working trunk; if it says 'not-trunking', the link is not trunking. 'Native vlan' shows the untagged VLAN (default 1).

The second section lists all VLANs allowed on the trunk; by default it's 1-4094. The third section shows VLANs that are actually active and allowed; if a VLAN is not in this list, it may not exist or be shut down. The last section shows VLANs that are in spanning-tree forwarding state; if a VLAN is missing, STP may be blocking it.

A common issue is mismatched native VLANs, which can cause errors; both ends must match.

Configuration Scenarios

Configure a trunk link between two switches

Two Cisco switches, SW1 and SW2, are connected via GigabitEthernet0/1. The goal is to allow multiple VLANs (e.g., VLAN 10, 20, 30) to traverse the link. Trunking must be enabled on both ends.

Topology

SW1(Gi0/1)---(Gi0/1)SW2

Steps

1.Step 1: Access SW1's CLI and enter global configuration mode: SW1> enable, SW1# configure terminal
2.Step 2: Enter interface configuration mode for Gi0/1: SW1(config)# interface gigabitEthernet 0/1
3.Step 3: Set the interface to trunk mode: SW1(config-if)# switchport mode trunk
4.Step 4: (Optional) Restrict allowed VLANs: SW1(config-if)# switchport trunk allowed vlan 10,20,30
5.Step 5: Exit and repeat on SW2: SW2(config)# interface gigabitEthernet 0/1, SW2(config-if)# switchport mode trunk
6.Step 6: Verify trunk status: SW1# show interfaces trunk

Configuration

! SW1 configuration
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
!
! SW2 configuration
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

Verify: Use `show interfaces trunk` on either switch. Expected output shows the interface in trunking mode, with VLANs allowed and active listed. For example: 'Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1'

Watch out: Both ends must be configured as trunk; if one side is set to access, the link will not trunk and may cause a VLAN mismatch. Also, ensure the native VLAN matches on both sides (default VLAN 1) to avoid misconfiguration.

Configure a router-on-a-stick with a trunk to a switch

A router (R1) connects to a switch (SW1) via a single link. The router must route between VLANs 10 and 20. The switch port must be a trunk, and the router uses subinterfaces with 802.1Q encapsulation.

Topology

R1(Gi0/0)---(Gi0/1)SW1

Steps

1.Step 1: On SW1, configure Gi0/1 as trunk: SW1(config)# interface gigabitEthernet 0/1, SW1(config-if)# switchport mode trunk
2.Step 2: On R1, enter interface configuration for Gi0/0: R1(config)# interface gigabitEthernet 0/0
3.Step 3: Create subinterface for VLAN 10: R1(config-subif)# interface gigabitEthernet 0/0.10, R1(config-subif)# encapsulation dot1Q 10, R1(config-subif)# ip address 192.168.10.1 255.255.255.0
4.Step 4: Create subinterface for VLAN 20: R1(config-subif)# interface gigabitEthernet 0/0.20, R1(config-subif)# encapsulation dot1Q 20, R1(config-subif)# ip address 192.168.20.1 255.255.255.0
5.Step 5: Verify routing: R1# show ip route

Configuration

! SW1 configuration
interface GigabitEthernet0/1
 switchport mode trunk
!
! R1 configuration
interface GigabitEthernet0/0
 no ip address
 no shutdown
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

Verify: On R1, use `show ip interface brief` to verify subinterfaces are up/up. On SW1, use `show interfaces trunk` to confirm trunk status. Also, ping from a host in VLAN 10 to VLAN 20's gateway to test routing.

Watch out: The native VLAN on the trunk (default VLAN 1) is not tagged. If the router subinterface uses encapsulation dot1Q 1 native, it will accept untagged frames; otherwise, native VLAN mismatch can cause connectivity issues. Also, ensure the switchport is not set to access mode.

Troubleshooting with This Command

When troubleshooting trunk links, the `show interfaces trunk` command is the primary tool. Healthy output shows the interface in 'trunking' state, with encapsulation '802.1q', and a list of allowed VLANs. Problem indicators include 'not-trunking' or 'inconsistent' status.

Common symptoms: VLAN traffic not passing, STP issues, or connectivity loss. Focus on the 'Mode' column: 'on' means manually set to trunk, 'desirable' or 'auto' indicate DTP negotiation. If the mode is 'dynamic desirable' but the other side is 'access', the link will not trunk.

Also check the 'Status' column: 'trunking' is good; 'not-trunking' indicates a problem. The 'Native vlan' column must match on both ends; mismatched native VLANs can cause VLAN hopping or connectivity issues. The 'Vlans allowed on trunk' shows which VLANs are permitted; if a VLAN is missing, traffic for that VLAN will not pass.

The 'Vlans active' shows VLANs that exist on the switch. A step-by-step diagnostic flow: 1) Verify physical connectivity (show interfaces status). 2) Check trunk status with `show interfaces trunk`. 3) If not trunking, check DTP negotiation: `show dtp interface`. 4) Ensure both ends are configured consistently. 5) Verify VLANs exist: `show vlan brief`. 6) Check for native VLAN mismatch: `show interfaces trunk` on both ends. 7) If using allowed VLAN list, ensure the desired VLANs are included. Correlate with `show spanning-tree` to see if the trunk is blocking due to STP.

Also, `debug trunk` can be used but with caution in production. For router-on-a-stick, also check subinterface encapsulation and IP addressing. The `show interfaces` command on the router will show if the subinterface is up/up.

If the trunk is down, the subinterface will be down/down.

CCNA Exam Tips

CCNA exam tip: The 'switchport mode trunk' command statically sets the interface to trunk, disabling DTP negotiation. Remember that DTP is Cisco proprietary and not used on non-Cisco switches.

CCNA exam tip: If you see 'switchport mode dynamic desirable' or 'auto', the interface can become a trunk via DTP. The exam may ask which mode forms a trunk with a static trunk.

CCNA exam tip: The native VLAN must match on both ends of a trunk; otherwise, VLAN hopping or misconfiguration can occur. The default native VLAN is 1.

CCNA exam tip: To restrict which VLANs are allowed on a trunk, use 'switchport trunk allowed vlan' command. The exam may test that only specific VLANs are permitted.

Common Mistakes

Mistake: Forgetting to set the interface to trunk mode before configuring trunk-specific commands like allowed VLANs or native VLAN. The interface will remain in access mode and commands may be rejected.

Mistake: Configuring trunk mode on an interface connected to an end device (PC, printer) that does not support trunking, causing the device to not communicate.

Mistake: Mismatched native VLANs on both ends of the trunk, leading to VLAN leakage or connectivity issues.

switchport mode trunk vs switchport trunk allowed vlan [list]

These two commands are commonly confused because they both relate to VLAN trunking configuration on Cisco switches, but serve distinct purposes: one enables trunking on the interface, while the other restricts which VLANs are allowed on an already trunked link.

Aspect	switchport mode trunk	switchport trunk allowed vlan [list]
Scope	Enables trunking on the interface	Limits VLANs on an existing trunk
Configuration mode	Interface configuration	Interface configuration
Persistence	Saved to running-config, can be written to startup-config	Saved to running-config, can be written to startup-config
Precedence	Must be configured before allowed VLAN list takes effect	Only effective if interface is in trunk mode
Typical use	Allow all VLANs by default on a trunk link	Restrict specific VLANs from traversing the trunk

Use switchport mode trunk when you need to configure an interface as a trunk port, allowing all VLANs by default.

Use switchport trunk allowed vlan [list] when you need to restrict the set of VLANs that can traverse an existing trunk link.

Platform Notes

In IOS-XE (e.g., Catalyst 3650/3850/9300), the syntax is identical: `switchport mode trunk`. However, IOS-XE may have additional features like `switchport trunk native vlan` and `switchport trunk allowed vlan` with the same syntax. The output of `show interfaces trunk` is similar but may include additional fields like 'Vlans in spanning tree forwarding state'.

On NX-OS (e.g., Nexus switches), the equivalent command is `switchport mode trunk` as well, but NX-OS uses a different default encapsulation (802.1Q is the only option). NX-OS also has `switchport trunk allowed vlan` and `switchport trunk native vlan`. However, NX-OS does not support DTP; trunk mode must be set manually.

The verification command is `show interface trunk` (similar). On ASA firewalls, trunking is not directly supported on physical interfaces; instead, subinterfaces are used with `vlan` command. For example, `interface gigabitethernet0/0.10 vlan 10`.

There is no `switchport mode trunk` equivalent. In IOS-XR, trunking is not typically used on router interfaces; instead, VLAN subinterfaces are configured with `encapsulation dot1q`. The `switchport mode trunk` command does not exist in IOS-XR.

Between IOS versions (12.x, 15.x, 16.x), the command syntax remains consistent, but newer versions may have additional options like `switchport mode trunk` with `nonegotiate` to disable DTP. The behavior is largely the same across versions.

Related Commands

show interfaces trunk

Displays all trunk ports including the trunking encapsulation (802.1Q or ISL), the native VLAN, VLANs allowed on the trunk, VLANs in the spanning tree forwarding state, and VLANs active in the management domain.

switchport mode access

Statically configures a switch port as an access port, disabling all DTP negotiation so the port permanently carries traffic for a single VLAN and can never negotiate to trunk mode.

switchport trunk allowed vlan [list]

Restricts the VLANs that are allowed to traverse a trunk link on a Cisco switch, used to control which VLAN traffic is permitted on the trunk.

switchport trunk native vlan [id]

Configures the native VLAN for an 802.1Q trunk interface, specifying which VLAN's frames are sent untagged on the trunk.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions