switchport trunk allowed vlan [list]
Restricts the VLANs that are allowed to traverse a trunk link on a Cisco switch, used to control which VLAN traffic is permitted on the trunk.
Definition: switchport trunk allowed vlan [list] is a Cisco IOS interface config command. Restricts the VLANs that are allowed to traverse a trunk link on a Cisco switch, used to control which VLAN traffic is permitted on the trunk.
Overview
The `switchport trunk allowed vlan` command is a critical tool for managing VLAN traffic on trunk links in Cisco switches. Trunk links are used to carry traffic for multiple VLANs between switches, routers, or other network devices. By default, a trunk port allows all VLANs (1-4094) to traverse it, which can lead to unnecessary broadcast traffic, security risks, and inefficient use of bandwidth.
This command restricts the VLANs that are allowed on a specific trunk, enabling network administrators to implement VLAN pruning and enforce traffic segmentation. The concept behind this command is rooted in VLAN tagging (802.1Q or ISL), where each frame is tagged with a VLAN ID. By limiting allowed VLANs, you reduce the broadcast domain size and prevent unauthorized VLANs from leaking across the network.
You would reach for this command when you need to control which VLANs are extended across a trunk, such as in a multi-tenant environment, when connecting to a firewall or router that only needs specific VLANs, or when optimizing bandwidth on a link. Alternatives include using VTP pruning (which automates this process but requires VTP configuration) or simply not configuring the command (which allows all VLANs). This command fits into the broader configuration workflow after setting the interface to trunk mode with `switchport mode trunk`.
It is typically used in conjunction with `switchport trunk native vlan` and `switchport trunk allowed vlan remove` or `add`. Important IOS behavior: the command is executed in interface configuration mode, and changes take effect immediately. The running config is updated, and the command can be verified with `show interfaces trunk`.
Privilege level 15 (privileged EXEC) is required to enter global configuration mode, but the command itself does not require additional privileges. The output is not buffered; it directly modifies the interface configuration. A common mistake is forgetting to include the native VLAN in the allowed list, which can cause management traffic loss.
Also, using the `all` keyword resets the allowed list to include all VLANs, which may inadvertently allow unwanted traffic. Understanding this command is essential for CCNA and CCNP candidates as it directly impacts network security and performance.
switchport trunk allowed vlan [list]When to Use This Command
- Limiting trunk to only specific VLANs for security or traffic segmentation
- Preventing VLAN hopping attacks by restricting allowed VLANs on trunk ports
- Isolating guest or IoT traffic to specific VLANs on a trunk to the distribution switch
- Removing unused VLANs from a trunk to reduce broadcast traffic and improve performance
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| list | VLAN IDs (e.g., 10,20,30-40) or keywords: all, add, remove, except | Specifies the VLANs to be allowed on the trunk. You can list individual VLANs separated by commas, ranges using a hyphen, or use keywords: 'all' to allow all VLANs, 'add' to add VLANs to the existing list, 'remove' to remove VLANs from the existing list, or 'except' to allow all VLANs except those specified. Common mistakes: forgetting that VLAN 1 is allowed by default and must be explicitly removed if desired; using spaces in the list (Cisco IOS requires no spaces between commas and hyphens); and not including the native VLAN, which can cause the native VLAN to be pruned. |
Command Examples
Allow only VLANs 10, 20, and 30 on trunk
switchport trunk allowed vlan 10,20,30This command configures the trunk to permit only VLANs 10, 20, and 30. All other VLANs are blocked. No output is displayed if successful.
Add VLAN 40 to existing allowed list
switchport trunk allowed vlan add 40The 'add' keyword appends VLAN 40 to the current allowed list without removing existing VLANs. No output is displayed.
Understanding the Output
The command itself produces no output on success. To verify the allowed VLAN list, use 'show interfaces trunk' or 'show interfaces switchport'. In 'show interfaces trunk', the 'Vlans allowed on trunk' line shows the permitted VLANs (e.g., 10,20,30).
If the list is empty or shows 'none', the trunk is blocking all VLANs. A common mistake is forgetting to include the native VLAN (usually VLAN 1) if needed. Always verify after configuration.
Configuration Scenarios
Restrict Trunk to Specific VLANs for a Server Farm
A server farm connected to a distribution switch only needs VLANs 10 (web servers) and 20 (database servers). Allowing all VLANs on the trunk wastes bandwidth and poses a security risk. This scenario restricts the trunk to only those VLANs.
Topology
Distribution-Switch(Gi0/1)---Trunk---(Gi0/1)Access-Switch
Access-Switch connects to servers in VLAN 10 and 20.Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enter interface configuration mode for the trunk port: interface gigabitEthernet 0/1
- 3.Step 3: Ensure the interface is in trunk mode: switchport mode trunk
- 4.Step 4: Restrict allowed VLANs to 10 and 20: switchport trunk allowed vlan 10,20
- 5.Step 5: Exit configuration mode: end
- 6.Step 6: Save the configuration: copy running-config startup-config
! interface GigabitEthernet0/1 switchport mode trunk switchport trunk allowed vlan 10,20 !
Verify: Use 'show interfaces trunk' to verify. Expected output shows the trunk port with allowed VLANs list: "Vlans allowed on trunk: 10,20"
Watch out: If the native VLAN (default VLAN 1) is not in the allowed list, management traffic may be disrupted. Ensure the native VLAN is included or change it with 'switchport trunk native vlan'.
Add a VLAN to an Existing Trunk Allowed List
A new department requires VLAN 30 to be extended across an existing trunk that currently only allows VLANs 10 and 20. Instead of reconfiguring the entire list, you can add VLAN 30 without affecting existing traffic.
Topology
Core-Switch(Gi0/1)---Trunk---(Gi0/1)Distribution-Switch
Distribution-Switch already has VLANs 10 and 20 allowed.Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enter interface configuration mode: interface gigabitEthernet 0/1
- 3.Step 3: Add VLAN 30 to the allowed list: switchport trunk allowed vlan add 30
- 4.Step 4: Exit and save: end; copy running-config startup-config
! interface GigabitEthernet0/1 switchport trunk allowed vlan add 30 !
Verify: Use 'show interfaces trunk' to verify. Expected output shows "Vlans allowed on trunk: 10,20,30"
Watch out: Using 'switchport trunk allowed vlan 30' without the 'add' keyword would replace the existing list with only VLAN 30, removing VLANs 10 and 20. Always use 'add' when you want to append.
Troubleshooting with This Command
When troubleshooting trunk link issues, the `switchport trunk allowed vlan` command is often the culprit for missing VLAN connectivity. Healthy output from `show interfaces trunk` shows the trunk port in the 'Trunking' mode, with a list of allowed VLANs that matches the intended design. Problem indicators include: the trunk port is not in trunking mode (e.g., 'dynamic desirable' or 'access'), the allowed VLAN list is empty (which means no VLANs are allowed, effectively blocking all traffic), or the allowed list does not include the VLAN in question.
Common symptoms this command helps diagnose include: hosts in a specific VLAN cannot communicate across the trunk, broadcast storms on a trunk (if too many VLANs are allowed), or security breaches (if unauthorized VLANs are allowed). A step-by-step diagnostic flow: 1) Verify trunk status with `show interfaces trunk`; look for the interface in question. 2) Check the 'Vlans allowed on trunk' field; if the desired VLAN is missing, the command needs adjustment. 3) Verify the native VLAN with `show interfaces trunk`; if the native VLAN is not in the allowed list, it may be pruned. 4) Check for VLAN existence with `show vlan brief`; the VLAN must exist in the VLAN database. 5) Use `show interface switchport` to confirm the interface is in trunk mode. 6) If the issue persists, check for mismatched native VLANs or trunk encapsulation (802.1Q vs ISL). Correlate with other commands: `show vlan` to see which VLANs are active, `show spanning-tree vlan <vlan>` to check if the trunk is blocking due to STP, and `debug trunk` (with caution) to see real-time trunk negotiation.
Remember that changes to the allowed VLAN list take effect immediately; if you accidentally remove the native VLAN, you may lose connectivity to the switch. Always have out-of-band access or a backup plan. Also, note that the `switchport trunk allowed vlan` command only affects tagged traffic; untagged traffic (native VLAN) is still forwarded if the native VLAN is in the allowed list.
If you need to block the native VLAN, you must either change the native VLAN to an unused VLAN or use ACLs.
CCNA Exam Tips
Remember that 'switchport trunk allowed vlan' without 'add' or 'remove' replaces the entire list; use 'add' to append.
The native VLAN is allowed by default; if you remove it, control traffic may be disrupted.
CCNA exam may test the difference between 'allowed vlan' and 'native vlan' commands.
Know that 'switchport trunk allowed vlan except 1-99' blocks VLANs 1-99 and allows all others.
Common Mistakes
Using 'switchport trunk allowed vlan' without 'add' or 'remove' accidentally removes all existing VLANs except those specified.
Forgetting to allow the native VLAN, causing DTP or CDP failures.
Applying the command to an access port instead of a trunk port, which has no effect.
switchport trunk allowed vlan [list] vs switchport mode trunk
These two commands are often used together but serve different purposes. `switchport mode trunk` enables trunking on an interface, while `switchport trunk allowed vlan [list]` restricts which VLANs are forwarded over that trunk. Understanding their distinct roles is crucial for proper VLAN traffic control.
| Aspect | switchport trunk allowed vlan [list] | switchport mode trunk |
|---|---|---|
| Scope | Controls allowed VLAN list on a trunk | Sets interface to trunk mode |
| Primary Function | Filters VLAN traffic on trunk | Enables 802.1Q tagging on interface |
| Default Behavior | Default allows all VLANs (1-4094) | Default mode is dynamic auto (not trunk) |
| Precedence/Ordering | Must be applied after interface is in trunk mode | Must be configured before allowed list is modified |
| Use Case | Used to prune specific VLANs from trunk | Used to establish a trunk link |
Use switchport trunk allowed vlan [list] when you need to restrict which VLANs traverse a trunk, for example, to limit broadcast domains or enforce security.
Use switchport mode trunk when you want to force an interface to become a trunk, overriding DTP negotiation.
Platform Notes
In IOS-XE (e.g., Catalyst 3650/3850/9300), the syntax is identical to classic IOS. However, the output of `show interfaces trunk` may include additional fields like 'Vlans in spanning tree forwarding state' and 'Vlans in spanning tree blocking state'. In NX-OS (e.g., Nexus 9000), the equivalent command is `switchport trunk allowed vlan <vlan-list>` under interface configuration, but note that NX-OS uses the 'switchport' command differently; trunk mode is set with `switchport mode trunk` and the allowed VLAN command is the same.
However, NX-OS also supports `switchport trunk allowed vlan add` and `remove` keywords. There is no direct ASA equivalent, as ASAs use subinterfaces for VLAN tagging. In IOS-XR, the concept of trunk ports is different; it uses 'dot1q tunneling' or 'subinterfaces' and does not have a direct `switchport trunk allowed vlan` command.
For IOS versions: in 12.x, the command is available and behaves the same as in 15.x and 16.x. However, in very old IOS (e.g., 12.0), the command might be `switchport trunk allowed vlan remove` or `add` but the syntax is consistent. One difference: in some IOS versions, the 'except' keyword is not supported; always verify with `?` in the CLI.
Also, on some platforms (e.g., Catalyst 2960), the command is available but may have limitations on the number of VLANs in the list. Always check platform documentation.
Related Commands
show interfaces trunk
Displays all trunk ports including the trunking encapsulation (802.1Q or ISL), the native VLAN, VLANs allowed on the trunk, VLANs in the spanning tree forwarding state, and VLANs active in the management domain.
switchport mode trunk
Configures a switch interface as a trunk port, allowing multiple VLANs to traverse the link using IEEE 802.1Q tagging.
switchport trunk native vlan [id]
Configures the native VLAN for an 802.1Q trunk interface, specifying which VLAN's frames are sent untagged on the trunk.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions