What Is Trunk port in Networking?
This page mentions older exam versions. See the Current Exam Context and Legacy Exam Context sections below for the updated mapping.
On This Page
Quick Definition
A trunk port is a special type of switch port that can carry data from many different networks, called VLANs, at the same time. Unlike a normal port that only handles one network, a trunk port adds a small label to each piece of data so the switch knows which network it belongs to. This allows a single cable to connect switches or a switch to a router and send traffic for many separate networks across that same cable.
Commonly Confused With
An access port belongs to a single VLAN and strips any existing VLAN tag before forwarding frames to the connected device. A trunk port carries multiple VLANs and preserves the 802.1Q tag, except for the native VLAN. Access ports are for end devices; trunk ports are for switch-to-switch or switch-to-router links.
A port connected to a user's PC is an access port assigned to VLAN 10. A port connecting SwitchA to SwitchB is a trunk port carrying VLANs 10, 20, and 30.
A hybrid port is a port that can be an access port for one VLAN and a trunk port for others simultaneously, depending on the configuration. This is more common on Huawei and some other vendor switches. On Cisco, such a port is simply a trunk port where the native VLAN is used for untagged traffic and other VLANs are tagged. The term 'hybrid' is not standard Cisco terminology for trunk ports.
On a Huawei switch, a hybrid port can be configured to allow VLAN 10 untagged (like an access port) and VLANs 20 and 30 tagged (like a trunk). On Cisco, the same function is achieved by setting the native VLAN to 10 and allowing tagged VLANs 20 and 30 on a trunk port.
A Layer 3 port is a switch port configured as a routed interface, meaning it behaves like a router interface with an IP address and no VLAN association. It does not use VLAN tags and is used for routing between subnets at Layer 3. A trunk port is a Layer 2 concept for carrying multiple VLANs. A trunk port does not have an IP address, whereas a routed port does.
A port connecting a switch to a router for inter-VLAN routing could be a trunk port (carrying all VLANs to the router), or it could be a Layer 3 port on a Layer 3 switch that directly routes without needing a separate router.
Dot1q tunneling, often called Q-in-Q, is used in service provider networks to add an outer VLAN tag to already-tagged frames from a customer network. This allows the service provider to carry multiple customer VLANs across their backbone without modifying the customer's internal tags. A trunk port normally adds only a single tag, while a dot1q tunnel port adds a second tag for service provider identification.
A customer sends a frame tagged with VLAN 100 on their trunk. At the service provider edge switch, a dot1q tunnel port adds an outer tag of VLAN 200 before sending it across the provider network. Regular trunk ports only handle single-tagged frames.
Must Know for Exams
Trunk ports are a core concept in networking certifications, especially for Cisco CCNA, CompTIA Network+, and Juniper JNCIA. In the CCNA exam (200-301), trunk ports fall under the 'Network Access' domain, which covers VLANs, trunking, and STP. You are expected to know how to configure a trunk port, understand the difference between access and trunk ports, know the 802.1Q tagging process, and troubleshoot common trunk issues like native VLAN mismatch. CCNA questions often present a scenario where a switch is not communicating with another switch, and you must identify that the trunk is down or misconfigured.
In CompTIA Network+ (N10-008 or later), trunk ports appear in the 'Networking Concepts' and 'Network Operations' domains. You need to understand when to use a trunk port versus an access port, the purpose of VLAN tagging, and the implications of native VLAN. CompTIA focuses less on command-line configuration and more on conceptual understanding and troubleshooting in a multi-vendor environment. You might be asked to choose which type of port to use in a given diagram or scenario.
For Juniper JNCIA-Junos, trunk ports are configured using the 'port-mode trunk' statement under an interface. Juniper treats VLANs as logical interfaces (units), and the concept of a native VLAN is handled differently. Exams may test your ability to configure a trunk interface and understand the difference between 'access' and 'trunk' port modes.
Questions can take several forms: scenario-based multiple choice where you must select the correct port type, configuration questions where you must identify the correct commands or parameters, and troubleshooting questions where you analyze output from 'show interfaces trunk' or 'show vlan' to find the problem. Common traps include confusing trunk and access port configuration, forgetting to allow the necessary VLANs on the trunk, and ignoring native VLAN mismatch issues. Also, exam writers love to test whether you know that DTP is a security risk. A classic question: 'Which protocol should be disabled on trunk ports to prevent VLAN hopping?' The answer is DTP. Knowing these details can earn you easy points on the exam.
Overall, trunk ports are a 'must-know' topic at the intermediate level. Even in higher-level exams like CCNP ENCOR, trunk port concepts are foundational for understanding advanced features like Private VLANs, STP, and Multilayer Switching. Mastering trunk ports ensures you can move on to more complex switching topics.
Simple Meaning
Think of a trunk port like a highway toll road with multiple lanes, each lane for a different type of vehicle. A normal port on a switch is like a single driveway that only leads to one house, meaning it can only carry traffic from one VLAN. A trunk port, on the other hand, is like a multi-lane highway that can carry cars, trucks, and buses all at the same time, with each vehicle being tagged with an electronic pass that tells the toll booth which lane it belongs to. In networking, that pass is called a VLAN tag, and the protocol that adds it is usually 802.1Q.
When data travels across a trunk port, the switch adds a small 4-byte tag inside the Ethernet frame. This tag contains a VLAN ID number, which is a number between 1 and 4094 that identifies which virtual network the data belongs to. The switch on the other end reads that tag and forwards the data to the correct VLAN. Without trunk ports, you would need a separate physical cable for each VLAN between switches, which would be messy and expensive.
Trunk ports are most commonly used to connect two switches together (switch-to-switch trunk) or to connect a switch to a router that performs routing between VLANs (router-on-a-stick). They are also used to connect switches to servers that host multiple virtual machines, each on a different VLAN. The key point is that a trunk port does not belong to any one VLAN by itself; it is a member of all VLANs by default, unless you manually restrict which VLANs are allowed on that trunk.
Full Technical Definition
A trunk port is a switch port configured to carry frames from multiple VLANs simultaneously, typically using IEEE 802.1Q VLAN tagging. In contrast to an access port, which is assigned to a single VLAN and strips any existing VLAN tag before forwarding the frame to the end device, a trunk port preserves the VLAN tag across the link. This allows multiple broadcast domains to share a single physical link between network devices.
The IEEE 802.1Q standard defines the tagging mechanism. When a frame is forwarded out of a trunk port, the switch inserts a 4-byte VLAN tag into the Ethernet frame header, placing it between the source MAC address and the EtherType/Length field. The tag consists of a Tag Protocol Identifier (TPID) set to 0x8100, indicating an 802.1Q frame, and a Tag Control Information (TCI) field. The TCI contains a 3-bit Priority Code Point (PCP) for Class of Service, a 1-bit Drop Eligible Indicator (DEI), and a 12-bit VLAN ID (VID). The VID supports up to 4094 unique VLANs because VLAN IDs 0 and 4095 are reserved.
Cisco switches historically used a proprietary protocol called Inter-Switch Link (ISL) for trunking, but 802.1Q is now the industry standard and ISL is deprecated. On Cisco switches, a trunk port is configured using the 'switchport mode trunk' interface command. Optionally, you can specify which VLANs are allowed on the trunk with 'switchport trunk allowed vlan' to prune unnecessary traffic. The native VLAN concept is important on 802.1Q trunks: frames from the native VLAN (default VLAN 1 on Cisco) are sent untagged, meaning no 802.1Q header is added. This ensures compatibility with devices that do not understand VLAN tagging, such as older network equipment or dumb hubs.
Dynamic Trunking Protocol (DTP) is a Cisco proprietary protocol that can automatically negotiate trunking between two switch ports. DTP frames are exchanged to decide whether the link should become an access or trunk port. However, from a security perspective, DTP is often disabled to prevent trunk hijacking attacks, where an attacker could force a trunk link and gain access to all VLANs. Best practice is to set trunk ports to 'switchport mode trunk' and 'switchport nonegotiate' to disable DTP.
A trunk port also participates in VLAN pruning. The VLAN Trunking Protocol (VTP) can be used to propagate VLAN information across the network, but VTP has significant risks and is often disabled in production environments. Instead, manual VLAN configuration on each switch is recommended for security and reliability. Trunk ports can carry all VLANs or a subset, and a common configuration is to allow only the required VLANs to reduce unnecessary broadcast traffic and limit the attack surface.
Real-Life Example
Imagine a large apartment building where each floor is a separate community with its own common area, rules, and security. The building has a single elevator that serves every floor. This elevator is like a trunk port. A regular door to a specific apartment is like an access port: it only allows entry to that one apartment and its specific VLAN. But the elevator can go to any floor, so it needs a way to know which floor each passenger wants. When a person enters the elevator and presses button number 5, that is like the elevator adding a digital tag that says 'floor 5'. The elevator control system reads that tag and takes the person to the correct floor.
In this analogy, the building is your network, each floor is a different VLAN, and the elevator is the trunk link between switches. Without the elevator (trunk port), you would need a separate staircase or ladder (physical cable) for each floor, which would be impractical and take up a lot of space. The elevator efficiently uses the same shaft (one cable) to serve all floors. The buttons in the elevator are the VLAN tags that ensure people (data frames) arrive at the right destination.
There is also a 'service elevator' that goes only to a specific maintenance floor. That service elevator is like the native VLAN on a trunk: it is the only traffic that does not get a tag because it is always going to the same default floor. If someone presses the button for floor 1, and floor 1 is the native VLAN, the elevator might not need to display a digital ticket because everyone automatically knows it is floor 1. This can cause confusion if the native VLAN is not the same on both switches, leading to VLAN mismatch issues, just like two elevator systems not agreeing on which floor is floor 1.
Why This Term Matters
Trunk ports are essential for any network that uses VLANs to segment traffic, which is practically all enterprise networks today. Without trunk ports, you would need a separate physical cable between switches for every single VLAN in your network. If you had 50 VLANs, you would need 50 cables between two switches. That is expensive, messy, and impossible to manage in a data center. Trunk ports solve this by allowing all VLAN traffic to share a single cable or a bundled group of cables (EtherChannel). This reduces cabling costs and simplifies network design.
From a practical IT perspective, trunk ports directly enable key networking features like inter-VLAN routing. In a router-on-a-stick configuration, a single router interface is configured as a trunk port to receive traffic from all VLANs, route between them, and send the traffic back out tagged appropriately. This is commonly used in small to medium businesses to provide routing between departments without buying expensive Layer 3 switches. Trunk ports also allow virtualization hosts, such as VMware ESXi or Hyper-V, to connect to multiple VLANs using a single physical NIC, which is critical for server virtualization and cloud computing.
Security is another major reason trunk ports matter. A misconfigured trunk port can accidentally expose all VLANs to an attacker or a misconfigured device. Understanding how to properly configure allowed VLAN lists, disable DTP, and manage the native VLAN is crucial for network security. The famous 'VLAN hopping' attack exploits default trunk port configurations, especially DTP, to gain unauthorized access to other VLANs. Therefore, security professionals must know how to harden trunk ports. In exams like CCNA, CompTIA Network+, and similar, trunk port configuration and troubleshooting are common practical topics that test your understanding of VLANs and inter-switch communication.
How It Appears in Exam Questions
Questions about trunk ports in IT certification exams typically fall into three categories: scenario-based, configuration, and troubleshooting.
Scenario-based questions describe a network design and ask which port type should be used. For example: 'A network administrator needs to connect two switches and allow traffic from VLANs 10, 20, and 30 to pass between them. Which port type should be configured on each switch?' The correct answer is a trunk port. Sometimes the scenario adds a twist, such as 'The link between switches must also carry untagged traffic for VLAN 1' which hints at the native VLAN concept. Another classic scenario: 'A server with a single NIC needs to communicate with multiple VLANs. How should the switch port be configured?' The answer is a trunk port, possibly with specific allowed VLANs.
Configuration questions ask you to identify the correct commands or settings. For instance: 'Which command configures a Cisco switch port as a trunk port?' The answer: 'switchport mode trunk'. Or: 'Which command restricts a trunk to only VLANs 10 and 20?' Answer: 'switchport trunk allowed vlan 10,20'. These questions may also present output from 'show running-config' and ask you to identify why a trunk is not working. For example, if you see 'switchport mode access' on an interface that connects to another switch, that is a mistake.
Troubleshooting questions are common and often involve a mismatch. The classic scenario: Two switches are connected, but hosts on different VLANs cannot communicate across the link. You are given output from 'show interfaces trunk' on one switch which shows 'Trunking Mode: On' and 'Native VLAN: 1', while the other shows 'Native VLAN: 2'. This is a native VLAN mismatch. Another scenario: the 'show interfaces trunk' output shows no VLANs allowed on the trunk, or the trunk port status is 'not-trunking' because of a DTP negotiation failure. You might also see a scenario where a trunk port is up/up but no traffic passes because the allowed VLAN list does not include the required VLANs.
Some advanced questions may involve Layer 2 security, such as configuring a port to be a trunk but with a limited number of allowed VLANs to prevent VLAN hopping. Or they may ask about the impact of setting a trunk port to 'switchport nonegotiate' without explicitly setting it to 'switchport mode trunk'. The exam expects a deep understanding of the interplay between port modes, DTP, and the native VLAN.
Practise Trunk port Questions
Test your understanding with exam-style practice questions.
Example Scenario
A small company has two departments: Sales (VLAN 10) and Engineering (VLAN 20). They have two switches: SwitchA in the Sales office and SwitchB in the Engineering office. Each switch needs to allow Sales and Engineering users to communicate within their own departments, but because the departments are in different physical locations, the two switches must be connected by a single cable.
If you configure the ports connecting the switches as access ports, you would need to choose only one VLAN for each port. For instance, if you set the port on SwitchA as an access port in VLAN 10, then only Sales traffic can cross to SwitchB. Engineering traffic from SwitchA would never reach SwitchB because its access port is only for VLAN 10. The only way to make both VLANs work would be to run two separate cables between the switches: one for VLAN 10 and one for VLAN 20. That is wasteful and messy.
Instead, you configure the ports on both switches as trunk ports. You set 'switchport mode trunk' on the connected interfaces. Now, both VLANs can travel over the single cable. When the switches send frames, they add a tag to each frame: frames from Sales get a tag with VLAN ID 10, and frames from Engineering get a tag with VLAN ID 20. The receiving switch reads the tag and forwards the frame only to ports that belong to that VLAN. This way, both departments can communicate across the single link without crossing into each other's traffic.
you decide to restrict the trunk to only carry VLANs 10 and 20, because you have other VLANs (like VoIP) that should not go across this link. You use the command 'switchport trunk allowed vlan 10,20' on both sides to prune unnecessary traffic. This reduces broadcast traffic and improves security. Also, you set the native VLAN to something other than VLAN 1, like VLAN 999, and ensure it is the same on both switches. This prevents any untagged traffic from accidentally being interpreted as VLAN 1 traffic, which is a common security hole. The network now works efficiently and securely.
Common Mistakes
Configuring a port as 'switchport mode trunk' but forgetting to set the allowed VLAN list, so all VLANs are allowed by default.
Allowing all VLANs on a trunk can cause unnecessary broadcast traffic from VLANs that do not need to cross the link. It also creates a security risk: if a device is accidentally connected to the trunk, it could access all VLANs.
Always configure 'switchport trunk allowed vlan' to explicitly list only the VLANs that need to pass over the trunk. For security, prune unused VLANs.
Setting the native VLAN on one switch to a different value than on the neighboring switch.
A native VLAN mismatch causes frames from the native VLAN to be received on the wrong VLAN, leading to connectivity issues and possible spanning-tree problems, such as a port being err-disabled.
Ensure that the native VLAN is identical on both ends of the trunk. Use 'switchport trunk native vlan <vlan-id>' to set it, and verify with 'show interfaces trunk'.
Plugging an end device like a PC or printer into a port configured as a trunk.
End devices do not understand VLAN tagging (802.1Q). They will receive tagged frames and drop them as malformed, or they may cause network loops if they forward them. The device will not be able to communicate properly.
Trunk ports should only be used to connect switches, routers, or virtualization hosts that support VLAN tagging. For end devices, use an access port and assign it to a single VLAN.
Leaving Dynamic Trunking Protocol (DTP) enabled on trunk ports.
DTP can allow an attacker to negotiate a trunk to a switch port, gaining access to all VLANs. This is a well-known VLAN hopping attack. DTP can cause unexpected trunk negotiation failures if the neighbor device does not support it.
Disable DTP on trunk ports with the 'switchport nonegotiate' command. Set the port mode explicitly to 'switchport mode trunk' so it will always be a trunk regardless of DTP.
Thinking that a trunk port can only carry tagged traffic for the native VLAN.
Incorrect. The native VLAN is the only VLAN that sends frames untagged on a trunk. All other VLANs are tagged with their VLAN ID. This is according to the 802.1Q standard. Some learners think the native VLAN is not carried at all, which is wrong.
Remember that the native VLAN is still part of the trunk, but its frames are sent without a tag. It is a default VLAN for untagged traffic, not a missing VLAN.
Configuring trunk ports with too many allowed VLANs and exceeding STP limitations.
Spanning Tree Protocol (STP) runs separately for each VLAN when using Per-VLAN Spanning Tree (PVST). A trunk carrying many VLANs can cause high CPU usage on the switch and increase convergence time. It also amplifies the impact of a spanning-tree topology change.
Only allow the necessary VLANs on the trunk. For very large numbers of VLANs, consider using Multiple Spanning Tree Protocol (MSTP) to reduce STP instances.
Exam Trap — Don't Get Fooled
{"trap":"Configuring a trunk port with 'switchport mode dynamic desirable' and expecting it to always form a trunk with any neighbor.","why_learners_choose_it":"Learners see 'dynamic desirable' and think it means 'always become a trunk'. They may have memorized that DTP modes exist but not their exact behavior.
The term 'desirable' sounds like it will actively try to form a trunk.","how_to_avoid_it":"Understand DTP negotiation: 'dynamic desirable' will actively ask the neighbor to become a trunk, but if the neighbor is set to 'dynamic auto' or 'access', it will not form a trunk. Only 'dynamic desirable' and 'trunk' (on) will actively try to form a trunk.
The safest way to ensure trunking is to use 'switchport mode trunk' and disable DTP with 'switchport nonegotiate'. In exams, always favor explicit configuration over dynamic negotiation for security."
Step-by-Step Breakdown
Configure the switch port as a trunk
Use the command 'switchport mode trunk' on the interface. This forces the port to become a trunk regardless of DTP negotiation. On some platforms, you may also need to specify 'switchport trunk encapsulation dot1q' if the switch supports both ISL and 802.1Q. This step is essential because it tells the switch to treat the port as a trunk that can carry multiple VLANs.
Disable Dynamic Trunking Protocol (DTP)
Apply 'switchport nonegotiate' on the interface. This prevents the port from sending DTP frames. It stops potential attackers from forcing a trunk link and also avoids negotiation conflicts with devices that do not support DTP. For security and reliability, it is best practice to disable DTP on all trunk ports.
Specify the allowed VLANs
Use 'switchport trunk allowed vlan <vlan-list>' to restrict which VLANs are permitted on the trunk. By default, all VLANs (1-4094) are allowed. Reducing this list improves security and reduces unnecessary broadcast and multicast traffic. For example, if you only want VLANs 10, 20, and 30, you would set 'switchport trunk allowed vlan 10,20,30'. This step is crucial for security and performance.
Configure the native VLAN
Use 'switchport trunk native vlan <vlan-id>' to set the native VLAN. The native VLAN is the only VLAN that sends frames untagged on the trunk. It is important to set the same native VLAN on both ends of the trunk. A common best practice is to use a dedicated, unused VLAN (e.g., VLAN 999) as the native VLAN instead of VLAN 1, to improve security and avoid mismatch issues.
Verify the trunk configuration
Use 'show interfaces trunk' and 'show interfaces <interface> switchport' to verify that the trunk is operational. Check that the port mode is 'trunk', the allowed VLAN list is correct, and the native VLAN matches on both sides. Also, ensure the trunk is 'up/up' on the line protocol. This step confirms that all previous configurations are applied correctly and the trunk is functioning as expected.
Test connectivity across the trunk
Ping between devices in different VLANs that should communicate across the trunk (if inter-VLAN routing is configured) or verify that devices within the same VLAN can communicate across switches. If there is a problem, check for native VLAN mismatch, STP blocking, or incorrect allowed VLAN list. This step validates that the trunk is actually forwarding traffic for the intended VLANs.
Practical Mini-Lesson
In a real-world network environment, configuring a trunk port goes far beyond just typing 'switchport mode trunk'. Network professionals need to consider several practical aspects to ensure a stable, secure, and efficient operation.
First, the encapsulation type must match between switches. On older Cisco switches that support both ISL and 802.1Q, you must explicitly set the encapsulation to 'dot1q' using 'switchport trunk encapsulation dot1q' before setting the mode to trunk. If the encapsulation is not set, the port might default to ISL, causing a mismatch with the neighbor switch that uses 802.1Q. Modern switches typically only support 802.1Q, so this step is often automatic.
Second, the native VLAN is a frequent source of trouble. In production networks, it is highly recommended to change the native VLAN from VLAN 1 to a non-default, unused VLAN. This is because VLAN 1 is the default for management traffic, CDP, VTP, and DTP. If an attacker can inject untagged traffic onto a trunk, that traffic will be placed in VLAN 1 by default, giving access to management VLAN resources. By moving the native VLAN to an unused VLAN, you create a 'dead-end' for untagged traffic, making it much harder for an attacker to use VLAN hopping via native VLAN. Ensure the native VLAN is never allowed to be manually configured on an access port, as that can cause loops.
Third, trunk ports are often bundled using EtherChannel (Link Aggregation Group, LAG) to increase bandwidth and provide redundancy. When configuring an EtherChannel, the trunk properties must be consistent across all member ports: same allowed VLAN list, same native VLAN, same mode (trunk or access), and same STP settings. If there is any inconsistency, the EtherChannel will not form. The command 'channel-group <number> mode active' enables LACP for dynamic negotiation, or 'on' for static. After forming the EtherChannel, trunk configuration is applied to the Port-Channel interface, not to individual ports.
Fourth, consider STP convergence. Trunk ports can be part of a spanning-tree topology. If a switch has many VLANs, each VLAN runs its own instance of STP (in PVST). A trunk failure or link flap can trigger STP recalculations for every VLAN, causing temporary connectivity loss. Using Rapid PVST (RSTP) or MSTP reduces convergence time. Also, configure PortFast only on access ports, never on trunk ports, because PortFast disables STP and can cause loops on a trunk.
Finally, documentation is critical. Record which VLANs are allowed on each trunk, the native VLAN used, and the reason for any pruning. This makes troubleshooting faster. Use 'show interfaces trunk' and 'show vlan' regularly to audit trunk status. In a datacenter environment, automated tools like Ansible can be used to push trunk configurations consistently across many switches.
A common real-world issue: a trunk port shows 'err-disabled' due to STP misconfiguration or native VLAN mismatch. The fix is to find the root cause, correct it, and then bring the interface up with 'shutdown' followed by 'no shutdown'. Always check the logs with 'show logging' for details on why the port went down.
practical trunk port management is about consistency, security, and awareness of Layer 2 protocols. It is not a set-and-forget configuration; it requires ongoing monitoring and maintenance.
Memory Tip
Remember: 'Trunk carries tags; Access strips tags.' Trunk ports mark traffic with a VLAN ID label, while access ports strip the label and only speak one VLAN language.
Covered in These Exams
Current Exam Context
Current exam versions that test this topic — use these objectives when studying.
200-301Cisco CCNA →N10-009CompTIA Network+ →Legacy Exam Context
Older materials may mention these exam versions, but learners should use the current objectives for their target exam.
N10-008N10-009(current version)Related Glossary Terms
802.1Q is the networking standard that allows multiple virtual LANs (VLANs) to share a single physical network link by tagging Ethernet frames with VLAN identification information.
AAA (Authentication, Authorization, and Accounting) is a security framework that controls who can access a network, what they are allowed to do, and tracks what they did.
A/B testing is a controlled experiment that compares two versions of a single variable to determine which one performs better against a predefined metric.
Frequently Asked Questions
Can a trunk port connect to a normal PC?
No, because a normal PC's network card does not understand 802.1Q VLAN tags. The PC would drop tagged frames or misinterpret them. Trunk ports should only connect to network devices that support tagging, such as switches, routers, or virtualized servers with hypervisors.
What is the native VLAN on a trunk port?
The native VLAN is the VLAN that is carried without an 802.1Q tag on a trunk. By default on Cisco switches, it is VLAN 1. It is used for control protocols like CDP and DTP. Best practice is to change it to an unused VLAN to improve security.
Do I need to configure the same native VLAN on both ends of a trunk?
Yes. If the native VLAN is different on each end, it is called a native VLAN mismatch, which can cause connectivity issues and STP problems. Always ensure the native VLAN ID is identical on both switches.
What happens if I set a trunk port to 'switchport mode access'?
The port will become an access port and will only belong to the VLAN configured with 'switchport access vlan'. It will no longer carry multiple VLANs. If it is connected to another switch, the link will likely not work as expected, and may cause a STP loop or loss of connectivity for VLANs.
Is DTP dangerous?
Yes, DTP can be a security risk because it allows an attacker to negotiate a trunk with a switch port, potentially gaining access to all VLANs. It is recommended to disable DTP on all trunk ports with 'switchport nonegotiate'.
Can a trunk port carry VLAN 1?
Yes, by default VLAN 1 is allowed on all trunks. However, for security reasons, it is often recommended to remove VLAN 1 from the allowed list and use a different VLAN as the native VLAN. But be careful: removing VLAN 1 from the allowed list can break some protocols that depend on VLAN 1, such as VTP if it is still used.
How do I know if a trunk port is working?
Use the command 'show interfaces trunk' on a Cisco switch. This will show you which interfaces are trunking, their mode, the allowed VLANs, and the native VLAN. Also, 'show interfaces <interface> switchport' provides detailed port information.
Summary
A trunk port is a switch port that can carry traffic from multiple VLANs simultaneously by adding an 802.1Q VLAN tag to each frame. This technology is fundamental to modern networking because it allows multiple logical networks to share a single physical link between switches, routers, and virtualization hosts. Understanding trunk ports is essential for configuring VLANs, inter-VLAN routing, and ensuring network security.
The key aspects to remember are: trunk ports use VLAN tagging (usually 802.1Q), they have a native VLAN that sends frames untagged, and the allowed VLAN list should be pruned for security and performance. Common mistakes include native VLAN mismatch, leaving DTP enabled, and forgetting to restrict allowed VLANs. In certification exams like CCNA and Network+, you must be able to configure a trunk, interpret 'show' commands to troubleshoot, and identify security best practices.
From an exam perspective, trunk ports are a high-probability topic. You will see scenario questions asking you to choose between trunk and access ports, configuration questions with Cisco CLI commands, and troubleshooting questions involving native VLAN mismatch or DTP issues. The takeaway is simple: know the command syntax, understand the role of the native VLAN, and always disable DTP for security. With these fundamentals, you are well prepared for any trunk port question.
In practice, trunk ports are the backbone of VLAN segmentation. They are used in enterprise campus networks, data center topologies, and even home lab environments. Mastering trunk ports sets the foundation for more advanced topics like EtherChannel, STP, and VTP. It is a concept that will serve you well throughout your IT career.