Exam Trap: VLAN and Trunk Errors

A VLAN (Virtual Local Area Network) is a logical grouping of devices that behave as if they are on the same physical LAN segment, regardless of their physical location. VLANs provide segmentation, security, and broadcast containment. In a typical enterprise, you will see VLANs for users (e.g., VLAN 10), servers (VLAN 20), voice (VLAN 30), management (VLAN 99), and so on.

A trunk is a point-to-point link between two switches (or between a switch and a router) that carries traffic for multiple VLANs. Without a trunk, each VLAN would require a separate physical link — an expensive and unscalable solution. Trunks use a tagging protocol to identify which frame belongs to which VLAN. On Cisco switches, the default trunking protocol is 802.1Q (dot1q).

When a frame enters a switch port assigned to a specific access VLAN, the switch adds a 4-byte 802.1Q tag between the source MAC address and the EtherType/Length field. This tag contains:

The receiving switch strips the tag and forwards the frame to the appropriate access port. The entire process is transparent to end devices — they never see the tag.

The native VLAN is the VLAN that carries untagged traffic on a trunk. By default, Cisco switches use VLAN 1 as the native VLAN. The key rule: both ends of a trunk must have the same native VLAN. If they differ, the switch will not report an error, but control plane traffic (CDP, VTP, DTP, STP BPDUs) may be misdirected, and user traffic on the native VLAN can leak between VLANs — a serious security issue. On the exam, watch for questions where one switch has native VLAN 1 and the other has native VLAN 99 — traffic on VLAN 1 will be silently dropped or misdelivered.

By default, a trunk allows all VLANs (1-4094). However, it is common practice to prune unused VLANs for security and efficiency. The command switchport trunk allowed vlan restricts which VLANs can traverse the trunk. The trap: if you forget to add a new VLAN to the allowed list, traffic for that VLAN will be dropped at the trunk. No error, no log — just a black hole. On the exam, you might see a scenario where a new VLAN is created and assigned to access ports, but ping fails between hosts on that VLAN across a trunk. The solution is to add the VLAN to the allowed list.

Cisco switches use DTP to automatically negotiate trunking. The modes are: - dynamic desirable: Actively tries to form a trunk. - dynamic auto: Will form a trunk if the other side is trunk or dynamic desirable. - trunk: Puts the port into trunking unconditionally. - access: Puts the port into access mode (never trunks). - nonegotiate: Disables DTP frames; useful when connected to non-Cisco devices.

The exam trap: if one side is dynamic auto and the other is dynamic auto, the link will be an access port, not a trunk — because both are passive. Candidates often assume two auto ports will trunk, but they won't. Similarly, dynamic desirable + dynamic desirable works, as does trunk + any dynamic mode.

VLAN 1 is the default VLAN and the native VLAN by default. Many engineers leave VLAN 1 for management, but this is a security risk because VLAN 1 cannot be removed from a trunk (Cisco IOS prevents it). Attackers can potentially hop VLANs if the native VLAN is not changed. Best practice: change the native VLAN to an unused VLAN (e.g., 999) and prune VLAN 1 from trunks where possible.

Always verify trunk configuration with: - show interfaces trunk — shows trunk status, native VLAN, and allowed VLANs. - show interfaces gigabitethernet 0/1 switchport — detailed port mode and VLAN info. - show vlan brief — shows VLANs and their assigned access ports.

Example output:

Switch# show interfaces trunk
Port        Mode         Encapsulation  Status        Native vlan
Gi0/1       desirable    802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/1       1-1005

Port        Vlans allowed and active in management domain
Gi0/1       1,10,20,30

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       1,10,20,30

Notice: the native VLAN is 1. If the other side expects native VLAN 99, this is a mismatch.

STP runs per VLAN (PVST+ by default on Cisco). A trunk carries BPDUs for each VLAN. If the native VLAN mismatches, STP may not converge correctly, causing loops or blocked ports. Also, if a VLAN is not in the allowed list, STP will not run for that VLAN on that trunk, potentially causing loops if another trunk carries that VLAN.

In a typical enterprise campus network, you might have a distribution switch connected to multiple access switches via trunk links. The access switches serve hundreds of users across several VLANs (e.g., VLAN 10 for HR, VLAN 20 for Engineering, VLAN 30 for Guest Wi-Fi). The network engineer must ensure that only the necessary VLANs are allowed on each trunk to prevent unauthorized access and to conserve bandwidth. For example, the trunk to the HR access switch should only carry VLAN 10, not the Engineering or Guest VLANs. This is done using the switchport trunk allowed vlan 10 command. A common real-world mistake: after adding a new VLAN (e.g., VLAN 40 for IoT devices), the engineer forgets to update the allowed list on the trunk. IoT devices cannot communicate with the server on another floor, and hours are wasted troubleshooting. The fix is simple: add the VLAN to the allowed list.

Another scenario: two data center switches are connected via a trunk. The native VLAN is left as default (VLAN 1), but VLAN 1 is also used for management traffic. An attacker could potentially send frames tagged with VLAN 1 on the native VLAN and cause a VLAN hopping attack. Best practice: change the native VLAN to an unused ID (e.g., 999) and explicitly prune VLAN 1 from the trunk. In production, you might see switchport trunk native vlan 999 and switchport trunk allowed vlan remove 1.

Performance considerations: trunk links are typically high-speed (1G or 10G) and may carry traffic for many VLANs. The switch CPU must process BPDUs for each VLAN (PVST+), so having hundreds of VLANs on a trunk can increase CPU utilization. Cisco recommends using MST (Multiple Spanning Tree) to reduce BPDU overhead. Also, the allowed VLAN list should be as narrow as possible to reduce the number of STP instances.

Misconfiguration consequences: a native VLAN mismatch can cause asymmetric routing and security breaches. For example, if Switch A has native VLAN 1 and Switch B has native VLAN 99, then frames from VLAN 1 on Switch A are sent untagged, but Switch B expects them to be tagged with VLAN 99. Switch B will drop the untagged frames, but control traffic like CDP and STP BPDUs may be mishandled. In one real incident, a misconfigured native VLAN caused a spanning-tree loop that brought down an entire floor for 30 minutes.