Switch Port Modes: Access vs Trunk

Switch port modes define how a switch port handles VLAN tagging. VLANs (Virtual Local Area Networks) logically segment a physical network into multiple broadcast domains. Without VLANs, all devices on the same switch would share a single broadcast domain, leading to inefficiency and security risks. Port modes determine whether a port belongs to a single VLAN (access) or can carry traffic for multiple VLANs (trunk).

Access ports are used to connect end devices such as PCs, printers, and IP phones. They assume the connected device is unaware of VLAN tagging (i.e., it sends and receives untagged frames). The switch assigns the port a single VLAN ID (PVID) and strips any VLAN tag from outgoing frames, so the end device sees only untagged traffic. Incoming untagged frames are tagged with the PVID. This ensures simplicity for devices that do not support 802.1Q.

Trunk ports connect switches, routers, or servers that understand VLAN tagging. They carry traffic for multiple VLANs simultaneously, preserving VLAN tags across the link. Trunk ports use the IEEE 802.1Q standard, which inserts a 4-byte tag into the Ethernet frame header. The tag contains a 12-bit VLAN ID (0-4095, with 0 and 4095 reserved), allowing up to 4094 VLANs. Trunk ports also have a native VLAN concept: untagged frames received on a trunk are assigned to the native VLAN (default VLAN 1). The switch may also strip tags from frames belonging to the native VLAN before sending them out the trunk, depending on configuration.

Consider a switch with two access ports (port 1 in VLAN 10, port 2 in VLAN 20) and a trunk port (port 3) connecting to another switch.

Cisco IOS configuration:

Example output:

Switch# show interfaces gigabitethernet0/1 switchport
Name: Gi0/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 999 (Inactive)
Trunking VLANs Enabled: ALL

CompTIA Network+ N10-009 objective 2.1 requires you to "Explain the characteristics of network topologies and network types." Within that, you must understand VLANs and trunking. You will be asked to identify correct configurations, interpret show command output, and troubleshoot connectivity issues caused by port mode misconfigurations. Be prepared to calculate which VLANs are allowed on a trunk given a configuration snippet. Know the default native VLAN (1) and that it is a security risk.

In a typical enterprise campus network, access ports are deployed on edge switches connecting end-user devices. For example, a company with multiple departments (Sales, HR, Engineering) uses separate VLANs (10, 20, 30) for each department. Each user's desk port is configured as an access port in their respective VLAN. This ensures that Sales users cannot directly communicate with HR users unless routed through a firewall. The access port configuration is straightforward: switchport mode access and switchport access vlan 10. Often, network engineers use a VLAN management tool (e.g., Cisco ISE) to dynamically assign VLANs based on user authentication (802.1X). In that case, the port is set to dynamic access mode, but the underlying principle remains the same.

Trunk ports are used to interconnect switches, both in the wiring closet and between floors. For instance, a distribution switch connects to multiple access switches via trunk ports. Each trunk carries all department VLANs. To optimize performance, network engineers prune VLANs that are not needed on a particular access switch. For example, if an access switch only serves Sales users, the trunk to that switch should only allow VLAN 10. This reduces unnecessary broadcast traffic. The configuration would be: switchport mode trunk and switchport trunk allowed vlan 10. Additionally, the native VLAN is changed from default VLAN 1 to a dedicated management VLAN (e.g., VLAN 999) to prevent VLAN hopping attacks. This is a common security best practice.

A common issue arises when a new switch is added to the network and the trunk is misconfigured. For example, if the native VLAN on one side is 1 and on the other side is 999, STP may fail, causing loops or loss of connectivity. The symptoms include intermittent connectivity and BPDU guard errors. Troubleshooting involves checking show interfaces trunk on both ends and ensuring native VLANs match. Another scenario is when a trunk port is accidentally configured as an access port, causing all VLANs to be dropped except the access VLAN. This results in users in other VLANs losing connectivity. The fix is to reapply the trunk configuration.

In data center environments, trunk ports are also used for server connections that require multiple VLANs (e.g., a web server in VLAN 100 and a database server in VLAN 200). The server's NIC must support 802.1Q tagging. The switch port is configured as a trunk, and the server's OS is configured to use the appropriate VLAN tags. Performance considerations include ensuring the trunk link has sufficient bandwidth (e.g., 10 Gbps or 40 Gbps) to handle aggregated traffic from multiple VLANs. Misconfiguration here can lead to server isolation or security breaches if VLANs are not properly segregated.