802.1Q Trunking Configuration

802.1Q is the IEEE standard for VLAN tagging on Ethernet networks. A trunk link is a point-to-point link between two switches (or a switch and a router) that carries traffic for multiple VLANs. Without trunking, each VLAN would require a separate physical link, which is impractical. 802.1Q solves this by inserting a 4-byte tag into the Ethernet frame header, identifying the VLAN to which the frame belongs.

In a switched network, VLANs logically segment broadcast domains. Hosts in different VLANs cannot communicate directly without a Layer 3 device (router or Layer 3 switch). However, traffic from multiple VLANs often needs to traverse the same physical cable between switches. Trunking allows that single cable to carry frames from many VLANs simultaneously, each tagged with its VLAN ID. This reduces cabling costs and simplifies network design.

When a switch forwards a frame from a host in VLAN 10 to another switch via a trunk port, it inserts a 4-byte tag between the source MAC address and the EtherType/Length field. The tag contains: - Tag Protocol Identifier (TPID): 2 bytes, fixed value 0x8100, indicating the frame is 802.1Q-tagged. - Tag Control Information (TCI): 2 bytes, further divided into: - Priority Code Point (PCP): 3 bits for Class of Service (0–7). - Drop Eligible Indicator (DEI): 1 bit for congestion management. - VLAN ID (VID): 12 bits, identifying the VLAN (0–4095). VLANs 0 and 4095 are reserved; usable VLANs are 1–4094.

After insertion, the switch recalculates the Frame Check Sequence (FCS). The receiving switch strips the tag and forwards the frame to the appropriate VLAN.

The native VLAN is a special VLAN on a trunk port. Frames belonging to the native VLAN are sent untagged over the trunk. Both ends of the trunk must agree on the native VLAN ID; otherwise, frames will be misclassified. By default, Cisco switches use VLAN 1 as the native VLAN. The exam tests that mismatched native VLANs cause connectivity issues and potential security risks (VLAN hopping).

A trunk port can be configured to allow only specific VLANs. By default, all VLANs (1–4094) are allowed. Restricting allowed VLANs improves security and reduces unnecessary broadcast traffic. The command switchport trunk allowed vlan controls this.

DTP is a Cisco proprietary protocol that negotiates trunking between two switches. It can set a port to dynamic desirable, dynamic auto, trunk, or access mode. DTP is not covered in depth on N10-009, but you should know that it exists and that relying on DTP can cause trunking failures if mismatched. For exam purposes, assume manually configured trunks (no DTP) are best practice.

To configure a trunk port on a Cisco switch:

Switch(config)# interface gigabitethernet0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# switchport trunk allowed vlan 10,20,30

To verify trunk configuration:

Switch# show interfaces trunk
Switch# show interfaces gigabitethernet0/1 switchport

show interfaces trunk displays all trunk ports, their mode, encapsulation, native VLAN, and allowed VLAN list. show interfaces switchport shows detailed port information including administrative and operational mode.

Adding a 4-byte tag increases the frame size beyond the standard 1518 bytes to 1522 bytes. Most modern switches and NICs support jumbo frames, but older equipment may drop tagged frames. This is rarely an issue in modern networks.

1. Campus Network with Multiple Access Switches

A university campus has 50 access switches distributed across buildings, each connecting to a distribution switch in the main data center. Each access switch supports multiple VLANs for faculty, students, and guests. The uplink from each access switch to the distribution switch is a trunk carrying 5–10 VLANs. The native VLAN is set to 999 (unused) to prevent VLAN hopping. Allowed VLAN lists are restricted per switch to only the VLANs needed in that building. Misconfiguration here (e.g., forgetting to allow a VLAN on one side) causes complete loss of connectivity for that VLAN in that building.

2. Data Center with Virtual Servers

A data center uses trunk ports to connect hypervisors to top-of-rack switches. Each hypervisor runs multiple virtual machines in different VLANs. The trunk must carry all relevant VLANs (often 50+). The native VLAN is set to a dedicated management VLAN (e.g., VLAN 5) that carries untagged traffic for hypervisor management interfaces. Performance considerations: trunk links often use Link Aggregation (LACP) to combine multiple physical links into one logical trunk, increasing bandwidth and redundancy.

3. Router-on-a-Stick for Inter-VLAN Routing

A small business uses a single router with a trunk link to a switch. The router has subinterfaces (e.g., Gi0/0.10, Gi0/0.20) each configured with encapsulation dot1Q 10 and an IP address in the respective VLAN. The switch port connected to the router is configured as a trunk. A common mistake is forgetting to enable encapsulation dot1Q on the router subinterface, causing the router to drop tagged frames.

What Goes Wrong When Misconfigured?

In production, always configure both ends manually, use a dedicated native VLAN, and restrict allowed VLANs. Document all trunk configurations and verify with show interfaces trunk after changes.