VLAN Trunking

This page covers VLAN trunking concepts and practical configuration on Cisco switches (802.1Q).

A trunk link carries traffic for multiple VLANs between network devices (switch-to-switch, switch-to-router, or switch-to-server). Trunking tags frames so receiving devices can identify the VLAN.

• 802.1Q (dot1q): industry standard. Inserts a 4-byte tag with VLAN ID.
• ISL: legacy Cisco proprietary (rarely used).

Frames in the native VLAN are sent untagged on an 802.1Q trunk. By default the native VLAN is VLAN 1. Mismatched native VLANs between ends can cause traffic leaks and security issues.

• access: access port, single VLAN only
• trunk: forces trunking
• dynamic desirable: actively attempts to form a trunk (DTP)
• dynamic auto: passively waits for trunking request
• nonegotiate: disables DTP, requires the other side to be set to trunk or nonegotiate

Note: DTP is Cisco proprietary. Use trunk/nonegotiate on links to non-Cisco devices.

• By default a trunk carries all VLANs (1-4094). You can restrict allowed VLANs to limit broadcast domains across links:
  • switchport trunk allowed vlan add|remove|all|none|
• VTP pruning can dynamically prune VLANs not active on a segment to reduce unnecessary broadcast traffic (VTP domain required).

On switch1 interface connecting to switch2:

interface GigabitEthernet0/1 switchport trunk encapsulation dot1q switchport mode trunk switchport trunk native vlan 99 switchport trunk allowed vlan 10,20,30,99

On the other side (if non-Cisco or to disable DTP):

interface GigabitEthernet0/1 switchport trunk encapsulation dot1q switchport mode trunk switchport nonegotiate

• show interfaces trunk
• show interface GigabitEthernet0/1 switchport
• show vlan brief
• show running-config interface GigabitEthernet0/1

• Check native VLAN mismatch if untagged traffic appears in wrong VLAN.
• Verify allowed VLAN list—missing VLANs won’t pass across the trunk.
• Ensure encapsulation (dot1q) is supported/consistent on both ends.
• If using DTP, ensure both ends support/agree on dynamic modes; prefer static trunking for stability.
• Look for mismatched speed/duplex or port-channel issues if trunk flaps.

• Avoid using the default native VLAN 1 where possible; set a dedicated unused VLAN as native.
• Disable unused ports and set them to access VLANs that are inactive or put them in an isolated VLAN.
• Consider filtering allowed VLANs and using private VLANs or ACLs for additional separation.

• IEEE 802.1Q specification
• Cisco documentation for switchport trunking and DTP