Core
Trunking (802.1Q)
Trunk links carry traffic for multiple VLANs between switches using 802.1Q tagging, with one VLAN typically left untagged as the native VLAN.
What you need to know
- 802.1Q inserts a 4-byte tag containing the VLAN ID into the Ethernet frame.
- The native VLAN is sent untagged across a trunk; default native VLAN is VLAN 1.
- A native VLAN mismatch between trunk ends causes CDP warnings and can leak traffic between VLANs.
- DTP negotiates trunking dynamically; disabling it with switchport nonegotiate is recommended on trunks.
- switchport trunk allowed vlan restricts which VLANs are permitted across the trunk.
- Trunk ports should be manually configured with switchport mode trunk on both ends in production/lab environments.
- ISL is a legacy Cisco proprietary trunking protocol, largely obsolete and not supported on newer switches.
Configuration commands
| Command | Mode | Purpose |
|---|---|---|
| interface gigabitethernet 0/1 | config | Enter interface configuration mode. |
| switchport trunk encapsulation dot1q | config-if | Set trunk encapsulation (required on switches supporting both ISL and dot1q). |
| switchport mode trunk | config-if | Force the port into trunking mode. |
| switchport trunk native vlan 99 | config-if | Change the native VLAN from the default VLAN 1. |
| switchport trunk allowed vlan 10,20,30 | config-if | Restrict the trunk to carry only the listed VLANs. |
| switchport trunk allowed vlan add 40 | config-if | Add VLAN 40 to the existing allowed list without replacing it. |
| switchport nonegotiate | config-if | Disable DTP frames on a manually configured trunk. |
Verify it
- show interfaces trunk
- show interfaces fa0/1 switchport
- show cdp neighbors detail
- show dtp interface fa0/1
Common mistakes
- Mismatched native VLANs on either end of the trunk.
- Forgetting switchport trunk encapsulation dot1q on platforms that require it before mode trunk.
- Leaving DTP enabled and getting an unexpected trunk or access negotiation result.
- Pruning the allowed VLAN list and accidentally removing the management VLAN.
- Assuming a trunk forms automatically without matching encapsulation on both sides.
Practise Trunking (802.1Q) in a real CLI
Generated labs, graded against the simulated network state.