Timedora

2 Trunking and VLAN Transport

Learn how Ethernet trunks transport VLAN traffic with 802.1Q, how native and allowed VLAN settings affect connectivity, and how to configure and troubleshoot trunk links.

How trunks carry VLAN traffic

A carries traffic for multiple VLANs across one Ethernet link, such as a link between switches. This lets several logically separate Layer 2 networks share a physical connection while remaining associated with their respective VLANs.

Tags and untagged traffic

The standard inserts a tag into an Ethernet frame. The tag includes a , which identifies the frame’s VLAN, and priority information used for traffic handling. The receiving switch reads the tag and forwards the frame within the identified VLAN.

A trunk can also carry untagged frames. On Cisco switches, the VLAN assigned to untagged traffic is the , which is VLAN 1 by default. Typically, frames for the leave the trunk untagged, while frames for other VLANs are tagged.

Configure the same at both ends of a trunk. A mismatch can cause connectivity problems and may contribute to spanning-tree loops.

Control which VLANs cross

The controls which VLANs can use a trunk. Cisco trunks commonly allow all VLANs by default, but limiting the list to the VLANs needed on that link reduces unnecessary VLAN traffic.

An allowed list does not create a VLAN. The VLAN must also exist and be active on the switch for its traffic to be carried. For example, if a trunk allows VLANs 10, 20, and 30, traffic for VLAN 40 will not cross it—even if VLAN 40 exists on both switches. Omitting a VLAN that is needed across the trunk can cause devices to lose connectivity.

Configure a trunk

This Cisco IOS-style example configures a link to another switch. It sets the port to trunk mode, allows VLANs 10, 20, and 30, and assigns VLAN 99 to untagged traffic. Create VLANs 10, 20, 30, and 99 on the switch as needed, and configure matching trunk settings at the other end.

Commands can vary by switch platform: some platforms use different interface names or do not support every command shown. Some switches support only and do not require a separate encapsulation command. On platforms where trunk negotiation is not needed or supported, switchport nonegotiate can disable frames; configure the neighbor as a trunk as well.

Troubleshoot trunk connectivity

When a VLAN cannot communicate across a trunk, check the link in a consistent order:

  1. Confirm the physical link is up. Check interface status, cabling, and interface errors.

  2. Verify trunk operation. Use show interfaces trunk to see which interfaces are trunking and which VLANs are allowed and active. Use show interfaces interface-id switchport to inspect the port’s mode, , and allowed VLANs.

  3. Compare both ends. Ensure the interfaces are configured compatibly as trunks, the native VLANs match, and the required VLAN appears in both allowed lists.

  4. Check VLAN availability. Use show vlan brief to confirm the VLAN exists and is active. An allowed VLAN that is absent or inactive may not carry traffic as expected.

  5. Look for negotiation or configuration mismatches. A trunk that relies on may fail to form if the neighbor is configured differently or does not support . Configure both ends deliberately, and disable negotiation when appropriate.

Useful verification commands include: