Trunk port vs access port: what actually changes
An access port carries one VLAN and tags nothing. A trunk port carries many and tags each frame with its VLAN ID. Access ports face devices that know nothing about VLANs — PCs, printers. Trunk ports face devices that do — switches, routers, hypervisors.
That is the definition, and it is where most explanations stop. The parts that actually cost people time are the native VLAN, the fact that Cisco ports will negotiate themselves into trunks if you let them, and the voice VLAN case where a port stubbornly refuses to be either one thing or the other.
Side by side
| Property | Access port | Trunk port |
|---|---|---|
| VLANs carried | One | Many — by default all, restrict with switchport trunk allowed vlan |
| Frame tagging | None. Frames leave untagged | 802.1Q tag added, except on the native VLAN |
| Connects to | End devices — PCs, printers, APs, servers | Other switches, routers, hypervisors, some APs |
| Device awareness | The device has no idea a VLAN exists | The far end must understand 802.1Q |
| Native VLAN | Not applicable | Applies — carries untagged frames, must match both ends |
| Typical fault | Port in the wrong VLAN | Native VLAN mismatch, or allowed-list missing a VLAN |
The tag itself
802.1Q inserts four bytes into the Ethernet header — a tag protocol identifier and a field holding the 12-bit VLAN ID, which is why VLANs stop at 4094. The switch adds the tag as a frame leaves a trunk and strips it as the frame enters an access port. End devices therefore never see a tag, which is the point: you can VLAN-segment a network without reconfiguring a single PC.
Configuring both
| Mode | Set the mode | Then scope it |
|---|---|---|
| Access | switchport mode access | switchport access vlan 10 |
| Trunk | switchport mode trunk | switchport trunk allowed vlan 10,20,30 |
! User-facing port — pinned, and negotiation disabled
SW1(config)# interface range FastEthernet0/1 - 20
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 10
SW1(config-if-range)# switchport nonegotiate
SW1(config-if-range)# spanning-tree portfast
! Switch-to-switch uplink
SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20,30
SW1(config-if)# switchport trunk native vlan 999
SW1(config-if)# switchport nonegotiateWhy nonegotiate is not optional
Cisco ports run Dynamic Trunking Protocol by default, and DTP will happily form a trunk on your behalf. On a port left at dynamic auto or dynamic desirable, anyone who plugs in a laptop and sends DTP frames can turn that port into a trunk — and then read traffic from every VLAN on the switch. That is VLAN hopping, and it needs no exotic tooling.
Setting switchport mode access and switchport nonegotiate on every user port closes it. The habit is worth forming early: an access port that cannot be talked into becoming a trunk is one whole class of attack you never have to think about again.
The port that is both
An IP phone with a PC plugged into its back needs two VLANs on one cable — voice for the phone, data for the PC — without being a full trunk:
SW1(config)# interface FastEthernet0/5
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10 ← PC, untagged
SW1(config-if)# switchport voice vlan 20 ← phone, taggedCisco still calls this an access port. It is tagging some frames and not others, which is trunk behaviour, but it is restricted to exactly two VLANs and it is not negotiable — so it does not carry a trunk's risks. Exam questions like this distinction.
Checking what you actually got
SW1# show interfaces GigabitEthernet0/1 switchport
Name: Gi0/1
Administrative Mode: trunk ← what you configured
Operational Mode: trunk ← what it actually became
Administrative Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 999 (NATIVE-UNUSED)
Trunking VLANs Enabled: 10,20,30Administrative and operational mode disagreeing is the tell. A port configured dynamic desirable whose neighbour is an access port will show operational mode static access — configured one way, behaving another. show interfaces trunk lists only genuinely trunking ports, so absence from that output is itself the answer.
Frequently asked
What is the difference between a trunk port and an access port?
An access port belongs to exactly one VLAN and sends frames untagged, so the device plugged into it has no idea VLANs exist. A trunk port carries many VLANs over one link and adds an 802.1Q tag to each frame so the far end knows which VLAN it belongs to. Access ports face end devices such as PCs and printers; trunk ports face other switches, routers and hypervisors that understand tagging.
What is the native VLAN on a trunk?
The native VLAN is the one VLAN whose frames cross a trunk untagged, defaulting to VLAN 1. It exists for backward compatibility with devices that do not understand 802.1Q. The native VLAN must match on both ends of a trunk — a mismatch merges two broadcast domains without warning and CDP will log a complaint. Good practice is to set it to a dedicated unused VLAN so that no user traffic ever travels untagged.
Why is DTP a security risk?
Dynamic Trunking Protocol lets a port negotiate itself into a trunk automatically. On Cisco switches the default mode of dynamic auto or dynamic desirable means an attacker can plug a laptop into what looks like a user port, send DTP frames, form a trunk and immediately see traffic from every VLAN — an attack called VLAN hopping. The fix is to disable negotiation explicitly on user ports with switchport mode access and switchport nonegotiate, so the port cannot become a trunk regardless of what is sent to it.
Can a port be both an access port and a trunk port?
Not formally, but a voice VLAN produces something very close. A port configured with switchport access vlan 10 plus switchport voice vlan 20 carries VLAN 10 untagged for the PC and VLAN 20 tagged for the IP phone, over one cable, with the PC plugged into the back of the phone. Cisco calls this an access port with a voice VLAN rather than a trunk, and it is limited to those two VLANs, but the port really is tagging some frames and not others.
How do I check whether a port is trunking?
Use show interfaces trunk, which lists only ports that are actually trunking along with their native VLAN and allowed VLAN list — if a port you expected is missing from the output, it is not trunking. For a single port, show interfaces GigabitEthernet0/1 switchport gives the administrative mode you configured and the operational mode the port actually reached, which is the key distinction when DTP negotiation has not produced the result you expected.
Trunking is core CCNA Network Access material. Related: VLANs explained, router on a stick and inter-VLAN routing methods.