A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Access ports belong to one VLAN. But when you have twenty VLANs and twenty switches, running a cable per VLAN is impossible. Trunks solve this: one physical link carries all VLANs, differentiated by a 4-byte tag inserted into the Ethernet header.
An 802.1Q-tagged frame inserts a 4-byte header between the source MAC and the EtherType field. The header contains a 12-bit VLAN ID (giving 4,094 usable VLANs), a 3-bit priority field, and other control bits.
Untagged Ethernet II frame:[ Dst MAC | Src MAC | EtherType | Payload | FCS ]802.1Q-tagged frame:[ Dst MAC | Src MAC | 0x8100 | TCI | EtherType | Payload | FCS ]↑ ↑TPID Tag Control Info- 3 bits: Priority (CoS)- 1 bit: DEI- 12 bits: VLAN ID
The TPID (Tag Protocol Identifier) value is `0x8100`, which is how a receiving switch knows the frame is tagged. Frames without this tag are assumed to be in the native VLAN.
Because tags are added and removed at trunk boundaries, a capture on an access port shows untagged frames — the tag never reaches the endpoint. Capture on the trunk and you'll see the tags.
Switch1(config)# interface gigabitEthernet0/24Switch1(config-if)# description Trunk-to-Switch2Switch1(config-if)# switchport trunk encapsulation dot1qSwitch1(config-if)# switchport mode trunkSwitch1(config-if)# switchport trunk native vlan 99Switch1(config-if)# switchport trunk allowed vlan 10,20,30Switch1(config-if)# no shutdown
Four config commands. `switchport trunk encapsulation dot1q` sets the tagging standard (necessary on older switches that supported ISL — modern ones default to dot1q). `switchport mode trunk` forces trunking. `switchport trunk native vlan 99` changes the untagged VLAN from the default 1 to 99. `switchport trunk allowed vlan` restricts which VLANs traverse the trunk — a security measure that prevents VLAN leakage.
Restricting allowed VLANs is best practice but can break connectivity when you forget. If you set `switchport trunk allowed vlan 10,20` and later add VLAN 30 on both ends, VLAN 30 won't pass until you add it to the allowed list. The symptom is baffling: both switches have VLAN 30 configured, but hosts can't communicate.
Three sections: which ports are trunking, what VLANs are allowed on each trunk, and which VLANs are actually forwarding. If the second section shows a VLAN but the third doesn't, spanning tree is blocking that VLAN on the trunk — often a loop issue.
Dynamic Trunking Protocol (DTP) is Cisco-proprietary. Ports configured `switchport mode dynamic auto` or `dynamic desirable` negotiate trunking automatically. `dynamic desirable` initiates negotiation; `dynamic auto` waits.
| Local mode | Peer: auto | Peer: desirable | Peer: trunk | Peer: access |
|---|---|---|---|---|
| dynamic auto | Access | Trunk | Trunk | Access |
| dynamic desirable | Trunk | Trunk | Trunk | Access |
| trunk (static) | Trunk | Trunk | Trunk | Limited |
| access (static) | Access | Access | Limited | Access |
DTP is convenient in lab settings and a security concern in production. An attacker can send DTP frames to negotiate a trunk on an access port and gain access to all VLANs. Best practice: `switchport nonegotiate` on all user-facing ports, and static trunk mode on real trunks.
Trunks are the backbone of any multi-VLAN network. Get the tagging model solid, restrict VLANs deliberately, and disable DTP where it doesn't belong.
Next lesson: native VLANs — the untagged VLAN on a trunk, and why it deserves special attention.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.