Can someone explain trunk vs access port simply?
I'm studying VLANs and I understand what a VLAN is, but the difference between trunk and access ports confuses me. When do I use each one? And what's this native VLAN thing? Why does it matter? A plain English explanation would be amazing.
- Access port = one VLAN, untagged frames. Trunk port = carries multiple VLANs using 802.1Q tags in the frame header. Use trunk between switches (so VLAN 10 traffic from switch A reaches VLAN 10 on switch B). Use access ports for end devices like PCs and printers. — ben31833,
- The native VLAN part is what confused me too. Frames on the native VLAN cross the trunk untagged — no 802.1Q header. Both sides of the trunk need to agree on which VLAN is native, or you get weird issues like traffic leaking between VLANs. Default is VLAN 1. — Yaron,
- Oh that's why native VLAN mismatches cause problems! If switch A sends untagged on VLAN 1 but switch B thinks native is VLAN 99, the frame ends up in the wrong VLAN. That could be a security issue too right? Thanks for explaining. — 22maya2n2,
1 Answer
Simple version: it's about how many VLANs a link carries.
Access port — belongs to exactly one VLAN and sends/receives untagged frames. This is what you plug end devices into (a PC, printer, AP). The switch quietly puts that traffic in, say, VLAN 10; the PC has no idea VLANs exist.
interface gi0/1
switchport mode access
switchport access vlan 10
Trunk port — carries many VLANs over one link and tags each frame with its VLAN ID using 802.1Q. You use trunks between switches (or switch-to-router) so VLAN 10, 20, 30 can all cross the same cable and stay separated.
interface gi0/24
switchport mode trunk
switchport trunk allowed vlan 10,20,30
One catch: the native VLAN on a trunk is sent untagged (default VLAN 1). Both ends must agree on it or you get VLAN leakage/mismatch warnings.
Mnemonic: access = one VLAN, no tag, edge device. Trunk = many VLANs, 802.1Q tags, switch-to-switch. In the lab, drop two switches, make the link between them a trunk, put PCs on access ports in matching VLANs, and show interfaces trunk confirms which VLANs are crossing.
- The design habit worth forming early: set access ports explicitly to their VLAN and hard-code trunks with `switchport mode trunk` rather than leaning on DTP auto-negotiation. Predictable ports save you a lot of 'why is this VLAN not passing' debugging later. — ariel.lahav22,