White Belt 20 min

Access and Trunk Ports with 802.1Q

Learn how switches forward traffic across VLANs using access ports for end devices and trunk ports for switch-to-switch links. We'll cover both Cisco Catalyst (IOS XE) and Nexus (NX-OS) platforms.

What Are Access and Trunk Ports?

Modern switches use VLANs (Virtual Local Area Networks) to separate traffic on a physical switch into logical groups. To support this:

  • Access ports connect end devices (servers, PCs, printers) to one VLAN. These ports strip VLAN tags on outbound frames.
  • Trunk ports connect switches together and carry traffic for multiple VLANs. These ports preserve VLAN tags using 802.1Q encapsulation.
  • 802.1Q is the IEEE standard for VLAN tagging. It adds a 4-byte header to Ethernet frames, including a 12-bit VLAN ID (0–4094).
Tip: A native VLAN on a trunk is the VLAN that carries untagged traffic. This simplifies legacy device support but should always be a dedicated VLAN (never a user VLAN).

Access Ports on Cisco Catalyst (IOS XE)

Configure a single access port for a device in VLAN 10:

interface GigabitEthernet1/0/5
 switchport mode access
 switchport access vlan 10
 description Server1-NIC
 no shutdown

Verify:

show interfaces GigabitEthernet1/0/5 switchport

Look for:

  • Operational Mode: static access
  • Access Mode VLAN: 10

Access Ports on Cisco Nexus (NX-OS)

Nexus access port configuration is similar:

interface Ethernet 1/5
 switchport mode access
 switchport access vlan 10
 description Server1-NIC
 no shutdown

Verify:

show interface Ethernet 1/5 switchport

Trunk Ports with 802.1Q on Catalyst (IOS XE)

Configure a trunk port between two switches that carries VLANs 10, 20, and 30. Set the native VLAN to 999 (management, not user traffic):

interface range GigabitEthernet1/0/1 - 2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 999
 description Trunk-to-Switch2
 no shutdown

Verify:

show interfaces trunk

Output shows:

  • Port: Gi1/0/1, Gi1/0/2
  • Mode: trunk
  • Encapsulation: 802.1q
  • Allowed VLANs: 10,20,30
  • Native VLAN: 999
Common Mistake: Forgetting to set the native VLAN or leaving it at VLAN 1. If the native VLAN differs on each end of a trunk, untagged traffic will be misrouted.

Trunk Ports with 802.1Q on Nexus (NX-OS)

Nexus trunk configuration uses the same keywords but slightly different interface naming:

interface Ethernet 1/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 999
 description Trunk-to-Switch2
 no shutdown

Verify:

show interface trunk

Note: NX-OS does not use DTP (Dynamic Trunking Protocol), so you must explicitly set switchport mode trunk on both ends. There is no switchport nonegotiate command.

Key Differences: Catalyst vs Nexus

Feature Catalyst (IOS XE) Nexus (NX-OS)
Interface name GigabitEthernet1/0/1 Ethernet 1/1
DTP support Yes (can negotiate trunk mode) No (must set mode explicitly)
Verify command show interfaces trunk show interface trunk
Feature flag needed No No (VLANs always enabled)

Summary

  • Use access ports to connect end devices to a single VLAN.
  • Use trunk ports to connect switches and carry multiple VLANs with 802.1Q tags.
  • Always set a native VLAN on trunks — use a dedicated management VLAN, never a user VLAN.
  • Catalyst (IOS XE) supports DTP negotiation; Nexus (NX-OS) requires explicit mode configuration.
  • Verify with show interfaces switchport and show interfaces trunk.