What is the difference between an access port and a trunk port?
Show the answer
Say this first
An access port belongs to one VLAN and sends and receives untagged frames; end hosts plug in there. A trunk carries many VLANs over one link and marks each frame with an 802.1Q tag, except frames in the native VLAN. Trunks connect switches to switches, routers, firewalls, hypervisors and some APs. A port with a voice VLAN is still an access port, with one extra tagged VLAN for the phone.
Go deeper
Configuration
interface GigabitEthernet1/0/1
description PC
switchport mode access
switchport access vlan 10
spanning-tree portfast
!
interface GigabitEthernet1/0/48
description Uplink to DSW1
switchport mode trunk
switchport trunk allowed vlan 10,20,30
switchport trunk native vlan 999
switchport nonegotiateChecking what a port really is
SW1# show interfaces GigabitEthernet1/0/1 switchport
Name: Gi1/0/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 10 (USERS)
Trunking Native Mode VLAN: 1 (default)Administrative mode is what you configured; operational mode is what it actually became. A port in dynamic mode can show "dynamic auto" and "trunk" at the same time.
Who needs a trunk
A hypervisor host with VMs in several VLANs, a firewall with one subinterface per VLAN, an AP that switches several SSIDs locally to their VLANs. An AP that tunnels all client traffic to a controller only needs an access port.
They will ask next
Why set
switchport mode accesswhen a port already works as access?Because the default on most Catalyst switches is dynamic auto. A device that sends DTP could turn the port into a trunk and reach every VLAN. Static access also skips the DTP wait when the link comes up.
Traps
- Saying a trunk carries no untagged traffic. The native VLAN crosses untagged unless you tag it.