Learn how access ports and 802.1Q trunk ports classify, carry, tag, and restrict VLAN traffic.

What you will be able to do

Distinguish the normal traffic role of an access port from that of a trunk port.
Explain how an access port assigns incoming traffic to a VLAN.
Describe how an 802.1Q trunk uses tags and a native VLAN.
Explain why the native VLAN must match across both ends of a trunk.

Two port roles, two traffic patterns

Switch ports commonly serve one of two VLAN-carrying roles. An access port normally handles one VLAN, while a trunk port carries traffic for multiple VLANs.

This distinction helps you choose the right configuration boundary. Use the access-port model when one connected device or device group belongs to one VLAN. use the trunk model when one link must transport several VLANs.

How an access port classifies traffic

An access port has an assigned VLAN. Traffic arriving through that port is treated as belonging to that assigned VLAN.

For example, imagine a workstation connected to a port assigned to VLAN 20. An incoming frame on that port enters the switch’s VLAN 20 traffic context, rather than choosing a VLAN from the frame itself.

A static access port receives its VLAN assignment manually. It may also receive that assignment through RADIUS when IEEE 802.1x is used.

Tagged traffic at an access port

Without a configured voice VLAN, an access port drops tagged packets that arrive on the port. Its normal single-VLAN behavior does not make those tags acceptable.

When a voice VLAN is configured, the port accepts packets tagged for that voice VLAN. It still drops tagged packets that identify other VLANs.

This creates a useful contrast: an access port can support a voice-and-data arrangement, but it does not become a general-purpose multi-VLAN trunk.

What makes a trunk different

A trunk port is designed to carry traffic for multiple VLANs across one link. The receiving side needs a way to identify which VLAN each piece of traffic belongs to.

IEEE 802.1Q provides that identification by supporting both tagged and untagged traffic on a trunk. Tags identify VLAN membership for traffic that carries them; one VLAN uses the untagged form.

For example, a switch-to-switch link could transport VLAN 10, VLAN 20, and VLAN 30. The link remains one physical connection, while the VLAN information distinguishes the traffic.

The native VLAN handles untagged traffic

On an 802.1Q trunk, the native VLAN is the VLAN associated with untagged traffic. One VLAN is left untagged, while traffic for other VLANs is identified with tags.

Consider a trunk whose native VLAN is VLAN 10. Traffic associated with that native VLAN can cross without a tag, while traffic for VLAN 20 or VLAN 30 is sent with its VLAN tag.

The native VLAN is therefore not an extra link. It is the trunk’s defined interpretation for traffic that arrives or leaves without VLAN tagging.

Why both trunk ends need the same native VLAN

Both ends of an 802.1Q trunk must use the same native VLAN. Otherwise, the two devices can assign different VLAN meanings to the same untagged traffic.

Suppose one end treats untagged traffic as VLAN 10 while the other treats it as VLAN 20. The link then lacks a shared interpretation for that traffic, so the native-VLAN settings do not agree.

When checking a trunk, compare the native VLAN configuration at both ends before relying on untagged traffic.

How the sending port chooses tags

For outgoing traffic, the port compares the traffic’s VLAN with the trunk’s native VLAN. Traffic matching the native VLAN is sent without a tag.

Traffic for any other VLAN is sent with a tag. This rule lets the receiving device distinguish the other VLANs while preserving the native VLAN’s untagged treatment.

The result is a deliberate mixture: one VLAN uses the untagged path, and the remaining permitted VLAN traffic uses tagged frames.

Restricting a trunk with an allowed list

A trunk can use an allowed VLAN list to restrict which VLANs may use that trunk. This narrows the trunk’s VLAN membership instead of automatically carrying every possible VLAN.

The list applies only to its associated trunk port. Changing the allowed VLAN list on one trunk does not, by that fact alone, change the list on another trunk port.

A practical review therefore asks two separate questions: which VLANs should this link carry, and which exact trunk port has the list?

VLAN availability still matters

A trunk port can belong to a VLAN only when VTP knows that VLAN and the VLAN is enabled. A trunk setting alone does not make an unknown or disabled VLAN available.

This gives trunk troubleshooting another checkpoint. After reviewing tags, the native VLAN, and the allowed list, verify that the intended VLAN is known through VTP and enabled.

Keeping these checks separate prevents a valid-looking trunk configuration from being mistaken for complete VLAN availability.

Recap before Practice and Prove

An access port normally carries one VLAN, and incoming traffic is treated as belonging to its assigned VLAN. A static access port receives that assignment manually or through RADIUS for IEEE 802.1x use.

An access port drops tagged traffic when no voice VLAN is configured. With a voice VLAN, it accepts the voice tag, rejects tags for other VLANs, and can separate voice from data traffic.

A trunk carries multiple VLANs over one link. On an 802.1Q trunk, one native VLAN uses untagged traffic, while traffic for other VLANs uses tags.

The native VLAN must match at both trunk ends. Outgoing traffic for that VLAN is untagged, and outgoing traffic for other VLANs is tagged.

An allowed VLAN list restricts one associated trunk port, while VTP knowledge and VLAN enablement determine whether that trunk can belong to a VLAN. Use these distinctions in Practice and Prove.

Access and Trunk Ports