Trunks, 802.1Q, and Native VLAN

An access port belongs to one VLAN, so a single access link between two switches could only ever carry one VLAN across. A trunk is a switch-to-switch — or switch-to-router — link that carries many VLANs at once. The problem it has to solve is identity: when a frame arrives over a link shared by VLANs 10, 20 and 30, the receiving switch must know which VLAN it came from, so that its MAC table and its flooding stay per-VLAN exactly as the previous lesson requires.

Untagged:  [ Dest MAC | Src MAC | EtherType | Payload | FCS ]
Tagged:    [ Dest MAC | Src MAC | 802.1Q | EtherType | Payload | FCS ]
                                  |
                                  4 bytes: TPID 0x8100 + PCP/DEI + 12-bit VLAN ID

802.1Q leaves exactly one VLAN on the trunk untagged: the native VLAN, which defaults to VLAN 1. Any untagged frame arriving on a trunk is treated as native-VLAN traffic. Two consequences follow, and they are the reason this lesson is the longest of the week.

The allowed-VLAN list is a separate control. By default a trunk carries every VLAN; switchport trunk allowed vlan restricts which may cross, limiting both the security surface and unnecessary broadcast flooding. If a VLAN is allowed on one end but omitted on the other, that one VLAN loses connectivity across the link while everything else works — a different symptom from a native mismatch, with no CDP log to help you.

The Dynamic Trunking Protocol is a Cisco-proprietary protocol that lets two switch ports negotiate whether their link becomes a trunk. For CCNA you need awareness rather than mastery: know the modes and the resulting link type, then disable it on known uplinks. The exam-relevant point is that leaving DTP enabled produces unpredictable, negotiable trunks, which is both a reliability and a security problem.

The single fact worth memorising is the last cell: two dynamic auto ends never form a trunk, because neither side initiates. The correct production habit is switchport mode trunk plus switchport nonegotiate, which pins the trunk and stops DTP frames entirely. VTP, a separate protocol that synchronises the VLAN database, is out of scope here.

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# switchport nonegotiate

Switch# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1       on           802.1q         trunking      99

Port        Vlans allowed on trunk
Gi0/1       10,20,30

Port        Vlans allowed and active in management domain
Gi0/1       10,20,30

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       10,20,30

Read it as four separate answers. Mode and Status confirm the port is actually trunking rather than merely configured to. Native vlan is the column you compare against the far end — differing values are the fingerprint of a native mismatch. The allowed block shows what you permitted; the forwarding block shows what is genuinely passing, and a VLAN present on one switch but missing from the other's forwarding block is the fingerprint of an allowed-list mismatch. On ISL-capable platforms switchport trunk encapsulation dot1q is set first; many modern switches are 802.1Q-only and skip it.

• A trunk carries many VLANs on one link; 802.1Q inserts a 4-byte tag holding a 12-bit VLAN ID.
• The native VLAN travels untagged and defaults to VLAN 1; harden it to a dedicated unused VLAN.
• A native mismatch hides behind working tagged VLANs — compare the Native vlan columns on both ends.
• An allowed-list mismatch breaks exactly one VLAN and produces no CDP log.
• Two dynamic auto ends never form a trunk; prefer switchport mode trunk plus nonegotiate.
• show interfaces trunk answers mode, native VLAN, allowed VLANs, and forwarding VLANs in one command.