Trunk Ports, 802.1Q and the Native VLAN

What it is

A trunk is a single link that carries traffic for many VLANs between switches.

When VLANs span more than one switch, the switches need such a link. Without trunking, you would need a separate cable between the switches for every VLAN.

A trunk marks each frame with a tag so the receiving switch knows which VLAN it belongs to. The standard for this tagging is IEEE 802.1Q, often written as dot1q.

How it works

Tagged frames cross the trunk, the native VLAN crosses untagged, and DTP can negotiate the link.

The 802.1Q tag

When a frame leaves a trunk port, the switch inserts a 4-byte tag into the Ethernet header, between the source MAC address and the type field.

The tag holds:

• a tag protocol identifier that marks the frame as tagged
• a 3-bit priority field, used for class of service
• a 1-bit field for drop eligibility
• a 12-bit VLAN ID, which allows 4096 values

The receiving switch reads the VLAN ID, removes the tag, and delivers the frame only to ports in that VLAN. Because the frame has grown by 4 bytes, the maximum frame size on a trunk is a little bigger than on an ordinary link.

The native VLAN

One VLAN on a trunk is handled differently. Frames in the native VLAN are sent without a tag, and untagged frames that arrive on a trunk are placed in the native VLAN. The default native VLAN is VLAN 1.

The native VLAN exists for compatibility, for example with devices that do not understand tags.

Both ends of a trunk must use the same native VLAN. If they disagree, frames can leak between VLANs, and the switches normally log a native VLAN mismatch message. As good practice, many networks set the native VLAN to an unused VLAN rather than leaving it as VLAN 1.

Configuring a trunk

interface GigabitEthernet0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,99

• switchport trunk encapsulation dot1q is needed only on switches that also support the older ISL protocol. Switches that support only 802.1Q reject this command, and you simply leave it out.
• switchport mode trunk makes the port a trunk, whatever the other end says.
• switchport trunk native vlan 99 changes the native VLAN.
• switchport trunk allowed vlan limits which VLANs may cross the trunk. By default, all VLANs are allowed. Limiting them reduces unnecessary traffic and tightens security.

Dynamic Trunking Protocol

Cisco switches can negotiate a trunk automatically with DTP (Dynamic Trunking Protocol). The outcome depends on the mode at each end.

A port in dynamic auto waits for the other side to ask. A port in dynamic desirable actively asks. Two auto ports will wait for each other forever, and no trunk forms.

The default mode on most Catalyst switches is dynamic auto.

For security, it is best practice to configure trunks by hand and turn off negotiation.

interface GigabitEthernet0/1
 switchport mode trunk
 switchport nonegotiate

Verifying

show interfaces trunk
show interfaces GigabitEthernet0/1 switchport
show vlan brief

show interfaces trunk is the key command. It shows which ports are trunking, the encapsulation, the native VLAN, the VLANs allowed on the trunk, and the VLANs that are allowed and active.

If a VLAN is missing from the last list, the VLAN may not exist on this switch, or it may be pruned or not allowed.