Infrastructure · Topic 1 of 13

802.1Q Trunking and DTP Troubleshooting

Troubleshoot static and dynamic 802.1Q trunks: DTP modes, switchport commands, native VLAN and allowed VLAN problems, and the show commands that find them.

5 min

In a nutshell

An 802.1Q trunk tags frames with a four byte header, except in the native VLAN.
Static trunking uses switchport mode trunk. Dynamic trunking uses DTP.
Dynamic desirable asks, and dynamic auto waits. Auto with auto gives an access port.

What it is

An 802.1Q trunk carries the traffic of many VLANs over one link between switches.

Each frame gets a four byte tag that holds the VLAN ID, so the far switch can put it in the right VLAN. One VLAN, the native VLAN, is sent without a tag. A trunk can be set by hand, which is static, or negotiated by the Dynamic Trunking Protocol (DTP), which is dynamic.

How it works

A trunk comes up from the modes on both ends, and problems come from mismatches.

Static trunking

A static trunk is configured with a fixed mode, shown here on IOS XE.

Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# switchport nonegotiate

On older Catalyst platforms that support both ISL and 802.1Q, you must first enter switchport trunk encapsulation dot1q. Newer platforms support only 802.1Q, and they do not accept that command.

The command switchport nonegotiate stops the port sending DTP frames. Use it when the other side is a device that does not use DTP, or when you want to remove the negotiation.

Dynamic trunking with DTP

DTP is a Cisco protocol that lets two connected ports agree to become a trunk. The mode you set on each end decides the result.

Mode	Behaviour
`switchport mode trunk`	Trunks and also sends DTP frames
`switchport mode dynamic desirable`	Actively asks to become a trunk
`switchport mode dynamic auto`	Becomes a trunk only if the other side asks
`switchport mode access`	Stays an access port and does not trunk

The outcomes follow from who asks:

Side A	Side B	Result
trunk	trunk, desirable or auto	Trunk
desirable	desirable or auto	Trunk
auto	auto	Access, since neither asks
access	anything	Access

The default mode on many Catalyst switches is dynamic auto, so two default ports never form a trunk. Dynamic negotiation is also a security risk, because an attacker could ask a port to trunk. Best practice is to set access ports to switchport mode access and trunks to switchport mode trunk with switchport nonegotiate.

Native VLAN and allowed VLANs

Two settings cause most trunk problems.

Native VLAN mismatch: if the ends use different native VLANs, untagged frames land in different VLANs on each side. The switches log a CDP message about the mismatch, and traffic can leak between VLANs.
Allowed VLAN list: a VLAN that is not on the allowed list is not carried. The list must agree with what you need on both ends.

You can change the list without retyping it all with switchport trunk allowed vlan add 40 or remove 40. Using the command without add replaces the whole list, which is an easy way to cut off traffic.

Verifying and troubleshooting

Switch# show interfaces trunk
Switch# show interfaces GigabitEthernet1/0/1 switchport
Switch# show vlan brief
Switch# show dtp interface GigabitEthernet1/0/1

show interfaces trunk lists the trunk ports, their mode, encapsulation, status, native VLAN, the allowed VLANs and the VLANs that are active and forwarding. show interfaces switchport shows the administrative mode that you set and the operational mode that was negotiated.

A simple order of checks:

Is the physical link up on both ends?
Is the port a trunk in show interfaces trunk? If not, compare the two modes.
Do the native VLANs match?
Is the VLAN in the allowed list, and does it exist on both switches?
Is the VLAN in the forwarding state, or is Spanning Tree blocking it?

If a VLAN is missing from the last column of show interfaces trunk, it has not been created on that switch, Spanning Tree is blocking it there, or it has been pruned.

What to remember for the exam

Eight facts cover most questions on this topic.

An 802.1Q trunk tags frames with a four byte header, except in the native VLAN.
Static trunking uses switchport mode trunk. Dynamic trunking uses DTP.
Dynamic desirable asks, and dynamic auto waits. Auto with auto gives an access port.
switchport nonegotiate stops DTP frames.
A native VLAN mismatch sends untagged frames into different VLANs.
switchport trunk allowed vlan without add replaces the whole list.
show interfaces trunk is the main troubleshooting command.
Setting a static mode on every port is a security practice, because it avoids negotiation.

Exam tip

If two ports will not trunk, look at the modes first. Two auto ports, or an access port on one end, is the usual cause.

Common mistakes

These four mistakes appear often.

Leaving both ends on dynamic auto. Neither side asks, so the link stays an access link.

Using nonegotiate with a dynamic mode. switchport nonegotiate is accepted only on a port that is a static trunk or access port, so set the mode first.

Replacing the allowed list by accident. Leaving out add removes every VLAN you did not retype.

Ignoring the native VLAN. A mismatch can work for a while and then cause strange leaks and Spanning Tree messages.

Watch out

Do not leave the native VLAN as VLAN 1 on trunks if you can avoid it. Use an unused VLAN and match it at both ends.

Check yourself

Work through these three questions.

What happens when both ends of a link are set to dynamic auto?
Neither side asks to trunk, so the link operates as an access port.
Which command shows the native VLAN and the allowed VLANs of a trunk?
show interfaces trunk lists the native VLAN, the allowed VLANs and the VLANs active on each trunk.
What does switchport nonegotiate do?
It stops the port from sending DTP frames, so the port does not negotiate.

Topic 1 of 13 in Infrastructure

Test yourself on Infrastructure

The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.