Access Ports and Trunk Links

Once you have VLANs, switch ports come in two main flavors: access ports and trunk ports. An access port carries traffic for a single VLAN and connects to end devices. A trunk port carries traffic for many VLANs at once and connects switches together. Knowing the difference is essential to building any multi-switch VLAN network, and it is a favorite exam topic.

An access port belongs to exactly one VLAN. You plug an end device, a PC, printer, or phone, into it, and that device sits in the assigned VLAN. The device has no idea VLANs exist; it just sends and receives normal frames. The switch quietly associates everything on that port with its single VLAN. Most ports in a building are access ports.

A trunk port carries traffic for multiple VLANs over one link. Trunks usually connect one switch to another, or a switch to a router. Because many VLANs share the trunk, the switch must label each frame with its VLAN ID so the other end knows where it belongs. Without trunks, you would need a separate cable per VLAN between switches, which is impractical.

How does a trunk keep VLANs straight? With 802.1Q tagging, the standard for VLAN tagging. As a frame enters the trunk, the switch inserts a small tag containing the VLAN ID. The receiving switch reads the tag, learns the frame VLAN, and removes the tag before delivering it to an access port. Tagging is what lets one cable safely carry many VLANs.

A trunk has one native VLAN whose traffic crosses the trunk untagged. By default this is VLAN 1. Any frame arriving on the trunk without a tag is assumed to belong to the native VLAN. For security, administrators often change the native VLAN away from VLAN 1 and ensure both ends of a trunk agree, since a mismatch can cause traffic to leak between VLANs.

Setting an access port is simple: mark the port as access and assign its VLAN. The example below shows a port placed in VLAN 20 for a user PC. Anything plugged in there joins VLAN 20. Access ports are the endpoints of the VLAN system, where ordinary devices connect without needing to understand tagging at all.

A trunk is configured to carry the VLANs that must travel between switches. The example marks a port as a trunk and limits it to two VLANs. Restricting which VLANs a trunk allows is good practice, it reduces the spread of broadcasts and limits exposure if a VLAN should not reach a particular switch.

Imagine three switches each hosting VLANs 10, 20, and 30. With trunks, a single cable between switches carries all three VLANs, tagged so each stays separate. Without trunks you would need three cables per switch pair. Trunks are what make VLANs scale across an entire building or campus while keeping the cabling simple.

A special case blends both ideas: an IP phone with a PC behind it. The port acts mostly as an access port for the PC data VLAN but also tags voice traffic for a separate voice VLAN. This lets one cable carry untagged PC data and tagged phone voice, a common setup that mixes access and trunk-like behavior on a single port.

Two frequent errors stand out. First, forgetting to allow a VLAN on a trunk, so devices in that VLAN cannot reach another switch. Second, a native VLAN mismatch, where the two ends disagree on the untagged VLAN, causing odd connectivity or security risks. When VLAN traffic mysteriously fails between switches, check the trunk allowed list and native VLAN first.

Remember the roles: access ports connect end devices and carry one VLAN; trunk ports connect switches and carry many VLANs using 802.1Q tags, with one untagged native VLAN. Access ports are the doors devices walk through; trunks are the highways between switches. Together they let VLANs span a network of any size cleanly and securely.

Test your port knowledge.

Switch ports are access or trunk. An access port connects an end device and carries one VLAN. A trunk port connects switches and carries many VLANs, using 802.1Q tagging to label each frame with its VLAN ID. A trunk has one native VLAN that travels untagged (default VLAN 1). Trunks let VLANs span multiple switches with simple cabling. Watch for unallowed VLANs and native VLAN mismatches when trunks misbehave.