Field guide · Networking & wireless
VLANs and Trunking
What a VLAN actually does to a frame, the difference between an access port and a trunk, and why the native VLAN is the setting that turns a tidy design into a way onto another network. Covers tagging, allowed lists, voice VLANs, and the specific faults that look like cabling problems and are not.
Diagram
Access, trunk, tagged, native — and which one is the security hole.
One VLAN, untagged. The device on the end has no idea a VLAN exists.
The switch strips any tag before the frame reaches the device, and adds the port’s VLAN back on the way in. That is why a PC never has to know its VLAN, and why moving the patch cord to a different port silently moves the device to a different network.
Procedure
Doing it
In the order the work happens, with the mistakes that cost a second trip called out where they occur.
Decide what each VLAN is for before you number it
A VLAN is a broadcast domain, and the only reasons to make another one are separation of traffic, separation of trust, or containing broadcast on a large flat network. Numbering first and finding a purpose later is how a site ends up with fourteen VLANs and one subnet doing all the work.
Set access ports explicitly, both halves
An access port carries one VLAN, untagged, to one device. Set the mode and the VLAN — `switchport mode access` and `switchport access vlan <id>` — because a port left on dynamic will negotiate a trunk with anything that asks for one, which is the classic VLAN-hopping opening.
Caution`switchport mode dynamic desirable` on an access port is a finding worth writing down. Nothing arrives configured that way. Add `switchport nonegotiate` and set the mode by hand.
Trunk only where a trunk is needed
A trunk carries several VLANs between switches, or to an access point or hypervisor that tags for itself. Everywhere else, a trunk is extra reach for anything that gets onto the port. Set the allowed list explicitly rather than leaving it at all — a trunk defaults to carrying every VLAN the switch knows about.
Change the native VLAN, and match it at both ends
The native VLAN is the one that crosses a trunk untagged. Leaving it at VLAN 1 means untagged traffic arriving on a trunk lands in the same VLAN as the management interface on most default configurations. Move it to an unused ID, set it identically on both ends, and put nothing else in it.
CautionA native VLAN mismatch between two ends merges two broadcast domains silently. It does not error — it just quietly bridges networks that were supposed to be separate.
Give voice its own VLAN, on the same port
A desk phone with a PC behind it wants the phone tagged into a voice VLAN and the PC untagged in the data VLAN, on one access port. That is what `switchport voice vlan` does. It is not a trunk, and configuring it as one gives the PC reach it should not have.
Prune, then verify from the far end
Remove VLANs from trunks that do not need to carry them, then check what actually arrives rather than what the config says should. A device that links at gigabit and gets no address is almost always in the wrong VLAN. The cable is rarely the culprit and is usually where people look first.
Questions
Questions people actually ask
- What is the difference between an access port and a trunk port?
- An access port belongs to exactly one VLAN and sends frames untagged — the device on the end has no idea a VLAN exists. A trunk carries several VLANs and tags each frame with its VLAN ID so the switch at the other end can tell them apart. Devices get access ports; the links between switches, and to access points or hypervisors that tag for themselves, get trunks.
- Why is the native VLAN a security problem?
- Traffic in the native VLAN crosses a trunk untagged, and on most default configurations the native VLAN is 1 — the same VLAN the switch manages itself in. That means untagged frames injected onto a trunk land next to the management interface. Move the native VLAN to an unused ID, use it for nothing, and set it identically at both ends.
- My device links but gets no IP address. Is that a VLAN problem?
- Usually, yes. A link light means the physical layer is fine, so the cable is not the suspect. Either the port is in a VLAN with no DHCP service reaching it, or the VLAN has been pruned off the trunk somewhere upstream. Check the port's VLAN first, then check the trunk between that switch and wherever DHCP lives.
- Does a VLAN make traffic secure?
- It separates broadcast domains; it does not encrypt anything, and it only separates traffic as well as the configuration holds. VLANs are a segmentation tool, and the routing between them is where policy is actually enforced. Treating a VLAN boundary as a security boundary without an access list between them is a common and expensive assumption.
- How many VLANs should a small office have?
- Fewer than most designs propose. Data, voice, and something for devices you do not trust — cameras, door controllers, guest — covers most sites. Each additional VLAN needs routing, a DHCP scope, and a firewall rule to be useful, so one you cannot describe the purpose of is a maintenance cost with no benefit.
Other guides
Related guides
- 01
Subnetting, Explained
Where the numbers come from, and the meaning behind them. - 02
The OSI Model, Layer by Layer
Seven layers, what each does, and how they hand off. - 03
Active Directory, Explained
Forests, domains, roles, and how a login really works. - 04
Writing a Switch Configuration
From factory default to a switch you would hand over. - 05
Spanning Tree and Switching Loops
Why one patch cord can take a whole floor down in seconds. - 06
Reading a Traceroute
Which loss is real, and whose network it is in.
Book the work
We do this work
as well as document it
Anyone configuring a switch port and wanting to be sure what will and will not reach it, or diagnosing a device that links but has no address.
- Free guides
- No sign-up
- Nothing tracked
- Written on the job