Stackvora.tech

Configure 802.1Q Trunk Between Two Switches

Detailed guide on configuring an 802.1Q trunk link between two switches, covering encapsulation, native VLANs, allowed VLANs, and verification steps for Cisco IOS.

Establishing VLAN trunks is fundamental for inter-switch communication and network segmentation. This article details the configuration of an 802.1Q trunk between two Cisco IOS switches, focusing on common setup parameters, verification, and potential issues. The principles discussed are applicable to most enterprise-grade switches supporting the 802.1Q standard, though command syntax may vary.

An 802.1Q trunk allows multiple VLANs to traverse a single physical link by adding a 4-byte tag to Ethernet frames. This tag includes a 12-bit VLAN ID, supporting up to 4094 VLANs. Proper configuration is critical for maintaining network segregation and efficient traffic flow.

Understanding 802.1Q Trunking Basics

Before diving into configuration, it's essential to grasp key 802.1Q concepts:

  • VLAN Tagging: 802.1Q inserts a 4-byte tag into the Ethernet frame header for frames belonging to a specific VLAN. This tag contains the VLAN ID (VID) and priority information (CoS).
  • Native VLAN: This is an untagged VLAN on an 802.1Q trunk. Frames belonging to the native VLAN are sent across the trunk without an 802.1Q tag. All other VLANs are tagged. It's crucial for the native VLAN to match on both ends of a trunk link to prevent communication issues and CDP/VTP warnings. By default, VLAN 1 is often the native VLAN.
  • Allowed VLANs: By default, an 802.1Q trunk allows all VLANs (1-4094) to traverse it. For security and performance, it's best practice to explicitly specify which VLANs are permitted on a trunk.

Pre-Configuration Steps: Planning and VLAN Creation

Before configuring the trunk, ensure the following:

  • VLANs Exist: All VLANs intended to traverse the trunk must be created on both switches. For example, if VLANs 10, 20, and 30 are to be trunked, they must be active on both Switch A and Switch B.
  • Port Selection: Identify the physical interfaces on both switches that will form the trunk link. For high-speed links, Gigabit Ethernet or 10 Gigabit Ethernet interfaces are typically used. For example, GigabitEthernet1/0/24.
  • Native VLAN Choice: Decide on a native VLAN ID. While VLAN 1 is default, using an unused VLAN ID (e.g., VLAN 999 for management or a dedicated 'blackhole' VLAN) is a common security practice to avoid exposing sensitive VLANs to untagged traffic.

To create VLANs (if they don't exist):

Switch(config)# vlan 10
Switch(config-vlan)# name DATA_VLAN
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name VOICE_VLAN
Switch(config-vlan)# exit
Switch(config)# vlan 99
Switch(config-vlan)# name NATIVE_VLAN
Switch(config-vlan)# exit

Configuring the 802.1Q Trunk Link

The configuration steps are identical on both switches forming the trunk. We'll use GigabitEthernet1/0/24 as the example interface.

1. Enter Interface Configuration Mode

SwitchA(config)# interface GigabitEthernet1/0/24

2. Specify Trunk Encapsulation (if necessary)

On older Cisco switches (e.g., Catalyst 2950, 3550, 6500 series), or if the switch supports both ISL and 802.1Q, you must explicitly define the encapsulation type. Modern switches (e.g., Catalyst 2960-X, 3650, 9300 series) typically only support 802.1Q, so this command may be unnecessary or even rejected with an error like Command rejected: An interface can only be configured for a single encapsulation type.

SwitchA(config-if)# switchport trunk encapsulation dot1q

3. Set the Interface to Trunk Mode

This command configures the interface as a permanent trunk port. Dynamic Trunking Protocol (DTP) modes like dynamic auto or dynamic desirable exist, but switchport mode trunk explicitly sets the port as a trunk, which is generally preferred for predictability and security.

SwitchA(config-if)# switchport mode trunk

4. Configure Allowed VLANs on the Trunk

This is a critical security and performance optimization. By default, all VLANs are allowed. Restricting allowed VLANs prevents unwanted traffic from traversing the trunk and reduces the size of VLAN Trunking Protocol (VTP) updates if VTP is in use.

To allow specific VLANs (e.g., 10, 20, 30, and the native VLAN 99):

SwitchA(config-if)# switchport trunk allowed vlan 10,20,30,99

To add VLANs to an existing list without overwriting:

SwitchA(config-if)# switchport trunk allowed vlan add 40

To remove VLANs:

SwitchA(config-if)# switchport trunk allowed vlan remove 10

5. Configure the Native VLAN

As discussed, frames on the native VLAN are untagged. Ensure this ID matches on both ends of the trunk. Mismatched native VLANs can lead to traffic misdirection, security vulnerabilities, and error messages (e.g., CDP native VLAN mismatch notifications).

SwitchA(config-if)# switchport trunk native vlan 99

Complete Configuration Snippet (Switch A and B)

! On Switch A
SwitchA(config)# interface GigabitEthernet1/0/24
SwitchA(config-if)# switchport trunk encapsulation dot1q  ! Omit on newer switches if rejected
SwitchA(config-if)# switchport mode trunk
SwitchA(config-if)# switchport trunk allowed vlan 10,20,30,99
SwitchA(config-if)# switchport trunk native vlan 99
SwitchA(config-if)# no shutdown
SwitchA(config-if)# end

! On Switch B
SwitchB(config)# interface GigabitEthernet1/0/24
SwitchB(config-if)# switchport trunk encapsulation dot1q  ! Omit on newer switches if rejected
SwitchB(config-if)# switchport mode trunk
SwitchB(config-if)# switchport trunk allowed vlan 10,20,30,99
SwitchB(config-if)# switchport trunk native vlan 99
SwitchB(config-if)# no shutdown
SwitchB(config-if)# end

Verifying the Trunk Configuration

After applying the configuration, it's crucial to verify the trunk is operating as expected.

1. Show Interfaces Trunk

This command provides a concise overview of all trunk ports on the switch, their status, native VLAN, and allowed VLANs.

SwitchA# show interfaces trunk

Port        Mode         Encapsulation  Status        Native Vlan
Gi1/0/24    on           802.1q         trunking      99

Port        Vlans allowed on trunk
Gi1/0/24    10,20,30,99

Port        Vlans allowed and active in management domain
Gi1/0/24    10,20,30,99

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/24    10,20,30,99

Key information to check:

  • Mode: Should be on (indicating switchport mode trunk).
  • Encapsulation: Should be 802.1q.
  • Status: Should be trunking.
  • Native Vlan: Must match the configured native VLAN (99 in this example) and be identical on both ends.
  • Vlans allowed on trunk: Should show the explicitly configured VLANs.

2. Show Interfaces Switchport

This command provides more detailed information about the specific port's switchport configuration.

SwitchA# show interfaces GigabitEthernet1/0/24 switchport
Name: Gi1/0/24
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 99 (NATIVE_VLAN)
Administrative Native VLAN tagging: enabled
Voice VLAN: none

!--- Omitted output for brevity ---!

Vlans allowed on trunk: 10,20,30,99
Vlans allowed and active in management domain: 10,20,30,99
Vlans in spanning tree forwarding state and not pruned: 10,20,30,99

Confirm Administrative Mode and Operational Mode are trunk, Trunking Native Mode VLAN is correct, and Vlans allowed on trunk matches your configuration.

3. Ping Test Between VLANs

If you have hosts connected to access ports in VLANs 10, 20, or 30 on both switches, perform a ping test between them to confirm end-to-end connectivity across the trunk.

Common Pitfalls and Troubleshooting

  • Native VLAN Mismatch: The most common issue. If native VLANs don't match, you'll see CDP messages like *Apr 1 10:00:00.000: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/0/24 (99) with SwitchB GigabitEthernet1/0/24 (1). This can lead to traffic not being forwarded for the mismatched native VLAN and potential spanning-tree issues. Always ensure native VLANs are identical.
  • Allowed VLAN Mismatch: If a VLAN is allowed on one side of the trunk but not the other, traffic for that VLAN will not pass. Use show interfaces trunk on both sides to compare.
  • Encapsulation Mismatch: On older switches, attempting to trunk with ISL on one side and 802.1Q on the other will result in no trunk forming. The show interfaces trunk command would likely show the port as 'not-trunking'.
  • Physical Layer Issues: Ensure the cable is connected, ports are not shut down, and there are no duplex mismatches. Check show interface status and show interface GigabitEthernet1/0/24 for errors.
  • Spanning Tree Protocol (STP): STP can block ports. If a trunk port is in a blocking state, no traffic will pass. Check show spanning-tree vlan [VLAN_ID] to confirm the port's state.
  • VLANs Not Created: A trunk port can be configured to allow VLANs, but if those VLANs don't exist in the switch's VLAN database, they won't function. Verify with show vlan brief.

Back to the knowledge base · Ask the AI assistant