In modern enterprise networking, physical network switches are almost always partitioned into multiple VLANs (Virtual Local Area Networks) to improve security and performance. To make VLANs work across an entire building or campus, network engineers must properly configure switch ports as either Access Ports or Trunk Ports.
What is an Access Port?
An access port is designed to connect to an endpoint device—such as a desktop PC, a printer, an IP phone, or a server.
- One VLAN Only: An access port belongs to exactly one specific VLAN (often called the Access VLAN).
- Untagged Traffic: Endpoints like Windows PCs or basic printers do not understand VLAN tags. The switch completely hides the concept of VLANs from the endpoint. When a PC sends a standard Ethernet frame into the switch, the switch receives it and internally assigns it to the configured Access VLAN. When the switch sends a frame back to the PC, it strips any VLAN tags off so the PC can read it.
What is a Trunk Port?
A trunk port is designed to pass traffic for multiple VLANs simultaneously across a single physical cable. Trunk ports are used to connect network infrastructure devices together, such as switch-to-switch, switch-to-router, switch-to-firewall, or switch-to-hypervisor (like VMware ESXi).
- 802.1Q Tagging: If Switch A sends a frame to Switch B, Switch B needs to know which VLAN that frame belongs to. To solve this, Switch A inserts a 4-byte 802.1Q VLAN Tag into the Ethernet header before sending it across the trunk cable. Switch B reads the tag, knows the traffic belongs to VLAN 10, and forwards it to the correct access ports.
- Allowed VLAN List: By default, a trunk allows all VLANs to cross it. For security and performance, engineers often restrict this using an Allowed VLAN List, ensuring only necessary traffic crosses the link.
The Native VLAN Concept
What happens if a trunk port receives an Ethernet frame that does not have an 802.1Q tag?
The switch assigns untagged frames to the Native VLAN. By default on most vendors (like Cisco), the Native VLAN is VLAN 1. For security reasons, best practices dictate changing the Native VLAN to an unused "black hole" VLAN to prevent traffic leakage. The Native VLAN must match on both ends of a trunk link, or a native VLAN mismatch error will occur (which breaks STP).
Real-World Office Example
Imagine a small office with two 48-port switches (Switch 1 on the first floor, Switch 2 on the second floor). The company uses four VLANs:
- VLAN 10: Users
- VLAN 20: Servers
- VLAN 30: Management
- VLAN 40: CCTV Cameras
The Access Ports: The CCTV camera in the lobby is plugged into Port 5 on Switch 1. Port 5 is configured as an Access Port on VLAN 40. The camera just sends standard, untagged video data. The switch receives it and internally tags it as VLAN 40.
The Trunk Port: Port 48 on Switch 1 connects to Port 48 on Switch 2 via a fiber optic cable. Port 48 is configured as a Trunk Port. When the video traffic needs to go to the recording server on the second floor, Switch 1 adds an 802.1Q tag with the number "40" and sends it across the trunk. Switch 2 receives it, reads the tag, strips the tag off, and sends the raw video data out the Access Port connected to the server.
Common Troubleshooting Scenarios
Misconfigured switchports account for a massive percentage of Help Desk tickets. (See Advanced VLAN Troubleshooting).
1. The Wrong Access VLAN
Problem: A user's PC cannot reach the internet or internal servers.
Troubleshooting: The physical cable might be plugged into Port 12, but Port 12 is configured for the Guest VLAN instead of the Employee VLAN. The PC receives an IP address for the wrong network. Changing the port's Access VLAN to the Employee VLAN immediately resolves the issue.
2. Missing VLAN on the Trunk
Problem: PCs on Switch 1 (VLAN 10) cannot ping PCs on Switch 2 (VLAN 10). However, they can ping other PCs on their own switch.
Troubleshooting: Check the trunk link connecting the two switches. The Allowed VLAN list might be restricting VLAN 10 from crossing the link. Alternatively, the administrator may have forgotten to actually create VLAN 10 in the global configuration of Switch 2.
3. PC Plugged into a Trunk Port
Problem: An employee unplugs a cable from a broken network switch and plugs their laptop directly into the wall jack. They get no network connectivity.
Troubleshooting: That wall jack was wired to a Trunk port designed to feed the broken switch. The laptop's standard network card does not understand the 802.1Q tagged frames coming from the wall and drops them.
Quick Summary
- Access Ports connect to endpoints (PCs). They handle one VLAN, and send/receive untagged traffic.
- Trunk Ports connect switches to other infrastructure devices. They handle multiple VLANs using 802.1Q tags to keep traffic separated.
- The Native VLAN is used to handle any untagged traffic that accidentally arrives on a trunk port.