VLANs and trunks: concepts, configuration and common mistakes
In short: A VLAN splits one physical switch into separate layer 2 networks. Access ports carry one VLAN to an end device; trunk ports carry many VLANs between switches, tagged with 802.1Q.
Why use VLANs
- Security: separate staff, guests, cameras and servers so a problem in one group doesn't spread.
- Smaller broadcast domains: less noise and better performance.
- Flexibility: group people by role, not by where their desk is.
Devices in different VLANs can't talk directly. Traffic between VLANs must go through a router or layer 3 switch, which is where you can apply security rules.
Access ports vs trunk ports
| Access port | Trunk port | |
|---|---|---|
| Connects to | PCs, printers, cameras, phones | Other switches, routers, servers with VLAN support |
| VLANs carried | One | Many |
| Tagging | Untagged | 802.1Q tags (except the native VLAN) |
Example configuration (Cisco IOS)
! Create VLANs
vlan 10
name STAFF
vlan 20
name CCTV
! Access port for a staff PC
interface GigabitEthernet0/5
switchport mode access
switchport access vlan 10
spanning-tree portfast
! Trunk to the next switch
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk native vlan 999
switchport trunk allowed vlan 10,20
switchport nonegotiateVerify
show vlan brief
show interfaces trunk
show interfaces Gi0/5 switchportMistakes that cause real outages
- Replacing the allowed list:
switchport trunk allowed vlan 30removes every other VLAN. Useallowed vlan add 30. - Native VLAN mismatch between the two ends of a trunk. Both sides must match.
- VLAN not created on one of the switches, so traffic for it is dropped.
- Leaving VLAN 1 as the native VLAN. Use an unused VLAN instead, which is a basic hardening step.
Key takeaways
- Access = one untagged VLAN; trunk = many tagged VLANs.
- Inter-VLAN traffic needs a router or layer 3 switch.
- Always use "allowed vlan add" on existing trunks.
- Match the native VLAN on both ends and don't use VLAN 1.
Tracks your learning on this device only. See your progress on the learning paths.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.