Configure and verify interswitch connectivity

Why trunks exist

Imagine two switches, SW1 and SW2, each with ports in VLAN 10 and VLAN 20. A VLAN 10 PC on SW1 needs to reach a VLAN 10 server on SW2. You could run one cable between the switches for VLAN 10 and another cable for VLAN 20, but with fifty VLANs that is fifty cables. Instead, we use a single cable configured as a trunk: a link that carries frames from many VLANs and labels each frame with a tag so the receiving switch knows which VLAN the frame belongs to.

The analogy: an access port is a single-lane road where every car is going to the same town. A trunk is a highway where cars from many towns share the road, and each car carries a sign saying which town it belongs to.

2.2.a Trunk ports

A trunk port is a switch port that carries multiple VLANs and adds a tag to frames (except for one VLAN, the native VLAN, described in 2.2.c). Trunks are used between switches, between a switch and a router (ROAS), between a switch and a wireless LAN controller, and between a switch and a server that hosts virtual machines in multiple VLANs.

Trunking encapsulation: ISL versus 802.1Q

Two tagging methods have existed. ISL (Inter-Switch Link) is an old Cisco proprietary method that wraps the whole frame in a new 26-byte header and 4-byte trailer. IEEE 802.1Q (pronounced “dot one Q”) is the open standard that inserts a 4-byte tag inside the frame. ISL is dead; modern switches support only 802.1Q. But some older switches (Catalyst 3560, 3750, 6500) support both and default to “negotiate,” so on those you must choose 802.1Q explicitly before you can turn a port into a trunk:

SW1(config)# interface gigabitethernet0/24
SW1(config-if)# switchport trunk encapsulation dot1q
SW1(config-if)# switchport mode trunk

On a switch that supports only 802.1Q (Catalyst 2960, 9200, 9300), the switchport trunk encapsulation command does not exist, and switchport mode trunk alone is enough. On an older multi-encapsulation switch, typing switchport mode trunk without first setting the encapsulation produces the error Command rejected: An interface whose trunk encapsulation is "Auto" can not be configured to "trunk" mode. The exam has been known to show this.

DTP: Dynamic Trunking Protocol

Cisco switches can negotiate whether a link becomes a trunk using DTP (Dynamic Trunking Protocol), a Cisco proprietary protocol. Each port is in one of these administrative modes (switchport mode ...):

The result of each combination:

The single most tested fact in this table: two ports both in dynamic auto never form a trunk. Both are waiting for the other to ask. Since dynamic auto is the factory default on most Catalyst switches (2960, 3560, 9000 series), two brand-new switches connected together will not trunk until you configure at least one side as trunk or dynamic desirable. (The old 2950 and 3550 defaulted to dynamic desirable, which is why very old study material says otherwise.)

access on one side and trunk on the other is a mismatch: the access side sends untagged frames and drops tagged ones, while the trunk side tags everything except its native VLAN. Only the native VLAN works, if that. CDP will log a %CDP-4-NATIVE_VLAN_MISMATCH or trunk mismatch warning.

Best practice: turn DTP off. Configure every port as either switchport mode access or switchport mode trunk, and on trunks add switchport nonegotiate so the switch stops sending DTP frames entirely. (switchport mode access already stops DTP; nonegotiate is only accepted on a port in access or trunk mode, never on a dynamic port.)

SW1(config)# interface gigabitethernet0/24
SW1(config-if)# switchport mode trunk
! Stop sending DTP frames; the far side must also be a static trunk
SW1(config-if)# switchport nonegotiate

Allowed VLANs on a trunk

By default a trunk carries all VLANs 1 to 4094. Limiting the list is both a security measure (the trunk to the guest-area switch should not carry the finance VLAN) and an STP optimization (fewer VLAN instances on the link). The command is switchport trunk allowed vlan, and it has several forms:

SW1(config)# interface gigabitethernet0/24
! Replace the list with exactly these VLANs
SW1(config-if)# switchport trunk allowed vlan 10,20,99
! Add to the existing list
SW1(config-if)# switchport trunk allowed vlan add 30
! Remove from the existing list
SW1(config-if)# switchport trunk allowed vlan remove 20
! Everything except these
SW1(config-if)# switchport trunk allowed vlan except 500-600
! Back to the default (all)
SW1(config-if)# switchport trunk allowed vlan all
! Carry nothing (rarely useful)
SW1(config-if)# switchport trunk allowed vlan none

The allowed list must match on both ends for a VLAN to actually pass. If SW1 allows 10,20 and SW2 allows 10,30, only VLAN 10 crosses the link.

Verifying trunks: show interfaces trunk

SW1# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/23      on           802.1q         trunking      99
Gi0/24      desirable    n-802.1q       trunking      99

Port        Vlans allowed on trunk
Gi0/23      10,20,99
Gi0/24      1-4094

Port        Vlans allowed and active in management domain
Gi0/23      10,20,99
Gi0/24      1,10,20,50,99

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/23      10,20,99
Gi0/24      1,10,20,50,99

How to read it:

• Mode on means switchport mode trunk; desirable or auto means the DTP mode. The Mode column shows the administrative setting.
• Encapsulation 802.1q means statically configured; n-802.1q means negotiated by DTP.
• Status trunking is what you want. A port that should be trunking but is missing from this output entirely is operating as an access port; check DTP modes.
• Native vlan is per-trunk and must match the far end.
• The three VLAN lists narrow down progressively: allowed (configured), then allowed and existing in the VLAN database, then allowed, existing, and not blocked by spanning tree. If a VLAN is in the first list but not the second, you forgot to create it on this switch.

Also useful: show interfaces gigabitethernet0/24 switchport shows the administrative and operational mode for a single port even when it is not trunking, which show interfaces trunk does not.

2.2.b 802.1Q

IEEE 802.1Q defines how a VLAN tag is inserted into an Ethernet frame. The tag is 4 bytes and is placed inside the frame, between the Source MAC address field and the Type/Length field. Because the tag is inserted rather than wrapped around the frame, the FCS (checksum) is recalculated.

The PCP, DEI, and VID together (16 bits) are called the TCI (Tag Control Information). Older documents call the DEI bit the CFI (Canonical Format Indicator); the bit position is the same, only the meaning was redefined.

A tagged frame looks like this in order:

| Dest MAC | Src MAC | TPID 0x8100 | PCP | DEI | VID | Type | Data | FCS |
|  6 bytes | 6 bytes |   2 bytes   |  3b |  1b | 12b |  2 B | ...  | 4 B |

The maximum standard Ethernet frame is 1518 bytes; a tagged frame is 1522 bytes. Devices that were never told about 802.1Q may treat a 1522-byte frame as oversized (a “baby giant”). Modern switches handle this without configuration.

The 12-bit VID is why there are 4096 possible VLAN numbers (2 to the 12th power) and why the usable range tops out at 4094: VID 0 means “no VLAN, only priority” and VID 4095 is reserved.

A receiving switch reads the VID, strips the tag, and forwards the frame as an ordinary untagged frame out the correct access ports. When a frame goes out a trunk, the switch inserts the tag. Access-port devices never see tags (except IP phones, which use them for the voice VLAN).

2.2.c Native VLAN

The native VLAN is the one VLAN on an 802.1Q trunk whose frames are sent without a tag. It exists for backward compatibility: a hub or an old device that does not understand tags could be placed on the link and still talk in the native VLAN. When a trunk port receives an untagged frame, it assumes the frame belongs to the native VLAN.

By default the native VLAN is VLAN 1 on every trunk. You change it per trunk:

SW1(config)# interface gigabitethernet0/24
SW1(config-if)# switchport trunk native vlan 99

Rules and consequences:

• The native VLAN must match on both ends of a trunk. If SW1 uses native VLAN 1 and SW2 uses native VLAN 99, an untagged frame from a VLAN 1 host on SW1 arrives at SW2 untagged and is placed into VLAN 99. Traffic silently leaks between VLANs. CDP detects this and logs %CDP-4-NATIVE_VLAN_MISMATCH. Spanning tree also detects it on PVST+ and may put the VLAN into an inconsistent blocking state.
• Native VLAN and security. Because untagged frames are trusted as native, an attacker on an access port in the native VLAN can craft a frame with an 802.1Q tag inside it (“double tagging” or VLAN hopping). The first switch strips the outer (native) tag, the second switch sees the inner tag and forwards the frame into a VLAN the attacker should not reach. This works only if the attacker’s access VLAN equals the trunk’s native VLAN. Mitigation: make the native VLAN an unused VLAN that no access port belongs to, and optionally tag it.
• Tagging the native VLAN. The global command vlan dot1q tag native forces the switch to tag native VLAN frames too, closing the double-tagging hole. Both ends must do it.
• ROAS. On the router, the subinterface for the native VLAN needs encapsulation dot1q <vlan> native, or the router will not accept untagged frames.

A hardened trunk configuration bringing 2.2 together:

SW1(config)# vlan 999
SW1(config-vlan)# name NATIVE-UNUSED
SW1(config-vlan)# exit
SW1(config)# interface gigabitethernet0/24
SW1(config-if)# description TRUNK-TO-SW2
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport nonegotiate
SW1(config-if)# switchport trunk native vlan 999
SW1(config-if)# switchport trunk allowed vlan 10,20,50,99
SW1(config-if)# end
SW1# show interfaces gigabitethernet0/24 switchport | include Native|Mode
Administrative Mode: trunk
Operational Mode: trunk
Trunking Native Mode VLAN: 999 (NATIVE-UNUSED)

Note that VLAN 999 is not in the allowed list. Since it is meant to carry nothing, that is fine (the native VLAN does not even have to exist in the VLAN database, though creating it keeps show output tidy); some engineers do allow it so the trunk can carry control frames on it. Either is acceptable.