Access Port vs Trunk Port — Difference and Configuration

An access port carries traffic for exactly one VLAN and is used to connect end devices (PCs, printers, phones). A trunk port carries traffic for multiple VLANs simultaneously using IEEE 802.1Q tagging and is used to connect switches to other switches or routers.

Key takeaways

Access port = one VLAN — connects end devices (computers, printers, IP phones) to the switch
Trunk port = multiple VLANs — connects switches to other switches, routers, or WAPs
Trunk ports use 802.1Q tagging to identify which VLAN each frame belongs to
Access ports do not add VLAN tags — the connected device has no knowledge of VLANs
Configure access port: switchport mode access + switchport access vlan {ID}
Configure trunk port: switchport mode trunk + switchport trunk allowed vlan {list}
Native VLAN on a trunk port sends untagged traffic — must match on both ends to avoid issues

Short answer: an access port carries traffic for exactly one VLAN and sends frames untagged. A trunk port carries traffic for many VLANs over a single link and tags each frame with an 802.1Q header so the switch at the other end knows which VLAN it belongs to.

The difference is VLAN tagging, not how many devices you can plug in. Both port types are single physical ports and both connect to exactly one cable. A trunk does not let you connect more devices, it lets one link carry more VLANs.

Access Port vs Trunk Port, Comparison

Feature	Access Port	Trunk Port
VLANs carried	Exactly one	Many (all, or an allowed list)
Frame tagging	Untagged	802.1Q tagged (except the native VLAN)
Typically connects	PCs, printers, phones, cameras, APs	Switch to switch, switch to router, switch to hypervisor
What the end device sees	A plain Ethernet link, it has no idea VLANs exist	Tagged frames, the device must understand 802.1Q
Native VLAN	Not applicable	One VLAN sent untagged
Cisco command	`switchport mode access`	`switchport mode trunk`
Broadcast domain	Belongs to one	Carries several, keeps them separate

What an Access Port Actually Does

An access port belongs to a single VLAN. When a frame arrives from the connected device, the switch associates it with that VLAN internally. When a frame leaves toward the device, the switch strips any VLAN tag first.

This is why an ordinary PC works on a VLAN without any configuration, it never sees a tag and does not need to know VLANs exist. The switch handles all of it.

One useful exception: an IP phone with a PC plugged into it uses an access port with a separate voice VLAN. The phone’s traffic is tagged, the PC’s is not, and both share the one port. That is still an access port, not a trunk.

What a Trunk Port Actually Does

A trunk carries frames from many VLANs over one physical link. Each frame gets a 4-byte 802.1Q tag inserted, containing the VLAN ID. The receiving switch reads the tag, removes it, and puts the frame into the right VLAN.

Without trunks, connecting ten VLANs between two switches would need ten cables. With a trunk it needs one.

The native VLAN

One VLAN on every trunk is the native VLAN, and its frames cross the trunk untagged. It defaults to VLAN 1. The native VLAN must match on both ends, if one switch calls it VLAN 1 and the other calls it VLAN 99, untagged frames land in the wrong VLAN and traffic leaks between them. This is one of the most common trunk faults, and Cisco switches will log a native VLAN mismatch when CDP detects it.

Configuring an Access Port

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# spanning-tree portfast
Switch(config-if)# no shutdown

spanning-tree portfast puts the port straight into forwarding instead of waiting through the listening and learning states. Use it on ports connected to end devices only, never on a link to another switch.

Configuring a range of access ports

Switch(config)# interface range GigabitEthernet0/1 - 24
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# spanning-tree portfast

Configuring a Trunk Port

Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 999
Switch(config-if)# switchport trunk allowed vlan 10,20,30,40
Switch(config-if)# no shutdown

Three things worth noting:

switchport trunk encapsulation dot1q is only needed on older switches that also supported ISL. Modern switches are 802.1Q only and reject the command.
Set the native VLAN to an unused VLAN (999 here) rather than leaving it as VLAN 1. Leaving user traffic on the native VLAN is a known attack surface for VLAN hopping.
Prune the allowed list. By default a trunk carries every VLAN. Listing only what the far side needs reduces broadcast traffic and limits the blast radius of a loop.

Adding a VLAN to an existing trunk

Switch(config-if)# switchport trunk allowed vlan add 50

Use add. Repeating switchport trunk allowed vlan 50 replaces the entire list with just VLAN 50, a classic way to cut a production trunk in one command.

Turn Off Dynamic Negotiation

By default many Cisco ports run DTP (Dynamic Trunking Protocol) and negotiate whether to become a trunk. That is convenient and insecure, an attacker can negotiate a trunk from a wall port and reach every VLAN.

! On access ports
Switch(config-if)# switchport mode access
Switch(config-if)# switchport nonegotiate

! On trunk ports
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport nonegotiate

Set the mode explicitly at both ends and disable negotiation.

Verification and Troubleshooting

Switch# show interfaces GigabitEthernet0/24 switchport
Name: Gi0/24
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 999
Trunking VLANs Enabled: 10,20,30,40

Operational Mode is the line that matters. If it says static access when you configured a trunk, the far end never agreed and the link is not trunking.

show interfaces trunk     ! every trunk, its native VLAN and allowed list
show vlan brief           ! which access ports are in which VLAN
show interfaces status    ! link state, speed, duplex and VLAN per port
show cdp neighbors detail ! confirms what is actually on the far end

Common faults

Native VLAN mismatch, untagged traffic lands in the wrong VLAN. Check show interfaces trunk on both ends.
VLAN missing from the allowed list, the VLAN exists on both switches but its traffic never crosses. Check the Trunking VLANs Enabled line.
VLAN not in the database, the port is assigned to VLAN 30 but VLAN 30 was never created, so the port stays inactive. show vlan brief will not list it.
One side access, one side trunk, the link comes up but only one VLAN passes. Both ends must be configured to match.
Encapsulation mismatch on older equipment, one end ISL, the other dot1q.

Which One Should You Use?

End device, PC, printer, camera, IP phone, wireless AP serving one SSID: access port.
Switch to switch, switch to router, switch to a hypervisor host, or an AP serving several SSIDs mapped to different VLANs: trunk port.

The question to ask is not how many devices are on the other end. It is whether the device on the other end needs to understand more than one VLAN.

Frequently Asked Questions

What is the main difference between an access port and a trunk port?

An access port carries one VLAN and sends frames untagged. A trunk port carries multiple VLANs and tags each frame with an 802.1Q header identifying its VLAN. It is about VLAN tagging, not the number of devices.

Can a trunk port connect more devices than an access port?

No. Both are single physical ports with one cable. A trunk carries more VLANs, not more devices.

Can a PC be plugged into a trunk port?

It will link up, but the PC will receive tagged frames it does not understand and will drop most of them. Only the native VLAN would work. Use an access port for a PC, unless the PC is running a hypervisor configured to read 802.1Q tags.

What happens if the native VLAN does not match?

Untagged frames sent from one side are placed into a different VLAN on the other, so traffic leaks between VLANs that should be separate. Cisco switches log a native VLAN mismatch when CDP is running.

Why should the native VLAN not be VLAN 1?

Leaving user traffic on VLAN 1 as the native VLAN enables double-tagging VLAN hopping attacks. Set the native VLAN to an unused VLAN that carries no traffic.

Does an access port support VLAN tagging at all?

Not for its data VLAN, those frames are untagged. The exception is a voice VLAN, where a connected IP phone tags its own traffic while the PC behind it stays untagged on the same port.

How do I check whether a port is actually trunking?

Run show interfaces <interface> switchport and read the Operational Mode line, not the Administrative Mode line. Administrative is what you configured; operational is what the link negotiated.

Related Guides

Continue with what a VLAN is, VLAN tagging on a switch, native VLAN configuration and VTP. See the full picture in our network switching guide, and plan your VLAN addressing with the VLAN calculator.

Written by

Gurpreet Singh

Hey! I"m Gurpreet Singh and I Have 7+ Years of experience in the Network & Security Domain as well as the Cloud Infra Domain. I am Certified with Cisco ( CCNA ), CheckPoint ( CCSA ), 1xAWS, 3xAZURE, and 3xNSE. So I love to share my tech knowledge with you.