Access Port vs. Trunk Port in Cisco Switches: A Simple Guide

Learn the difference between Access Ports and Trunk Ports in Cisco switches, how they work with VLANs, and how to configure them using simple Cisco IOS commands.

When working with Cisco switches, you will often hear two important terms: Access Port and Trunk Port.

Both are used to connect network devices, but they have different purposes. Understanding the difference helps you configure VLANs correctly and troubleshoot network connectivity problems.

In this guide, we will explain both port types using simple examples and practical Cisco commands.

1. What Is an Access Port?

An Access Port is a switch port that belongs to one VLAN. It is commonly used to connect end devices such as:

• Desktop computers
• Printers
• IP cameras
• Other devices that normally send and receive untagged Ethernet traffic

For example, imagine you have three VLANs in your network:

VLAN ID	VLAN Name	Purpose
10	DATA	Computers
20	VOICE	IP phones
30	GUEST	Guest devices

If you connect a computer to port FastEthernet0/1 and assign that port to VLAN 10, the computer's normal untagged traffic will be associated with VLAN 10.

Access Port Configuration Example

enable
configure terminal

vlan 10
 name DATA
exit

interface fastEthernet 0/1
 switchport mode access
 switchport access vlan 10
 no shutdown
exit

end
write memory

What do these commands do?

• vlan 10 creates VLAN 10.
• name DATA gives the VLAN a name.
• interface fastEthernet 0/1 selects the switch port.
• switchport mode access configures the port as an access port.
• switchport access vlan 10 assigns the port to VLAN 10.
• no shutdown enables the port.
• write memory saves the configuration.

Result: The port is assigned to VLAN 10, so normal untagged traffic from the connected computer is placed in that VLAN.

2. What Is a Trunk Port?

A Trunk Port is a switch port that can carry traffic for multiple VLANs over the same physical connection.

Trunk ports are commonly used to connect:

• One switch to another switch
• A switch to a router configured for multiple VLANs
• A switch to a firewall that handles multiple VLANs
• A switch to a server or other device configured to use VLAN tagging

For example, suppose Switch S1 has VLANs 10, 20, and 30, and Switch S2 also needs to carry those VLANs.

Instead of using three separate cables, you can use one trunk connection to carry traffic for all three VLANs.

Trunk Port Configuration Example

enable
configure terminal

interface gigabitEthernet 0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 no shutdown
exit

end
write memory

What do these commands do?

• interface gigabitEthernet 0/1 selects the port connected to the other switch.
• switchport mode trunk configures the port as a trunk.
• switchport trunk allowed vlan 10,20,30 allows VLANs 10, 20, and 30 to pass through the trunk.
• no shutdown enables the port.
• write memory saves the configuration.

Important: The other end of the connection must also be configured appropriately. The exact commands can vary depending on the Cisco switch model and operating system.

3. What Is VLAN Tagging?

When traffic from multiple VLANs travels over a trunk, the receiving device needs to identify which VLAN each Ethernet frame belongs to.

This is commonly handled using IEEE 802.1Q (802.1Q) VLAN tagging.

In simple terms:

• Access port: Normally sends and receives untagged traffic for its assigned VLAN.
• Trunk port: Uses VLAN tags to distinguish traffic belonging to different VLANs. A native VLAN can carry untagged traffic on many Cisco trunk configurations.

For example, when VLAN 10 and VLAN 30 traffic travel across the same trunk, the VLAN tags help the receiving switch distinguish between the two.

4. Access Port vs. Trunk Port: What Is the Difference?

Feature	Access Port	Trunk Port
Main purpose	Connect end devices	Carry multiple VLANs
VLANs carried	One assigned access VLAN	Multiple permitted VLANs
Typical connection	Computer or printer	Switch-to-switch link
VLAN tagging	Usually untagged at the endpoint	Uses 802.1Q tags for VLAN identification
Common configuration	switchport mode access	switchport mode trunk

Easy way to remember:

• Access = one VLAN for normal endpoint traffic.
• Trunk = multiple VLANs over one connection.

5. Practical Example

Imagine you have two Cisco switches connected together.

• Switch S1 connects to a computer in VLAN 10.
• Switch S2 connects to a guest computer in VLAN 30.
• The link between S1 and S2 is a trunk that allows VLANs 10, 20, and 30.

The configuration could look like this:

On Switch S1:

vlan 10
 name DATA
vlan 20
 name VOICE
vlan 30
 name GUEST

interface fastEthernet 0/1
 switchport mode access
 switchport access vlan 10

interface gigabitEthernet 0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

On Switch S2:

vlan 10
 name DATA
vlan 20
 name VOICE
vlan 30
 name GUEST

interface fastEthernet 0/6
 switchport mode access
 switchport access vlan 30

interface gigabitEthernet 0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

In this example, the trunk carries the three VLANs between the switches, while each computer-facing access port is assigned to its intended VLAN.

Remember: Devices in different VLANs cannot communicate directly at Layer 2. Communication between VLANs requires a Layer 3 device, such as a router or a Layer 3 switch, with appropriate routing and security policies.

6. How to Verify the Configuration

After configuring the ports, use these commands to check the results.

Check VLANs and access-port assignments:

show vlan brief

This command displays the VLANs and their associated access ports.

Check trunk ports:

show interfaces trunk

This command displays operational trunk ports and information about the VLANs allowed and active on them.

Check a specific interface:

show running-config interface gigabitEthernet 0/1

This helps you review the configuration of the selected interface. Command support may vary by platform.

7. Common Problems and Troubleshooting

If devices cannot communicate as expected, check the following:

1. Incorrect VLAN assignment: Make sure the access port belongs to the correct VLAN.
2. Trunk not operating: Confirm that the link is operational and configured as a trunk at both ends.
3. VLAN missing on the other switch: Make sure the required VLAN exists on both switches.
4. VLAN not allowed on trunk: Check that the VLAN is included in the trunk's allowed list.
5. Physical connection problem: Check the cable, interface status, and link lights.
6. Inter-VLAN routing missing: If devices belong to different VLANs, verify that routing and the required gateway configuration are in place.

Frequently Asked Questions (FAQs)

Can an access port carry multiple VLANs?

An access port is assigned to one access VLAN for normal endpoint traffic. Special features and other port modes exist, but a standard access port is not intended to carry multiple tagged VLANs.

Can I use a trunk port to connect a computer?

Yes, if the computer's network adapter and configuration support VLAN tagging and the connection is configured correctly. However, a standard computer connection usually uses an access port.

Do I need a trunk port between two switches?

If the link must carry multiple VLANs, a trunk is the common solution. If the link only needs to carry one VLAN, other configurations may be possible.

Does a trunk port automatically allow every VLAN?

Not necessarily. The allowed VLAN list, VLAN existence, platform configuration, and operational trunk state determine which VLANs can pass.

Conclusion

Access ports and trunk ports are essential parts of VLAN configuration on Cisco switches.

An Access Port connects an endpoint to one assigned VLAN, while a Trunk Port carries traffic for multiple VLANs across a single connection.

Understanding when to use each port type helps you build a more organized network and troubleshoot VLAN connectivity more effectively.

For further learning, practice these commands in Cisco Packet Tracer before applying changes to a production network.