What is an Access Port?

An Access Port is a switch port that belongs to a single VLAN. It is normally used to connect end-user devices to a network.

For example, if a computer is connected to a switch port configured as an access port in VLAN 10, that port carries traffic for VLAN 10.

    PC
     |
     | Ethernet
     |
```

+-------------+
|   Switch    |
|             |
| Gi0/1       |
| Access      |
| VLAN 10     |
+-------------+
|
VLAN 10 

The connected computer normally does not need to understand VLAN tagging. The switch associates the traffic arriving on the access port with the configured VLAN.

Example of an Access Port

Suppose a company has the following VLANs:

• VLAN 10 – Administration
• VLAN 20 – Sales
• VLAN 30 – IT Department

A computer belonging to the Administration department could be connected to an access port assigned to VLAN 10.

```

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10 

Now, GigabitEthernet0/1 operates as an access port for VLAN 10.

What is a Trunk Port?

A Trunk Port is a switch port that can carry traffic belonging to multiple VLANs over a single physical connection.

Trunk ports are commonly used between:

• Switch and switch
• Switch and router
• Switch and firewall
• Switch and virtualization server
• Switch and other VLAN-aware network devices

          VLAN 10
             |
          VLAN 20
             |
          VLAN 30
             |
      +-------------+
      |   Switch 1  |
      +-------------+
             ||
             || Trunk
             || Multiple VLANs
             ||
      +-------------+
      |   Switch 2  |
      +-------------+
        |    |    |
       PC   PC   PC
      V10  V20  V30
    

Instead of creating a separate physical cable for every VLAN, a trunk allows multiple VLANs to share one physical link.

Why Do We Need Trunk Ports?

Imagine two switches connected to each other. Both switches have VLAN 10, VLAN 20, and VLAN 30.

   SWITCH 1                         SWITCH 2

 VLAN 10 PC                      VLAN 10 PC
      |                               |
      +---- VLAN 10 ----+     +-------+
                        |     |
                     +--+-----+--+
                     |   TRUNK  |
                     +--+-----+--+
                        |     |
      +---- VLAN 20 ----+     |
      |                               |
 VLAN 20 PC                      VLAN 20 PC

      +---- VLAN 30 -----------------+
      |                               |
 VLAN 30 PC                      VLAN 30 PC
    

A trunk allows the switch-to-switch connection to transport traffic from multiple VLANs.

Access Port vs Trunk Port

What is 802.1Q?

IEEE 802.1Q is a standard used to identify VLAN traffic on Ethernet trunk links.

When traffic from different VLANs travels across a trunk link, the Ethernet frame can contain a VLAN tag that identifies which VLAN the frame belongs to.

   Ethernet Frame
```

+---------+---------+----------+----------------+
| Dest MAC| Src MAC | 802.1Q   | Data / Payload  |
| Address | Address | VLAN Tag |                |
+---------+---------+----------+----------------+
|
+---- VLAN ID 

The VLAN ID allows the receiving switch to determine which VLAN the frame belongs to.

How 802.1Q Tagging Works

Consider two switches connected through a trunk.

  PC A
 VLAN 10
    |
    | Access Port
    |
```

+-----------+
| Switch 1  |
+-----------+
|
| Trunk
|
| VLAN 10 Frame
| 802.1Q Tag
|
+-----------+
| Switch 2  |
+-----------+
|
| Access Port
|
PC B
VLAN 10 

The first switch receives the frame from the access port and knows that the traffic belongs to VLAN 10.

When the frame crosses the trunk, VLAN information is carried using 802.1Q tagging. The receiving switch reads the VLAN information and forwards the frame appropriately.

What is a VLAN ID?

A VLAN ID identifies a particular VLAN. For example:

• VLAN 10 = Administration
• VLAN 20 = Sales
• VLAN 30 = IT
• VLAN 40 = Guest

When traffic crosses a trunk, the VLAN ID helps switches keep traffic separated.

Native VLAN

On an 802.1Q trunk, one VLAN can be configured as the native VLAN.

Traffic belonging to the native VLAN is normally sent without an 802.1Q VLAN tag on the trunk.

    SWITCH 1                         SWITCH 2

   VLAN 10  =====================  VLAN 10
   VLAN 20  =====================  VLAN 20
   VLAN 30  =====================  VLAN 30

                TRUNK
                 |
          Native VLAN = 99
    

In enterprise environments, administrators should carefully configure and match the native VLAN on both sides of the trunk.

Configuring an Access Port on Cisco Switch

Suppose we want GigabitEthernet0/1 to connect a computer to VLAN 10.

```

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# no shutdown 

The port is now configured as an access port in VLAN 10.

Configuring a Trunk Port on Cisco Switch

Suppose GigabitEthernet0/24 connects Switch 1 to Switch 2. We want it to carry VLANs 10, 20, and 30.

```

Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# no shutdown 

The trunk can now carry traffic for VLANs 10, 20, and 30.

Verifying Trunk Configuration

Cisco provides several useful commands for checking trunk configuration.

```

Switch# show interfaces trunk 

This command displays trunk ports, allowed VLANs, native VLAN information, and other trunk-related details.

```

Switch# show vlan brief 

This command provides a summary of VLANs and access-port assignments.

```

Switch# show interfaces GigabitEthernet0/24 switchport 

This command provides detailed information about the switchport configuration.

Allowed VLANs on a Trunk

A trunk does not always need to carry every VLAN configured on a switch. Administrators can specify which VLANs are allowed.

```

Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# switchport trunk allowed vlan 10,20,30 

In this example, only VLANs 10, 20, and 30 are allowed across the trunk.

Restricting allowed VLANs can reduce unnecessary traffic and improve network security and management.

Real-World Example

Imagine a company with two floors. Each floor has a Cisco switch.

         FLOOR 1                         FLOOR 2

    +-------------+                 +-------------+
    |   Switch 1  |                 |   Switch 2  |
    +-------------+                 +-------------+
      |    |    |                       |    |    |
      |    |    |                       |    |    |
     V10  V20  V30                     V10  V20  V30
      |    |    |                       |    |    |
     PC   PC   PC                      PC   PC   PC
     
          \_______________________________/
                     TRUNK
              VLAN 10, 20, 30
    

The trunk connection allows users in the same VLAN to communicate across the switches while keeping different VLANs logically separated.

Access Port Traffic vs Trunk Traffic

Access Port

```

PC
|
| Normal Ethernet Frame
|
v
[ ACCESS PORT ]
|
| Switch associates traffic with VLAN 10
|
VLAN 10 

Trunk Port

```

VLAN 10
|
| 802.1Q
|
VLAN 20
|
| 802.1Q
|
VLAN 30
|
v
[ TRUNK PORT ]
|
| Multiple VLANs
|
v
Another Switch 

Can an Access Port Carry Multiple VLANs?

In normal Cisco switch configuration, an access port is associated with one access VLAN.

Therefore, if you need to transport traffic from multiple VLANs over one physical link, a trunk port is normally used.

This distinction is especially important when configuring switch-to-switch connections.

Common Mistakes

1. Configuring a switch-to-switch connection as an access port.
2. Forgetting to create the required VLANs.
3. Using different native VLANs on each side of a trunk.
4. Forgetting to allow required VLANs on the trunk.
5. Connecting an end device to a trunk without understanding VLAN tagging.
6. Forgetting to verify the trunk configuration.

Easy Way to Remember

```

ACCESS PORT
|
|---- One VLAN
|
PC

TRUNK PORT
|
|---- VLAN 10
|---- VLAN 20
|---- VLAN 30
|
Switch 

Remember: Access = one VLAN for an end device. Trunk = multiple VLANs between network devices.

Access Port vs Trunk Port: Quick Comparison

Practical Packet Tracer Lab

You can practice Access Ports and Trunk Ports using Cisco Packet Tracer.

Lab Topology

   PC1                         PC2
 VLAN 10                     VLAN 20
    |                           |
    |                           |
```

+----------+               +----------+
| Switch 1 |===============| Switch 2 |
+----------+     TRUNK     +----------+
|                           |
VLAN 10                     VLAN 20
|                           |
PC3                         PC4 

Practice Tasks

1. Create VLAN 10 and VLAN 20 on both switches.
2. Assign PC1 and PC3 to VLAN 10.
3. Assign PC2 and PC4 to VLAN 20.
4. Configure the switch-to-switch connection as a trunk.
5. Allow VLAN 10 and VLAN 20 on the trunk.
6. Verify the configuration using Cisco show commands.
7. Test communication between devices in the same VLAN.
8. Observe that devices in different VLANs require Layer 3 routing to communicate.

Quiz

Question: Which type of switch port is normally used to connect a PC to VLAN 10?

Bonus Question: Which technology is commonly used to identify VLAN traffic across an Ethernet trunk?

Key Takeaways

• Access ports normally carry traffic for one VLAN.
• Access ports are commonly used for PCs, printers, and other end devices.
• Trunk ports carry traffic from multiple VLANs.
• Trunk ports are commonly used between switches and other VLAN-aware devices.
• 802.1Q is used to identify VLAN traffic on Ethernet trunk links.
• The native VLAN is normally sent untagged on an 802.1Q trunk.
• Administrators can restrict which VLANs are allowed across a trunk.
• Cisco provides commands such as show interfaces trunk to verify trunk configuration.
• Understanding access and trunk ports is essential for learning VLANs and Cisco switching.