CCNA 200-301 v1.1 reference — Network Access

Trunks and 802.1Q

802.1Q tagging, native VLAN behavior, allowed VLAN lists, and how to configure and verify trunk links between switches.

Objective 2.2v1.1 exam target

Trunk ports and tagging

A trunk carries multiple VLANs over one link. 802.1Q inserts a 4-byte tag between source MAC and EtherType containing the VLAN ID (12 bits → 1–4094). The receiving switch reads the tag and forwards the frame into that VLAN — the tag never reaches the host.

802.1Q tag anatomy

Field	Size	Contents
TPID	16 bits	0x8100 — marks the frame as tagged
PRI (PCP)	3 bits	802.1p priority for QoS
DEI/CFI	1 bit	Drop eligible indicator
VID	12 bits	VLAN ID 0–4095

Native VLAN

The native VLAN is the one VLAN whose frames travel the trunk untagged. Both ends must agree: a native VLAN mismatch leaks traffic between the two different VLANs and generates mismatch warnings. Default native VLAN is 1 — changing it is common hardening.

Interpret a native VLAN mismatch

SW1: native VLAN 1
SW2: native VLAN 99

SW1 sends VLAN 1 untagged; SW2 receives it untagged and places it in VLAN 99 — traffic is misclassified, and the inconsistent topology can also trigger STP inconsistency blocking rather than merely leaking traffic.
Traffic 'leaks' from VLAN 1 into VLAN 99 — a segmentation failure, not a hard error.
CDP reports 'Native VLAN mismatch' — the warning exists precisely because the link still forwards.

Always match native VLAN on both ends, and preferably move it off VLAN 1 to a dedicated unused VLAN — a mismatch misclassifies traffic and can block via STP inconsistency.

Configuration and verification

Configure and verify a trunk

Trunk two switches carrying VLANs 10, 20, 30 — Privileged EXEC → Interface configuration

Cisco IOS / IOS XE

configure terminal
interface gigabitethernet1/0/24
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,30,99
 end

Verify

show interfaces trunk
show interfaces gi1/0/24 switchport

Port listed with mode trunk and encapsulation 802.1q.
Native VLAN matches on both ends; allowed-and-active list shows 10,20,30,99.

switchport trunk encapsulation dot1q is required only on models that still support ISL.
VLANs must exist and be active to appear in the 'spanning-tree forwarding' state.

Changes device configuration.

$ show interfaces trunk (interpreted)

Port Mode Encapsulation Status Native vlanMode and native VLAN at a glance.

Gi1/0/24 on 802.1q trunking 99Confirm native VLAN matches the far end.

Port Vlans allowed on trunkAdministrative allowed list.

Gi1/0/24 10,20,30,99What you permitted.

Port Vlans allowed and active in management domainAllowed AND existing/active VLANs.

Gi1/0/24 10,20,30,99A VLAN missing here exists nowhere in the path.

Trunk negotiation context

DTP (Dynamic Trunking Protocol) negotiates trunking: dynamic desirable initiates, dynamic auto responds. Disable on hard-set trunks with switchport nonegotiate for hygiene.
VTP can propagate VLAN definitions; know it exists, but verify with show vlan brief rather than trusting it.

Common mistakes

Assuming tagged frames never reach hosts — access ports strip tags, but phones, hypervisors and misconfigured/trunked hosts legitimately see tags.
Mismatching native VLAN — frames cross VLAN boundaries silently.
Allowing 'vlan all' everywhere — it widens the broadcast/failure domain and attack surface.
Forgetting that an allowed VLAN that doesn't exist on the switch still forwards nothing.

VLAN 30 traffic dies between switches

Observation: VLAN 10 and 20 work across the trunk; VLAN 30 does not.

Hypotheses

VLAN 30 not in the allowed list
VLAN 30 not created or suspended on one switch
Native VLAN confusion (VLAN 30 is the native VLAN somewhere)

Check	Indicates
`show interfaces trunk` on both ends	VLAN 30 absent from allowed or from allowed-and-active splits the causes.
`show vlan brief` on both switches	Active VLAN 30 needed on both sides.
Native VLAN on both ends	If 30 is native on one side only, untagged frames land in different VLANs.

Correction: Add VLAN 30 to the allowed list or create/activate it where missing.

VLAN 30 appears 'allowed and active' in trunk output and hosts pass traffic.

On this page

Trunk ports and tagging
Native VLAN
Configuration and verification

Related resources

Practise this topic Source topic 17: VLANs (Part 2 - Trunks & ROAS)Practise topic 17 deck Source topic 19: DTP & VTP Practise topic 19 deck

Sources

Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
IEEE 802.1 Working Group — reviewed 2026-11-02
Cisco — LAN Switching Command Reference — reviewed 2026-11-02

Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.