VLANs and 802.1Q trunking: four bytes that run the world

Strip away the vendor vocabulary and a VLAN is just a number a switch uses to keep broadcast domains apart. A trunk is a link that carries many of those numbers at once. The entire mechanism fits in four bytes inserted into the Ethernet frame.

The 802.1Q tag

The tag carries a 12-bit VLAN ID — hence the 1–4094 range — plus three priority bits that QoS borrows for CoS markings. One frame, one tag, and suddenly a single physical link can serve every VLAN in the building.

The exception is the native VLAN: frames from it cross the trunk untagged. It exists for backward compatibility, and it's also the root of a classic attack (double-tagging), which is why hardening guides tell you to set the native VLAN to something unused and tag it anyway:

SW1(config)# vlan dot1q tag native

Build a trunk on purpose

Dynamic Trunking Protocol will happily negotiate a trunk for you, and that's exactly the problem — an access port that negotiates is an access port an attacker can turn into a trunk. Configure both sides explicitly:

SW1(config)# interface Gi1/0/24
SW1(config-if)# switchport trunk encapsulation dot1q
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport nonegotiate
SW1(config-if)# switchport trunk native vlan 999
SW1(config-if)# switchport trunk allowed vlan 10,20,30

Verification, always

SW1# show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi1/0/24    on               802.1q         trunking      999

Port        Vlans allowed on trunk
Gi1/0/24    10,20,30

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/24    10,20,30

Read all three blocks, every time. "Allowed" and "forwarding and not pruned" are different questions — and the gap between them is where trunking tickets live.

Exam checklist

• Native VLAN mismatch? CDP will complain, and STP may misbehave. Fix it fast.
• switchport mode dynamic auto on both ends = no trunk. Auto doesn't initiate.
• Allowed lists are per-trunk filters — add and remove keywords save you from accidentally wiping the list.

Next in Layer 2: VTP — the protocol everyone disables until the lab asks for version 3.