Skip to content
Log in Sign up My account

3.1.a Troubleshooting 802.1Q Trunking

Blueprint 3.1.a: Troubleshoot static and dynamic 802.1q trunking protocols

  • Static trunks (switchport mode trunk) and access ports
  • Dynamic trunking with DTP: dynamic desirable, dynamic auto, switchport nonegotiate, and the outcome of every combination
  • Native VLAN behaviour and native VLAN mismatches
  • Allowed VLAN lists, VLANs that do not exist locally, and pruning
  • VTP basics as they affect trunks: domain, mode, revision number, pruning

The verb is troubleshoot. Expect exhibits of show interfaces trunk or show interfaces switchport from both ends of a link and a question about why a VLAN does not pass. You must be able to predict the operational mode from the administrative modes and spot the one line in the output that is wrong.

What a trunk does

An 802.1Q trunk carries frames for many VLANs over one link. The sender inserts a 4-byte tag after the source MAC address. The tag holds a 12-bit VLAN ID (1 to 4094 usable) and a 3-bit priority field (CoS, used by QoS). One VLAN per trunk, the native VLAN, is sent untagged. The receiver puts any untagged frame into its own native VLAN.

An access port belongs to one VLAN and sends untagged frames. Hosts, printers and most IP phones' data traffic sit on access ports (a phone's voice VLAN is the exception: the phone tags voice frames on a port with switchport voice vlan).

Field Size Meaning
TPID 16 bits 0x8100, marks the frame as tagged
PCP (CoS) 3 bits Priority 0 to 7
DEI 1 bit Drop eligible indicator
VID 12 bits VLAN ID

Catalyst 9000 switches support only 802.1Q. Older switches and the IOSvL2 image also support Cisco ISL, so on those platforms you must set the encapsulation before you can hard-code a trunk:

interface GigabitEthernet0/1
 switchport trunk encapsulation dot1q   ! required on IOSvL2, 3560, 3750; not present on Catalyst 9000
 switchport mode trunk

If you skip the first line on a platform that supports ISL, IOS rejects the second with a message that an interface whose trunk encapsulation is "Auto" cannot be configured to "trunk" mode. That is a common moment of confusion in a lab or simulation item.

Dynamic Trunking Protocol (DTP)

DTP is Cisco proprietary. Switch ports in a dynamic mode exchange DTP frames to agree whether the link should be a trunk. DTP also negotiates the encapsulation on switches that support ISL.

Administrative mode DTP behaviour Becomes a trunk when the other side is
switchport mode access Permanently non-trunking; never asks for a trunk Never. Always access.
switchport mode dynamic auto Willing, but only responds to a request trunk or dynamic desirable
switchport mode dynamic desirable Actively asks to trunk trunk, dynamic desirable or dynamic auto
switchport mode trunk Permanently trunking; sends DTP so a dynamic neighbour can follow Always trunk on this side
switchport mode trunk + switchport nonegotiate Sends no DTP frames Always trunk on this side; the far side must be hard-coded too

The default administrative mode on Catalyst 9000 access ports is dynamic auto. Some older platforms defaulted to dynamic desirable. Never rely on the default: confirm it with show interfaces switchport.

The outcome matrix

Side A \ Side B access dynamic auto dynamic desirable trunk
access Access Access Access Mismatch
dynamic auto Access Access Trunk Trunk
dynamic desirable Access Trunk Trunk Trunk
trunk Mismatch Trunk Trunk Trunk

Three rows deserve attention:

  1. Auto plus auto is an access link. Both sides wait for the other to ask. This is the single most tested DTP fact.
  2. Trunk plus access is a mismatch. One side tags, the other side does not expect tags. Tagged frames are dropped by the access side; only untagged native VLAN frames get through, into the access VLAN. Rapid PVST+ usually notices because the access port receives a per-VLAN BPDU, logs %SPANTREE-7-RECV_1Q_NON_TRUNK and blocks the port as type inconsistent.
  3. Trunk with nonegotiate plus a dynamic mode does not trunk. nonegotiate stops DTP frames, so a dynamic auto or desirable neighbour never hears a request and stays access, while the near side tags. You get the same symptom as row 2.
graph LR
  subgraph "Forms a trunk"
    T1["trunk"] --- T2["dynamic auto"]
    D1["desirable"] --- D2["dynamic auto"]
    N1["trunk + nonegotiate"] --- N2["trunk"]
  end
  subgraph "Does not form a trunk"
    X1["dynamic auto"] --- X2["dynamic auto"]
    Y1["trunk + nonegotiate"] --- Y2["dynamic desirable"]
    Z1["trunk"] --- Z2["access"]
  end

Turning DTP off

Best practice is to hard-code every inter-switch link as a trunk, disable DTP on it, and hard-code every edge port as access. A port in a dynamic mode facing a user lets an attacker negotiate a trunk with a laptop (switch spoofing) and reach every VLAN.

interface GigabitEthernet0/1
 description Uplink to DIST1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate          ! no DTP frames sent
!
interface GigabitEthernet1/0
 description User port
 switchport mode access          ! access mode stops trunk negotiation
 switchport access vlan 10

switchport nonegotiate is accepted only when the mode is trunk or access. If the port is in a dynamic mode, IOS rejects it with a conflict between nonegotiate and dynamic status.

DTP and the VTP domain

DTP frames carry the switch's VTP domain name. If two switches have different, non-empty VTP domain names, dynamic negotiation fails and the switch logs %DTP-5-DOMAINMISMATCH. A link that should come up as desirable to auto stays access. Static trunks (switchport mode trunk on both ends) are not affected. This is a favourite troubleshooting twist because nothing on the interface itself looks wrong.

Exam trap

When both ends show Administrative Mode: dynamic auto and Operational Mode: static access, the answer is the auto-auto combination, not a native VLAN or encapsulation problem. When one end is dynamic desirable, the other is dynamic auto, and the link still does not trunk, look for a VTP domain name mismatch.

Native VLAN

The native VLAN is the one VLAN a trunk sends untagged. The default is VLAN 1. Each switch uses its own configured value, and the two ends do not negotiate it.

Behaviour Detail
Default VLAN 1
Set with switchport trunk native vlan <id> on each end
Mismatch detection CDP logs %CDP-4-NATIVE_VLAN_MISMATCH
STP reaction (PVST+ and Rapid PVST+) Blocks the two affected VLANs on that port as PVID inconsistent; other VLANs keep forwarding
Mismatch effect if STP did not block Untagged frames in VLAN A on one side land in VLAN B on the other, merging two broadcast domains
Hardening Use an unused VLAN as native on every trunk, or tag it with vlan dot1q tag native (global)

A native VLAN mismatch does not bring the trunk down and does not affect tagged VLANs. It also does not stop DTP from forming the trunk. The symptoms are confined to the two native VLANs.

Why use an unused native VLAN? A VLAN hopping attack called double tagging puts two tags on a frame. The first switch strips the outer tag (because it matches the native VLAN) and forwards the frame untagged across the trunk. The next switch reads the inner tag and delivers it to the victim VLAN. If the native VLAN has no hosts, the attacker cannot start the attack. vlan dot1q tag native closes it for good by tagging the native VLAN too.

Allowed VLANs and why a VLAN might not cross a trunk

By default a trunk allows VLANs 1 to 4094. A VLAN crosses a trunk only if all of these are true on both switches:

  1. The VLAN is in the trunk's allowed list.
  2. The VLAN exists in the local VLAN database and is active (not suspended or shut down).
  3. Spanning tree is forwarding that VLAN on the port.
  4. VTP pruning (if enabled) has not pruned it.

show interfaces trunk reports these as four successive filters, so the VLAN that drops out between two sections tells you which condition failed.

DIST1# show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi0/2       on               802.1q         trunking      999

Port        Vlans allowed on trunk
Gi0/2       10,20,30,99,999

Port        Vlans allowed and active in management domain
Gi0/2       10,20,99,999

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/2       10,99,999

Reading it top to bottom:

  • Section 1: Mode on means switchport mode trunk. You would see desirable or auto for a dynamic port that is trunking. Native VLAN is 999.
  • Section 2: VLAN 30 is allowed.
  • Section 3: VLAN 30 is missing, so it does not exist on DIST1 (or it is suspended). Fix: vlan 30.
  • Section 4: VLAN 20 exists but is not forwarding, so STP blocks it on this port or VTP pruned it. Check show spanning-tree vlan 20.

Editing the allowed list safely

Command Result
switchport trunk allowed vlan 10,20 Replaces the list with exactly 10 and 20
switchport trunk allowed vlan add 30 Adds 30 to the existing list
switchport trunk allowed vlan remove 20 Removes 20
switchport trunk allowed vlan except 100 Everything except 100
switchport trunk allowed vlan none No VLANs (the trunk carries only control traffic)
switchport trunk allowed vlan all Back to 1 to 4094

Exam trap

Typing switchport trunk allowed vlan 30 when you meant to add VLAN 30 replaces the list and cuts off every other VLAN on the trunk, often including your management VLAN. In a simulation this can lock you out of the device you are configuring. Always use add on a trunk that is already carrying traffic.

VTP basics as they relate to trunks

VLAN Trunking Protocol propagates the VLAN database between switches in the same VTP domain. VTP advertisements travel only over trunks, which is why it belongs with this objective.

Mode Creates or changes VLANs Forwards advertisements Syncs from advertisements
Server (default) Yes Yes Yes
Client No Yes Yes
Transparent Yes, locally only Yes (v2 and v3 regardless of domain; v1 only within the same domain) No
Off (v3, and v1/v2 on newer releases) Yes, locally only No No

Points that cause trunk-related outages:

  • Revision number. A server or client accepts any advertisement with a higher configuration revision number in the same domain and overwrites its VLAN database. Plugging in a lab switch with the same domain name and a higher revision can delete VLANs across the campus. Changing the domain name or setting transparent mode and back resets the revision to 0. VTP version 3 adds the concept of a primary server: only the primary can push changes, which prevents this accident.
  • Null domain. A switch with no domain name adopts the domain name of the first VTP advertisement it receives on a trunk.
  • Domain, password and version must match for updates to be accepted.
  • Pruning removes VLANs from a trunk when the downstream switch has no ports in them. VLAN 1 and the reserved VLANs cannot be pruned. Pruned VLANs disappear from the last section of show interfaces trunk, and show interfaces switchport lists Pruning VLANs Enabled.
  • Extended range VLANs (1006 to 4094) require VTP transparent or off mode with versions 1 and 2. Version 3 can carry them.
ACC1# show vtp status
VTP Version capable             : 1 to 3
VTP version running             : 2
VTP Domain Name                 : CAMPUS
VTP Pruning Mode                : Disabled
VTP Traps Generation            : Disabled
Device ID                       : 5254.0003.0000
Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00

Feature VLAN:
--------------
VTP Operating Mode                : Transparent
Maximum VLANs supported locally   : 1005
Number of existing VLANs          : 9
Configuration Revision            : 0

Many enterprises run transparent or off everywhere and create VLANs per switch (or through automation) so that VTP can never overwrite anything.

Troubleshooting workflow

graph TB
  S["VLAN X does not cross the link"] --> A{"show interfaces trunk<br/>port listed?"}
  A -- "No" --> B["Check show interfaces switchport<br/>admin and oper mode, DTP combo,<br/>encapsulation, VTP domain"]
  A -- "Yes" --> C{"X in allowed list<br/>on both ends?"}
  C -- "No" --> D["allowed vlan add X"]
  C -- "Yes" --> E{"X allowed and active?"}
  E -- "No" --> F["Create VLAN X or no shutdown<br/>check VTP mode"]
  E -- "Yes" --> G{"X forwarding and not pruned?"}
  G -- "No" --> H["show spanning-tree vlan X<br/>show interfaces pruning"]
  G -- "Yes" --> I["Check native VLAN, access ports, SVI, ARP"]
Command What it proves
show interfaces trunk Which ports are trunking, native VLAN, the four VLAN filters
show interfaces Gi0/2 switchport Administrative vs operational mode, negotiation on or off, native VLAN, allowed and pruning lists
show dtp interface Gi0/2 DTP state, timers and packet counters
show vlan brief Which VLANs exist and which access ports are in them
show vtp status Domain, mode, version, revision
show cdp neighbors Gi0/2 detail Confirms the far-end device and port, and native VLAN on some releases
show spanning-tree vlan X Whether STP blocks the VLAN on the port

Sample show interfaces switchport output for a dynamic port that did not trunk:

ACC1# show interfaces GigabitEthernet0/2 switchport
Name: Gi0/2
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: static access
Administrative Trunking Encapsulation: negotiate
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
...
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001

Negotiation of Trunking: On means DTP is running. Off means nonegotiate is configured.

Exam trap

A VLAN that is allowed on the trunk but missing from the "allowed and active in management domain" section does not exist on that switch. The fix is to create the VLAN, not to touch the trunk. On a VTP client you cannot create it locally; it must be created on the server or the switch must be moved to transparent mode.

Lab: break and fix a trunk

Topology: the course base campus block. All three switches are IOSvL2.

graph TB
  D1["DIST1"] -- "Gi0/0 + Gi0/1 to DIST2" --- D2["DIST2"]
  D1 -- "Gi0/2 to ACC1 Gi0/1" --- A1["ACC1"]
  D2 -- "Gi0/2 to ACC1 Gi0/2" --- A1
  A1 -- "Gi1/0 VLAN 10" --- H1["Host1"]

VLANs: 10 and 20 (users), 99 (management, 192.168.100.0/24), 999 (unused native).

Steps

  1. On all three switches create VLANs 10, 20, 99 and 999, and set vtp mode transparent.
  2. On DIST1 Gi0/2 and ACC1 Gi0/1 build a static trunk with native VLAN 999, allowed VLANs 10, 20, 99, 999, and DTP disabled.
  3. On DIST2 Gi0/2 and ACC1 Gi0/2 leave both ends at switchport mode dynamic auto. Confirm the link stays access with show interfaces switchport. Change DIST2's end to dynamic desirable and confirm it trunks.
  4. Set vtp domain LAB-A on DIST2 and vtp domain LAB-B on ACC1 (both transparent). Bounce the DIST2 to ACC1 link with shutdown / no shutdown and watch for %DTP-5-DOMAINMISMATCH. Set the same domain to fix it, then hard-code the trunk anyway.
  5. On DIST1 Gi0/2 remove the native VLAN line. Watch for the CDP native VLAN mismatch and check show spanning-tree inconsistentports. Put it back.
  6. On ACC1 Gi0/1 type switchport trunk allowed vlan 20 (without add). Note which VLANs drop out of show interfaces trunk, then repair with the full list.

Configuration for step 2

vtp mode transparent
vlan 10,20,99,999
!
interface GigabitEthernet0/2
 description To ACC1 Gi0/1
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,99,999
 switchport mode trunk
 switchport nonegotiate

vtp mode transparent
vlan 10,20,99,999
!
interface GigabitEthernet0/1
 description To DIST1 Gi0/2
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,99,999
 switchport mode trunk
 switchport nonegotiate
!
interface GigabitEthernet1/0
 switchport mode access
 switchport access vlan 10

Expected verification after step 2

ACC1# show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi0/1       on               802.1q         trunking      999

Port        Vlans allowed on trunk
Gi0/1       10,20,99,999

Port        Vlans allowed and active in management domain
Gi0/1       10,20,99,999

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       10,20,99,999

ACC1# show interfaces GigabitEthernet0/1 switchport | include Mode|Negotiation|Native
Administrative Mode: trunk
Operational Mode: trunk
Negotiation of Trunking: Off
Trunking Native Mode VLAN: 999 (VLAN0999)

Expected log during step 5

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet0/2 (1), with ACC1 GigabitEthernet0/1 (999).

For more practice, do Sim 01: EtherChannel LACP and trunk troubleshooting and study diagrams E18 and E19.

Quick check

SW1 is switchport mode trunk with switchport nonegotiate. SW2 is dynamic desirable. What is the operational mode on each side?

SW1 is a trunk because it is hard-coded. SW2 never receives a DTP frame, so its negotiation fails and it stays an access port. The link is mismatched: SW1 tags frames that SW2 does not expect. Fix it by making SW2 a static trunk.

Section 2 of show interfaces trunk lists VLAN 40 but section 3 does not. What is the most likely cause?

VLAN 40 does not exist (or is suspended) in the local VLAN database. Create it with vlan 40, or create it on the VTP server if this switch is a VTP client.

Which two values must match for VTP updates to be accepted, apart from the domain name?

The VTP password (if set) and a compatible version. The configuration revision is then compared to decide whether to apply the update.

References

  • Catalyst 9300 Series Layer 2 Configuration Guide, chapters "Configuring VLAN Trunks" and "Configuring VTP" (search on cisco.com for your release)
  • IEEE 802.1Q, Bridges and Bridged Networks (VLAN tagging)
  • Cisco tech note "Understanding and Configuring VLAN Trunk Protocol (VTP)" (search on cisco.com)
  • Cisco Live On-Demand Library: search "campus LAN design" and "Catalyst switching troubleshooting"