VLANs and trunks explained: 802.1Q, native VLAN, DTP
One switch, three departments, and a single broadcast reaches every machine in the building. Accounting hears engineering, the guest laptop hears the servers, and every broadcast eats every port. VLANs split that one switch into separate networks that share the same hardware.
This page covers the 802.1Q tag, access, trunk and hybrid ports, the native VLAN trap, allowed lists, why Cisco tells you to switch off DTP, and how Cisco, Huawei, Aruba and Juniper each handle untagged frames.
One switch, many networks
A VLAN is a broadcast domain. Hosts in the same VLAN talk to each other at layer two. Hosts in different VLANs cannot, even when they sit on the same switch, and a broadcast never leaves its VLAN.
To get from one VLAN to another, traffic has to be routed: a VLANIF interface on Huawei, an IRB interface on Juniper, a routed interface or a router anywhere else.
The 802.1Q tag
Between switches, the VLAN travels inside the frame. IEEE 802.1Q inserts a four byte tag right after the source MAC address.
Two bytes of tag protocol identifier, 0x8100. Three bits of priority, values zero to seven. One bit that used to be called CFI and is now the drop eligible indicator. And twelve bits of VLAN ID. Twelve bits give 4,096 values, but zero and 4,095 are reserved, so the usable range is 1 to 4,094.
Access, trunk and hybrid
An access port belongs to one VLAN and talks untagged: frames come in without a tag, the switch adds the port's VLAN, and removes it on the way out. A trunk carries many VLANs between switches, each frame tagged with its VLAN.
Huawei adds a third type, the hybrid port, where you choose VLAN by VLAN whether frames leave tagged or untagged. Juniper is strict about the difference: an access interface accepts only untagged packets.
The native VLAN
A trunk still has to decide what to do with a frame that arrives without a tag. On Cisco, Huawei and Aruba it lands in the native VLAN, VLAN 1 by default, and frames of that VLAN leave untagged. Huawei calls it the PVID.
Cisco's guide is blunt: make sure the native VLAN is the same on both ends of the trunk, because a mismatch might cause spanning tree loops.
Juniper takes the opposite default: an ELS trunk drops untagged data until you configure a native VLAN ID and make the trunk a member of that VLAN.
Allowed lists
By default a Cisco trunk allows every VLAN, 1 to 4,094, and a Huawei trunk created with allow pass all does the same. Huawei's own advice is to avoid allow pass all and list only the VLANs you need.
Watch the syntax on Aruba: removing the last VLAN from an allowed list does not leave the trunk empty, it makes it carry every VLAN currently defined, and any new ones. On Cisco, allowed vlan none really means none. The same intent, opposite results.
DTP, and why Cisco says switch it off
Cisco switches can negotiate trunks with DTP. On a Catalyst 9300 every port starts in dynamic auto, which becomes a trunk if the other side asks. Dynamic desirable asks.
Cisco's own guidance is to turn negotiation off where it is not needed: use switchport mode access on host ports, and switchport nonegotiate on trunks, because some devices forward DTP frames improperly and leave one side trunking while the other is not.
Huawei has its own negotiation, LNP, enabled by default; Huawei warns it can drive the CPU high with many VLANs.
VLAN 1
VLAN 1 is special on every vendor. It exists from the first boot and cannot be deleted, and every port starts in it. On Cisco, CDP, LACP, DTP and VTP keep using VLAN 1 even if you remove it from a trunk.
Huawei says it directly: do not use VLAN 1 as the management VLAN or a service VLAN, because every interface joins it by default and broadcast storms follow. Put users, servers and management in VLANs you chose.
Voice VLANs
IP phones get their own VLAN on the same access port: voice tagged, the PC behind the phone untagged. Cisco sets it with switchport voice vlan and relies on CDP to tell the phone which VLAN to use.
Huawei can recognise phones by their MAC address or by VLAN. Aruba marks a VLAN as voice, and Juniper uses VoIP settings with LLDP MED.
Configuring it on four vendors
The same access port and trunk, four syntaxes.
Cisco: switchport mode access, switchport access vlan, and for the trunk, switchport mode trunk with an allowed list. Huawei: port link-type access and port default vlan, then port link-type trunk and port trunk allow-pass vlan. Aruba: vlan access, and vlan trunk allowed. Juniper: interface mode access with vlan members, and interface mode trunk.
Reading it back
To check, Cisco has show vlan and show interfaces trunk, Huawei has display vlan and display port vlan, Aruba has show vlan and show vlan port, and Juniper has show vlans and show ethernet switching interfaces.
The question is always the same: which VLANs exist, and which ports carry them, tagged or untagged.
What NacTrack shows
Checking every trunk by hand is where mistakes hide. NacTrack reads VLANs and trunks from every switch over SSH, whatever the vendor, and shows where each VLAN is present, which VLANs each trunk allows, and the VLANs left on no port at all.
See this protocol on your own network
NacTrack reads these protocols off your devices, over SSH and read-only.