Cisco VLAN Trunking: Configuration and Troubleshooting

VLAN trunking is a foundational skill for any network engineer. When configured correctly, trunks allow multiple VLANs to traverse a single physical link between switches. When they break, however, the symptoms can be subtle—intermittent connectivity, devices appearing on the wrong subnet, or complete loss of inter-VLAN communication.

This guide covers the essential configuration steps and the diagnostic commands I use most frequently when troubleshooting trunk-related issues in production environments.

1. Basic Trunk Configuration

On Cisco IOS switches, a trunk port is configured using the following commands:

interface GigabitEthernet0/1
 description Trunk to Distribution Switch
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,50

The switchport trunk allowed vlan command is critical—it restricts which VLANs traverse the trunk[reference:0]. By default, all VLANs are allowed, which can lead to unnecessary broadcast traffic and security risks. I recommend explicitly specifying only the VLANs that are needed.

Security Note: To reduce the risk of spanning-tree loops or storms, you can disable VLAN 1 on trunk ports by removing it from the allowed list[reference:1]. The interface will still send and receive management traffic such as CDP, LACP, and VTP in VLAN 1[reference:2].

The native VLAN is also worth configuring explicitly:

switchport trunk native vlan 999

This changes the VLAN for untagged traffic on the trunk. Using a dedicated, unused VLAN as the native VLAN is a security best practice.

2. Verification Commands

Once a trunk is configured, verifying its operational state is straightforward:

show interfaces trunk

This command shows all trunk ports, their mode, and which VLANs are allowed and active.

For a specific interface:

show interfaces GigabitEthernet0/1 switchport

This displays detailed information including administrative mode, operational mode, native VLAN, and allowed VLAN list[reference:3].

3. Troubleshooting Common Trunk Issues

3.1. Interface Status: Down/Down

If show ip interface brief shows the interface as down/down, the issue is physical. Check cabling, verify both ends are connected to the correct ports, and test with a known-good device[reference:4].

Also check for excessive errors:

show interfaces GigabitEthernet0/1

Look for incrementing counters for runts, giants, and CRC errors—these indicate physical-layer problems such as faulty cables or electrical interference[reference:5].

3.2. Interface Status: Up/Down (Protocol Down)

This usually indicates a Layer 2 mismatch. Common causes include:

Trunk mode mismatch: One end is set to switchport mode trunk while the other is switchport mode access.
Encapsulation mismatch: One end expects 802.1Q while the other uses ISL (rare in modern networks).
Native VLAN mismatch: The native VLAN must match on both ends of the trunk.

To diagnose, check both ends:

show interfaces GigabitEthernet0/1 switchport

Compare the Administrative Mode, Operational Mode, and Native VLAN values.

3.3. Intermittent Connectivity or High Error Rates

When a trunk is up but experiencing intermittent issues, check the interface counters:

show interfaces GigabitEthernet0/1 counters

Pay attention to input errors, CRC, and collisions. A sudden increase in these counters often points to a duplex mismatch—verify that both ends are set to speed 1000 and duplex full (or auto-negotiation is working correctly).

3.4. VLANs Not Passing Traffic

If the trunk is up but specific VLANs are not working:

Verify the VLAN exists on both switches: show vlan brief
Verify the VLAN is allowed on the trunk: show interfaces trunk
Check that the VLAN is active (not shutdown): show vlan id 10
For inter-VLAN routing, verify the SVI (Switch Virtual Interface) is up: show ip interface brief

4. VTP Considerations

If you use VTP (VLAN Trunking Protocol), ensure all switches have the same VTP domain name and that the VTP mode is appropriate for your design[reference:6]. In most production environments, I recommend using VTP Transparent mode to maintain explicit control over VLAN configuration.

vtp domain YOUR_DOMAIN
vtp mode transparent

5. A Quick Diagnostic Workflow

When called to investigate a trunk issue, I follow this sequence:

Physical layer: show ip interface brief — check status
Interface details: show interfaces Gi0/1 switchport — check mode and native VLAN
Error counters: show interfaces Gi0/1 — look for CRC, runts, giants
Trunk status: show interfaces trunk — verify allowed VLANs
VLAN existence: show vlan brief — ensure VLANs are created
End-to-end: Ping from a device in one VLAN to a device in another (if routing is configured)

This methodical approach has saved me hours of guesswork in production environments.

Pro Tip: For Catalyst 9000 series switches, Cisco provides extensive troubleshooting documentation covering important checks and useful command outputs when working with the Cisco TAC[reference:7]. Familiarizing yourself with these resources can significantly reduce resolution time.