Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I am new to network Engineering. I find it is hard to distinguish and understand different switchport settings.
Why can I have a switchport set to access, auto, or dynamic? What are they used for? Are those functions only used for a host to switch connection?
What is "switchport nonnegotiate" used for?
Welcome to the field of network engineering!
DTP stands for Dynamic Trunking Protocol and is crucial to the commands below. It is also Cisco proprietary.
switchport mode access - Always forces that port to be an access port with no VLAN tagging allowed EXCEPT for the voice vlan. DTP is not used and a trunk will never be formed.
switchport nonegotiate - turns off DTP and forces the interface into a trunk.
switchport mode dynamic desirable - pro-active DTP negotiation will begin and if the other-side is set to trunk, desirable, or auto. The interface will become a trunk. Otherwise the port will become an access port.
switchport mode dynamic auto - allows the port to negotiate DTP if the other side is set to trunk or desirable. Otherwise it will become an access port.
switchport mode trunk - This interface will always be a trunk no matter what happens on the other side. It will also use DTP to negotiate a neighbouring interface that is set to dynamic desirable or dynamic auto into a trunk.
In the real world - I have never seen *dynamic auto*or dynamic desirable as generally network engineers try and make layer 2 related items (such as switchport settings) stable and static. There are also security risks associated with this.
An access role port is usually used for an single host or device. You must also specify which VLAN you would like it to be associated with, otherwise it will default to VLAN 1 in the Cisco world. eg)
interface gig0/1
switchport mode access
switchport access vlan 10
Also, if you have a VLAN for voip traffic. You can also set the voice vlan as required by adding
switchport voice vlan 20
A trunk port is generally only used when you want to interconnect two switches together in order to pass multiple VLANs between the two switches. In this example, the switches will use Dot1Q tagging and allow vlans 10, 20 & 30 to be passed between the two switches. Vlan 10 however, will be passed without tagging since it is set as the native vlan. eg)
Switch1# interface gig0/1
switchport encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30Switch2# interface gig0/1
switchport encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30
Take a look at Implement trunk and trunk protocols for more examples and to learn more about ISL or dot1q tagging along with some more command and debug information.
switchport mode access. The port will initiate DTP, but it will never trunk. In fact, the only way to disable DTP is to use switchport nonegotiate.
The switchport nonegotiate command is used to stop the port from sending DTP messages
Switchport puts a port into layer2 mode (ip routing disabled for the port). You cannot assign an IP address to a L2 port, only to the VLAN the L2 port belongs to. The options after switchport is used to set port operation mode for VLAN trunking. Cisco IOS command reference
"no switchport" enabled L3 features on the port, you can give it an IP address, perform ip routing etc, which is usually seen on a Layer 3 switch, aka a Router with (almost) all Ethernet ports.
When I first came to network engineering, I kept forgetting to set "no switchport" and "ip routing" where I needed layer 3 features.
Specifically concerning negotiate or nonegotiate ...
By default, the negotiation port setting is on, that is , the ability to negotiate a trunk port (if not a trunk the port becomes an access port.) To see all a ports settings use the useful command show interfaces switchport
NOTE: nonegotiation can be used on an access link as well, a clue why it is used - it saves on network activity and CPU cycles, because DTP is off.
A port set with nonegotiate still forms a trunk link with (and only with) an opposing port set to trunk. Both ports must be set using switchport mode trunk command
I confess I am all theory and not a networking pro! Happy to be corrected
EDIT: using nonegotiation is used when linking a Cisco switch to a non Cisco switch that does not understand DTP, and so gets confused by DTP messages. The DTP protocol agrees the encapsulation between the two interfaces, all switches will use the IEEE 802.1Q standard (all Cisco switches do now as well, ISL is legacy.) so there is the common theme, there is no need for negotiating. If you know definitely which ports will trunk and which will be access, hard code them that way and turn off negotiation, which can cause problems
switchport mode access - This command puts the interface (access port) into permanent nontrunking mode. The interface will generate DTP frames, negotiating with the neighboring interface to convert the link into a nontrunk link. The interface becomes a nontrunk interface even if the neighboring interface does not agree to the change.
switchport mode dynamic desirable - This command makes the interface actively attempt to convert the link to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode. This is the default mode for all Ethernet interfaces. If the neighboring interface is set to the access or non-negotiate mode, the link will become a non-trunking link.
switchport mode dynamic auto – This command makes the interface willing to convert the link to a trunk link if the neighboring interface is set to trunk or desirable mode. Otherwise, the link will become a non-trunking link.
switchport mode trunk – This command puts the interface into permanent trunking mode and negotiates to convert the link into a trunk link. The interface becomes a trunk interface even if the neighboring interface does not agree to the change.
switchport nonegotiate – Prevents the interface from generating DTP frames. You can use this command only when the interface switchport mode is access or trunk. You must manually configure the neighboring interface as a trunk interface to establish a trunk link, otherwise the link will be a non-trunking link.
