2

Is there any privilege using trunk mode over access mode when only one vlan is allowed on the trunk port?an example:

#switchport mode access vlan 2

&

#switchport mode trunk
#switchport trunk allowed vlan 2

Thanks!

Improve this question
2
  • 1
    To be clear, the command switchport access vlan ## simply sets the access mode VLAN, and does not actually set the port as an Access port. You need the switchport mode access command as well to explicitly set the port as an Access Port. Without this command, whether the port becomes Access or Trunk will be based upon the Dynamic Trunking Protocol (DTP).
    – Eddie
    Sep 6, 2016 at 16:33
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 14, 2017 at 4:08

7 Answers 7

Reset to default
3

Provide both sides of the link are configured the same way, both method will work.
But networks evolve.

If latter you want to add more vlans on the link, and it's configured as access, you will have to convert it to trunk and this will cause a service interruption.

If configured as trunk, you will only need to allow the new vlan, without disrupting service, so it will be easier.

Improve this answer
0
3

the difference is that ;if you use trunk mode ,VLANs 1 and 1002 through 1005 are reserved VLANs and cannot be removed from any trunk link , automatically the native vlan will pass through the link with the allowed vlans . so you will get OTHER vlan on the trunk . but when you use access mode you made sure that only one vlan will pass through the link. please make use of this link

Improve this answer
2

The difference is that in the latter scenario, frames will be sent over the link with a 802.1q tag with vlan ID 2, and only frames tagged in the same way will be permitted on ingress. In other words the other side of the link needs be configured the same way.

Unless you also configure the port to have vlan 2 as the native vlan, which is never tagged (unless you use a different trunking protocol like ISL). So in that scenario the behaviour is exactly the same.

Improve this answer
2

If you only have one VLAN traversing the link then you should follow best practices and use switchport mode access. Allowing VLAN 1 and 1002-1005 across the trunk provides a potential security issue as VLAN 1 carries a lot of system data for Cisco. Not to mention that all traffice coming from the other end (assuming the other end is a server or client) will not belong to a VLAN and that can cause further issues.

I try to stick to a more restrictive strategy. If I don't need for multiple VLANs to traverse a link, I always set it up as an access port.

Improve this answer
1

As others have point out, you can tag frames on a trunk with the VLAN, and most end devices don't understand VLAN tags.

There are a couple of things that also come into play on a Cisco switch:

Using the recommended global spanning-tree portfast default and spanning-tree portfast bpduguard default commands only affect access ports. You must specifically use the trunk keyword to affect trunks, too.

Improve this answer
0

The only privilege you get if using a trunk port is multiple VLAN tagging is allowed.

Using trunk ports where an access port can do the job can create security issues and it will also slow down the network, as all broadcast from allowed VLAN will be forwarded to all the trunk ports by default.

It all depends on the purpose of device connected to the port.

Suppose, if the device acting as a Network attached Storage server then it should be connected to a trunk port. Otherwise clients from multiple VLAN won't be able to access the required storage.

Improve this answer
4
  • Not sure I understand the part about slowing down the network: are you saying that broadcast frames are not sent out on access ports?
    – hertitu
    Sep 7, 2016 at 12:56
  • DNS servers certainly don't need to be in multiple vlans, as DNS is routed. And a DHCP server can be multi-homed in multiple vlans but can also be put in a single vlan, with dhcp requests being forwarded by a relay agent (e.g. the "ip helper-address" feature on a Cisco router).
    – hertitu
    Sep 7, 2016 at 12:59
  • You are right about DNS. Broadcast from only configured VLAN is allowed on access port.
    – Justin George
    Sep 7, 2016 at 17:47
  • So if you have an access port in vlan 2, and a trunk port that only allows vlan 2, then they will have the same amount of broadcast traffic, right? So then how would a trunk slow down the network?
    – hertitu
    Sep 7, 2016 at 20:48
0

IF you only need 1 vlan on that link, a trunk is not necessary.

Improve this answer
1
  • If you want to use CoS marking, you must have VLAN tags, and that means a trunk.
    – Ron Maupin ♦
    Sep 7, 2016 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.