Is there any privilege using trunk mode over access mode when only one vlan is allowed on the trunk port?an example:
#switchport mode access vlan 2
#switchport mode trunk #switchport trunk allowed vlan 2
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
Provide both sides of the link are configured the same way, both method will work.
But networks evolve.
If latter you want to add more vlans on the link, and it's configured as access, you will have to convert it to trunk and this will cause a service interruption.
If configured as trunk, you will only need to allow the new vlan, without disrupting service, so it will be easier.
the difference is that ;if you use trunk mode ,
VLANs 1 and 1002 through 1005 are reserved VLANs and cannot be removed from any trunk link , automatically the native vlan will pass through the link with the allowed vlans . so you will get OTHER vlan on the trunk . but when you use access mode you made sure that only one vlan will pass through the link. please make use of this link
The difference is that in the latter scenario, frames will be sent over the link with a 802.1q tag with vlan ID 2, and only frames tagged in the same way will be permitted on ingress. In other words the other side of the link needs be configured the same way.
Unless you also configure the port to have vlan 2 as the native vlan, which is never tagged (unless you use a different trunking protocol like ISL). So in that scenario the behaviour is exactly the same.
If you only have one VLAN traversing the link then you should follow best practices and use switchport mode access. Allowing VLAN 1 and 1002-1005 across the trunk provides a potential security issue as VLAN 1 carries a lot of system data for Cisco. Not to mention that all traffice coming from the other end (assuming the other end is a server or client) will not belong to a VLAN and that can cause further issues.
I try to stick to a more restrictive strategy. If I don't need for multiple VLANs to traverse a link, I always set it up as an access port.
As others have point out, you can tag frames on a trunk with the VLAN, and most end devices don't understand VLAN tags.
There are a couple of things that also come into play on a Cisco switch:
Using the recommended global
spanning-tree portfast default and
spanning-tree portfast bpduguard default commands only affect access ports. You must specifically use the
trunk keyword to affect trunks, too.
The only privilege you get if using a trunk port is multiple VLAN tagging is allowed.
Using trunk ports where an access port can do the job can create security issues and it will also slow down the network, as all broadcast from allowed VLAN will be forwarded to all the trunk ports by default.
It all depends on the purpose of device connected to the port.
Suppose, if the device acting as a Network attached Storage server then it should be connected to a trunk port. Otherwise clients from multiple VLAN won't be able to access the required storage.