I manage a switch, and I saw that on one interface there were 19 different MAC addresses, all of them on the same VLAN, so I guessed that there was a switch connected to that interface. Since all MAC addresses were on the same VLAN, I configured that interface as an access mode interface, with that VLAN, but I do not know how it is configured the corresponding interface on the other switch.

  1. Is that wrong?
  2. Does that worsen the switching perfomance?
  3. Should I go to talk to the person who manages the other switch to know how he configured the interface connected to the switch that I manage?
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Commented Feb 19, 2018 at 17:52

3 Answers 3


You don't mention brand of the switch, any management software, or any configuration (in particular how that interface was previously configured), so I can only answer generically.

Most default switch MAC address tables have a relatively low timeout to age out entries. Just because you are only seeing 19 devices from the same VLAN on a port currently doesn't mean that there aren't other devices that will need to utilize a different VLAN on the trunk.

You say you "guessed that there was a switch connected to that interface." Guessing is a bad way to decide on making changes in a network. This indicates you do not understand the network in enough detail to be making the change and you should spend more time investigating before doing so.

Is that wrong?

Connecting two switches utilizing access ports? Wrong, no. It is considered a best practice to connect two switches with trunk/tagged ports. However, there are circumstances where using access ports is perfectly fine, if not necessary.

There may also be other considerations. For instance, there may be default configuration (or other configuration on the port) that could apply differently to access ports or trunk/tagged ports. For example, if your switches use VTP (or a similar mechanism), VTP only runs over trunk/tagged ports. Another example would be spanning-tree portfast (or similar), which can be applied by default to access ports along with features such as BPDU guard.

Wrong to make a change based on a guess? Yes, absolutely. Unless you have some pressing reason forcing your hand, you shouldn't make decisions in networking based on guesses. You are likely to create issues.

Does that worsen the switching perfomance?

No. There should be no noticeable difference in performance between an access port and trunk port. However, look a couple paragraphs up as there may be configuration that is applied differently to access ports and trunk/tagged ports. This configuration may have some impact on the port operation.

Should I go to talk to the person who manages the other switch to know how he configured the interface connected to the switch that I manage?

Yes and you really should have done so before making the change. When other parties are involved, it is almost always best to reach out to them before making any changes.

Reverse the situation, what if the other person were to make such a change without informing you? Go a bit further and say this disrupted operation on your network in some fashion. Wouldn't you prefer that you had been informed before hand so you wouldn't have to spend time and effort troubleshooting an issue created by someone else?


It may be a hub or WAP connected to that interface. In that case, it probably needs to be an access interface. If it is a switch, then you should match the configuration of the switch connected to it.

The best practice is to connect switches with a trunk link, even if it only has a single VLAN. You can restrict the VLANs allowed on the trunk to a single VLAN, native or not. You cannot add VLANs to an access interface later, but it is a simple matter to add VLANs to a trunk.

There will be no performance difference between an access interface and a trunk interface.

  • An AP (especially in an enterprise environment) may also require a trunk/tagged port to operate correctly.
    – YLearn
    Commented Aug 30, 2017 at 3:00
  • Yes, of course,or a WAP may use a CAP/WAP tunnel for the trunk, and a hub may be connecting something like servers with trunk interfaces, which is why I wrote "probably."
    – Ron Maupin
    Commented Aug 30, 2017 at 3:05
  • An AP using a CAPWAP tunnel is likely fine with an access port. However, with such a configuration you generally won't see multiple devices on a port in the switch's MAC address table as the traffic is tunneled back to the controller. If you are seeing multiple devices, then it is either operating in a standalone mode, or bridging data traffic directly on the wire, either of which will likely require a trunk.
    – YLearn
    Commented Aug 30, 2017 at 3:08

We get into some situations where a customer gives us a single access port because they want the attached switch to be a certain vlan. I've also seen this as a method to put an unmanaged switch on a vlan where programming a trunk port isn't an option.

CCTV (ip cameras) or feeding a small offics switch in a small business is a good example. All the cameras or office computers might need to be vlan 99 and they all connect to one switch. By using an access port on the Cisco side everything on the attached switch will "be on" vlan 99 (eventually untagged traffic will be tagged 99 at the Cisco switch interface).

An access port is just a un-tagged vlan port. In HP switches the port would be called access. It'd just be untagged vlan 99. It may not be best practice but those are a couple reasons it's done.

Answers to your questions

1) It's not wrong, it'll work fine but not recommended if possible

2) Switch performance won't be affected in the sense of utilization of hardware or speed based on the access port alone.

3) You could talk to that person to get a better understanding of why they did it and to understand your network better.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.