How to configure trunk on Cisco Catalyst Switch

Hi Rene,

I have 2 doubts:

  1. I tried this on Packet Tracer.

One side of the link between the 2 switches, I set one side as TRUNK and other side as ACCESS.
Wen I do show trunk, it does show me a trunk on one side and not on the other.
Also I didnt see any port inconsistent state message.
What must be the error

  1. If one side is set to manual TRUNK and the other side to AUTO, how does the trunk link even form ? who is sending out negotiation packets in this case ???

Hi Vikas,

If one side is set to trunk and the other as access then you do have a mismatch. It’s possible that packet tracer doesn’t report this, it’s an emulator after all.

Even if you use static trunk or access mode, negotiation still takes place. This is done by DTP. Take a look at this lesson:

Cisco DTP (Dynamic Trunking Protocol)


Your left hand side description is correct. Since the incoming tag matches the native vlan of the trunk, the tag gets discarded. I suspect, however, that your scenario would break if you told your switch “switchport trunk native vlan tag” which means that even the native vlan keeps the tag. Since almost all PCs have no idea what a vlan tag is, it would discard the packet.

For your right hand side, I suspect the problem is not knowing what the access port VLAN is for connection from Switch 5 to Switch 6. If it is not vlan 10, this would explain the failure.

I was reading an article that mentioned a VLAN must not be tagged twice. When do we say the VLAN is tagged? If on cisco I use command vlan 30 name test. Than it just creates a pass thru vlan - this should not be tagging. If I assign an interface to it and give an IP address, is that called tagging? or If I just mention interface vlan 30 description test — is this the tagging. To summarize:

#vlan 30
#name Test Is this tagging

#interface vlan 30
#description TEST Is this tagging

config gi0/1

in continuation to previous mail:

config int gi0/1
swtichport mode access vlan 30 Is this tagging?

Hello Pankaj.

Tagging occurs when a frame exits a switch on a trunk port. If you have a trunk port with VLANs 10 and 20 allowed on it for example, and you send a frame from VLAN 10 through that trunk, as it exits the physical port, a tag of “10” will be placed in the header of the frame.

So in none of your above examples is tagging being configured. The following configuration configures a trunk:

interface fastethernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20

These commands tell the switch that frames that exit fastethernet 0/1 must be tagged with the appropriate VLAN tag.

Now you mention that you read that you should not tag a frame twice. The article you read is probably referring to double tagging as a method of attacking networked resources to gain access to traffic on other VLANs that would normally not be accessible. This is a security issue that you can read more about here:

There are cases where you do want to have two tags such as when you use q-in-q. You can read more about it in Rene’s lessons here:

I hope this has been helpful!


very nice article rene.
If I am connecting a router (lets say ASR1000) with a switch (lets say 3750)…what will be the port type on switch ?
and what config is needed on both router and switch.

Many thanks

This question can’t be answered generically. How you configure the switchport is entirely dependent on your environment and what you are trying to do. It could be either an access layer port or a trunk port.

The more interesting of the two cases would be when you have multiple VLANs, and you are using the router as a “Router on a stick.” In the example below, we are using two VLANs, 2 (data) and 3 (phones).

Router Config (partial)

interface GigabitEthernet0/0.2
 description DATA
 encapsulation dot1Q 2
 ip address
interface GigabitEthernet0/0.3
 description PHONES
 encapsulation dot1Q 3
 ip address

Switch Config (partial)

vlan 2
 name DATA
vlan 3
 name PHONES
interface GigabitEthernet0/3
 description Connection-To-Router-Gig0/0
 switchport trunk allowed vlan 2,3
 switchport mode trunk

Thanks Awesome really appropriate you effort.

  1. SwitchA(config)#interface fa0/14

  2. SwitchA(config-if)#switchport mode dynamic auto

  3. SwitchA(config)#interface fa0/14

  4. SwitchB(config-if)#switchport mode dynamic auto

In the above need very small correction NO 3 should be SwitchB

SwitchB(config)#interface fa0/14

19 posts were merged into an existing topic: How to configure trunk on Cisco Catalyst Switch

Following your guide step by step on two Catalyst 2950s, when I connect the two switches together I am getting: Operational Mode down. I have tested both the cable and ports to make sure they are operational and both ports are “no shut”. Any suggestions?

Hello Rachael,

Operational mode down means that interface itself is down. If you look at the interface status, what does it say?

SW1#show interfaces GigabitEthernet 0/1
GigabitEthernet0/1 is down, line protocol is down (notconnect) 

If it shows up as down, are you sure you used a crossover cable between the 2950 switches? They don’t support autosensing so it has to be a crossover cable:


I have a question. I have created the trunks like the tutorial, my issue is I cannot get Switch A to talk my laptop that is connected to switch A in a real lab situation. I have statically set my laptop to have the ip address and I have connected the other end of the ethernet cable to port 0/1 on the switch, I have set the switch to be in access mode on vlan 50. If I ping from the switch the pings fail and device is not showing in the mac table, although the interface is up up. Could you recommend any check I can preform between the switch and the PC.

Have you gave the switch an IP address? I believe you need to give the switch an IP address with the commands in global config and interface config mode.

int vlan 50
ip add 192.168.1.x

Please let me know if this helps or if you already have assigned an IP to the switch.

Hello Jagdeep.

Kevin is right. You should have an IP address set up on the switch itself, specifically on the vlan 50 interface. Once you assign that VLAN to the access port 0/1 and the port comes up, the VLAN interface should become pingable, and you should be able to ping the laptop from the switch.

I hope this has been helpful!


Thanks, I will give it a go, I have not done that. I was speaking to a guy in my office and he was explaining that, although I had added VLAN 50, at layer 2 level. I would still need to give the VLAN an address to allow layer 3 routing.

1 Like

I have got it to work with the suggestions made, the mistake I made was not entering int vlan 50 as I was entering vlan 50 on its own and then trying to add the ip address which fails.


Hi Guys - I’m currently studying for a CCDA and the book states that best practice for designing the access layer is to set trunks to ON and ON with no-negotiate. I get the no-negotiate part but can’t figure out what the ‘On and ON’ part relates to? Thanks - Gareth.


could be wrong, but i think there is a typo here in this image. I believe the top box is supposed to be SW1 configs, and bottom is supposed to be SW2.

1 Like

Hello Gareth

The following are the options that you can use for configuring a switchport. These are taken from this Cisco documentation.

  • switchport mode access: Puts the interface (access port) into permanent nontrunking mode and negotiates to convert the link into a nontrunk link. The interface becomes a nontrunk interface, regardless of whether the neighboring interface is a trunk interface.
  • switchport mode dynamic auto: Makes the interface able to convert the link to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk or desirable mode. The default switchport mode for newer Cisco switch Ethernet interfaces is dynamic auto. Note that if two Cisco switches are left to the common default setting of auto, a trunk will never form.
  • switchport mode dynamic desirable: Makes the interface actively attempt to convert the link to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode. This is the default switchport mode on older switches, such as the Catalyst 2950 and 3550 Series switches.
  • switchport mode trunk: Puts the interface into permanent trunking mode and negotiates to convert the neighboring link into a trunk link. The interface becomes a trunk interface even if the neighboring interface is not a trunk interface.
  • switchport nonegotiate: Prevents the interface from generating DTP frames. You can use this command only when the interface switchport mode is access or trunk. You must manually configure the neighboring interface as a trunk interface to establish a trunk link.

Now the terminology used to describe the configuration as “ON” and “ON” is an unfortunate and confusing use of a terminology that is more often used for etherchannel. Etherchannel also has an autoconfiguration feature where you can configure the etherchannel on both ends with any of the following commands:

channel-group 1 mode on
channel-group 1 mode auto
channel-group 1 mode desirable

The first of these commands hardwires etherchannel to function without negotiation. This is an “ON” and “ON” configuration situation.

Once again, unfortunately, the same terminology is used for Dynamic Trunking Protocol (DTP). To answer your question, an “ON and ON” configuration simply means nothing more than configuring both ends of the trunk as switchport mode trunk and using the switchport nonegotiate command on both ends of the trunk.

I hope this has been helpful!