Trunks and 802.1Q tagging

Why trunks?

Say VLANs 10, 20 and 30 exist on two switches, one on each floor. Without trunks you would need one cable per VLAN between the switches: three cables for three VLANs, fifty cables for fifty VLANs. A trunk is a single link that carries the traffic of many VLANs. To keep the VLANs apart on that shared cable, each frame is labelled with its VLAN number.

The 802.1Q tag

IEEE 802.1Q is the standard way to tag frames. The switch inserts a 4-byte tag between the source MAC address and the EtherType field of the Ethernet frame, and recalculates the frame check sequence (FCS). The receiving switch reads the tag, removes it, and delivers the frame in the right VLAN.

Cisco also had an older protocol of its own, ISL, which wrapped the whole frame instead of adding a tag. It is obsolete and most current switches support only 802.1Q.

The native VLAN

On an 802.1Q trunk, frames in one special VLAN, the native VLAN, are sent without a tag. Any untagged frame that arrives on the trunk is placed in the native VLAN. By default the native VLAN is VLAN 1.

The native VLAN must be the same on both ends. If SW1 uses native VLAN 1 and SW2 uses native VLAN 99, an untagged frame from VLAN 1 on SW1 lands in VLAN 99 on SW2: traffic leaks between VLANs. CDP notices this and logs a "native VLAN mismatch" message.

For security, change the native VLAN to an unused VLAN (for example 999) on both ends, and never put users in it. Attackers can abuse the default native VLAN with a "double tagging" VLAN hopping attack, sending a frame with two tags so that it ends up in a VLAN they should not reach.

Configuring a trunk

SW1(config)# interface gigabitEthernet 0/1
SW1(config-if)# switchport trunk encapsulation dot1q
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 999
SW1(config-if)# switchport trunk allowed vlan 10,20,30
SW1(config-if)# switchport nonegotiate

The allowed VLAN list and the add trap

By default a trunk carries all VLANs. switchport trunk allowed vlan limits it to a list. The catch: giving a plain list REPLACES the old list.

SW1(config-if)# switchport trunk allowed vlan 10,20
SW1(config-if)# switchport trunk allowed vlan 30
! Now ONLY VLAN 30 is allowed. VLANs 10 and 20 just went down on this trunk.

SW1(config-if)# switchport trunk allowed vlan 10,20
SW1(config-if)# switchport trunk allowed vlan add 30
! Correct: VLANs 10, 20 and 30 are allowed.

DTP: trunks that negotiate themselves

DTP (Dynamic Trunking Protocol) is a Cisco protocol that lets two switch ports agree whether to become a trunk. The port modes are: access (never a trunk), trunk (always a trunk), dynamic desirable (actively asks to trunk) and dynamic auto (trunks only if the other side asks).

The trap: dynamic auto plus dynamic auto gives an access link, because both sides wait for the other to ask. Many current Cisco switches use dynamic auto by default, so two new switches cabled together often do not form a trunk. switchport nonegotiate stops DTP frames entirely; use it with a hard-coded trunk.

Verifying: show interfaces trunk

SW1# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1       on           802.1q         trunking      999

Port        Vlans allowed on trunk
Gi0/1       10,20,30

Port        Vlans allowed and active in management domain
Gi0/1       10,20,30

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       10,20,30