3.1.a Troubleshoot static and dynamic 802.1q trunking protocols

A trunk is a link that carries more than one VLAN. 802.1Q does this by adding a VLAN tag to Ethernet frames as they cross the trunk. The receiving switch reads the tag and keeps the frame inside the correct VLAN.

That is the whole idea. Most trunk problems come from one of four places:

1. The link is not actually trunking.
2. The VLAN is not allowed on the trunk.
3. The native VLAN does not match.
4. Dynamic Trunking Protocol (DTP) negotiated something different than you expected.

The mental model

An access port belongs to one VLAN. A trunk port can carry many VLANs. Frames for most VLANs are tagged. Frames for the native VLAN are normally untagged.

If VLAN 10 works on SW1 but not on SW2, do not start by blaming routing. First ask: did VLAN 10 cross every Layer 2 link in the path?

PC1 · VLAN 10 · untagged at access -> SW1 Gi1/0/10 · access VLAN 10 -> SW1 Gi1/0/1 · trunk -> 802.1Q trunk · tagged Eth + VID 10 -> SW2 Gi1/0/1 · trunk -> SW2 Gi1/0/20 · access VLAN 10 -> PC2 · VLAN 10 · untagged delivery

Tagged VLAN 10 on trunk
Ethernet · 802.1Q VID=10 · payload
Needs vlan 10 + allowed on trunk both sides
Native VLAN 999 on trunk
Ethernet · payload only — no 802.1Q tag
Needs matching native vlan on both switches

VLAN 10 broken, other VLANs OK
allowed list or missing vlan 10
CDP native VLAN mismatch
native vlan differs on one side
No trunk at all
mode / DTP auto + auto

Tagged VLANs must be in switchport trunk allowed vlan on both ends. The native VLAN must match on both sides or you get silent mis-forwarding, not a clean error.

Static vs dynamic trunking

Static trunking means you tell the interface to be a trunk:

switchport mode trunk

Dynamic trunking means DTP negotiates whether a trunk forms. Common modes:

For real networks, static trunks are clearer. For the exam, know how DTP can surprise you.

Good trunk configuration

Example: SW1 and SW2 connect on GigabitEthernet1/0/1. VLANs 10 and 20 should cross the link. VLAN 999 is the native VLAN.

vlan 10
 name USERS
vlan 20
 name VOICE
vlan 999
 name NATIVE_UNUSED
!
interface GigabitEthernet1/0/1
 description Trunk to SW2
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,999
 switchport nonegotiate
 no shutdown

Many modern Catalyst switches do not require switchport trunk encapsulation dot1q because 802.1Q is the only supported encapsulation. If the command is unavailable, that is not a problem.

Verification commands

Start here:

show interfaces trunk
show interfaces gi1/0/1 switchport
show vlan brief
show dtp interface gi1/0/1
show interfaces status

What you want to see:

• The interface is listed under show interfaces trunk.
• The mode is trunk, not access.
• The native VLAN matches on both sides.
• The VLAN you need is allowed and active.
• DTP is either disabled intentionally or negotiated correctly.

Common failures

VLAN not allowed

Symptom: VLAN 10 hosts on opposite switches cannot talk, but other VLANs work.

Check:

show interfaces trunk

Fix:

interface gi1/0/1
 switchport trunk allowed vlan add 10

Do not accidentally replace the whole allowed list unless you mean it. allowed vlan 10 replaces the list. allowed vlan add 10 adds VLAN 10.

Native VLAN mismatch

Symptom: CDP complains about native VLAN mismatch, or untagged traffic behaves strangely.

Check:

show interfaces trunk
show cdp neighbors detail

Fix both ends:

interface gi1/0/1
 switchport trunk native vlan 999

Best practice: use an unused native VLAN. Do not put users on the native VLAN.

Dynamic auto on both sides

Symptom: You expected a trunk, but the link is access.

Two dynamic auto ports do not actively ask to trunk. Neither side starts the negotiation.

Fix with static trunking:

interface gi1/0/1
 switchport mode trunk

Or make one side dynamic desirable, but static is usually clearer.

VLAN exists on one switch only

A trunk can allow VLAN 30, but if VLAN 30 does not exist locally, the switch cannot forward that VLAN correctly.

Check:

show vlan brief
show interfaces trunk

Fix:

vlan 30
 name GUEST

Lab: Build and break a trunk

Topology

PC1 -> SW1 Gi1/0/10 SW1 Gi1/0/1 -> Gi1/0/1 SW2 PC2 -> SW2 Gi1/0/10

PC1 and PC2 are in VLAN 10.

Task 1: Configure VLAN 10 and the trunk

On both switches:

vlan 10
 name USERS
vlan 999
 name NATIVE_UNUSED
!
interface gi1/0/10
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
!
interface gi1/0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,999
 switchport nonegotiate

Task 2: Verify

show interfaces trunk
show vlan brief
show interfaces gi1/0/1 switchport

Ping between PC1 and PC2.

Task 3: Break it

On SW2:

interface gi1/0/1
 switchport trunk allowed vlan remove 10

Predict the symptom. Then verify with:

show interfaces trunk

Task 4: Fix it

interface gi1/0/1
 switchport trunk allowed vlan add 10

Exam traps

• A trunk can be up/up and still not carry the VLAN you need.
• Native VLAN mismatches affect untagged traffic and are easy to miss if tagged VLANs still work.
• dynamic auto plus dynamic auto does not form a trunk.
• allowed vlan replaces the list; allowed vlan add modifies it.
• VLANs must exist locally on the switches that forward them.

Quick checklist

1. Are both sides operationally trunking?
2. Is the correct native VLAN used on both sides?
3. Are required VLANs created and allowed?
4. Is DTP behaving as expected or disabled intentionally?
5. Is pruning or an allowed-list blocking the VLAN?
6. Does the MAC table show expected learning per VLAN?
7. Are STP states blocking the VLAN on the path?