200-301 · Network Access · Updated August 3, 2026

802.1Q Trunking on Cisco: Tags, Native VLAN, and Allowed Lists

A trunk carries traffic for many VLANs across a single link by inserting a four-byte IEEE 802.1Q tag into each frame, with one exception: frames belonging to the native VLAN cross untagged. On a Catalyst switch a trunk is built with switchport mode trunk on the interface, and by default it permits every VLAN ID from 1 to 4094 until switchport trunk allowed vlan narrows the list. That allowed list is evaluated independently on each end of the link, and the keyword you use with it decides whether you edit the list or replace it outright.

The 802.1Q tag

The tag is inserted immediately after the source MAC address, ahead of the EtherType field, and the frame check sequence is recalculated afterward. Its four bytes hold two halves:

A 16-bit TPID (tag protocol identifier) fixed at 0x8100, which is what identifies the frame as tagged.
A 16-bit TCI (tag control information) split into a 3-bit PCP (priority code point) field used for class-of-service marking, a 1-bit DEI (drop eligible indicator), and a 12-bit VID (VLAN identifier).

Twelve bits give 4096 values. IDs 0 and 4095 are reserved, which is why the usable range stops at 4094 and why a frame tagged with VLAN ID 0 carries priority bits but no VLAN assignment. The four added bytes push the maximum Ethernet frame from 1518 to 1522 bytes.

802.1Q is the IEEE standard and the only encapsulation on current Catalyst platforms. ISL (Inter-Switch Link) is the legacy Cisco-proprietary alternative, which wrapped the whole original frame in a new header and trailer instead of inserting a tag. Older platforms supporting both required switchport trunk encapsulation dot1q before the mode command; a platform that supports only 802.1Q rejects that command entirely.

Configuring a trunk

SW1(config)# interface GigabitEthernet1/0/24
SW1(config-if)# switchport trunk encapsulation dot1q
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 888
SW1(config-if)# switchport trunk allowed vlan 10,20,30
SW1(config-if)# switchport nonegotiate

switchport mode trunk pins the administrative mode. The port trunks whether or not the neighbor agrees, which is a separate topic from how a link decides its role; see DTP trunk negotiation for the mode pairings and for why switchport nonegotiate is accepted only on a statically configured port.

The native VLAN is the one VLAN whose frames traverse the trunk with no tag applied. It defaults to VLAN 1 and must be identical on both ends; see native VLAN mismatch for the consequences when it is not. The native VLAN receives no exemption from the allowed list, and that catches people out: designate VLAN 888 as native, forget to permit it, and the trunk carries nothing for that VLAN at all while the configuration still reads native vlan 888.

Allowed VLAN list keywords

Command form	Effect on the permitted list
`switchport trunk allowed vlan 10,20,30`	Replaces the entire list with exactly those VLANs
`switchport trunk allowed vlan add 50`	Appends to whatever the list currently holds
`switchport trunk allowed vlan remove 40`	Subtracts the named VLANs, leaving the rest untouched
`switchport trunk allowed vlan except 40`	Replaces the list with every VLAN other than the named ones
`switchport trunk allowed vlan all`	Sets the list to 1-4094
`switchport trunk allowed vlan none`	Empties the list; the port still trunks but forwards nothing
`no switchport trunk allowed vlan`	Removes the restriction, returning the list to 1-4094

There is no default keyword and no any keyword on this command, and the clear family of commands operates on counters and dynamic state at the privileged exec prompt rather than on interface configuration.

The replacement behavior is the trap. A trunk permitting 10, 20, and 30 that receives switchport trunk allowed vlan 40 ends up permitting VLAN 40 and nothing else, with the three production VLANs dropped silently and VLAN 1 no exception. The list is also not validated against the VLAN database, so permitting a VLAN that exists nowhere is accepted without complaint.

Sequencing follows the same logic. none followed by add 10,20 yields exactly VLANs 10 and 20, because add appends to a list that is empty at that moment. Reaching a target of 10, 20, and 30 from a starting list of 10, 20, 30, and 40 works two ways: remove 40 edits in place, and the bare list 10,20,30 replaces it with the same end state. The subtractive form is safer on a production trunk, because a typo affects only the VLAN named.

Reading show interfaces trunk

SW2# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi1/0/1     desirable    802.1q         trunking      1

Port        Vlans allowed on trunk
Gi1/0/1     1,10,20,30

Port        Vlans allowed and active in management domain
Gi1/0/1     1,10,20

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/1     1,10,20

The four blocks form a funnel, and knowing which stage a VLAN falls out of names the fault.

Vlans allowed on trunk reflects configuration only. A trunk that has never been restricted reads 1-4094 here. This list ignores whether the VLANs exist locally.
Vlans allowed and active in management domain is the first list minus VLANs that are not defined in the local VLAN database and minus VLANs that have been shut down. A VLAN that appears in list one but vanishes in list two is missing or shut down on this switch, confirmed with show vlan brief and fixed by creating the VLAN on the local switch.
Vlans in spanning tree forwarding state and not pruned is the second list minus VLANs whose port is blocking for spanning tree and minus VLANs removed by VTP pruning. A VLAN that survives to list two and disappears in list three is a spanning-tree or pruning matter, not a configuration matter.

In the header row, the Mode column reports the local administrative setting (on, off, auto, desirable, or nonegotiate), Status reports the operational outcome, and Native vlan reports which VLAN travels untagged on this end.

Typed with no interface argument, the command lists only ports that are operationally trunking, so empty output on a link that was supposed to be a trunk is itself the diagnosis. Naming an interface, as in show interfaces gigabitethernet 1/0/24 trunk, prints that port’s trunk attributes even when it is not trunking. A field-by-field walkthrough of the whole report is in reading show interfaces trunk.

Independent evaluation on each end

Two switches never compare allowed lists. SW1 permitting VLAN 45 while SW2 does not means SW1 tags and transmits VLAN 45 frames that SW2 discards on arrival, while every mutually permitted VLAN passes normally. The symptom is one VLAN failing across the link with all others healthy, and only inspecting both ends reveals it. The remedy is switchport trunk allowed vlan add 45 on the deficient switch.

How the 200-301 exam tests this

Keyword outcome. A trunk with a known list receives one allowed-vlan command and you state the resulting list. Distinguish replace from add, remove, except, all, and none.
One VLAN fails, the rest work. Two show interfaces trunk captures differ by one VLAN in the first list. The cause is the asymmetric allowed list, and the answer adds the VLAN on the deficient end.
Funnel reading. A VLAN sits in the first list but is absent from the second. The two acceptable causes are that it is undefined on the local switch or that it is shut down, and a blocked VLAN is the distractor because blocking removes a VLAN only between lists two and three.
Composite change window. A multi-command answer must add VLANs, move the native VLAN, remove a VLAN, and silence negotiation, with a stated requirement to edit rather than replace the list. The winning set uses add and remove, permits the new native VLAN explicitly, and places switchport nonegotiate on a port whose mode is already statically trunk.

The funnel logic only becomes automatic with repetition — work through CCNA practice questions until reading all three lists takes seconds.

Quick reference

The 802.1Q tag is four bytes: TPID 0x8100 plus a TCI holding 3 priority bits, 1 DEI bit, and a 12-bit VLAN ID; usable IDs are 1 to 4094.
Native VLAN frames cross the trunk untagged; every other permitted VLAN is tagged.
A trunk with no allowed-vlan command permits 1-4094.
A bare VLAN list replaces the whole allowed list, including VLAN 1 and the native VLAN.
The native VLAN is not exempt from the allowed list; removing it silently kills untagged traffic.
none leaves the port trunking with nothing permitted, so trunk output still lists it while traffic stops.
The three VLAN lists in show interfaces trunk subtract undefined and shut VLANs, then blocked and pruned VLANs.
show interfaces trunk with no interface argument shows only operational trunks; empty output means nothing is trunking.