200-301 · Network Access · Updated August 3, 2026

Access Port or Trunk? Wiring a Cisco Access Point Correctly

A lightweight access point running in local mode connects to an access port in the AP management VLAN. Client traffic never appears on that wire as tagged frames, because it is encapsulated inside the CAPWAP (Control and Provisioning of Wireless Access Points) tunnel that runs from the AP’s single IP address to the wireless LAN controller. An autonomous access point, or a FlexConnect access point doing local switching, needs an 802.1Q trunk instead, because those devices place client VLAN traffic onto the wire themselves.

Why local mode only needs an access port

In a centralized design, the switch never sees a wireless client’s frames as such. The AP takes the 802.11 frame, converts it, and wraps it in a CAPWAP data packet addressed from the AP’s own IP address to the controller’s management interface address, one of the controller interface types that a WLC design has to get right. Everything leaving the AP’s Ethernet port is IP traffic from one host in one subnet. There is nothing to tag, so there is nothing for a trunk to carry:

SW1(config)# interface GigabitEthernet1/0/12
SW1(config-if)# description AP-FLOOR2-NORTH
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 40
SW1(config-if)# spanning-tree portfast

VLAN 40 here is the AP management VLAN, the subnet where the AP gets its DHCP address and from which it discovers and joins the controller. PortFast is appropriate because the AP is a single host from the switch’s perspective, and pairing it with BPDU guard is standard practice. See PortFast, BPDU guard, root guard, and loop guard for that configuration.

When a trunk is required

Two device types put tagged client traffic on the wire:

Autonomous access points. These have no controller. Each SSID (service set identifier) is mapped to a VLAN in the AP’s own configuration, and the AP tags client frames accordingly. The switch port must trunk those VLANs, and the AP’s own management traffic normally rides untagged on the native VLAN.
FlexConnect access points with locally switched WLANs. These do have a controller, but the WLANs configured for local switching bypass the CAPWAP data tunnel and drop client traffic straight onto the branch LAN with the VLAN tag the FlexConnect VLAN mapping specifies. The AP’s management traffic and its control tunnel to the controller ride on the native VLAN.

SW1(config)# interface GigabitEthernet1/0/18
SW1(config-if)# description AP-BRANCH-FLEX
SW1(config-if)# switchport trunk encapsulation dot1q
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 40
SW1(config-if)# switchport trunk allowed vlan 40,60,70
SW1(config-if)# spanning-tree portfast trunk

The switchport trunk encapsulation dot1q line is only needed on platforms that support more than one encapsulation; on switches that only do 802.1Q the parser rejects it. Set the trunk statically rather than leaving it to DTP (Dynamic Trunking Protocol), because an access point does not negotiate. A port left in a dynamic mode with nothing to negotiate against falls back to access, which is exactly the wrong outcome here; the DTP mode pairings show why.

	Local mode lightweight AP	Autonomous AP or FlexConnect local switching
Switch port mode	Access	802.1Q trunk
VLANs on the wire	One (AP management)	AP management as native, plus each client VLAN tagged
Client traffic path	Tunneled to the controller inside CAPWAP	Switched locally by the AP onto the wired VLANs
Where VLAN mapping lives	Controller (dynamic interface per WLAN)	AP configuration or FlexConnect VLAN mapping
Effect of losing the controller	AP stops serving clients	Locally switched WLANs keep working in standalone mode

Symptoms when the port mode is wrong

Trunk configured where an access port belongs. This often appears to work, because the AP’s untagged management traffic lands in the native VLAN and the AP joins the controller normally. The exposure is a native VLAN mismatch against the AP’s expected management VLAN, in which case the AP receives no DHCP address and never joins the controller at all. The port sits up and up with a device that never appears in the controller’s AP list.

Access port configured where a trunk belongs. The tell is a partial failure. The AP itself works: it is powered, it has an address, it appears on the controller, and it broadcasts every SSID. Clients associate successfully and then get nothing. They fail DHCP and end up with an APIPA address, because the tagged frames the AP sends for those client VLANs are dropped by an access port, which accepts only untagged traffic. Anything mapped to the port’s access VLAN may work while everything else fails, which makes the pattern look like a DHCP scope problem until you check the port.

Verify with:

SW1# show interfaces GigabitEthernet1/0/12 switchport
SW1# show interfaces trunk
SW1# show cdp neighbors GigabitEthernet1/0/12 detail

CDP (Cisco Discovery Protocol) is Cisco-proprietary and reports the AP’s platform, its IP address, and the native VLAN it believes it is using, which resolves a mismatch argument quickly.

Powering the access point

Most access points are powered over the same cable. Before ordering hardware, check the switch’s inline power budget:

SW1# show power inline

Module   Available     Used     Remaining
          (Watts)     (Watts)    (Watts)
------   ---------   --------   ---------
1           370.0      124.5       245.5

Interface Admin  Oper       Power   Device              Class Max
                            (Watts)
--------- ------ ---------- ------- ------------------- ----- ----
Gi1/0/12  auto   on         30.0    AIR-AP2802I-B-K9    4     30.0
Gi1/0/18  auto   on         30.0    AIR-AP2802I-B-K9    4     30.0
Gi1/0/24  auto   off        0.0     n/a                 n/a   30.0

The header gives the three figures a capacity decision needs: total available, currently committed, and remaining. The per-port table then shows administrative and operational power state, the wattage granted, the detected device, and its class. show environment power is a different report covering the physical power supplies and fans, and show interfaces status says nothing about power at all.

Class 3 devices draw up to 15.4 watts at the source under 802.3af, class 4 up to 30 watts under 802.3at (PoE+), and 802.3bt raises that further for the highest-end access points. An AP that boots, joins, and then runs with one radio disabled is usually being granted less power than it wants.

How the 200-301 exam tests this

Choosing the port mode from a design description. A scenario states that all wireless traffic is tunneled to a controller and asks how the AP’s switch port should be configured. Centralized switching means one VLAN on the wire, so the answer is an access port, and the trunk options are the distractors.
Diagnosing a partial failure. A scenario has an AP that is online and broadcasting while clients on most SSIDs cannot obtain addresses. The port mode does not match a locally switching AP, so tagged client frames are being discarded.
PoE budget verification. A question asks which command reports total, used, and remaining inline power in one place before adding access points. show power inline is the only one of the plausible-looking choices that produces all three, and show inline power status is not IOS syntax.

These scenarios reward pattern recognition, and pattern recognition comes from reps — enough CCNA practice questions and the design description alone tells you the port mode.

Quick reference

Local mode lightweight AP: access port in the AP management VLAN, PortFast, BPDU guard.
Autonomous AP or FlexConnect with local switching: static 802.1Q trunk, native VLAN equal to the AP management VLAN, client VLANs allowed.
All client traffic in a local-mode design rides inside the CAPWAP tunnel from the AP’s single IP address, so the switch sees only one VLAN.
Wrong access port on a locally switching AP: the AP joins and beacons, but clients fail DHCP on the tagged VLANs.
Wrong native VLAN on a trunk to an AP: the AP never gets an address and never joins the controller.
Configure the trunk statically; access points do not participate in DTP negotiation.
show power inline reports available, used, and remaining watts plus per-port class and granted power.
Which mode an AP is running, and what each mode does, is covered in Cisco AP modes and CAPWAP.