200-301 · Network Access · Updated August 3, 2026

Reading show interfaces trunk: Allowed vs Active vs Forwarding

show interfaces trunk prints four blocks: a header describing each trunking port, then three separate VLAN lists. Those lists are not repetitions of each other. The first is what the port is configured to permit, the second narrows that to VLANs the local switch actually knows about and has active, and the third narrows it again to VLANs the port is really forwarding right now. Reading a trunk correctly means knowing which of the three a VLAN dropped out of, because each drop has a different cause and a different fix.

The full output

SW1# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi1/0/24    on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gi1/0/24    1-60

Port        Vlans allowed and active in management domain
Gi1/0/24    1,10,20,30,40

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/24    1,10,20,40

Only ports that are currently trunking appear at all. The header line reports the administrative mode (on, desirable, auto, nonegotiate), the tagging encapsulation, the operational status, and the native VLAN for untagged frames. A trunk whose status reads anything other than trunking is a different problem, usually DTP negotiation or a mode mismatch.

The three lists

List	Source of the list	A VLAN is missing because
Vlans allowed on trunk	The `switchport trunk allowed vlan` command on this port. Defaults to 1-4094.	Someone restricted the list, or used the `remove` keyword.
Vlans allowed and active in management domain	The allowed list, filtered to VLANs that exist in this switch’s VLAN database and are not shut down.	The VLAN was never created locally, or it was shut down with `shutdown` in VLAN configuration mode.
Vlans in spanning tree forwarding state and not pruned	The active list, filtered to VLANs this port is forwarding.	Spanning tree blocked the port for that VLAN, or VTP pruning removed it.

The lists are strictly nested. A VLAN can never appear in a later list without appearing in the earlier ones, so you read them top down and stop at the first list where the VLAN you care about disappears.

The allowed list

1-4094 in the first list is the untouched default and tells you nobody has restricted the port. Reading the default is what makes the second list informative: if the port permits everything and the active list contains only 1, 10, and 20, then 1, 10, and 20 are the only VLANs that exist and are active on this switch. That is a statement about the local VLAN database, not about the neighbor. Whenever you see a first list that has been narrowed, treat any absence in the second list as ambiguous until you check show vlan brief.

The allowed list is edited with switchport trunk allowed vlan 10,20,30 (which replaces the whole list) or with the add, remove, and except keywords. Retyping the base command without add is the classic way an engineer removes VLANs by accident.

The active list

The second heading uses the phrase “management domain” because the filter is the VLAN database, which VTP synchronizes across a domain. Two things pull a VLAN out here.

The VLAN does not exist locally. VLAN 30 permitted on a trunk but never created on this switch will show in list one and vanish from list two, so the fix is creating the VLAN in the local database.

The VLAN exists but is administratively shut down. shutdown entered at the SW1(config-vlan)# prompt stops the VLAN from forwarding while leaving it in the database. show vlan brief then reports its status as act/lshut rather than active, and the fix is no shutdown for that VLAN in VLAN configuration mode.

That second cause produces a distinctive and silent failure. Comparing two ends of the same trunk shows identical allowed lists and different active lists:

SW2# show interfaces trunk
Port        Vlans allowed on trunk
Gi1/0/48    1,10,20,30
Port        Vlans allowed and active in management domain
Gi1/0/48    1,10,20

Nothing logs an error, because nothing is misconfigured from the trunk’s point of view. The VLAN is simply switched off on one side.

The forwarding list

The third list starts from the active list and subtracts two things.

Spanning tree blocking. Cisco switches run a spanning-tree instance per VLAN with Rapid PVST+, so a single trunk port can be forwarding for VLAN 10 and blocking for VLAN 30 at the same time. A VLAN that survives to list two and disappears from list three, on a network with redundant paths, is normally being blocked here so that a loop stays broken elsewhere.

VTP pruning. When pruning is enabled on a VTP server, a switch tells its upstream neighbor not to send traffic for VLANs that have no active ports downstream. Those VLANs stay allowed and active, and stop being carried, so they drop out of the third list too.

Both causes look identical in the output, which is why a question that shows only this pattern accepts either explanation. show spanning-tree vlan 30 separates them: if the port is in a blocking or alternate role for that VLAN, spanning tree is the reason.

Trunks and show vlan brief

A trunk port never appears under a VLAN in show vlan brief. That output lists the access ports assigned to each VLAN, and a trunk carries many VLANs rather than belonging to one, so it has no single VLAN to be listed under. It is not hidden membership in VLAN 1 and not a missing access-VLAN assignment. show interfaces trunk and show interfaces <id> switchport are where trunk detail lives. For the configuration side, see 802.1Q trunk configuration.

How the 200-301 exam tests this

Which VLANs is this trunk carrying. You get all three lists and are asked what the port is actually forwarding. The answer is always the third list, and the trap answer treats the first list as authoritative because it looks the most complete.
Why one VLAN is missing. A VLAN present in lists one and two but absent from list three is a spanning-tree block or a pruned VLAN, never a removal from the allowed list, because the allowed list still shows it.
Reading the database from the output. A default 1-4094 allowed list paired with a short active list is a question about which VLANs exist on that switch. The stem tells you the port has no restriction so the deduction is available.
Two-switch comparison. Matching allowed lists with mismatched active lists, plus a show vlan brief line reading act/lshut, points at a VLAN shut down in VLAN configuration mode on one switch. Re-adding the VLAN to the allowed list changes nothing, because it is already allowed.

List three answers the question every time — a habit worth cementing with CCNA practice questions before the first list’s completeness tempts you.

Quick reference

Only trunking ports appear in show interfaces trunk; check the header for status and native VLAN first.
List one is the configured allowed VLANs, default 1-4094.
List two subtracts VLANs that are not in the local database or are shut down.
List three subtracts VLANs that spanning tree is blocking or that VTP pruning removed.
act/lshut in show vlan brief means a VLAN was shut down; recover it with no shutdown in VLAN configuration mode.
Use add and remove when editing the allowed list so you do not overwrite it.
Trunk ports are absent from show vlan brief by design.