VLAN Trunking Explained
Understand VLAN trunking, 802.1Q tagging, native VLANs, and trunk vs access ports — with a hands-on networking interview guide.
Expected Interview Answer
A VLAN trunk is a single physical link between two switches (or a switch and a router) that carries tagged traffic for multiple VLANs simultaneously, using 802.1Q tags inserted into each Ethernet frame so the receiving device knows which VLAN the frame belongs to.
Without trunking, each VLAN would need its own dedicated physical cable between switches, which does not scale. Instead, a trunk port is configured to accept and transmit frames from many VLANs over one link: as a frame leaves a switch on a trunk, an 802.1Q tag is inserted into the Ethernet header carrying a 12-bit VLAN ID (1-4094), and the receiving switch reads that tag to know which VLAN the frame belongs to before forwarding it out the correct access ports. A trunk usually also carries a native VLAN, whose frames are sent untagged by default, which is a common security misconfiguration point if both ends do not agree on the native VLAN. Access ports, in contrast, belong to exactly one VLAN and never see tags — the switch adds and strips them transparently at trunk boundaries. Trunking is what allows a single uplink between a switch and a router (or a Layer 3 switch) to route between many VLANs using router-on-a-stick or an SVI-based design.
- Carries multiple VLANs over a single physical link, saving cabling
- 802.1Q tagging lets switches distinguish frames per VLAN
- Enables inter-VLAN routing via a single uplink to a router/L3 switch
- Keeps broadcast domains logically separated despite sharing physical infrastructure
AI Mentor Explanation
VLAN trunking is like a single shared team bus carrying players from several different squads to the same stadium, where each player’s kit bag has a colored tag identifying which squad they belong to. The driver does not need a separate bus per squad — one bus, many tags, and everyone is sorted correctly on arrival. If a bag has no tag, it defaults to the designated 'home squad' bag pile, which can cause confusion if the two ends do not agree on which squad that default is. This mirrors how a VLAN trunk carries multiple VLANs over one link using 802.1Q tags, with a native VLAN for untagged frames.
Step-by-Step Explanation
Step 1
Configure trunk port
Both switch ends of the link are configured as trunk ports, allowing a defined set of VLANs to traverse it.
Step 2
Tag on egress
As a frame leaves a switch on the trunk, an 802.1Q tag is inserted carrying the 12-bit VLAN ID.
Step 3
Read tag on ingress
The receiving switch reads the VLAN ID from the tag to determine which VLAN the frame belongs to.
Step 4
Strip and forward
The switch strips the tag and forwards the frame out the correct access port(s) for that VLAN.
What Interviewer Expects
- Explains why trunking avoids one physical cable per VLAN
- Knows 802.1Q tagging inserts a 12-bit VLAN ID into the frame
- Understands native VLAN and its untagged-frame behavior
- Distinguishes trunk ports (multi-VLAN) from access ports (single VLAN)
Common Mistakes
- Confusing a trunk port with an access port
- Not knowing native VLAN frames are sent untagged
- Assuming VLAN tags are visible to end-host applications
- Forgetting that mismatched native VLANs on both ends is a security risk
Best Answer (HR Friendly)
“VLAN trunking lets one physical network cable between switches carry traffic for many separate virtual networks at once, by tagging each piece of data with which VLAN it belongs to. It saves on cabling and hardware while keeping departments or environments logically separated, and it is one of the first things a network engineer configures when connecting switches together.”
Code Example
# Load the 802.1Q kernel module
sudo modprobe 8021q
# Create tagged sub-interfaces for VLAN 10 and VLAN 20 on eth0
sudo ip link add link eth0 name eth0.10 type vlan id 10
sudo ip link add link eth0 name eth0.20 type vlan id 20
# Bring the tagged interfaces up
sudo ip link set eth0.10 up
sudo ip link set eth0.20 up
# Assign each sub-interface to its own VLAN subnet
sudo ip addr add 10.0.10.1/24 dev eth0.10
sudo ip addr add 10.0.20.1/24 dev eth0.20Follow-up Questions
- What is the difference between a trunk port and an access port?
- What is the native VLAN and why can it be a security concern?
- How does router-on-a-stick enable inter-VLAN routing over one trunk?
- What is VLAN hopping and how is it mitigated?
MCQ Practice
1. What does an 802.1Q tag add to an Ethernet frame?
802.1Q inserts a tag carrying a 12-bit VLAN ID (1-4094) into the Ethernet frame header.
2. How many VLANs can a single trunk port typically carry?
A trunk port is designed to carry tagged traffic for multiple VLANs over one physical link.
3. How are native VLAN frames typically sent on a trunk?
Frames belonging to the native VLAN are sent without an 802.1Q tag by default.
Flash Cards
What is VLAN trunking? — Carrying multiple VLANs, tagged with 802.1Q, over a single physical link.
What does 802.1Q add? — A tag with a 12-bit VLAN ID inserted into the Ethernet frame.
Trunk port vs access port? — Trunk carries many tagged VLANs; access port belongs to exactly one, untagged VLAN.
What is the native VLAN? — The VLAN whose frames are sent untagged by default on a trunk.