What an 802.1Q trunk is
A trunk is a Layer 2 link that carries traffic for more than one VLAN. Instead of dedicating one physical cable to every VLAN, IEEE 802.1Q adds VLAN information to Ethernet frames so the receiving device can preserve the correct logical context.
Trunks are common between switches, between a switch and a router using subinterfaces, between switches and hypervisors, and between a switch and an enterprise wireless access point that maps several SSIDs to different VLANs.
The IEEE 802.1Q VLAN tag
802.1Q inserts a tag into the Ethernet frame. Among its fields is a 12-bit VLAN Identifier (VID), which tells the receiving bridge which VLAN should process the frame. The tag also contains priority-related information that can participate in Layer 2 quality-of-service handling.
The important operational idea is simple: frames on a trunk can carry explicit VLAN identity, while frames presented to an ordinary endpoint on an access port are normally untagged from the endpoint's perspective.
How tagging changes the Ethernet frame
Adding an 802.1Q tag changes the Ethernet frame format and increases the frame size by four bytes. Standards-compliant network equipment accounts for this tagged frame format. Problems can appear when unusual encapsulation stacks, tunnels, or provider tags push the effective frame size beyond what part of the path supports.
Do not confuse VLAN tagging with the IP MTU itself. They are related through the total frame carried by the link, but they belong to different layers and are configured differently.
Access ports versus trunk ports
An access port normally serves one endpoint VLAN, while a trunk carries several VLANs. This distinction is a configuration role rather than a different physical Ethernet technology. The same interface hardware may be configured for either purpose depending on the platform.
For a workstation, phone, printer, or other simple endpoint, the access-switch configuration often hides VLAN tagging from the device. For infrastructure links, a trunk preserves the VLAN identity across the path.
The native VLAN and untagged frames
Many 802.1Q implementations support a native VLAN whose traffic can be sent untagged on a trunk. Both ends must agree on how untagged frames are interpreted. A mismatch can place traffic into different VLANs at each end and create difficult-to-diagnose connectivity or security issues.
Operationally, keep the native-VLAN configuration explicit and consistent. Do not rely on defaults simply because the link appears to work during an initial test.
Allowed VLAN lists
A trunk does not have to carry every VLAN configured in the network. An allowed list can restrict the link to the VLANs that actually need to cross it. This reduces unnecessary Layer 2 scope and makes the intended topology easier to reason about.
If a VLAN is accidentally removed from the allowed list, hosts may work locally on one switch but fail whenever their traffic must cross that trunk. This is a classic troubleshooting pattern: correct access ports on both sides, but no continuity between them.
Router-on-a-stick
With router-on-a-stick, one physical router interface uses multiple logical subinterfaces, each associated with an 802.1Q VLAN. The switch-to-router link is a trunk, and the router provides a Layer 3 gateway for each configured VLAN.
This design is useful for learning and smaller deployments, but a multilayer switch can often route between VLANs directly through switched virtual interfaces. The dedicated inter-VLAN routing guide compares these models.
Trunks toward wireless access points
An enterprise AP may advertise several SSIDs and map each one to a different VLAN. Its Ethernet uplink can therefore be an 802.1Q trunk carrying employee, guest, voice, IoT, or management traffic back into the wired switching infrastructure.
This is one of the clearest examples of wired and wireless design converging: radio access is different from Ethernet access, but VLAN segmentation can remain consistent across both environments. See the Wi-Fi guide for the wireless side of that architecture.
Trunks and spanning tree
A trunk can carry several Layer 2 domains across a redundant topology, so loop prevention remains important. Depending on the spanning-tree implementation, topology decisions may be shared across VLANs or calculated in VLAN- or instance-aware ways.
The key point is that a trunk is not exempt from Layer 2 loop problems. Redundant trunk links must be designed together with STP/RSTP or an appropriate multi-link architecture.
Trunk security considerations
Infrastructure trunks should be configured intentionally. Limit allowed VLANs, avoid exposing unnecessary VLANs to edge ports, harden unused interfaces, and be cautious with automatic negotiation features where they are not needed.
A VLAN tag is not an authorization mechanism. Security still depends on port configuration, authentication, Layer 2 protections, Layer 3 policy, and the trust model of the connected device.
QinQ and stacked VLAN tags
Provider and service-provider environments may use stacked VLAN tags, commonly called QinQ, to carry customer VLAN information across another Layer 2 service. Conceptually, an outer provider tag transports frames that may already contain an inner customer tag.
This is more advanced than ordinary enterprise trunking, but it reinforces an important idea: Ethernet can carry several layers of logical segmentation, and the effective frame size and operational boundaries must still be understood.
How to troubleshoot a trunk
Verify both ends of the link. Confirm that each side expects trunking, that the VLAN exists, that the allowed lists are compatible, and that the native VLAN matches. Then check spanning-tree state and whether the physical link is actually forwarding traffic.
- Is the interface operational?
- Do both ends use compatible trunk settings?
- Is the required VLAN allowed?
- Does the native VLAN match?
- Is STP blocking the path?
- Is a link aggregation configuration changing which logical interface should be inspected?
What to study after 802.1Q trunks
Continue with STP and RSTP to understand redundant Layer 2 paths, then EtherChannel and LACP to combine compatible links into one logical bundle. Keep the relationship with VLANs and inter-VLAN routing in mind: trunks carry the Layer 2 segments, while routing connects their IP subnets.