I'm Confused from the fact that Vlan tagging is done at access port and trunk port always gets tagged packets (until its case of native vlan).But I still believe in other fact which says tagging happen only when a frame hit the trunk port which means trunk port gets untagged frame and tagging is not possible at access port.

Would like to know where actually this tagging happens ?

and also which command we can use to encapsulate 802.1q protocol to access port ? The way we do at trunk port is

switchport trunk encapsulation dot1q

Is the above command applicable for access mode also?


switchport trunk encapsulation dot1q does not apply to access mode ports.

Vlan Tags are only pushed on the packet if it comes in untagged and egresses a trunk port; otherwise, the packet's vlan is simply tracked internally in the switch. Packets ingress to an access vlan port are tagged with that same vlan on the trunk port. The only exception is a packet that is on the trunk port's native vlan (default, vlan 1 on Cisco switches)

This answer on stackoverflow should clarify

| improve this answer | |
  • Mike Pennington thanks for your response ,very simple behavior would like to ask ,when a packets from end station hits switch's access port ,will it be tagged or only when frame hit the trunk will be tagged.This is behavior wanted to confirm on. Can access port do the valn tagging ? – Patha Sep 28 '12 at 9:27
  • the behavior you described in your comment is correct. Packets ingress to an access port are tagged on the trunk port. The only exception is a packet that is on the trunk port's native vlan (default, vlan 1 on Cisco switches) – Mike Pennington Sep 28 '12 at 9:42
  • 1
    A vlan is a logical construct internal to a switch. The access port receives the frame, and the switch is aware of what vlan that access port belongs to via configuration. Tagging only happens between switches on Trunk links as Mike stated so the switches can communicate vlan context to each other. – Niall Byrne Sep 28 '12 at 9:46

The statement

switchport trunk encapsulation dot1q

is needed (on some) cisco switches to explicitly set the trunking mode as there are switches where ISL trunking is also available. On other (mostly smaller desktop) switches it produces an error (because dot1q is the only trunking mode there).

When you set the port to trunk mode with

switchport mode trunk

statements like

switchport trunk .... 

comes to play

When the port is in access mode with:

switchport mode access

statements like

switchport access ...

comes to play.

One can easily check port settings with:

show running-config interface f0/1

EDIT: Beware as other vendors use different terminology.

On HP trunking = port aggregation.
On Cisco etherchannel = port aggregation.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.