Learn Computer Networking PNETLab - VLAN Trunking Protocol & IEEE 802.1Q Trunking

#Introduction

In episode 4 you created VLANs on a single switch. The problem arises as the network grows: how do you carry VLAN 10 and VLAN 20 traffic across two physical switches at once? The solution is trunking — and episode 5 discusses all of its details.

We will learn the IEEE 802.1Q tag mechanism, the native VLAN risk, Cisco trunk configuration, and then VTP (VLAN Trunking Protocol) with all its shortcomings. This material is very important because trunking mistakes are the most common cause of Layer 2 problems in both labs and production.

#The Need for VLAN Trunking

#Connecting Inter-VLAN Communication Across Multiple Switches

If two switches each have PCs in VLAN 10, a normal cable is not enough: without trunking, a switch does not know which VLAN a frame from the other switch belongs to. A trunk link is a single physical link that carries traffic from many VLANs at once. Because several VLANs pass over the same single link, every frame must be tagged with its VLAN identity.

#IEEE 802.1Q Trunking Encapsulation

#How the 4-Byte Tag Works on an Ethernet Frame

IEEE 802.1Q inserts a 4-byte tag between the source MAC address and the Type/Length field of an Ethernet frame. The tag contains a 12-bit VLAN ID (VID), supporting up to 4096 VLANs. When a frame arrives at another switch, the switch reads the tag, forwards the frame to the correct VLAN, and removes the tag before sending the frame to an access port.

Practice it in PNETLab: connect two switches, then capture the trunk link with Wireshark. You will see frames tagged 802.1Q Virtual LAN, PRI 0, CFI 0, ID 10 as they move between the switches.

#Native VLAN and the Risk of VLAN Hopping

On an 802.1Q trunk, the native VLAN is sent untagged. By default the native VLAN is VLAN 1. Because it is untagged, native VLAN frames are considered to belong to every connected switch — this is the gap exploited by the VLAN hopping technique: an attacker pretends to be a trunk switch (double tagging) to reach other VLANs.

Standard mitigation: change the native VLAN from 1 to a dedicated VLAN, never use VLAN 1 for data, and disable automatic trunking (DTP) on access ports.

#Trunk Configuration on a Cisco Switch

#Enabling Trunk on an Interface

In PNETLab, connect SW1 and SW2, then configure trunk on both:

configure terminal
interface g0/0
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20
exit

On IOL L2 switches, the command switchport trunk encapsulation dot1q sets 802.1Q encapsulation; on switches that only support dot1q, this command is automatically ignored. switchport mode trunk makes the port a trunk link.

#Restricting the VLANs Allowed on a Trunk

Best practice: only allow the VLANs that are actually needed across the trunk. switchport trunk allowed vlan 10,20 restricts the traffic to only VLANs 10 and 20. Other VLANs, including VLAN 1, will not be forwarded — a small step that reduces the attack surface and broadcast load.

#VLAN Trunking Protocol (VTP)

#VTP Domain and Server, Client, Transparent Modes

VTP propagates the VLAN database from one switch to another within a single domain. There are three modes:

• Server: the source of the VLAN database; changes are propagated across the whole domain.
• Client: receives and stores the database from the server, cannot create its own VLANs.
• Transparent: forwards VTP messages but does not store the domain database.

A minimal configuration:

configure terminal
vtp domain PNETLAB
vtp mode server
exit

vtp domain PNETLAB sets the domain name, and vtp mode server makes the switch the source of the VLAN database.

#VTP Revision Number Mismatch Risk and Pruning

The main danger of VTP: the revision number. Every server change increments the database revision number. If a switch with a higher revision number connects to the network, the VLAN database of the entire domain can be overwritten — VLANs can be deleted or created unintentionally. In production networks, many engineers choose vtp mode transparent or disable VTP entirely.

VTP Pruning is a feature that prevents VLAN broadcast traffic from being sent to switches that do not have members of that VLAN. This saves bandwidth on large trunks, but it must be configured carefully because it adds complexity.

#Avoiding Trunking Mistakes

Before closing this episode, three golden rules of trunking: always configure trunk on both sides of the link, always set the same native VLAN on both sides (a mismatch will break communication), and never let a trunk propagate unintentionally to ports facing end users. Verify with the following commands:

SW1# show interfaces trunk
SW1# show interfaces g0/0 switchport

show interfaces trunk displays the list of active trunks along with the allowed VLANs, while show interfaces switchport shows the mode and native VLAN of each interface.

#Closing

Key takeaways:

• Trunk carries many VLANs over one physical link by tagging frames.
• The 802.1Q tag is 4 bytes and contains a 12-bit VLAN ID.
• The native VLAN is sent untagged; change it from VLAN 1 and restrict it over the trunk.
• switchport mode trunk plus allowed vlan secures a trunk.
• VTP server client transparent carries the risk of revision number mismatch.
• Always verify with show interfaces trunk.

In the next episode, episode 6, we build the bridge between VLANs: inter-VLAN routing — the router-on-a-stick (ROAS) method with sub-interfaces, the SVI method on Layer 3 switches, configuring both in PNETLab, and a comparison of performance and efficiency between the two approaches.