Access Port vs Trunk Port
The core difference is scope: an access port carries exactly one VLAN and sends frames untagged, while a trunk port carries many VLANs at once and tags each frame with its VLAN ID using 802.1Q. Put simply, an access port connects a single end device into a single VLAN; a trunk port is the pipe that carries multiple VLANs between switches (or to a router).
Part of the VLANs, Trunking & Inter-VLAN Routing learning hub
Because an access port only ever deals with one VLAN, the device plugged into it never sees a VLAN tag and doesn't need to understand VLANs at all. A trunk, by contrast, has to label traffic so the switch on the other end knows which VLAN each frame belongs to — with one exception, the native VLAN, which crosses the trunk untagged.
| At a glance | Access Port | Trunk Port |
|---|---|---|
| VLANs carried | Exactly one (the access VLAN) | Many VLANs simultaneously |
| Frame tagging | Untagged — frames carry no VLAN tag | 802.1Q tagged, so each frame's VLAN is identified |
| Native VLAN | Not applicable | One untagged native VLAN (VLAN 1 by default) |
| Typical connection | End device — PC, printer, IP phone, server, AP | Switch-to-switch or switch-to-router |
| Device awareness | The end device is VLAN-unaware | Both ends must agree on tagging and native VLAN |
| Cisco mode | switchport mode access | switchport mode trunk |
| Purpose | Places one device into one VLAN | Extends multiple VLANs across a single link |
What an access port is
An access port belongs to a single VLAN. Any device plugged into it is placed in that one VLAN, and all frames leaving toward the device go out untagged — the device has no idea VLANs even exist. This is what you assign to endpoints: a PC, a printer, a server, a wireless access point.
The one common exception is an IP phone, where a single access port can also carry a separate voice VLAN. Aside from that special case, treat an access port as one-device, one-VLAN, no tags.
What a trunk port is
A trunk port carries traffic for many VLANs over one physical link. To keep them separate, the switch tags each frame with its VLAN ID using the 802.1Q standard, so the switch at the far end can sort the traffic back into the correct VLANs.
Trunks connect infrastructure to infrastructure — switch to switch, or switch to a router doing inter-VLAN routing. You can also limit which VLANs a trunk carries with an allowed-VLAN list, so it only passes the VLANs that actually need to cross that link.
The key differences
Number of VLANs: an access port is one VLAN; a trunk is many.
Tagging: access traffic is untagged; trunk traffic is 802.1Q-tagged — except the native VLAN, which crosses the trunk untagged (VLAN 1 by default).
What connects to it: access ports face end devices that don't understand VLANs; trunk ports face other switches or routers that do.
When to use each
Use an access port for anything that is an endpoint and only needs to live in one VLAN — that is the vast majority of ports on an access-layer switch.
Use a trunk port when a link must carry more than one VLAN: between two switches, between a switch and a router (router-on-a-stick), or up to a distribution/core switch. If you're unsure, ask 'does this link need more than one VLAN?' — if yes, trunk; if no, access.
A common gotcha: native VLAN mismatch
Both ends of a trunk must agree on the native VLAN. If one switch calls it VLAN 1 and the other calls it VLAN 99, untagged frames land in the wrong VLAN — that's a native VLAN mismatch, and it can leak traffic between VLANs and trigger spanning-tree problems. Cisco switches will usually flag it via CDP.
A second gotcha is leaving a port on dynamic negotiation (DTP). A port set to auto/dynamic can be talked into becoming a trunk, so the safe practice is to hard-set each port to either access or trunk rather than letting it negotiate.
Frequently asked questions
Which is better, an access port or a trunk port?
Neither — they do different jobs. An access port is the right choice for connecting a single end device into one VLAN, and a trunk port is the right choice for carrying many VLANs between switches or to a router. A healthy network uses both: mostly access ports at the edge, trunks between the switches.
When would I use a trunk port instead of an access port?
Use a trunk whenever a single link needs to carry more than one VLAN. The classic cases are switch-to-switch uplinks and a switch-to-router link for inter-VLAN routing (router-on-a-stick). If the link only needs one VLAN — such as a port for a PC or printer — use an access port.
What's the main difference between an access port and a trunk port?
An access port carries one VLAN and sends frames untagged to an end device; a trunk port carries many VLANs and tags each frame with 802.1Q so the other side knows which VLAN it belongs to. The trunk's one untagged exception is the native VLAN (VLAN 1 by default).
Now build it on real Cisco IOS
Concepts stick when you configure them. Try a free graded lab, then grade your own config against the answer key.