Differences Between Access ports and Trunk ports

A switch port can work in two modes: access mode and trunk mode. In access mode, it removes vlan information from all frames before forwarding them. In trunk mode, it keeps vlan information. Based on the configured mode, it is known as either an access port or a trunk port. If we configure a switch port in access mode, it will be called an access port. If we configure it in trunk mode, it will be known as a trunk port.

A switch uses vlan information to group devices and creates boundaries for broadcast messages. A VLAN is a switch-only feature. End devices do not understand VLAN information. If we connect an end device with a trunk port, the end device will receive frames with the vlan information. Since an end device does not understand frames containing vlan information, it drops them.

An end device will accept frames only when it receives them in their original formats. An access port forwards frames in their original formats. Because of this, we always connect an end device only with an access port. We use a trunk port to connect the switch port with another switch or a router.

Before we take more differences between an access and a trunk port, let us understand Broadcast and VLAN.

A broadcast is a layer three message. It represents all devices in the local segment. When a device sends a broadcast message, the message reaches all devices connected in the local segment.

broadcast message

Many functions depend on broadcast messages. End devices generate a lot of broadcast messages every minute. Broadcast messages consume a big chunk of network bandwidth. All devices on the local segment receive a broadcast message, whether the message is for them or not. To limit broadcast messages, we break the network into subnets. Devices in one subnet do not send broadcast messages to another subnet.

vlan

Subnets are created on layer 3 addresses. A switch does not understand layer 3 addresses. But it includes a feature called VLAN that allows us to define switch ports in VLANs.

subnet vlans

A switch does not know the VLANs another switch has. A switch is an end device for another switch. When it receives a broadcast frame from another switch, it forwards the frame from all ports having the VLAN ID of the receiving port.

We have two options to solve this problem. The first option creates as many connections between switches as many VLANs they have and configure a connection in each VLAN. For example, if we have five VLANs, we need five connections.

vlan on access ports

Since this method requires as many connections between the switches as many VLANs they have, generally, administrators do not use it. Administrators use the second method which is more convenient and easy.

The second method does not need many connections. Only one connection between switches is enough to allow communication between all VLANs. Actually, it uses trunk ports to connect switches. Trunk ports are special ports. They add VLAN information to all outgoing frames and remove it from all incoming frames.

Let us take an example to understand this process in more detail.

The following image shows a network. This network has two switches. Switches are connected via a trunk link on port 8.

trunk connection

PC1 generates a broadcast frame. The frame reaches port 1. The port 1 belongs to VLAN 10. The switch decides to forward it from all ports having VLAN ID 10. Since a trunk port belongs to all VLANs, the switch decides to forward it from port 8.A trunk port does not forward the frame in its original format. Before forwarding the frame, it adds a header to the frame. The header includes the VLAN ID. For example, if a frame belongs to VLAN 10, the header includes VLAN ID 10. After adding the VLAN header, it forwards the frame. Only a trunk port can read the modified frame.

vlan frame moves

The modified frame reaches port 8 of switch 2. Since it is a trunk port, it reads the modified frame. It reads the VLAN header to know about the recipient VLAN. From the header, it learns the frame is intended for VLAN 10.

reading vlan information

After learning about the recipient VLAN, it removes the VLAN header from the frame and forwards the frame from all ports having VLAN ID 10.

PC3 receives the frame in its original format from port 1.

frame received

Now let's say, PC4 generates a broadcast frame. The frame reaches port 6. The VLAN ID of port 6 is 20. The trunk port adds a VLAN header containing VLAN 10 to the frame and forwards it. The frame reaches switch 1 on the trunk port. The trunk port reads VLAN information from the header and removes it. After removing the header, it gives the frame to all ports having the VLAN ID 20. The ports in VLAN 20 forward the frame in its original format.

This way a single trunk connection is enough to exchange all VLAN traffic between two switches.

Differences between access ports and trunk ports

difference between access port and trunk port

The following table lists the main difference between access ports and trunk ports.

An access port belongs to only one VLAN. A trunk port belongs to all VLANs.
An access port forwards the frame in its original format. A trunk port forwards the frame after adding the VLAN header.
An access port connects an end device to the network. A trunk port extends the network.
By default, all switch ports are access ports. By default, no switch port is a trunk port.

Conclusion

An Ethernet switch port can work in two modes: access and trunk. In access mode, it connects an end device to the network and works only in a single VLAN. In trunk mode, it connects a switch or a router to the network and works with all VLANs.

ComputerNetworkingNotes CCNA Study Guide Differences Between Access ports and Trunk ports