Key Takeaways
- Five modes, one question: does this port trunk, and does it negotiate?
accessandtrunkare static answers.dynamic autoanddynamic desirablehand the decision to DTP, which means to whatever is plugged in. - Two
dynamic autoports never form a trunk. Both sides are waiting to be asked. This is the single most common “why is my trunk down” cause on a lab switch. switchport nonegotiatedoes not stop a port trunking. It only stops DTP frames being sent or processed. The mode still decides; DTP just stops having an opinion.- Leaving DTP on an access port is a real vulnerability, not a style issue. Anything that can speak DTP can negotiate itself a trunk and reach every VLAN the port allows.
- Don’t assume the default. It varies by platform and software train.
show interfaces switchporttells you the truth in two lines.
This post is one of the oldest on the site, and for years it was a reproduction of somebody else’s article. It has been rewritten from Cisco’s own switching documentation, with the negotiation behaviour and the security case both checked against the current guides rather than remembered.
What each mode actually says
The modes are easier to hold onto if you read them as statements the port makes to whatever is on the other end of the cable.
switchport mode access — “I will never trunk. I carry exactly one VLAN.” The port still sends DTP by default, effectively announcing that it is not interested, which helps the far end give up quickly rather than sit in negotiation.
switchport mode trunk — “I am trunking regardless of what you do, and I will send DTP to try and bring you along.” Note the second half: the mode is unconditional, but the port is still generating DTP frames unless you tell it otherwise.
switchport mode dynamic desirable — “I would like to trunk. I am actively asking. If nobody answers, I will fall back to access.” Actively soliciting.
switchport mode dynamic auto — “I am willing to trunk if you ask me, but I will not ask you. If nobody asks, I become an access port.” Passively willing.
switchport nonegotiate — “I am not participating in DTP at all: I will not send it and I will not act on it.” This is not a mode. It is a modifier, and it is only accepted when the port is already statically access or trunk — the switch rejects it in either dynamic mode, because a dynamic port with no negotiation protocol would have nothing to decide with.
switchport trunk encapsulation {isl | dot1q} — “use this tagging format, don’t negotiate it.” Largely a historical command now. ISL has been dead for years and current platforms are 802.1Q-only, so on a Catalyst 9000 or a Nexus the command may not exist at all. On older gear it is still worth pinning.
Which combinations actually form a trunk
This is the table worth memorising. Everything else follows from it.
| access | dynamic auto | dynamic desirable | trunk | |
|---|---|---|---|---|
| access | Access | Access | Access | Mismatch |
| dynamic auto | Access | Access | Trunk | Trunk |
| dynamic desirable | Access | Trunk | Trunk | Trunk |
| trunk | Mismatch | Trunk | Trunk | Trunk |
The two cells that catch people:
auto to auto gives you an access port. Both ends are passively willing and neither one initiates, so the negotiation never starts. The link comes up, the interfaces look healthy, and you quietly have a single-VLAN link where you expected a trunk. If a lab trunk refuses to form and both switches are on defaults, this is almost always why.
trunk to access is a genuine mismatch. One end tags, the other end does not expect tags. Traffic in the native VLAN will pass and everything else will not, which produces the worst class of fault: partially working. See the native VLAN post for what happens to those frames.
During negotiation DTP frames go out every second; once the port has settled they drop back to every 30 seconds. So a trunk that is going to form, forms quickly — if it has not come up after a few seconds, waiting longer will not help.
Why you should turn DTP off
DTP decides the VLAN membership of a port based on frames arriving on that port. On an access port in a dynamic mode, that is an access-control decision being delegated to whatever someone plugs into the wall.
The attack is switch spoofing, and it is old but it still works wherever defaults survive. Connect something that can emit DTP — a laptop running yersinia, or just a switch someone brought from home — send a desirable frame, and the port becomes a trunk. A trunk carries every VLAN in its allowed list, which by default is all of them. The attacker has gone from one access VLAN to the whole switch without touching a router.
Cisco’s own guidance is direct about this: on links you do not intend to trunk, use switchport mode access to disable trunking; where you do want a trunk to something that does not speak DTP, use switchport mode trunk together with switchport nonegotiate so the port trunks without generating DTP frames.
The configurations worth standardising on
An access port, hardened:
interface GigabitEthernet1/0/10 description User access switchport mode access switchport access vlan 20 switchport nonegotiate spanning-tree portfast spanning-tree bpduguard enable
switchport mode access already prevents the port trunking. nonegotiate is what stops it emitting DTP into a user-facing port, which is both a small information leak and one less protocol on an untrusted edge. The two spanning-tree lines are not part of this topic but belong on every access port anyway.
A trunk that does not negotiate — the right pattern for a link to a non-Cisco switch, a firewall, or a hypervisor, none of which speak DTP:
interface GigabitEthernet1/0/48 description Uplink switchport mode trunk switchport nonegotiate switchport trunk allowed vlan 10,20,30 switchport trunk native vlan 999
Both ends static, no negotiation, and an explicit allowed list rather than the default of everything. This also gives the fastest possible trunk formation, since nothing waits on DTP.
Check rather than assume
The factory default differs across platforms and releases — most Catalyst IOS and IOS-XE switches ship interfaces as dynamic auto, some older platforms shipped dynamic desirable, and Nexus defaults to access. Guessing wrong is how you end up debugging the auto-to-auto case above.
Switch#show interfaces gigabitethernet1/0/10 switchport Name: Gi1/0/10 Switchport: Enabled Administrative Mode: dynamic auto Operational Mode: static access Administrative Trunking Encapsulation: dot1q Negotiation of Trunking: On Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default)
Three lines carry the answer. Administrative Mode is what you configured. Operational Mode is what the port actually settled on — and those two disagreeing is the entire point of the command. Negotiation of Trunking is DTP: On means the port is still speaking it, and it is what nonegotiate turns off.
A quick audit across a switch:
show interfaces switchport | include Name|Administrative Mode|Negotiation
Anything reporting a dynamic administrative mode, or negotiation On where you did not intend it, is worth a second look. It pairs well with a sweep for ports nobody is using — dormant and negotiating is the worst combination on the list. If you would rather never have to audit for this again, put switchport nonegotiate into every port role up front: that is what the Cisco Switch Configuration Best Practices: Build Template does.
Sources
- Cisco — VLAN Configuration Guide: Configure VLAN Trunking, for the mode definitions, DTP timers and the interaction matrix
- Cisco — Configuring VLAN Trunks (Catalyst 3650), for the guidance on disabling trunking where it is not intended
Related: Cisco Native VLAN: How It Works and Why Mismatches Bite, Easily Find Unused Ports on a Cisco Switch, Cisco Config Archive & Rollback: revert vs reload, Cisco Switch Configuration Best Practices: Build Template