ArubaOS-CX Access vs Trunk Ports: Native VLAN Tagging Explained

Configuring an ArubaOS-CX interface as an access port or a trunk port is one of the first tasks every campus engineer faces, yet the native VLAN behavior trips up many people coming from ProCurve or Cisco backgrounds. This article distills the community-validated best practices from the Aruba Airheads forum: a hardened access-port template for edge hosts, a trunk-port template for inter-switch links, and a clear explanation of what vlan trunk native <id> tag actually does compared with the untagged default.

Access Port Configuration (Edge Host)

For a port (or Layer 2 VSX-LAG / Standard-LAG) connected to an edge host such as a PC or printer, the recommended configuration is:

interface 1/1/<n>
    no shutdown
    mtu 9198
    description "Link-to-Edge-Host"
    no routing
    vlan access <vlan-id>
    loop-protect
    spanning-tree bpdu-guard
    spanning-tree port-type admin-edge
    spanning-tree tcn-guard
    exit

• spanning-tree bpdu-guard — disables the interface if a BPDU is received (blocks rogue switches).
• spanning-tree port-type admin-edge — transitions the port to forwarding immediately during STP convergence.
• spanning-tree tcn-guard — stops TCN propagation to other STP ports.
• loop-protect — the default action tx-rx-disable shuts the port down on loop detection.

Trunk Port Configuration (Inter-Switch Link)

interface 1/1/<n>
    no shutdown
    no routing
    mtu 9198
    flow-control rx
    description "Link-to-Remote-Switch"
    vlan trunk native <vlan-id> tag
    vlan trunk allowed <vlan-id>
    spanning-tree link-type point-to-point
    spanning-tree ignore-pvid-inconsistency enable
    exit

• vlan trunk native <vlan-id> tag — enables tagging on the native VLAN. Without the tag keyword the native VLAN is sent untagged.
• vlan trunk allowed <vlan-id> — permits exactly that VLAN; vlan trunk allowed all permits every VLAN.
• spanning-tree link-type point-to-point — sets the STP link type for full-duplex inter-switch links (this is the default).

Native VLAN Tagged vs Untagged: What the Peer Expects

The most common source of confusion: with vlan trunk native <id> tag, only incoming packets tagged with the matching VLAN ID are accepted; untagged packets are dropped except for BPDUs, and egress packets are always tagged. The remote peer must therefore be configured as a tagged member of that VLAN (in ProCurve terminology). If you want an untagged native VLAN instead, omit the tag keyword — but then make sure the peer expects untagged traffic on its native VLAN, otherwise you risk a PVID mismatch. Some engineers prefer vlan trunk native <id> tag plus vlan trunk allowed all for maximum interoperability with third-party switches.

Related Articles on This Site

For the basic comparison, see ArubaOS-CX access vs trunk port comparison and ArubaOS-CX access/trunk interface best practices, or learn how VLANs route traffic in our inter-VLAN routing guide.

原文链接：https://airheads.hpe.com/discussion/arubaos-cx-accesstrunk-interface-configuration-commongood-practices