ArubaOS-CX Access vs Trunk: Best Practice Templates

ArubaOS-CX switches use two distinct port modes: access ports carry a single untagged VLAN for end hosts, while trunk ports carry multiple tagged VLANs for peer switches, firewalls and hypervisors. The Aruba Airheads community has distilled the common configuration practice for both roles, including the spanning-tree guards that protect edge ports and the native VLAN tagging decision that trips up many engineers. This article turns those best practices into ready-to-use CLI templates.

Access vs Trunk on ArubaOS-CX

Access Port Configuration Template

interface 1/1/<n>
no shutdown
mtu 9198
description "Link-to-Edge-Host"
no routing
vlan access <vlan-id>
loop-protect
spanning-tree bpdu-guard
spanning-tree port-type admin-edge
spanning-tree tcn-guard
exit

• spanning-tree bpdu-guard - disables the interface if it receives MSTP BPDUs
• spanning-tree port-type admin-edge - transitions directly to forwarding during STP establishment
• spanning-tree tcn-guard - stops topology change notifications propagating to peer devices

Trunk Port Configuration Template

interface 1/1/<n>
no shutdown
no routing
mtu 9198
flow-control rx
description "Link-to-Remote-Switch"
vlan trunk native <vlan-id> tag
vlan trunk allowed <vlan-id>
spanning-tree link-type point-to-point
spanning-tree ignore-pvid-inconsistency enable
exit

• vlan trunk native <vlan-id> tag - tags the native VLAN (recommended when the peer expects tagged-only traffic)
• vlan trunk allowed <vlan-id> - permits exactly the listed VLANs; use vlan trunk allowed all to allow all
• spanning-tree link-type point-to-point - assumes a full-duplex point-to-point link to a switch (default)

Native VLAN Tagging: The Key Decision

On a trunk connecting two ArubaOS-CX switches you can either tag the native VLAN (vlan trunk native <id> tag) or leave it untagged. Tagging the native VLAN is preferred when you control both ends, because it guarantees that only tagged traffic flows on the link and avoids pvid-inconsistency issues - you can add more tagged VLANs later without changing the native behavior. The peer interface must then be a tagged member of that VLAN.

Verification Commands

show vlan
show vlan brief
show interface 1/1/1
show running-config interface 1/1/1

For more on VLAN behavior on the platform, see ArubaOS-CX access vs trunk native VLAN tagging, the Junos access, trunk and IRB examples, and Cisco Nexus NX-OS VLAN and trunk configuration.

原文链接：https://airheads.hpe.com/discussion/arubaos-cx-accesstrunk-interface-configuration-commongood-practices