ArubaOS-CX Access vs Trunk Ports: Comparison and Configuration

Every ArubaOS-CX switch port must decide how it handles VLAN tagging: as an access port that carries a single untagged VLAN to an end device, or as a trunk port that carries multiple tagged VLANs between switches. Getting this decision wrong is one of the most common causes of "can't reach the server" tickets in campus networks. This article explains the access vs trunk distinction on AOS-CX, gives you a comparison table you can keep next to your desk, and shows the exact CLI commands to configure and verify both port types.

Access Port vs Trunk Port: The Difference

Configuring an Access Port on AOS-CX

First create the VLAN, then assign the port:

switch(config)# vlan 10
switch(config-vlan-10)# name Sales
switch(config-vlan-10)# exit
switch(config)# interface 1/1/1
switch(config-if)# vlan access 10
switch(config-if)# no shutdown

Port 1/1/1 is now an access port in VLAN 10. End devices plugged in here get an untagged frame in VLAN 10 with no configuration on their side.

Configuring a Trunk Port on AOS-CX

switch(config)# vlan 20
switch(config-vlan-20)# name Engineering
switch(config-vlan-20)# exit
switch(config)# interface 1/1/2
switch(config-if)# vlan trunk allowed 10,20
switch(config-if)# vlan trunk native 1

The trunk carries VLANs 10 and 20 tagged, and VLAN 1 untagged as the native VLAN. To make even the native VLAN tagged, add vlan trunk native tag. To restrict which VLANs can pass, use vlan trunk allowed explicitly - never leave a trunk allowing all VLANs unless you intend it.

Verification Commands

switch# show vlan
switch# show vlan 10
switch# show interface 1/1/1
switch# show running-config interface 1/1/1

show vlan shows each VLAN with its ports and tagging status; show interface 1/1/1 displays the operational state and the access/trunk assignment.

Decision Guide

• Plugging in a PC, server, IP camera or phone → access port.
• Uplink to another switch, router, or firewall → trunk port.
• Server with VLAN trunking (VMware, bare-metal with VLAN tags) → trunk port.
• Never put an end-user PC on a trunk - it can hop VLANs.

See also ArubaOS-CX access/trunk interface best practices and Cisco VLAN configuration and verification workflow for the cross-vendor view.

原文链接：https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-7762/Content/Chp_VLANs/vlan-over.htm