ArubaOS-CX Access vs Trunk Ports: Tagging and Examples

ArubaOS-CX does not use Cisco's switchport vocabulary at all, and that trips up engineers who assume the model is the same with different words. In AOS-CX there are only two port modes - access and trunk - and the native VLAN has rules of its own. This article covers the tagging model, the two commands that decide everything, and a set of configuration templates you can paste.

The Two Port Modes, Precisely

A port is in exactly one mode at a time. Setting vlan trunk allowed automatically moves the port to trunk mode; setting vlan access moves it back to access mode.

The Native VLAN Rule That Catches Everyone

The native VLAN is mandatory on an AOS-CX trunk - there is always one, and by default it is VLAN 1. Two documented behaviours are worth memorising:

• When you define a native VLAN, the switch automatically runs vlan trunk allowed all to guarantee the default VLAN stays permitted. If your intent was a pruned trunk, you must re-apply the allowed list after setting the native VLAN.
• To make the native VLAN traffic leave the port tagged, use vlan trunk native <id> tag. This is how you build a truly tag-only uplink where no untagged frame can ever enter or leave.

interface 1/1/24
    no shutdown
    vlan trunk native 999
    vlan trunk native 999 tag
    vlan trunk allowed 10,20,30,999

Template 1 - Access Port for a Host

vlan 20
    name USERS

interface 1/1/1
    no shutdown
    vlan access 20
    spanning-tree bpdu-guard
    spanning-tree port-type admin-edge

There is no vlan access 'plus' native VLAN on access ports; the access VLAN is the PVID and the frame is untagged. If a device on the port needs tagging, the port is a trunk, not an access port.

Template 2 - Trunk Uplink Between Switches

vlan 10
    name SERVERS
vlan 20
    name USERS
vlan 999
    name NATIVE_UNUSED

interface 1/1/49
    no shutdown
    vlan trunk native 999
    vlan trunk allowed 10,20
    spanning-tree bpdu-guard

Setting a deliberately unused native VLAN (a common choice is 999 or 666) avoids the classic VLAN-1 hopping problem and makes accidental untagged traffic obvious during troubleshooting.

Template 3 - Server Port With Multiple Tagged VLANs

interface 1/1/10
    no shutdown
    vlan trunk native 999
    vlan trunk native 999 tag
    vlan trunk allowed 100,101,102
    spanning-tree bpdu-guard
    flow-control rxtx

With the native VLAN tagged and the allowed list containing only the VLANs the hypervisor actually uses, a misconfigured host cannot leak untagged frames into the access VLAN.

Template 4 - Voice VLAN on an Access Port

interface 1/1/5
    no shutdown
    vlan access 20
    vlan voice
    voice vlan 30
    poe-enable

The phone tags its voice frames with VLAN 30 and sends PC traffic untagged into VLAN 20, so the phone's own switch handles the split. Verify the phone negotiated the voice VLAN rather than assuming it: show lldp neighbor-info 1/1/5 shows the advertised network policy.

Verification Commands

show vlan
show vlan 20
show interface 1/1/49 trunk
show running-config interface 1/1/49
show lldp neighbor-info
show mac-address-table vlan 20
show spanning-tree interface 1/1/49

show interface <port> trunk is the fastest single command in the whole toolkit here: it prints the mode, the native VLAN and the allowed list in one screen.

Translating From Cisco Habits

• Cisco switchport mode access + switchport access vlan 20 becomes vlan access 20.
• switchport trunk allowed vlan 10,20 becomes vlan trunk allowed 10,20.
• switchport trunk native vlan 999 becomes vlan trunk native 999.
• Cisco's switchport mode trunk has no direct equivalent because the first vlan trunk command switches the port to trunk mode implicitly.

For designs that link several VLANs across a pair of switches rather than a single port, the VSX active gateway guide covers the multichassis case, and the best-practice templates article collects the wider set of port profiles.

原文链接：https://support.hpe.com/hpesc/public/docDisplay?docId=sd00007217en_us&page=GUID-95D12BB6-1C63-49D7-A9ED-DEEEE9F33F39.html&docLocale=en_US