ArubaOS-CX Access vs Trunk Ports: Modes and Config Examples

ArubaOS-CX uses a clean but easy-to-misread port model: an interface carries exactly one untagged VLAN in access mode, while a trunk port carries multiple VLANs defined by a native (untagged) VLAN plus an allowed list of tagged VLANs. Engineers coming from Cisco or ProVision often stumble on the AOS-CX commands because there is no "switchport" keyword - the VLAN statements live directly on the interface or LAG. This guide compares access and trunk modes, explains native VLAN tagging, and shows complete configuration examples including LAG scenarios.

Access vs Trunk: The ArubaOS-CX Model

• Access port: carries traffic for one VLAN only. Untagged frames belong to the configured access VLAN via vlan access <ID>. Tagged frames from other VLANs are dropped.
• Trunk port: carries one or more VLANs. vlan trunk native <ID> sets the untagged (native) VLAN, and vlan trunk allowed <list> defines which VLANs may cross the trunk. A native VLAN must exist; VLAN 1 is the default.
• Native VLAN tagging: adding the tag keyword (vlan trunk native 30 tag) makes even the native VLAN egress tagged. Incoming untagged packets are then dropped (except BPDUs), and only packets tagged with the matching VLAN ID are accepted.

Comparison Table

• Purpose: access = single end-device VLAN; trunk = multi-VLAN uplinks between switches/hypervisors.
• Untagged frames: access = assigned to the access VLAN; trunk = assigned to the native VLAN.
• Tagged frames: access = dropped unless they match the access VLAN; trunk = accepted if in the allowed list.
• Typical commands: access uses vlan access 5; trunk uses vlan trunk native/allowed.
• Common use: access for servers/APs/desktops; trunk for inter-switch links, ESXi bonding and VSX keepalive links.

Configuring an Access Interface

switch(config)# vlan 5
switch(config)# interface 1/1/1
switch(config-if)# no shutdown
switch(config-if)# vlan access 5

Configuring a Trunk Interface

switch(config)# vlan 30
switch(config)# vlan 50
switch(config)# vlan 120
switch(config)# interface 1/1/2
switch(config-if)# no shutdown
switch(config-if)# vlan trunk native 30
switch(config-if)# vlan trunk allowed 30,50,120

Because VLAN 30 is the native VLAN and is not configured with the tag keyword, untagged frames arriving on this port are placed into VLAN 30 while VLANs 50 and 120 travel tagged.

Trunk with Tagged Native VLAN

When the peer expects all traffic tagged - common on hypervisor virtual switches and some uplink designs - force the native VLAN to be tagged too:

switch(config)# interface 1/1/3
switch(config-if)# vlan trunk native 30 tag
switch(config-if)# vlan trunk allowed 30,50,120

Access and Trunk over a LAG

The same VLAN statements apply inside a LAG interface, which is how you build a resilient multi-VLAN uplink:

switch(config)# interface lag 10
switch(config-lag-if)# lacp mode active
switch(config-lag-if)# vlan trunk native 30
switch(config-lag-if)# vlan trunk allowed 30,50,120
switch(config)# interface 1/1/4
switch(config-if)# no shutdown
switch(config-if)# lag 10

Verification

switch# show lacp interfaces
switch# show vlan
switch# show running-config interface 1/1/2

Keep the native VLAN identical at both ends of a trunk. If one side expects tagged native traffic and the other sends it untagged, the VLANs will silently mismatch and connectivity will fail in ways that are hard to spot without the show commands above.

Related reading: ArubaOS-CX native VLAN and untagged trunk traffic guide and ArubaOS-CX VSX configuration guide.

Original article: ArubaOS-CX: Configuring a switch as an access switch