In the previous chapter, you partitioned a single switch into VLAN 10 (Sales) and VLAN 20 (Engineering). But in the real world, companies rarely fit on a single 24-port switch in a single room. An enterprise campus often spans multiple floors—Floor 1 has twenty sales reps and ten engineers, while Floor 2 has another thirty sales reps and fifteen engineers.
If you used standard access ports to connect the Floor 1 switch to the Floor 2 switch, you would have to run a dedicated physical copper cable for every single VLAN in the company. If your organization had twenty VLANs, you would burn twenty physical switch ports on each end just to connect the two floors together! This approach is cost-prohibitive and unmanageable.
The Multi-Floor Cabling Dilemma
In our last lab, we divided one switch into separate virtual spaces for Sales and Engineering. That works well when your whole team fits in one room. But real companies rarely stay in a single room. Picture a two-story office: Floor 1 has twenty sales reps and ten engineers. Floor 2 has thirty sales reps and fifteen engineers.
If you used standard access ports to connect the Floor 1 switch to the Floor 2 switch, you would have to run a dedicated physical cable for every single department in the company. If your business had ten VLANs, you would burn ten physical switch ports on each floor just to connect the two levels together! That wastes switch ports, burns expensive copper, and creates a cabling nightmare in the risers.
The 802.1Q Solution: Trunk Ports
To eliminate this waste, the networking industry created the IEEE 802.1Q standard. Instead of running a bunch of separate wires, you connect the two switches with a single high-speed cable—such as a 1 Gbps Cat6 link or 10 Gbps fiber. That single link is configured as a Trunk Port.
A trunk port is a shared highway. Unlike an access port that belongs to only one team, a trunk port allows traffic from all VLANs to travel across the exact same physical wire at the same time, without ever mixing or leaking between departments.
How the 4-Byte VLAN Tag Works
When an Ethernet frame speeds across the trunk between Floor 1 and Floor 2, how does the receiving switch know whether that data belongs to Sales or Engineering? The first switch adds a tiny 4-byte 802.1Q Tag directly into the frame before sending it out:
Standard Ethernet Frame:
[ Destination MAC (6B) ] [ Source MAC (6B) ] [ Type (2B) ] [ Data (46-1500B) ] [ FCS (4B) ]
Tagged Frame on the Trunk:
[ Dest MAC ] [ Src MAC ] [ 802.1Q Tag (4 Bytes) ] [ Type ] [ Data ] [ FCS ]
├── Tag Identifier (0x8100)
├── Priority Bits (Quality of Service)
└── VLAN ID (Which department it belongs to: 1 to 4094)
- Adding the Tag (Leaving Switch 1): When Sales PC-1 on Floor 1 sends a file to Sales PC-2 on Floor 2, Switch 1 stamps the frame with
VLAN ID: 10and pushes it onto the trunk. - Crossing the Wire: The tagged frame travels across the single link connecting the two floors.
- Reading and Stripping (Arriving at Switch 2): Switch 2 inspects the tag: "This tag says VLAN 10." It strips the 4-byte tag away, turning it back into a standard Ethernet frame, and forwards it strictly out of its local VLAN 10 access ports.
| Port Type | What Plugs Into It | VLAN Capacity | Frame Tagging |
|---|---|---|---|
| Access Port | End user devices (PCs, laptops, printers) | Exactly one VLAN | Standard untagged frames |
| Trunk Port | Switch-to-switch or switch-to-router | Multiple VLANs at once | Tagged with 4-byte 802.1Q headers |
Because the switch automatically inserts the 802.1Q header as frames leave for the trunk and strips it away before delivering frames to computers, end-user operating systems never see the tag. Workstations continue using regular network cards without needing any special software or drivers.
Field Troubleshooting: The Native VLAN Mismatch
Every trunk has a default channel called the Native VLAN (usually VLAN 1). Frames belonging to the Native VLAN travel across the trunk without any tag. This maintains backward compatibility with older devices that do not understand 802.1Q tags.
A classic misconfiguration occurs when a technician sets the Native VLAN to VLAN 1 on Switch 1, but sets it to VLAN 99 on Switch 2. When Switch 1 sends untagged frames, Switch 2 assumes they belong to VLAN 99. Suddenly, traffic leaks between two different departments! Switch logs will immediately warn you with "Native VLAN Mismatch" alerts.
The Next Challenge: Crossing Between VLANs
Thanks to trunking, Sales on Floor 1 talks directly to Sales on Floor 2, and Engineering talks across floors just as easily. But what happens when Sales genuinely needs to send an email or file to Engineering? Right now, they cannot, because VLANs are completely separate Layer 2 islands.
In our next chapter, we will see how a router connects them using Router-on-a-Stick. You will configure virtual subinterfaces so that traffic can leave one VLAN, cross a router, and safely enter another department without sacrificing security.