What is the difference between access and trunk ports?

An access port belongs to one VLAN and sends untagged frames (the PVID). A trunk port carries multiple VLANs using 802.1Q tags. End devices connect to access ports; switches connect to each other via trunks. A hybrid port can do both (tagged for some VLANs, untagged for one).

Security (isolate departments, guest networks), performance (reduce broadcast domain size), flexibility (move users without rewiring), and compliance (segment PCI cardholder data). Without VLANs, all devices share one broadcast domain, causing unnecessary traffic and security exposure.

TASK

Understand and configure VLANs

VLANs logically segment a physical network into isolated broadcast domains. Learn VLAN IDs, tagging (802.1Q), and trunk vs access ports.

1

A VLAN (Virtual LAN) is a logical network segment created on a switch. VLANs isolate broadcast traffic and improve security. Each VLAN has an ID (1-4094, with 1 often default and 1002-1005 reserved). The 802.1Q tag (4 bytes inserted into the Ethernet frame) carries the VLAN ID between switches on trunk ports.
2

MAC Address Tool →
Look up the MAC address of network devices to identify them by vendor. This helps map physical devices to VLAN assignments. Document which ports connect to which VLANs and devices.
3

IP Address Info →
Plan the IP subnet for each VLAN. Typically each VLAN maps to one subnet: VLAN 10 → 10.0.10.0/24, VLAN 20 → 10.0.20.0/24. Inter-VLAN routing requires a router or Layer-3 switch.

Frequently asked questions

What is the difference between access and trunk ports?: An access port belongs to one VLAN and sends untagged frames (the PVID). A trunk port carries multiple VLANs using 802.1Q tags. End devices connect to access ports; switches connect to each other via trunks. A hybrid port can do both (tagged for some VLANs, untagged for one).
Why use VLANs?: Security (isolate departments, guest networks), performance (reduce broadcast domain size), flexibility (move users without rewiring), and compliance (segment PCI cardholder data). Without VLANs, all devices share one broadcast domain, causing unnecessary traffic and security exposure.