A trunk can be up while traffic still fails. This VLAN trunk troubleshooting lab separates two common faults: a native VLAN mismatch and a VLAN missing from the allowed list.
Lab scope: Cisco Catalyst IOS/IOS XE, one 802.1Q link and normal untagged native VLAN behavior. Commands and outputs below are illustrative, not captured production results. Interface names and messages vary by platform.
Two-switch lab diagram
| SW1 Gi1/0/1 Native VLAN 99 Allowed: 10,20,99 | ↔ 802.1Q trunk | SW2 Gi1/0/1 Native VLAN 99 Allowed: 10,20,99 |
| PC-A: VLAN 10, 192.168.10.11/24 PC-B: VLAN 20, 192.168.20.11/24 | Same-VLAN tests A ↔ C • B ↔ D | PC-C: VLAN 10, 192.168.10.12/24 PC-D: VLAN 20, 192.168.20.12/24 |
Create VLANs 10, 20 and 99 on both switches. Assign the endpoint access ports to VLAN 10 or 20 as shown. Same-subnet tests do not require inter-VLAN routing. If you need the basics first, read what a VLAN is and how it works.
Native VLAN mismatch vs missing allowed VLAN: different symptoms
| Check | Native VLAN mismatch | Missing allowed VLAN |
|---|---|---|
| Example fault | SW1 native 99; SW2 native 999 | SW2 allows 10,99; VLAN 20 omitted |
| Link and trunk | Can remain up and show trunking | Can remain up and show trunking |
| Traffic symptom | Untagged frames enter different VLANs; STP may block affected VLANs | VLAN 20 fails across the link while VLAN 10 works |
| Evidence | Different native values; possible CDP warning or PVID inconsistency | VLAN 20 absent from an allowed list |
| Fix | Match the intended native VLAN | Add the required VLAN to the relevant trunk |
Untagged traffic is classified into the receiving trunk’s native VLAN. A mismatch can place that traffic into the wrong VLAN. PVST+/Rapid PVST+ protection may block affected VLANs. A mismatch does not mean every tagged VLAN must fail.
Start with both ends of the trunk
show interfaces gi1/0/1
show interfaces gi1/0/1 switchport
show interfaces trunk
show vlan brief
show spanning-tree inconsistentports
show loggingRun the checks on SW1 and SW2. Confirm the interface is up, operationally trunking and connected to the expected peer. If it is not a trunk, resolve the mode or link problem before diagnosing individual VLANs.
Issue 1: Find and fix a native VLAN mismatch
Commands and expected fault output
SW1# show interfaces trunk
Port Mode Encapsulation Status Native vlan
Gi1/0/1 on 802.1q trunking 99
SW2# show interfaces trunk
Port Mode Encapsulation Status Native vlan
Gi1/0/1 on 802.1q trunking 999The trunk is operational, but its native VLAN differs. With CDP enabled, a warning may resemble:
%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered
on GigabitEthernet1/0/1 (99), with SW2 GigabitEthernet1/0/1 (999).Check STP as well:
show spanning-tree inconsistentports
show spanning-tree vlan 99
show spanning-tree vlan 999Depending on STP mode and received BPDUs, you may see PVID_Inc or a PVID inconsistency. Its absence does not prove the native VLANs match. Compare the actual configuration at both ends.
Fix: restore the intended native VLAN
VLAN 99 is the intended native VLAN in this lab. Correct SW2:
SW2# configure terminal
SW2(config)# vlan 99
SW2(config-vlan)# name NATIVE
SW2(config-vlan)# exit
SW2(config)# interface gi1/0/1
SW2(config-if)# switchport trunk native vlan 99
SW2(config-if)# endFor a live network, establish the intended design and management path before changing it. For EtherChannel links, check and configure the logical Port-channel as appropriate for your platform.
Verify after the native VLAN fix
show interfaces trunk
show interfaces gi1/0/1 switchport
show spanning-tree inconsistentportsBoth trunk rows should now report native VLAN 99:
Port Mode Encapsulation Status Native vlan
Gi1/0/1 on 802.1q trunking 99After convergence, the affected port should have no PVID inconsistency. Keep STP enabled. Old warnings remain in the log buffer; check for new warnings after the correction. Since VLAN 99 has no user endpoints in this lab, the VLAN 10/20 pings alone do not prove native VLAN alignment—compare the native values too.
Issue 2: Fix VLAN traffic missing from the allowed list
Identify a selective failure
PC-A reaches PC-C in VLAN 10, but PC-B cannot reach PC-D in VLAN 20. Both native VLANs are 99 and the trunk is up. Compare allowed lists:
SW1# show interfaces trunk
Port Vlans allowed on trunk
Gi1/0/1 10,20,99
SW2# show interfaces trunk
Port Vlans allowed on trunk
Gi1/0/1 10,99VLAN 20 is missing on SW2. A successful VLAN 10 test validates VLAN 10 only.
Fix: add VLAN 20 without replacing the list
SW2# configure terminal
SW2(config)# interface gi1/0/1
SW2(config-if)# switchport trunk allowed vlan add 20
SW2(config-if)# endKeep the add keyword. The command switchport trunk allowed vlan 20 replaces the allowed list with VLAN 20 alone and can remove other required VLANs. Check both ends and add VLAN 20 wherever it is missing.
Verify all three trunk sections
show interfaces trunkIn this single-link lab, after convergence, expect both switches to show:
Port Vlans allowed on trunk
Gi1/0/1 10,20,99
Port Vlans allowed and active in management domain
Gi1/0/1 10,20,99
Port Vlans in spanning tree forwarding state and not pruned
Gi1/0/1 10,20,99| Where VLAN 20 appears | Next check |
|---|---|
| Missing from allowed | Trunk allowed list |
| Allowed but not active | Local VLAN existence and status |
| Active but not forwarding/not pruned | STP state and pruning |
| Present in all three | Access ports, IP addressing, MAC learning and endpoint firewall |
A redundant network may intentionally have an STP-blocked path. Do not force every trunk to forward. If VLAN 20 is absent locally and belongs on that switch, create it:
configure terminal
vlan 20
name USERS_20
endFinal verification: prove traffic works
Confirm each endpoint access port is in the intended VLAN using show vlan brief and show interfaces <endpoint-port> switchport. Then test:
PC-A> ping 192.168.10.12
PC-B> ping 192.168.20.12Repeat from the opposite endpoints. Initial packets may time out during ARP resolution; sustained loss needs further investigation.
show mac address-table dynamic vlan 10
show mac address-table dynamic vlan 20
show spanning-tree vlan 20After traffic, SW1 should learn PC-D’s VLAN 20 MAC through the trunk; SW2 should learn PC-B’s through the trunk.
| Verification | Expected result |
|---|---|
| Native VLAN | 99 on both ends |
| Allowed and active VLANs | Required VLANs included on both ends |
| STP | No unexpected inconsistency; intended path forwards |
| Endpoint tests | Same-VLAN pings succeed in both directions |
| Logs | No new native mismatch warnings |
Save only after verification:
copy running-config startup-configFrequently asked questions
Can a trunk be up while one VLAN fails?
Yes. Trunk status alone does not confirm that every required VLAN is allowed, active and forwarding.
Does a native VLAN mismatch block all VLANs?
Not necessarily. Untagged traffic is misclassified, and STP may block affected VLANs. Other tagged VLANs may continue working.
Why is an allowed VLAN still not forwarding?
It may be absent or inactive in the local VLAN database, blocked by STP, or pruned. Read all three sections of show interfaces trunk.
Cisco references
PM Networking is an emerging leader in the ed-tech space, founded by Praphul Mishra in 2020 with a vision to democratize tech education. The journey of PM Networking began as a YouTube channel with the sole purpose of sharing valuable knowledge in the fields of Networking, Cyber Security, and Cloud Computing. What started as a humble effort to educate has rapidly evolved into a comprehensive online learning platform that caters to the growing demand for specialized IT skills.PM Networking stands out in the crowded ed-tech industry by providing affordable, world-class training tailored to the needs of aspiring IT professionals. The platform is dedicated to equipping learners with the skills and knowledge required to excel in the highly competitive tech industry. Whether it’s Networking fundamentals, advanced Cyber Security protocols, or mastering the complexities of Cloud Computing, PM Networking offers a range of courses designed to cater to different levels of expertise.
0 Comments