Simple definition
A VLAN trunk carries multiple VLANs over the same Ethernet link.
Technical definition
A trunk normally uses IEEE 802.1Q tagging: a VLAN identifier is added to frames so several logical networks can share one physical link. Depending on the configuration, a native VLAN or PVID can carry some untagged frames.
How it works / role
When transmitting, the switch associates each frame with its VLAN and keeps or adds the 802.1Q tag on the trunk. On reception, the peer reads the tag and places the frame into the correct VLAN. The allowed-VLAN list must be consistent at both ends.
What is it used for?
Connect switches, firewalls, hypervisors, or Wi-Fi access points while carrying several logical networks on one physical interface.
Practical example
A trunk between a switch and a firewall carries VLANs 10, 20, and 40; the firewall uses one 802.1Q subinterface for each network.
Common issues
- A required VLAN is missing from the allowed-VLAN list
- The native VLAN or PVID differs between the two ends
- One side is configured as access while the other side is trunk
- Tagging is incorrect on a hypervisor, access point, or subinterface
Key takeaway: A trunk works reliably only when tagging, native VLAN, and allowed VLANs are consistent end to end.