switchport trunk allowed vlan
Acts as a Layer 2 firewall for your trunk links. By default, a trunk permits every single VLAN (1-4094) to cross it. This command restricts the trunk to only carry traffic for explicitly specified VLANs, reducing unnecessary broadcast overhead and tightening security.
Quick Reference
Switch(config-if)#switchport mode trunkno switchport trunk allowed vlanSyntax & Modifiers
| Modifier Option | Action Performed |
|---|---|
| [vlan-id(s)] | Entering numbers directly (e.g., 10,20,30) explicitly sets the list, overwriting any previous configuration. |
| add [vlan-id(s)] | Appends the specified VLAN(s) to the currently active allowed list without disrupting existing traffic. |
| remove [vlan-id(s)] | Strips the specified VLAN(s) off the allowed list. |
| except [vlan-id(s)] | Allows all VLANs (1-4094) except the specific ones listed. |
| none | Blocks all VLANs from crossing the trunk. |
CLI Deployment Scenarios
Scenario 1: The Initial Lockdown
You just created a trunk and only want your Sales (10), HR (20), and IT (99) VLANs to cross the link.
Scenario 2: Safely Expanding the Network
Six months later, a new Engineering VLAN (30) is created. You need to allow it across the same core trunk link.
CCNA Exam Gotchas
The Career-Ending Overwrite Trap
If the trunk is currently allowing VLANs 10, 20, and 99, and you type switchport trunk allowed vlan 30 (forgetting the word add), you will instantly overwrite the entire list. VLANs 10, 20, and 99 will be immediately disconnected, black-holing all their traffic, and ONLY VLAN 30 will cross the trunk. Always double-check for the 'add' keyword!
Native VLAN Severing
If you change the Native VLAN on a trunk to VLAN 999 using switchport trunk native vlan 999, you must ensure that VLAN 999 is included in your allowed list. If you restrict the allowed list and forget to include the Native VLAN, untagged traffic will be dropped at the port.