Switchport Configurations Explained

It always helps me to think of the English translation when trying to memorize and understand some the Cisco IOS settings I think are important.

Here are some Cisco IOS switchport configurations translated into English:

switchport mode trunk‘ says: “Always trunk on this end, and I will send DTP to attempt to negotiate a trunk on the other end.”

switchport nonegotiate‘ says: “Do not send or respond to DTP from this end. Disable all DTP on this port.” (Best used on user access ports, when trunking to non-Cisco switches, when trunking to a router1, or if you are paranoid about fast convergence2)

switchport mode dynamic desirable‘ says: “Ask the other end to trunk using DTP and trunk if the negotiation succeeds. If DTP negotiation fails then become an access port.”

switchport mode dynamic auto‘ says: “If the other end asks me to be a trunk with DTP, then become a trunk, but I wont initiate any negotitation from this end. If no one asks me to become a trunk then I will become an access port.”

switchport mode access‘ says: “Never trunk on this end, and I will send out DTP to help my link partner reach the same conclusion.”

switchport trunk encapsulation‘ says: “Do not negotiate the trunk protocol with DTP. Only use the trunk protocol specified in this command (isl or dot1q).


[1] Cisco routers do not talk DTP

[2] The process of DTP message exchange adds some delay in negotiating and bringing up a trunk. Use ‘switchport mode trunk‘ + ‘switchport nonegotiate‘ + ‘switchport trunk encapsulation‘ for the fastest possible formation of a trunk.




  1. sarah says

    Very good article ! I just want to clear one confusion , when port is configured as access port, doesn’t it disable the dtp?
    thanks a lot!

  2. says


    DTP remains on even when you configure ‘switchport mode access’, only now the DTP messages are saying “I am not a trunk, don’t even bother”.
    DTP will be disabled entirely if you add ‘switchport nonegotiate’.


    • jeff mci says

      in-regards to the DTP messages still being sent….funny how i never realized that after all these years…**i feel sham**….time to run some debugs in the lab to see if i find anything else i could have missed….—great article.. thanks..

  3. Sai says

    If i dont have switchport nonegotiate configured and if i try to configure it on a live trunk, will the trunk formation start all over again or will this be seamless?

  4. Chennai CCNA says

    Dear Brad,

    What is the difference between “switchport mode access” and “switchport nonegotiate” ?
    Look like both are almost similar?


    • Matt says

      “switchport mode access” means the port cannot go into trunk mode, but it will still inform the remote side, using, DTP. “switchport nonegotiate” means don’t talk DTP at all. If you have both enabled, it means “don’t become a trunk and don’t talk about it either!” So the commands serve different purposes, because you could have “switchport mode trunk” and “switchport nonegotiate” just as easily.

  5. John Khoury says

    Could you please explain what does trunk and switchport mean individually? Is there any resources that explains these and other network terminology in layman’s definitions. Thank you for your time.

  6. Julius says

    Very well done Explanation, very easy to understand even to a lay man!! Thanks for the clarification

  7. Georgia Jaeger says

    Nice read. I am studying for my CCNA and was wondering what the application of “switchport” to a port actually means. A lot of time is spent in talking about the commands and little about what “switchport” means on a port. It turns on DTP.. I really liked your explanation. IT really clarified some points for me, especially what negotiation means.

    Thanks for your post!

    • says

      Hi Georgia.

      The ‘switchport’ command also tells the switch (usually a Multi-Layer Switch or MLS) to treat the port as a layer 2 port, i.e. as a member of a VLAN and to allow it to switch frames and learn MAC addresses etc., as well as participating in all other layer 2 processes such as spanning-tree.

      The ‘no switchport’ command tells the switch to treat the port as a layer 3 interface, so that you can run a routing protocol, add an interface IP address (or other layer 3 address) and create sub-interfaces, none of which is possible on a layer 2 interface. If you try running this command on a layer 2 only switch (e.g. a 2950) it will not understand it and reject it as ‘incomplete’, as shown below:

      ALS1#conf t
      Enter configuration commands, one per line. End with CNTL/Z.
      ALS1(config)#int fa0/24
      ALS1(config-if)#no switchport
      % Incomplete command.

      A routed port does not belong to a VLAN as far as the MLS is concerned because it has no concept of VLANs at layer 3, just a like a port on a router. However, on a MLS each VLAN also has a layer 3 interface: the VLAN interface, also known as an SVI. This is created on an MLS when the VLAN itself is created. On a pure layer 2 switch, such as the 2950, there is only one layer 3 interface: this is the ‘VLAN1’ interface (an SVI) that you configure to allow management connectivity.

      ALS1#show run int vlan 1
      Building configuration…

      Current configuration : 67 bytes
      interface Vlan1
      no ip address
      no ip route-cache

      • Georgia Jaeger says

        Thx. The is entire thread has been a life saver. The concepts are really much clearer to me than before. Thanks so much all for your insight.

  8. Tj says

    Very very good article…!!!

    Brad, A question.

    The two commands can be configured on the same port “switchport mode trunk” and “switchport access vlan 10” and that action would have the second?

    interface GigabitEthernet1/0/1
    switchport mode trunk
    switchport trunk allowed vlan 1,5-10,20
    switchport access vlan 10
    switchport nonegotiate


Leave a Reply

Your email address will not be published. Required fields are marked *