Access, Trunk, and Hybrid Link Types

Port link type decides how tags are handled

Creating VLANs is useless until ports know which VLAN a frame belongs to and whether to tag it on the wire. Huawei VRP exposes three exam-critical link types:

Set the type before detailed VLAN membership commands (order can matter if the device rejects commands in the wrong type):

[Huawei] interface GigabitEthernet0/0/1
[Huawei-GigabitEthernet0/0/1] port link-type access

Replace access with trunk or hybrid as required. Changing type may clear previous VLAN membership—reapply VLAN commands after a type change.

PVID and port default vlan

PVID (Port VLAN ID) is the VLAN assigned to untagged frames arriving on the port. On access ports, PVID is the VLAN of the attached host. Command:

[Huawei-GigabitEthernet0/0/1] port default vlan 10

Behavior summary:

• Ingress untagged frame → classified into the PVID.
• Egress for that VLAN on an access port → tag stripped; host sees ordinary Ethernet.
• Hosts almost never send 802.1Q tags; access ports keep life simple for PCs.

If two access ports need to communicate at Layer 2, both must share the same PVID/VLAN (and any intermediate trunks must allow that VLAN).

Access port complete mini-config

[Huawei] vlan batch 10
[Huawei] interface GigabitEthernet0/0/1
[Huawei-GigabitEthernet0/0/1] port link-type access
[Huawei-GigabitEthernet0/0/1] port default vlan 10
[Huawei-GigabitEthernet0/0/1] quit

Verify with display vlan 10 and display port vlan (or platform-equivalent) so the port shows as untagged member of VLAN 10.

Trunk ports and allow-pass

A trunk carries multiple VLANs between switches (or to a router-on-a-stick). Frames for allowed VLANs are sent tagged with the VLAN ID (except often the PVID/native-like untagged VLAN, depending on config).

Core commands:

[Huawei] interface GigabitEthernet0/0/24
[Huawei-GigabitEthernet0/0/24] port link-type trunk
[Huawei-GigabitEthernet0/0/24] port trunk allow-pass vlan 10 20 30

Allow all VLANs (convenient but less secure):

[Huawei-GigabitEthernet0/0/24] port trunk allow-pass vlan all

Or add/remove selectively:

[Huawei-GigabitEthernet0/0/24] port trunk allow-pass vlan 40
[Huawei-GigabitEthernet0/0/24] undo port trunk allow-pass vlan 40

The #1 trunk exam trap: forgetting allow-pass

You create VLAN 20 on both switches, put servers in VLAN 20, and configure port link-type trunk on the uplink—but you never add VLAN 20 to port trunk allow-pass vlan. Result: VLAN 20 traffic does not cross the trunk. Symptoms look like “hosts can’t reach gateway” or “MAC of server never appears on the far switch.” Fix: allow the VLAN on both ends of the trunk and confirm with display port vlan / display trunkmembership style outputs available on the platform.

PVID on trunks

Trunks still have a default VLAN / PVID. Untagged frames on a trunk are mapped to that PVID. Mismatched PVIDs on two ends of a trunk can cause subtle VLAN hopping-style confusion or management issues. For HCIA, remember: tagged data VLANs must be allowed; treat PVID consistency as a professional habit.

Optional trunk PVID example:

[Huawei-GigabitEthernet0/0/24] port trunk pvid vlan 1

(Exact keyword may appear as port trunk pvid vlan depending on software; labs reinforce the concept of trunk native/default VLAN.)

Hybrid ports: Huawei-specific power tool

Hybrid ports combine flexibility that pure access and pure trunk lack: you can specify, per VLAN, whether egress frames are tagged or untagged.

Typical pattern—PC + IP phone on one cable:

• Data VLAN 10 untagged (PC expects no tag).
• Voice VLAN 30 tagged (phone understands 802.1Q).

Conceptual configuration shape:

[Huawei] interface GigabitEthernet0/0/5
[Huawei-GigabitEthernet0/0/5] port link-type hybrid
[Huawei-GigabitEthernet0/0/5] port hybrid pvid vlan 10
[Huawei-GigabitEthernet0/0/5] port hybrid untagged vlan 10
[Huawei-GigabitEthernet0/0/5] port hybrid tagged vlan 30

Interpretation:

• Untagged frames from the PC → PVID 10.
• Egress VLAN 10 → untagged toward the PC.
• Egress VLAN 30 → tagged toward the phone.

Hybrid is also used when a device must receive one VLAN untagged while a switch uplink still needs other VLANs tagged—edge cases where “access” is too narrow and “trunk” would tag everything the host cannot parse.

Hybrid vs trunk (exam comparison)

Do not claim hybrid is “just like Cisco trunk.” The exam rewards Huawei wording: hybrid can untag multiple VLANs’ egress according to configuration, which is the operational distinction students must articulate.

Tagging rules cheat sheet

End-to-end path example

• Access SW1 G0/0/1: access, PVID 10, PC-A.
• Access SW1 G0/0/24: trunk, allow 10,20.
• Aggregation SW2 G0/0/24: trunk, allow 10,20.
• SW2 G0/0/2: access, PVID 10, PC-B.

PC-A to PC-B:

1. PC-A sends untagged frames → SW1 classifies VLAN 10.
2. SW1 tags VLAN 10 on the trunk toward SW2.
3. SW2 accepts tag 10 (allowed), strips on access toward PC-B.
4. MAC learning of A and B occurs in VLAN 10 on both switches.

If either trunk omits VLAN 10 from allow-pass, the path breaks even though both access ports are “in VLAN 10.”

Verification and troubleshooting order

1. display vlan — VLAN exists.
2. display port vlan / interface config — link-type and membership correct.
3. Confirm allow-pass (trunk) or hybrid tagged/untagged lists on every hop.
4. display mac-address vlan 10 — does the remote MAC appear?
5. Check physical up/up and STP forwarding (next chapter domain).

Common misconfigurations

• Access port left in VLAN 1 while addressing assumes VLAN 10.
• Trunk configured but allow-pass still default-only subset.
• Hybrid PVID not included in untagged list (or mismatched).
• One side access, other side trunk without understanding tags—host may not process tagged frames.
• Assuming port link-type trunk alone allows every VLAN forever without checking actual allow lists after VLAN creation.

Transition to routing

Access, trunk, and hybrid keep traffic inside the correct VLANs. Users in VLAN 10 still cannot reach VLAN 20 until a Layer 3 device routes between those subnets. Huawei campus designs usually use VLANIF interfaces on a multilayer switch; classic router-on-a-stick uses trunked sub-interfaces. That is the next section.