2.2 Access, Trunk, Native and Voice VLANs

Port Modes in Junos: Access vs. Trunk

Junos OS categorizes switch interfaces into distinct operational modes depending on how they manipulate 802.1Q tags upon ingress and egress. On modern Juniper switches running Enhanced Layer 2 Software (ELS)—such as the EX2300, EX3400, EX4300, EX4400, EX4600, and QFX5100/5120 series—port modes are defined under the unit 0 family ethernet-switching hierarchy.

Access Mode (interface-mode access)

Access ports connect end-user devices—such as workstations, laptop docking stations, printers, IP surveillance cameras, and non-virtualized servers—that have no awareness of 802.1Q tagging.

• Ingress Processing: The access port expects standard, untagged Ethernet frames. When an untagged frame enters the physical port, the switch internally assigns the frame to the configured access VLAN in the Packet Forwarding Engine (PFE) hardware table. If an access port receives an 802.1Q tagged frame, the switch silently discards it by default (unless voice VLAN is explicitly configured).
• Egress Processing: When the switch forwards a frame out an access port toward an endpoint, the PFE strips the 4-byte 802.1Q header, delivering a standard, untagged frame to the client.

[edit]
user@EX4400# set interfaces ge-0/0/1 unit 0 family ethernet-switching interface-mode access
user@EX4400# set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members DATA-USERS

Trunk Mode (interface-mode trunk)

Trunk ports connect switches to other switches (inter-switch links), routers, firewalls, and virtualization hypervisors (such as VMware ESXi or KVM) that require simultaneous access to multiple VLANs across a single physical or aggregated link.

• Ingress Processing: When a tagged frame arrives on a trunk port, the switch parses the 802.1Q header. If the VID matches a VLAN listed in the port's vlan members allowed list, the frame is admitted and forwarded within that broadcast domain. If the incoming VID is not explicitly permitted on the trunk, the frame is dropped immediately at the MAC layer.
• Egress Processing: As frames exit a trunk port, the switch preserves the 802.1Q tag, allowing the downstream switch or router to maintain broadcast domain separation.

[edit]
user@EX4400# set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode trunk
user@EX4400# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members [ DATA-USERS VOICE-USERS MGMT-INFRA ]

Exam Tip: You can also configure set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members all to allow all locally defined VLANs across the trunk. However, enterprise best practice restricts trunk membership to explicitly defined VLAN lists to prevent unnecessary broadcast flooding.

---

Native VLAN Architecture & Junos ELS Mechanics

While trunk ports primarily transport 802.1Q tagged frames, standard networks often require trunk links to carry untagged traffic. For example, legacy hardware, remote out-of-band management adapters, and standard Spanning Tree BPDUs are link-local control frames handled separately from ordinary native-VLAN data. The Native VLAN provides a mechanism to ingest and transmit this untagged traffic over an 802.1Q trunk.

In Junos, the native VLAN is specified on the physical interface using the native-vlan-id statement:

[edit]
user@EX4400# set interfaces ge-0/0/0 native-vlan-id 99
user@EX4400# set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode trunk
user@EX4400# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members [ DATA-USERS VOICE-USERS NATIVE-TRANSIT ]
user@EX4400# set vlans NATIVE-TRANSIT vlan-id 99

Ingress and Egress Behavior of Native VLANs

• Ingress: When an untagged frame enters trunk port ge-0/0/0, the switch maps it internally to VLAN 99 (NATIVE-TRANSIT).
• Egress: Verify the platform’s native-tag insertion/removal behavior independently of ingress classification. Junos documents no-native-vlan-insert for supported untagged egress. Do not assume native-vlan-id alone strips every native-VLAN frame on every ELS/MX interface style.

Critical Junos ELS Operational Requirement

In this ELS ethernet-switching trunk example, include the native VLAN in the logical interface’s vlan members list as well as configuring native-vlan-id on the physical interface. Other interface styles must have the corresponding supported VLAN-ID association. If NATIVE-TRANSIT (VLAN 99) is omitted from vlan members, the switch drops all untagged frames received on that trunk link, even though native-vlan-id 99 is configured on the physical port.

Security Best Practice

For designs requiring native data traffic, prefer assigning the native VLAN to an unused, dedicated VLAN ID (e.g., VLAN 999) that has no access ports and terminates no Layer 3 routing interfaces. This mitigates "double-tagging" hopping attacks, where an attacker crafts a frame with two 802.1Q tags: the outer tag matches the native VLAN (which an affected untagged-egress configuration strips), exposing the inner tag to be forwarded directly into a victim VLAN on the downstream switch.

---

Voice VLAN Architecture & LLDP-MED

In enterprise office deployments, an IP telephone typically shares a single wall jack with an employee's computer. The IP phone contains an integrated three-port Layer 2 switch:

• Port 1 connects to the building wall plate (upstream switch access port).
• Port 2 connects internally to the phone's voice DSP and call-processing software.
• Port 3 connects to the employee's workstation via a patch cable.

+---------------+       Untagged Data       +-------------+       Untagged Data (VLAN 10)       +------------+
|  Employee PC  | ------------------------> |  IP Phone   | ----------------------------------> | Access Port|
+---------------+                           | (Int. Switch|                                     |  ge-0/0/2  |
                                            |             | === 802.1Q Tagged Voice (VLAN 20) =>|            |
                                            +-------------+     (PCP 5 / DSCP 46 EF)            +------------+

To ensure crystal-clear audio, voice traffic must be separated from large PC data file transfers. If voice and data shared the same broadcast domain and priority queue, a large file download or malware burst from the PC could induce jitter, latency, and dropped calls. The access switch must therefore handle both tagged voice traffic and untagged PC data simultaneously on a single physical port.

Junos ELS Voice VLAN Configuration

In Junos ELS, the port remains configured in interface-mode access with the data VLAN bound under vlan members. The voice VLAN is activated using the switch-options voip hierarchy:

[edit]
user@EX4400# set vlans DATA-USERS vlan-id 10
user@EX4400# set vlans VOICE-USERS vlan-id 20

user@EX4400# set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access
user@EX4400# set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members DATA-USERS

user@EX4400# set switch-options voip interface ge-0/0/2.0 vlan VOICE-USERS
user@EX4400# set switch-options voip interface ge-0/0/2.0 forwarding-class expedited-forwarding

Automated Discovery via LLDP-MED

How does the IP phone know which VLAN to tag its packets with? Rather than manually configuring hundreds of desk phones, switches use Link Layer Discovery Protocol - Media Endpoint Discovery (LLDP-MED), standardized under ANSI/TIA-1057. When the phone powers on via PoE, it initiates LLDP exchanges with the Junos switch. The switch responds with an LLDP-MED Network Policy Type-Length-Value (TLV) stating:

• Application Type: Voice
• VLAN ID: 20 (VOICE-USERS)
• Tagging: Tagged
• L2 Priority (PCP): 5
• DSCP Value: 46 (Expedited Forwarding)

Upon parsing this TLV, the phone automatically configures its internal DSP to tag all voice signaling (SIP) and audio media (RTP) with 802.1Q VID 20. Simultaneously, the phone's internal switch forwards untagged packets from the employee's computer straight to the access switch port, where the switch tags them internally into VLAN 10.

Official references checked 2026-10-18: Native VLAN semantics.