Using Trunk Ports for End User Desktops?

[MikeChavez06]

Hi Everyone,

I often hear that end user desktops should be configured with access ports, not trunk ports.  I understand that this is for security reasons.

However, on my SG300/350 series switches, there is a preconfigured Smartport value for desktops.  This configuration configures a trunk port, then assigns the port membership native VLAN to a value you specify.

So in the end, the port is configured as a trunk, but only one VLAN is accessible.  This sounds pretty similar to an access port.  For example, if I configure a SmartPort for desktop and specify VLAN 152, it looks like this:

Questions

1. Is it wrong to configure an end-user desktop port in this fashion?

2. Any downside to using a trunk port for an end-user desktop as long as no other VLANs are joined?

[Sujoy Paria]

Hi Mike,

The default Switchport mode is ‘Trunk’ in Cisco Small Business 300 series Switches and ‘Access’ in Cisco Small Business 350 series Switches. By default no VLAN is allowed in trunk ports (only VLAN 1) in 300 series switches however in 350 series Switches by default trunk ports are members of all VLANs regardless of whether the VLANs are active or inactive on the switch.

So in 300 series Switches you need to specifically add any additional VLAN (apart from the only VLAN allowed on that port) to allow the traffic for that VLAN even though the port is configured as ‘Trunk’. Due to that it seems like an access port.

Regarding your first query, it is not a wrong configuration for the end user desktop connected ports (considering the 300 series Switches) as long as only one VLAN is allowed however it is recommended to use ‘Access’ mode as the desktop will be part of one VLAN.

And regarding your second query (not restricted to Cisco Small Business Switches), you may refer the below mentioned link…

 https://community.cisco.com/t5/switching/the-effect-of-plugging-an-end-device-into-a-trunk-port/td-p/2708478