Hello @chris-gavorcik ,
first of all, a few general statements:
Whenever you want to send tagged traffic on a port, then this port should be configured as a trunk port on a Cisco switch (the voice vlan you mentioned being one exception to this rule but you appear not to use IP phones on this switch).
By default, Vlan 1 is the untagged Vlan which Cisco calls the native Vlan. Whenever you want a different vlan as untagged on a port you need to change the native vlan.
By default all vlans are allowed on a Cisco trunk. So as soon as you configure a port as a trunk, then all Vlans that are enabled on this switch are allowed to run over this port.
If you want to restrict certain vlans from using a trunk port, then you need to configure allowed-vlan lists. As soon as you use allowed-vlan lists the logic is reversed, meaning only those vlans that you explicitly allow can use this trunk port. It is important to note that you also have to allow the native vlan in this list if you want it to run over this link.
You can use interface range commands to configure multiple ports with a single command to make life a bit easier.
As a starting point let's look at the vlans of your original post, i.e. vlans 2 and 601:
vlan 2
name WIFI
vlan 601
name VLAN 601 Business Operation
!
interface range gi1/0/1 - 14
switchport mode trunk
interface range gi1/0/1, gi1/0/3, gi1/0/5, gi1/0/7 - 14
switchport trunk native vlan 601
Now just one example for an allowed-vlan list.
If I want to only allow the vlans 2 and 601 on port gi1/0/1, it looks like this:
interface gi1/0/1
switchport trunk allowed vlan 2,601
Verification of trunks and allowed-vlan lists can be done with the "show interface trunk" command.
If you have further questions or need some help to configure the EtherChannel or other features just let us know.
HTH!
