Trunk Allowed VLANs: A Silently Pruned VLAN
A new VLAN works on each switch but not between them. Diagnose the trunk's allowed list and fix it yourself, live, right below.
Symptom
A newly created VLAN works on each switch but not between them. Read the trunk's allowed list and add the VLAN without wiping the ones already there.
Your mission
Prove the cause, then fix it
Format
Guided CLI investigation
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: SW1 · SW2
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
VLAN 30 was created on both switches and its access ports are up, but hosts in VLAN 30 on SW1 cannot reach hosts in VLAN 30 on SW2. VLANs 10 and 20 are unaffected.
What you'll practice
- Read all four sections of show interfaces trunk
- Distinguish a VLAN that does not exist from one that is not allowed on a trunk
- Understand that the allowed list is a whitelist, not a filter of exceptions
- Use switchport trunk allowed vlan add rather than overwriting the list
- Verify the VLAN reaches spanning-tree forwarding state on the trunk
The topology
Two switches joined by a single 802.1Q trunk carrying the user VLANs, with access ports for each VLAN on both sides.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show interfaces trunkshow vlan briefshow running-config interface GigabitEthernet0/0Topology diagram
Frequently asked
Why is switchport trunk allowed vlan 30 the wrong command here?
Without the add keyword it replaces the entire list rather than extending it, so VLAN 30 starts working and VLANs 10 and 20 stop. It is the classic way to turn a one-VLAN outage into a site-wide one, and it takes effect the instant you press Enter.
The VLAN shows in show vlan brief. Why is that not enough?
show vlan brief only proves the VLAN exists on this switch and which local access ports are in it. Whether its tagged frames are permitted across a trunk is a separate setting, and show interfaces trunk is where you read it.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.