What is an Access Port?

An access port is a Layer 2 interface mode used for switch ports that connect directly to end devices such as PCs, printers, and phones. It belongs to a single VLAN – the access VLAN – treats untagged incoming packets as tagged with that VLAN’s ID, and discards any tagged frame whose VLAN ID doesn’t match.

Key takeaways

• An access port belongs to exactly one VLAN, the access VLAN.
• Untagged incoming packets are treated as tagged with the access VLAN ID.
• Tagged frames that don’t match the access VLAN are discarded.
• Trunk ports are the counterpart, carrying multiple VLANs between switches.
• Access ports can add PoE, a voice VLAN, or multihoming for redundancy.

On this page: Why it matters · How it works · Types · Access ports & Versa · FAQ

Why are access ports important?

Most end devices – PCs, printers, cameras, access points – send and expect plain, untagged Ethernet frames; they have no notion of VLAN tags at all. Access ports let a switch place that untagged traffic into the correct VLAN without any special configuration on the device itself. That’s what makes VLAN-based segmentation practical at scale: an administrator sets the port’s mode and VLAN once, and every device plugged into it inherits the right broadcast domain automatically.

Access ports are also a containment boundary. Because a port belongs to exactly one VLAN and discards mismatched tagged frames, a device – or an attacker – plugged into it cannot simply tag its own traffic to hop into a different VLAN. That restriction keeps departmental, guest, and security-zone segmentation enforceable at the physical port, rather than dependent on every connected device behaving correctly.

What is an access port?

An access port is configured in access mode, one of two Layer 2 interface modes a switch port can run (the other being trunk mode). In access mode, the interface accepts untagged packets and belongs to only one VLAN, the access VLAN: any untagged packet arriving is treated as tagged with that VLAN’s ID, and any tagged frame whose VLAN ID doesn’t match is discarded. Access VLAN IDs are typically assigned in the range 1 through 4094, with VLAN 0 reserved for a fully untagged interface.

Trunk mode is the counterpart: a trunk interface accepts tagged packets and can carry multiple VLAN IDs or ranges over one link, typically between switches, with a native VLAN ID optionally defined so an untagged packet arriving on the trunk is treated as belonging to that native VLAN. An access port, by contrast, is the simple, single-VLAN case: one cable, one VLAN, no tagging behavior the connected device needs to understand.

Types of access ports

The standard access port is the default case: one physical port, one access VLAN, for a PC, printer, or wireless access point sending untagged traffic. A multihomed access port extends that behavior across two switches at once – using multi-chassis link aggregation (MC-LAG) so the port connects to more than one network device, improving reliability if one upstream switch fails. A PoE- and voice-VLAN-enabled access port pairs access-mode configuration with a physical port profile supplying Power over Ethernet and a separate voice VLAN – discovered via LLDP – for IP phones sharing a cable run with a PC. An access port can also require 802.1X authentication, so a device must authenticate before the port forwards its traffic.

Access ports & Versa

Versa configures access-mode interfaces in two places, covering both the SD-WAN edge and dedicated LAN switching. In Concerto’s Secure SD-WAN network-interface workflow, a Layer 2 interface can be set to Interface Mode “Access,” restricting it to one VLAN ID and treating untagged packets as members of that VLAN – see Configure access and trunk interfaces in Concerto. On VOS-based switches (including the CSX4300, CSX4500, and CSX8300 series), Director’s SD-LAN wizard configures physical ports the same way – Access or Trunk mode, with a VLAN ID for access ports – and lets an administrator add a physical port profile for PoE, LLDP, and voice VLAN, or an 802.1X profile for port-based authentication, per Configure SD-LAN using workflow templates.

Frequently asked questions

What is the difference between an access port and a trunk port?

An access port belongs to a single VLAN and treats untagged packets as members of that VLAN. A trunk port carries multiple VLAN IDs over one link by requiring tagged packets, so the switches on either end can tell VLANs apart.

Can an access port belong to more than one VLAN?

No. An access port belongs to only one VLAN, the access VLAN. Carrying more than one VLAN on the same link requires trunk mode instead, which accepts tagged packets across a specified list or range of VLAN IDs.

What happens if a tagged frame arrives on an access port?

The switch discards it if the frame’s VLAN ID doesn’t match the port’s access VLAN. Access ports handle untagged traffic for one VLAN; a mismatched tagged frame is dropped rather than forwarded.

Can an access port also provide Power over Ethernet?

Yes. An access port’s Layer 2 mode is independent of PoE – a physical port profile can supply PoE, with a configurable priority, to a device on the same port set to access mode.

What is a multihomed access port?

It uses multi-chassis link aggregation (MC-LAG) to connect to more than one upstream network device at once, rather than a single switch, improving reliability if one upstream connection fails.

More on Access Port

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about access ports, these are worth looking at next.