An allowed VLAN list specifies which VLANs may traverse a trunk interface. Trunks allow all VLANs by default, but limiting the list to required VLANs reduces broadcast-domain flooding and is a practical security measure. section 12.3.2
Interpret the list in two stages:
- A VLAN must be permitted by the trunk’s allowed list. section 12.3.2
- The VLAN must also exist on the switch; nonexistent VLANs cannot forward traffic, even when the trunk allows all VLANs. section 12.3.2
- Use add and remove to change the current list, all to permit every VLAN, none to permit no VLANs, and except to permit every VLAN except specified IDs. section 12.3.2
Restrict a trunk to required VLANs
On interface G0/0, configure only VLANs 10, 20, and 30: SW1(config-if)# switchport trunk allowed vlan 10,20,30 SW1(config-if)# do show interfaces trunk Gi0/0 10,20,30 The verification output confirms that only those VLANs are allowed. Broadcast and unknown-unicast frames from other VLANs are not flooded through this interface. section 12.3.2
