How to Remove Trunk Port in Cisco Switch Command

In Cisco Catalyst switches running Cisco IOS or IOS-XE, removing a trunk port can mean three different operational tasks: converting an active trunk into a standard access port for an end-user device, stripping all custom configurations to return an interface to factory defaults, or pruning specific VLANs from an active trunk link without tearing down the connection.

Executing the wrong command can lead to spanning tree recalculations, native VLAN mismatches, or unexpected Dynamic Trunking Protocol (DTP) negotiations that leave the port in an unintended state. Below is a comprehensive walkthrough of the CLI commands, behavioral differences, verification steps, and automation templates required to safely modify or remove trunk configurations on Cisco switches.

Table of Contents

Converting a Trunk Port to a Static Access Port

When repurposing an uplink or server trunk interface for a standard workstation, printer, or single-VLAN endpoint, the interface must be transitioned from trunk mode to static access mode. Simply issuing no switchport mode trunk is often insufficient because the port may fall back to dynamic auto or desirable mode depending on the platform default.

Follow these steps to safely convert the port:

Enter Global Configuration Mode:
text Switch# configure terminal
Select the Target Interface:
Specify the physical interface currently configured as a trunk (for example, GigabitEthernet 1/0/10):
text Switch(config)# interface GigabitEthernet 1/0/10
Set the Administrative Mode to Static Access:
Force the switchport into permanent non-trunking mode:
text Switch(config-if)# switchport mode access
Assign the Intended Access VLAN:
By default, an access port belongs to VLAN 1. Explicitly assign the port to the appropriate broadcast domain:
text Switch(config-if)# switchport access vlan 20
Clean Up Lingering Trunking Configuration (Optional but Recommended):
Remove residual trunk settings to keep the running configuration tidy and prevent unexpected behavior if the port mode is changed in the future:
text Switch(config-if)# no switchport trunk allowed vlan Switch(config-if)# no switchport trunk native vlan
(Note: On legacy Catalyst platforms such as the 3560 or 3750 series, you may also need to issue no switchport trunk encapsulation dot1q if static encapsulation was defined.)
Enable Host Optimizations (If Connecting an End Device):
text Switch(config-if)# spanning-tree portfast Switch(config-if)# exit

Resetting a Trunk Interface to Factory Defaults with the Default Interface Command

If an interface has accumulated complex configurations—such as custom trunk allowed lists, voice VLANs, QoS trust markings, Storm Control, or port security—manually removing each parameter with no commands is time-consuming and error-prone. Cisco IOS provides the default interface command to instantly clear all applied configurations and reset the port to factory default settings.

Follow these steps to wipe all trunk parameters completely:

Enter Global Configuration Mode:
text Switch# configure terminal
Execute the Default Interface Command:
Apply the command to the target interface. You must execute this from global configuration mode, not interface mode:
text Switch(config)# default interface GigabitEthernet 1/0/10
The switch will return a confirmation message:
text Interface GigabitEthernet1/0/10 set to default configuration
Verify Port Security Posture:
On most modern Catalyst switches (such as the Catalyst 9200, 9300, and 9500 series), resetting an interface to default restores it to an unassigned Layer 2 switchport. Depending on your switch’s global template, the interface may default to an administrative mode of dynamic auto or access in VLAN 1.
Administratively Disable the Interface (Best Practice):
If the port will not be put into service immediately, shut it down to prevent unauthorized physical connections:
text Switch(config)# interface GigabitEthernet 1/0/10 Switch(config-if)# shutdown Switch(config-if)# description UNUSED_PORT Switch(config-if)# exit

Switchport Mode Access vs. Default Interface: Key Differences

Choosing between switchport mode access and default interface depends on whether the interface is being reassigned immediately to an endpoint or decommissioned entirely. The table below highlights how both methods handle operational parameters, downtime, and inherited properties.

Criterion	`switchport mode access`	`default interface <id>`
Primary Objective	Transition an active trunk into a dedicated single-VLAN access port.	Completely purge all custom configurations and return port to factory defaults.
Interface State	Remains `up/up` (link does not drop unless renegotiation occurs).	Port resets; link flap occurs while port renegotiates speed/duplex/STP.
Port Description	Retained intact.	Completely deleted.
VLAN Membership	Must be explicitly defined (defaults to VLAN 1 if omitted).	Reverts to factory default (VLAN 1).
Residual Configs (QoS, Port Security, MTU)	All non-trunk parameters remain active on the interface.	All QoS, Storm Control, MTU, and security settings are wiped.
Reversibility	Fast: switch back with `switchport mode trunk`.	Destructive: requires re-entering all custom port attributes.
Typical Use Case	Reallocating a server or switch uplink directly to an office workstation.	Decommissioning links, clearing misconfigured ports, or preparing for patch audits.

Removing Specific VLANs from a Trunk Without Disabling the Link

In enterprise networks, you often need to stop carrying one or more VLANs across an inter-switch trunk without bringing down the trunk itself.

Critical Warning: Never use switchport trunk allowed vlan <vlan-id> to remove a VLAN. That command overwrites the existing allowed list, leaving only the specified VLAN allowed and instantly dropping traffic for all other VLANs traversing the link.

To safely prune one or more VLANs from an active trunk:

Inspect Current Allowed VLANs on the Interface:
text Switch# show interfaces GigabitEthernet 1/0/10 trunk
Check the Vlans allowed on trunk line in the output (for example: 1-50,100,200).
Enter Interface Configuration Mode:
text Switch# configure terminal Switch(config)# interface GigabitEthernet 1/0/10
Issue the Remove Parameter:
Use the remove modifier followed by the specific VLAN ID or range you wish to disallow:
text Switch(config-if)# switchport trunk allowed vlan remove 20,30,40-45
Verify the Revised Allowed List:
text Switch(config-if)# do show interfaces GigabitEthernet 1/0/10 trunk
Confirm that the pruned VLAN IDs no longer appear under Vlans allowed on trunk.

Verifying Trunk Removal and Inspecting Interface State

After modifying or removing trunk configurations, use diagnostic show commands to verify that the port is operating in the intended mode and that no unwanted VLAN encapsulation or DTP frames are active.

1. Confirm the Port is Removed from Active Trunks

Execute the global trunk status command:

Switch# show interfaces trunk

If the trunk configuration was successfully removed or the port was transitioned to static access mode, the interface will not appear in this output.

2. Inspect Administrative vs. Operational Switchport States

To verify that dynamic negotiation is disabled and inspect the current operational state, run:

Switch# show interface GigabitEthernet 1/0/10 switchport

Evaluate these critical output fields:

Name: Gi1/0/10
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 20 (Marketing)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001

Administrative Mode: Reflects your explicit configuration (static access).
Operational Mode: Reflects what the hardware is currently doing (static access). If this indicates trunk while Administrative Mode shows dynamic auto, the neighboring switch is forcing the port into a trunk via DTP.
Negotiation of Trunking: Should read Off on standard access ports or ports configured with switchport nonegotiate.

3. Check the Running Configuration

Ensure no obsolete trunk lines remain in the interface stanza:

Switch# show running-config interface GigabitEthernet 1/0/10

Ready-to-Use CLI Templates for Trunk Port Decommissioning

Use the following CLI snippets for batch administration, port decommissioning, or automated script execution. Replace placeholders enclosed in angle brackets (<INTERFACE>, <VLAN_ID>) with your environment’s specific values.

Template 1: Convert Single Trunk Interface to Access Port

configure terminal
interface <INTERFACE>
 description END_USER_DEVICE
 switchport mode access
 switchport access vlan <VLAN_ID>
 switchport nonegotiate
 no switchport trunk allowed vlan
 no switchport trunk native vlan
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
exit

Template 2: Convert Multiple Interfaces (Batch Interface Range)

configure terminal
interface range GigabitEthernet 1/0/10 - 24
 description USER_ACCESS_PORTS
 switchport mode access
 switchport access vlan <VLAN_ID>
 switchport nonegotiate
 no switchport trunk allowed vlan
 spanning-tree portfast
 no shutdown
exit

Template 3: Complete Interface Wipe and Decommission

configure terminal
default interface <INTERFACE>
interface <INTERFACE>
 description DECOMMISSIONED_PORT
 shutdown
exit

Cisco Catalyst Switchport Command Reference and Operational Defaults

The table below provides a formal syntax reference for configuring, modifying, and tearing down trunk interfaces on Cisco Catalyst switches running IOS and IOS-XE platforms.

========================================================================================
COMMAND SYNTAX                                DEFINITION & BEHAVIOR
========================================================================================
switchport mode access                        Configures the interface as a permanent,
                                              non-trunking Layer 2 port. Suppresses DTP
                                              trunk formation frames.

switchport mode trunk                         Forces the port into permanent 802.1Q 
                                              trunking mode and negotiates with the
                                              neighbor link if DTP is active.

no switchport mode trunk                      Negates explicit trunk mode; returns the
                                              port's administrative mode to the system
                                              default (typically dynamic auto).

switchport trunk allowed vlan remove <id>     Selectively filters out specific VLANs
                                              from the 802.1Q header tag list without
                                              disrupting other active VLANs.

switchport trunk allowed vlan all             Clears all manual trunk pruning, allowing
                                              all VLANs (1-4094) across the trunk link.

switchport nonegotiate                        Disables Dynamic Trunking Protocol (DTP)
                                              frames. Port will not generate DTP packets
                                              or respond to trunk negotiation attempts.

default interface <interface-id>              Clears all Layer 2, Layer 3, and interface
                                              parameters. Restores hardware-defined
                                              operational defaults for that port.

switchport trunk encapsulation dot1q          Specifies standard IEEE 802.1Q tagging.
                                              (Required on legacy dual-encapsulation
                                              Catalyst hardware before setting trunk mode.)
========================================================================================

Platform Defaults and Behavioral Notes

Catalyst 9000 Series (IOS-XE): Encapsulation defaults strictly to standard 802.1Q; the legacy Cisco Inter-Switch Link (ISL) protocol is obsolete, and the switchport trunk encapsulation command is deprecated on these models.
DTP Considerations: When changing a trunk port back to an access port, always set switchport mode access explicitly. Avoid relying on no switchport mode trunk, as the switch may default to switchport mode dynamic auto, leaving the interface vulnerable to trunking if an unauthorized switch or attacking device sending DTP frames is attached to the other end.

Summary

Removing a trunk port on a Cisco switch comes down to three operational scenarios: changing the port’s role to an access connection via switchport mode access, resetting all port parameters using default interface, or selectively pruning VLANs with switchport trunk allowed vlan remove. Always verify your changes using show interfaces trunk and show interface <id> switchport to ensure operational and administrative states match, and save your active configurations with write memory or copy running-config startup-config once the changes are confirmed.

Please follow and like us:

100% FREE Cisco, PMP & other IT Certification Packs