On a managed switch, every port is configured as either an access port or a trunk port, and the difference decides how VLAN traffic flows through it. An access port hands a single VLAN to one device, while a trunk port carries many VLANs at once between switches. This page explains both port modes, the native-VLAN gotcha that trips people up, and how a control engineer wires an industrial switch correctly.
Trunk vs access port in one line: An access port belongs to one VLAN and connects to a single end device, carrying that VLAN's traffic without any tags. A trunk port carries traffic for multiple VLANs at once, tagging each frame with its VLAN number using 802.1Q so the switch on the other end can tell them apart. Access ports face devices; trunk ports connect switches.
An access port is the simple case: it is assigned to exactly one VLAN and it connects to a single end device, such as a PLC, an HMI, or a camera. The device plugged into it has no idea VLANs exist. Frames arrive and leave the access port with no VLAN tag on them, and the switch silently associates everything on that port with its configured VLAN. This is how ordinary devices join a segment without needing any special configuration.
Because an access port carries only one VLAN, it is the natural way to place a device into a specific segment. Putting a controller on an access port assigned to the PLC VLAN drops that controller cleanly into the control broadcast domain, and nothing else. If you later need that same device in a different VLAN, you change the port's access VLAN rather than touching the device, which is one reason VLAN membership is described as a property of the switch configuration.
The mental model is that an access port is the edge of the VLAN world. Everything on the device side is plain, untagged Ethernet, and the switch is where the traffic gets its VLAN identity. Most ports on an OT switch that face actual field equipment are access ports, each one dropping its device into the right segment with no tagging visible to the device at all.
A trunk port exists to carry more than one VLAN over a single link, which is what you need between two switches or up to a router. If VLAN 10 and VLAN 20 both need to reach another switch, you do not run two cables; you run one trunk that carries both. To keep them straight, the trunk tags each frame with its VLAN number using the 802.1Q standard, so the receiving switch reads the tag and delivers the frame into the correct VLAN.
That tagging is the whole trick. On an access port frames are untagged because there is only one possible VLAN, but on a trunk the switch must label every frame so the other end can sort them back out. An 802.1Q tag is a small field inserted into the Ethernet frame that says which VLAN it belongs to. Both ends of the trunk have to agree on which VLANs are allowed to cross, and a well-configured trunk permits only the VLANs that actually need to traverse that link.
Trunks are what let VLANs span more than one switch. A plant with several managed switches around the site uses trunk links between them so that, for example, the PLC VLAN is continuous across all of them even though the controllers are physically scattered. The uplinks that stitch the switching fabric together are trunk ports; the ports that face devices are access ports. Getting this division right is the backbone of a correctly built VLAN network.
The classic mistake on a trunk is the native VLAN. Every 802.1Q trunk has one VLAN whose frames it sends untagged, called the native VLAN, and if the two ends of a trunk disagree about which VLAN that is, traffic can silently leak from one VLAN into another. Because the native VLAN's frames carry no tag, they are the one class of traffic where a mismatch quietly crosses a boundary you intended to keep separate.
The safe practice is to make the native VLAN match on both ends of every trunk and, ideally, to use a dedicated unused VLAN for it that carries no real device traffic, so a mismatch has nothing valuable to leak. Just as important, an engineer should explicitly set the list of VLANs a trunk is allowed to carry rather than letting it pass everything, so only the segments that genuinely need to cross a given link can do so. Trunks that carry every VLAN by default are a common source of over-exposure.
Wiring an industrial managed switch correctly then follows a clear pattern. Ports facing single devices are configured as access ports on the appropriate VLAN, uplinks to other switches are configured as trunks carrying only the needed VLANs with a matched, dedicated native VLAN, and any port whose mode is left at a loose default is treated as a defect to fix. Documenting which ports are access and which are trunk, and which VLANs each trunk carries, is part of keeping the OT network both correct and auditable.
In a SCADA network the access-versus-trunk distinction shapes how cleanly the control segments hold together. Each PLC, RIO rack, and HMI sits on an access port in its assigned VLAN, so the field devices themselves stay simple and unaware of VLANs, while the switch quietly keeps each one in the right segment. This keeps the device-facing edge of the network easy to reason about and easy for a technician to patch.
Trunks are where the site's segmentation becomes continuous. The links between control-room switches, cabinet switches, and any uplink toward a gateway or DMZ are trunks that carry the plant's VLANs across the whole switching fabric, so the PLC VLAN, HMI VLAN, and others remain intact end to end even though they run through many switches. A misconfigured trunk, or a native-VLAN mismatch on one, is exactly the kind of subtle error that can blur segments an OT team believed were separate.
For sites that forward data to the cloud, port discipline also governs the gateway's reach. Connecting an edge gateway on an access port in a purpose-built VLAN, or on a tightly restricted trunk that carries only the VLANs whose values must travel upstream, keeps the gateway from quietly seeing the entire plant. Correct access and trunk configuration is therefore not just a switching detail; it is part of controlling what a remote-monitoring path can and cannot touch.
Use an access port when the port connects to a single end device, such as a PLC, HMI, or camera, and should carry just one VLAN. Use a trunk port when the port links to another switch or router and must carry several VLANs at once. In short, access ports face devices and trunk ports connect switches.
The native VLAN is the one VLAN whose frames a trunk sends untagged. If the two ends of a trunk disagree about which VLAN is native, traffic can silently leak between VLANs, because those untagged frames cross without a tag to check. The fix is to match the native VLAN on both ends and use a dedicated, unused VLAN for it.
802.1Q is the standard that lets a single link carry multiple VLANs by inserting a small tag into each Ethernet frame that identifies which VLAN it belongs to. Trunk ports use this tagging so the switch at the other end can sort frames back into the correct VLANs. Access ports do not tag frames, because they carry only one VLAN.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.