A managed switch assigns every port one of three modes — Access, Trunk, or Hybrid — and the only real difference is how it tags or strips the 802.1Q VLAN label on frames entering and leaving the port. Once you see the tag/strip action on each mode, the three stop blending together.
Access belongs to one VLAN and strips the tag for terminals; use it for PCs, cameras, and APs.
Trunk carries multiple VLANs between devices and strips the tag only on the native (PVID) VLAN; use it to interconnect switches or routers.
Hybrid, common on Huawei/H3C layer 2 switch gear, lets you decide per-VLAN whether a frame leaves tagged or untagged — the most flexible of the three.
All three modes differ by exactly one thing: when a frame enters the port, does it get tagged; when it leaves, does it get stripped; and how many VLANs may pass. In one sentence each:
Access — belongs to a single VLAN, connects terminals. An untagged frame arriving gets the VLAN tag; a frame leaving has the tag stripped, so the terminal sees a plain Ethernet frame.
Trunk — carries multiple VLANs, connects switches or routers. On exit, only the native VLAN (PVID) frame is stripped; every other VLAN frame keeps its tag.
Hybrid — the most flexible, typical on domestic industrial layer 2 switch brands. Multiple VLANs pass, and you configure per VLAN whether the frame leaves tagged or untagged.
Access is the simplest. Connect a PC to a VLAN-10 Access port: the PC sends a frame with no 802.1Q tag, the switch tags it VLAN 10, and when it leaves VLAN 10 the switch strips the tag, so the PC never notices VLANs exist. An Access port belongs to exactly one VLAN and serves ordinary terminals like computers, cameras, and APs.
Trunk ports interconnect switches. They pass multiple VLAN frames but strip the tag only on the native VLAN (PVID, default VLAN 1); other VLAN frames keep their tags. One cable between two switches thus carries many VLANs and saves ports. Plug a terminal into a Trunk port and it usually misses every packet outside the native VLAN, because those frames are tagged and a normal NIC does not read 802.1Q.
Hybrid ports hand the choice to the admin. You can set one VLAN to leave tagged and another to leave untagged. A typical use: make the uplink Hybrid, pass some VLANs tagged to the upper switch while delivering one VLAN untagged to a local server or special device.
| Scenario | Recommended mode | Why |
|---|---|---|
| PC, camera, AP | Access | Terminal cannot read VLAN tags |
| Switch-to-switch link | Trunk | Multi-VLAN pass-through, simple config |
| Router / firewall link | Trunk or Hybrid | Needs multiple VLAN sub-interfaces |
| One port, multi-VLAN to terminal untagged | Hybrid | Controls tagged/untagged per VLAN |
| Server taking multiple VLANs | Hybrid / Trunk | Depends on NIC 802.1Q support |
Tip: A Hybrid port can act as Access — just join it to one VLAN and set that VLAN to leave untagged, and its behavior matches Access exactly.
Pick the mode by asking what device the port faces and whether frames must travel tagged. This logic holds whether the peer is another switch or a network switch vs router uplink. Terminals that ignore VLAN tags want Access. Links between switches want Trunk for clean multi-VLAN pass-through. A port that must both pass VLANs tagged upstream and hand one VLAN untagged to a local device wants Hybrid. The decision is never about the name — it is about tag handling.
First, connecting a terminal to a Trunk port leaves it without an IP, because the port sends only the PVID untagged and everything else tagged, which a plain NIC cannot parse. Second, configuring a Hybrid port's inbound PVID but forgetting the outbound untagged setting, so traffic gets in but cannot get out. Third, interconnecting two switches with one side Access and the other Trunk — the same VLAN frame is tagged on one end and stripped on the other, and the VLAN simply will not pass.
Warning: Never mix Access on one side of an inter-switch link and Trunk on the other for the same VLAN; the tag mismatch breaks forwarding. Treat network switch vs router uplinks as Trunk/Hybrid too, since the router needs VLAN sub-interfaces.
Can an Access port carry multiple VLANs? No. An Access port belongs to a single VLAN and serves terminals. If you need multiple VLANs on one port, move to Trunk or Hybrid.
Which is better, Trunk or Hybrid? Neither is universally better. Cisco-style gear favors Trunk (flexibility via native VLAN plus an allowed-VLAN list); Huawei/H3C gear favors Hybrid, controlling tag or untag per VLAN. Configure by vendor and do not mix the two on the same link.
Can a Hybrid port replace Access? Yes. Join the Hybrid port to one VLAN and set that VLAN to leave untagged, and it behaves exactly like an Access port.
Access, Trunk, and Hybrid differ not in name but in VLAN tag handling: Access is "one VLAN, strip for terminal," Trunk is "multi-VLAN pass-through, strip only PVID," and Hybrid is "per-VLAN flexible." Choose the port mode by asking what the port connects to and whether frames must travel tagged.
Customer Manager at Shenzhen Rayin Technology Co., Ltd.
