switchport mode access
Hardcodes a physical switch interface to act as a dedicated access port. This permanently disables Dynamic Trunking Protocol (DTP) negotiation and ensures the port can only transmit and receive untagged frames for a single assigned VLAN.
Quick Reference
Switch(config-if)#Syntax Breakdown
Unlike many Cisco IOS commands, switchport mode access does not take any numerical arguments or variables. It is a static declaration that changes the physical operational state of the interface ASIC.
By default, Cisco switches dynamically attempt to negotiate whether a port should be a trunk or an access port using DTP. By entering this command, you strip away that "guessing" logic, forcing the port into a permanent edge state.
CLI Deployment Scenarios
Scenario 1: Securing an End-User PC Port
You are connecting a new employee's desktop to GigabitEthernet 0/1. You must ensure the port does not form a trunk link.
Scenario 2: Mass Edge Port Configuration
You have a 24-port switch where ports 1 through 20 all connect to standard office printers and computers. You configure them simultaneously using the range command.
CCNA Exam Gotchas
VLAN Hopping Attacks
If you connect a PC to a port and only type switchport access vlan 10 without explicitly declaring switchport mode access, the port remains in dynamic auto mode. A malicious user with Kali Linux could send DTP frames into that wall jack, trick the switch into becoming a trunk, and gain access to every VLAN in the building. Always hardcode the mode.
The Voice VLAN Exception
An access port is technically only allowed to carry one VLAN. However, if you configure switchport voice vlan [id], Cisco creates a special exception, allowing a tagged voice frame and an untagged data frame to share the single access link. The exam frequently tests your knowledge of this exception.