trunk
termA link that carries several VLANs at once, tagging each frame so the far end knows which network it belongs to.
The trunk is where segmentation is enforced and where it is most often quietly undone. A port configured to carry every VLAN by default hands an attacker the whole estate from one cable, and a native VLAN mismatch between two switches silently merges two networks the diagram says are separate. Both are configuration rather than protocol defects, which is why segmentation reviews look at trunk allow-lists before they look at firewall rules.
The word means two different things on two common platforms. On a Cisco switch a trunk is a link carrying many VLANs with 802.1Q tags. On an F5 BIG-IP a trunk is link aggregation: in F5's own reference, 'Link Aggregation allows multiple physical links to be treated as one logical link. It is also referred to as trunking', with LACP available but disabled by default. Read the platform before you read the word.
On a tagged trunk, the native VLAN is the exception: Cisco's rule is that a packet whose VLAN matches the port's native VLAN 'is sent untagged; otherwise, the device sends the packet with a tag'. The native VLAN is 1 by default on Cisco and on Aruba's AOS-CX, and Cisco warns that if the two ends disagree, 'spanning-tree loops might result'.
The hardening list is short and well known: carry only the VLANs needed, move the native VLAN to an unused ID or tag it, and switch trunk negotiation off on ports that face hosts.
Also known as: 802.1q, tagged port