e trunk Please use the 'clear trunk' command to remove vlans from allowed list. Remember that all VLANs are allowed by default. Preventing a single VLAN from using a trunk is as simple as using the clear trunk command: Switch-2# (enable) clear trunk 3/5 100 Removing Vlan(s) 100 from allowed list. Port 3/5 allowed vlans modified to 1-99,101-4094. You don't have to use a show trunk command to see which VLANs are allowed, because the clear trunk tells you the new status of the port. To limit a CatOS switch SO that only one VLAN is allowed, disallow all the remaining VLANs. Just as you removed one VLAN with the clear trunk command, you can remove all of the VLANs except the one you want to allow: Configuring Trunks Switch-2# (enable) clear trunk 3/5 1-99,101-4094 Removing Vlan(s) 1-99,101-4094 from allowed list. Port 3/5 allowed vlans modified to 100. Finally, a show trunk will show you the status of the trunks. As you can see, only VLAN 100 is now allowed on trunk 3/5: Switch-2# (enable) sho trunk * - indicates vtp domain mismatch # - indicates dot1q-all-tagged enabled on the port $ - indicates non-default dot1q-ethertype value Encapsulation Status Native vlan dot1q trunking nonegotiate trunking nonegotiate isl trunking Vlans allowed on trunk 1-4094 1-4094 Vlans allowed and active in management domain Vlans in spanning tree forwarding state and not pruned Nexus and NX-OS Remembering that NX-OS on a Nexus 7000 places interfaces in routed mode by default, we must first issue the switchport interface command: NX-7K-1-Cozy(config-if)# int e3/2 NX-7K-1-Cozy(config-if)# switchport Now we put the port into trunk mode with the switchport mode trunk interface command: NX-7K-1-Cozy(config-if): switchport mode ? access Port mode access trunk Port mode trunk NX-7K-1-Cozy(config-if)# int e3/2 NX-7K-1-Cozy(config-if)# switchport mode trunk We limit the VLANs allowed over the trunk with the switchport trunk allowed vlan interface command: Chapter 5: Trunking NX-7K-1-Cozy(config-if)# switchport trunk allowed vlan <1-3967,4048-4093>