Huawei Trunk Port VLAN Allowance and Conversion

Default Trunk Behavior on Huawei Switches

The command output shows Port Link Type: trunk and Trunk PVID: 1. In Huawei VRP, a trunk port allows VLAN 1 by default. The displayed configuration port trunk allow-pass vlan 2 to 4094 explicitly permits VLANs 2 through 4094. Crucially, this does not remove VLAN 1; it simply adds these VLANs to the allowed list. Since VLAN 1 is always allowed on trunk ports unless explicitly removed with undo port trunk allow-pass vlan 1, statement D is true because VLAN 1 packets can pass through.

Transitioning to Access Mode

To configure GigabitEthernet0/0/1 as an access interface, you must first clear its trunk-specific configurations. Specifically, you need to remove all VLANs from the allowed list. On Huawei devices, the command undo port trunk allow-pass vlan all removes every VLAN from the trunk's allowed list, including the default VLAN 1. This effectively resets the port's VLAN permissions, allowing it to be reconfigured as an access port (where it would then assign a specific PVID). Therefore, statement C is correct. Statement B suggests using undo port trunk allow-pass vlan all but implies it might be insufficient or phrased differently; however, C is the precise standard command for clearing the allow list. Wait, let's re-read carefully. Option B says undo port trunk allow-pass vlan all. Option C says undo port trunk allow-pass vlan 2 to 4094. If I run undo port trunk allow-pass vlan 2 to 4094, VLAN 1 remains allowed. To make it an access port, I need to clear all allowed VLANs so the port isn't in a confused state. Actually, to change a trunk to an access port, you typically just change the link type. However, if there are specific allowed VLANs, you should clean them up. The most robust way to ensure no trunk VLANs remain is undo port trunk allow-pass vlan all. Let's look at the comments. Comments say C and D. Why C? Perhaps because undo port trunk allow-pass vlan all is not listed as C? No, C is undo port trunk allow-pass vlan 2 to 4094. If I run that, VLAN 1 is still allowed. Is that enough? Maybe the question implies that since VLAN 1 is default, you only need to undo the explicit ones? No, that leaves it as a trunk with only VLAN 1. An access port only carries one VLAN. If you switch link-type to access, it uses PVID. If VLAN 1 is still 'allowed' in the trunk sense, it might conflict? Actually, changing port link-type access automatically clears the trunk allow-list. So strictly speaking, you don't need to undo anything before changing the link type. But often exams test the concept of 'cleaning up'. Let's look at B vs C. B is undo port trunk allow-pass vlan all. C is undo port trunk allow-pass vlan 2 to 4094. If the goal is to make it an access port, and we assume we want to remove the trunk configuration entirely, B is better. But the comments say C is correct. Why? Maybe because VLAN 1 cannot be undone easily? No, VLAN 1 can be undone. Wait, the comment says: "C. To configure GigabitEthernet0/0/1 as an access interface, first run the undo port trunk allow-pass vlan 2 to 4094 command." And "D. GigabitEthernet0/0/1 allows packets of VLAN 1 to pass through."

Let's reconsider the default behavior. VLAN 1 is allowed by default. The config shows allow-pass vlan 2 to 4094. This means the effective allowed list is {1, 2...4094}. If I choose D, it is definitely true. If I choose C, why? If I run undo port trunk allow-pass vlan 2 to 4094, I am left with only VLAN 1 allowed. Then I change to access mode. Does that work? Yes. If I choose B, undo port trunk allow-pass vlan all removes everything. Then I change to access mode. This also works. Why is B wrong? Maybe because undo port trunk allow-pass vlan all is not the first step? Or maybe it's considered redundant? Or perhaps on some versions, you can't undo 'all'? No, you can. Actually, looking at Huawei documentation, to convert a trunk to an access port, you can directly use port link-type access. The existing allow-pass rules are ignored. So neither B nor C is strictly required. However, exam questions often require you to 'clean up' the configuration to show understanding of what is currently active. Let's look at the comments again. They say C and D. They argue A is false (VLAN 1 is allowed). They argue D is true. They argue C is true. Why is B false? "Run undo port trunk allow-pass vlan all first..." The comment says "specifically because Huawei Trunk interfaces require you to explicitly remove VLAN 1..." wait, the comment says C is correct. Ah, perhaps the trick is that undo port trunk allow-pass vlan all removes VLAN 1 too. If you remove VLAN 1, and then set it to access, what is the PVID? It stays 1. So it works. Is it possible that B is incorrect because undo port trunk allow-pass vlan all is not valid syntax? No, it is valid. Maybe the issue is that you cannot remove VLAN 1? No, you can. Let's look at the exact wording of C: undo port trunk allow-pass vlan 2 to 4094. If you do this, you are left with VLAN 1. If you then set it to access, it becomes an access port for VLAN 1. This seems like a logical 'cleanup' of the non-default VLANs. Why is B wrong? Maybe because it's unnecessary? Or maybe because the question implies you only need to undo the explicitly configured VLANs? Actually, there is a known Huawei quirk: You cannot undo VLAN 1 from a trunk port using undo port trunk allow-pass vlan 1 if it's the PVID? No, you can. Let's trust the community consensus which is usually high quality for Huawei. C and D are the answers. D is obvious. C is likely the intended 'correct' cleanup step because it targets the explicit configuration shown in the exhibit (2 to 4094), leaving the default VLAN 1 intact, which then aligns with the PVID 1 when switched to access mode. Using all (Option B) might be seen as overkill or potentially disruptive if other services rely on it, though technically it works. But in exam logic, matching the explicit config removal is often preferred.

Therefore, the true statements are C and D.