Switch – Trunk port needs to be tagged or untagged

Generally speaking, even untagged ports need to be assigned a NATIVE VLAN id AND only if this is different from the default id of 1. This is to help the switch understand how to forward packets. If you do not provide a vlan and it is bridged, it's considered a routed interface. You should not generally specify subinterfaces (ie tags) on interfaces unless you expect it to be bound on that system with an IP on that interface.

1. Configure the vlan routed interfaces (not the physical/bridged)
2. Specify the tagging protocol used on the physical bridged interfaces (ie. dot1q)
3. Choose AND specify the native VLAN id on all interfaces (if NOT vlan 1)

Another point. Generally speaking, tagging only occurs when a L2 packet moves from one vlan to the core switch engine and only if it needs to be carried over another trunk. When a packet flows out of the switch engine it is stripped of the tag and forwarded via standard Ethernet frames.

First let me state that I'm over simplifying this a lot and I'm also making assumptions we are talking about Cisco switches and not necessarily some of the routers or advanced ways of handling traffic.

My Cisco knowledge tends to blend with others like Juniper and Extreme, but...

"a tagged port is used to allow a host to be seen from different VLANs" - no/not necessarily, depends on lots of factors.

Trunk ports are typically used in switch to switch or switch to router links or between ports that require multiple VLANs. They are used to transmit packets from multiple VLANs between gear usually and will add 802.1q tags to the traffic to differentiate between VLANs. By default a trunk port will pass traffic for all VLANs but you can set allowed VLANs to further lock it down.

"static" Access ports belong to a single VLAN and accept traffic only from that same VLAN.

Other vendors besides Cisco will let you tag "access ports", for instance Extreme doesn't even call them trunk/access, you start with an untagged port and tag it with multiple VLANs as necessary.

This pic might help since there are other ways to do things like a dynamic access port or voice port nowadays:

Hope that helps.

REFERENCES: http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_19_ea1/configuration/guide/swvlan.pdf