What are the Basic Issues of VLAN and How do Troubleshoot Issues?
What are the Basic Issues of VLAN in a Network? A virtual LAN ( VLAN ) is a…
On an 802.1Q trunk, every frame carries a VLAN tag, except one. The native VLAN is the single VLAN whose frames are sent and received untagged. By default on Cisco switches this is VLAN 1, and leaving it that way is one of the most common Layer 2 security weaknesses in production networks.
Why It Exists
802.1Q was designed to interoperate with devices that predate VLAN tagging. A legacy hub, an old server NIC, or a device that does not understand tags still needs to communicate across a trunk. The native VLAN is the compatibility hatch: untagged frames arriving on a trunk are assumed to belong to it, and its frames leave without a tag.
The compatibility need is largely historical. The mechanism remains, and so does the risk it creates.
How Frames Are Handled
| Frame arriving on a trunk | Switch behaviour |
|---|---|
| Tagged with VLAN 10 | Placed in VLAN 10 |
| Tagged with the native VLAN ID | Placed in the native VLAN (normally, unless tagging is forced) |
| Untagged | Placed in the native VLAN |
| Tagged with a VLAN not in the allowed list | Dropped |
The third row is where the security problem starts: any untagged frame injected onto a trunk lands in the native VLAN.
Configuration
Switch(config)# vlan 999
Switch(config-vlan)# name NATIVE-UNUSED
Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 999
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# switchport nonegotiateNote that VLAN 999 is deliberately not in the allowed list and carries no user traffic. It is a black hole, untagged frames land there and go nowhere.
Switch# show interfaces trunk
Switch# show interfaces GigabitEthernet0/24 switchport | include NativeThe Security Risk, VLAN Hopping
Two attacks exploit the native VLAN and DTP:
Switch spoofing
Cisco access ports default to dynamic auto, meaning they will negotiate a trunk if the device on the other end asks. An attacker’s machine sends DTP frames pretending to be a switch, the port becomes a trunk, and the attacker now receives every VLAN allowed on it.
The fix is to explicitly configure port mode and disable DTP everywhere:
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport nonegotiateDouble tagging
This one specifically requires the attacker to be in the native VLAN. They craft a frame with two 802.1Q tags, the outer matching the native VLAN, the inner naming the target VLAN.
- The first switch strips the outer tag, because it matches the native VLAN and native traffic is untagged on the trunk.
- The frame goes onto the trunk still carrying the inner tag.
- The second switch reads the inner tag and delivers the frame into the target VLAN.
The attack is one-way, there is no return path, but it is enough for injection attacks, and it works against a correctly functioning switch. The defence is straightforward: put the native VLAN on a dedicated unused VLAN that no access port is assigned to, so no attacker can be in it.
Forcing tags on everything
Switch(config)# vlan dot1q tag nativeThis makes the switch tag native VLAN traffic as well, eliminating untagged frames entirely and closing the double-tagging vector completely. Verify the far-end device supports it before enabling, a mismatch breaks the trunk.
Native VLAN Mismatch
If two ends of a trunk disagree about the native VLAN, untagged frames leaving one switch land in the wrong VLAN on the other. Two separate broadcast domains get silently merged, which produces the kind of fault that is genuinely difficult to trace, hosts in different VLANs unexpectedly reaching each other, or a duplicate-IP conflict across what should be separate networks.
CDP detects it and logs:
%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on
GigabitEthernet0/24 (99), with Switch2 GigabitEthernet0/1 (1).This message is a real fault, not a warning to ignore. Fix the mismatch rather than disabling CDP. Note that if CDP is disabled, which many hardening guides recommend, you lose this detection entirely, so verify native VLANs manually on every trunk.
Best Practice Summary
- Do not use VLAN 1 for anything. Not native, not user data, not management. It is the default everywhere, and defaults are what attackers assume.
- Set the native VLAN to a dedicated unused VLAN on every trunk, and keep it consistent site-wide.
- Do not allow the native VLAN in the trunk’s allowed list if it carries nothing.
- Match the native VLAN on both ends of every trunk.
- Disable DTP everywhere with
switchport nonegotiateand explicit mode configuration. - Prune the allowed VLAN list so trunks carry only what they need.
- Consider
vlan dot1q tag nativeif all your equipment supports it. - Shut down unused ports and place them in an unused VLAN.
Native VLAN vs Management VLAN vs Default VLAN
| Term | Meaning | Should be VLAN 1? |
|---|---|---|
| Default VLAN | VLAN 1, every port belongs to it out of the box | It is, by definition |
| Native VLAN | The untagged VLAN on a trunk | No, use a dedicated unused VLAN |
| Management VLAN | Where the switch’s own SVI lives for SSH and SNMP | No, use a separate, restricted VLAN |
These three are all VLAN 1 by default and should all be moved off it, to three different VLANs.
Frequently Asked Questions
What is the default native VLAN?
VLAN 1 on Cisco switches, which is also the default VLAN for all access ports and the default management VLAN. Changing it is a standard hardening step.
Can the native VLAN carry user traffic?
It can, but it should not. Putting users in the native VLAN is what makes double-tagging attacks possible.
What happens if native VLANs do not match on a trunk?
Untagged frames leaving one switch are placed in a different VLAN on the other, silently bridging two broadcast domains. CDP logs a NATIVE_VLAN_MISMATCH message when it can detect it.
Do access ports have a native VLAN?
Not in the 802.1Q sense. An access port carries one VLAN and sends everything untagged. Native VLAN is a trunk concept.
Should I enable vlan dot1q tag native?
It closes the double-tagging vector completely by removing untagged frames from trunks. Enable it if every device on the trunk supports it, verify first, because a mismatch will break the link.
Does the native VLAN affect voice VLANs?
An IP phone port sends voice traffic tagged and PC traffic untagged, so the PC data lands in the access VLAN, which functions as the untagged VLAN for that port. It is a related mechanism but configured with switchport voice vlan rather than native VLAN commands. More in the switching guide.
