What is the native VLAN, and why do people say you should change it?
Show the answer
Say this first
The native VLAN is the one VLAN on an 802.1Q trunk whose frames cross untagged. It is VLAN 1 by default. I change it to an unused VLAN and tag it or prune it, because leaving user traffic in the native VLAN enables double-tagging attacks and a native VLAN mismatch quietly leaks traffic between VLANs.
Go deeper
What it does
802.1Q inserts a 4-byte tag after the source MAC. Frames in the native VLAN skip the tag. A switch that receives an untagged frame on a trunk puts it in its own configured native VLAN.
Why it matters
- Double tagging. An attacker in the native VLAN sends a frame with two tags. The first switch strips the outer tag (it matches the native VLAN) and forwards the frame, still tagged with the inner VLAN, across the trunk. The next switch delivers it into the victim VLAN. It is one way only, but it works.
- Mismatch. If one side uses native VLAN 1 and the other uses 99, untagged frames jump between
VLAN 1 and VLAN 99. CDP logs
%CDP-4-NATIVE_VLAN_MISMATCH, and STP blocks the port for PVST+ with an inconsistent state.
What I configure
interface GigabitEthernet1/0/48
switchport mode trunk
switchport trunk native vlan 999
switchport trunk allowed vlan 10,20,30
switchport nonegotiate
!
vlan dot1q tag nativeVLAN 999 has no access ports. vlan dot1q tag native makes the switch tag even the native VLAN.
They will ask next
Can you have a trunk with no native VLAN at all?
Not on Cisco: a trunk always has a native VLAN. You make it harmless by choosing an unused VLAN, tagging it with
vlan dot1q tag native, and removing it from the allowed list.Which control traffic still uses VLAN 1?
CDP, VTP, DTP and PAgP keep using VLAN 1 even after you change the native VLAN or remove VLAN 1 from the allowed list. That is why you cannot delete VLAN 1 on a Cisco switch. You make it harmless instead: no user ports, no SVI, and never the native VLAN.
Traps
- Saying the native VLAN carries "management traffic". It carries whatever is untagged, nothing more.
- Forgetting that both ends must agree. The mismatch is the most common real outage here.