TechKnowSurge
Cisco CCNA 1.13 Cisco CCNA 2.1 Cisco CCNA 2.2 Cisco CCNA 5.7
TechKnowSurge Catalog Videos Native VLANs
VideoNetworkFree

Native VLANs

Native VLANs allow a single untagged VLAN to traverse an 802.1q trunk link alongside multiple tagged VLANs, enabling backward compatibility with legacy devices that cannot process VLAN tags. Understanding how to configure and match native VLANs on both ends of a trunk is essential for maintaining a stable and secure switched network.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

In an 802.1q-tagged network, trunk links carry traffic from multiple VLANs simultaneously by embedding a VLAN ID tag inside each Ethernet frame. This tagging allows the receiving switch to identify which VLAN a given frame belongs to and forward it accordingly. The native VLAN is the single exception to this rule — traffic assigned to the native VLAN traverses the trunk without any tag, arriving at the far end as a plain, untagged Ethernet frame. Because only one VLAN per trunk link can be untagged at a time, both switches on either end of that link must be configured with the same native VLAN for the traffic to be interpreted correctly. The native VLAN feature exists largely to maintain backward compatibility with legacy devices and older protocols that do not support 802.1q tagging. Rather than dropping or misrouting that untagged traffic, the switch recognizes it as belonging to the designated native VLAN and handles it appropriately. Native VLAN is a per-interface setting, so each trunk link in a network can technically be assigned a different native VLAN. However, mismatches between the two ends of a link can cause traffic to be placed into the wrong VLAN, which is both a functional and a security concern. Cisco devices running CDP will detect and flag native VLAN mismatches, providing a built-in safeguard against misconfiguration. Cisco switches ship with VLAN 1 set as the default native VLAN on all interfaces, allowing newly connected devices to communicate without any initial configuration. While convenient, it is generally recommended to change the native VLAN to one that is not used by any active VLAN in the environment. Assigning an otherwise unused VLAN as the native VLAN limits the exposure of untagged traffic and reduces the risk of VLAN hopping attacks. Keeping the native VLAN consistent across all trunk interfaces also simplifies network management and reduces the likelihood of configuration errors.

What you'll learn

What's covered

Native VLANs

Aligned to

Cisco CCNA
1.13 Describe switching concepts
2.1 Configure and verify VLANs (normal range) spanning multiple switches
2.2 Configure and verify interswitch connectivity
5.7 Configure and verify Layer 2 security features

Key terms

Virtual LAN
VLAN
A logical grouping of network devices that behave as if they are on the same network regardless of physical location.
Switch
A network device that connects devices within a LAN and forwards traffic based on MAC addresses.
Data Link Layer
Layer 2 of the OSI model responsible for node-to-node data transfer and error detection on a single network segment.
Native VLAN
The one VLAN on an 802.1Q trunk whose frames are sent untagged. Any untagged frame received on the trunk is assigned to it. Both ends of a trunk must be configured with the same native VLAN.
VLAN Trunk
A point-to-point link between two switches that carries traffic for multiple VLANs simultaneously using IEEE 802.1Q tagging.
Native VLAN Mismatch
A misconfiguration where the two endpoints of a trunk link are configured with different native VLANs, which can cause traffic to be forwarded to the wrong VLAN.

Topics

Networking Vlans 802 1q Trunk Links Native Vlan Cisco Switches

Transcript

What a native VLAN is

We know that how trunk lines operate is they send the information from switch to switch with the VLAN information, the VLAN ID, tagged within the ethernet frame, so that when the frame gets to the other switch it can know what VLAN that ethernet frame is a part of. But what we can do is we can have one, and only one, of these VLANs that are being sent across here untagged.

What that means is that I can have all of these different VLANs going across here, they're all tagged, and as long as they only have one VLAN that's untagged, this switch is going to know what VLAN that's a part of, provided that you program both of these switches to have the same native VLAN in place. So that's what the native VLAN is: it's just untagged traffic that's going across those ethernet lines.

From the frame's standpoint

So what does that look like from the ethernet frame standpoint? Here's our 802.1Q defined ethernet frame with the tagged traffic in there, and that can be sent across, and the switch on the other side knows what VLAN it's a part of. And the native VLAN just does not have that tag in there, so essentially it's just like a regular ethernet frame that's sent across there.

The reason why you'd want to have a native VLAN is for some legacy equipment or some older protocols that are communicating back and forth, and those devices are not necessarily going to have tagged traffic go across there, so this helps support some of that legacy equipment.

It is a per-link setting

This is a per link setting, and what that means is that every single one of these links could actually have a different native VLAN. I could do a native VLAN 10, a native VLAN 20 and a native VLAN 30 on each of these separate trunk lines, and it's going to operate just fine, because what I'm doing is I'm actually configuring it on the interface. I'm configuring it on each of these interfaces, which allows me to configure each of these lines differently.

One thing you've got to watch out for: what you would not want to do is a native VLAN 2 on this side and a native VLAN 10 on this side, because that can cause some problems. Now, your Cisco switches, if you have CDP running and some of the other protocols, they'll actually recognize that you have a mismatch and it will identify it on the switch. So that is helpful on these Cisco devices, but just generally speaking you wouldn't want to set up the wrong connections on there. You'd want to set it up all the same on both of the sides, but as long as they're the same on both sides, then that's going to be per interface.

What I tend to do is I tend to have each one of these trunk lines all the same — they're all programmed the same, that way it's easier for me to remember. I also choose one that's not the same as any of my other VLANs, not the VLANs that I'm going to use. I just do that for a little extra bit of security there, so that way those are separated out and no one else can utilize that native VLAN.

The Cisco default

One thing to note on Cisco equipment is that the default native VLAN is one. So if you don't specify something, then one is going to be the native VLAN on that device, on all those interfaces. The reason for that is because Cisco wants their devices for the most part to work out of the box — once you unpack it and plug it in, they want it to work — and so one way they do that is to set it up so that VLAN one is the native VLAN, and now you can start connecting in devices.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →