Native VLANs on trunk links carry untagged traffic between switches, and configuring a non-default native VLAN is an important step in reducing security exposure on managed networks.
We're going to take a look at setting up a native VLAN on our trunk lines.
What we have right now is that we are on this demo laptop right here, and I have an Ethernet cable plugged into switch 2, which is right here, and that is connected into switch 1, which is right here. Going between these two devices is a trunk line that VLANs are allowed to pass on. What happens is, as information comes into switch 2, it tags it with the VLAN that it's supposed to be on and sends it across this trunk line.
More specifically, the demo laptop is set up on the management VLAN, VLAN 10. So when it is trying to remote into this switch right here, or ping — let's say it's pinging this switch right here — what it'll do is come into switch number two, and it will get tagged as it goes out the port, this trunk line. It will get tagged with VLAN 10, and then switch 1 will receive that and understand that's part of VLAN 10, and since it's being pinged, that device will then reply in a similar fashion.
The thing is that we can connect these and have all that traffic going across there, and we can have it labeled, or we can have it tagged with whatever VLAN it's a part of. But we can have a native VLAN, and that is the VLAN that doesn't get tagged across that trunk line. By default that is VLAN 1: VLAN 1 does not get tagged as it goes across that trunk line, and all other traffic does.
What we're going to do is specify that VLAN — let's say VLAN 5 is our native VLAN. The importance of being able to specify what the native VLAN is is that there is some legacy equipment, and there are some things that still require a native VLAN, or cannot tag that traffic, or there are some protocols that need that native VLAN. But on the flip side, if it is just the default one — anytime you have the default, there's potential that you could get hacked, there's some things that you can leverage with it. So it's always good to set things not as the default.
Let's set the native VLAN to five across that line. What I'm going to do is pull up switch 1 first and we'll program switch 1. We'll need to get into the interface, so I'm going to get into the interface, and this is interface fa 1 0 43, the one that's connected to switch 2. So we'll get into that interface, and the command that we'll use to set this up is trunk native vlan and then the VLAN ID, so in this case right here we're saying it's five. We'll hit enter, and now that traffic, VLAN 5, is not going to be tagged as it goes across there.
Now, we're not generating much traffic, or any traffic, relayed across VLAN 5, so it's not that big of a concern, but at this point in time we would have a mismatch. This device is talking across this trunk line and it's not set to the same native VLAN. There are times when you'll actually see messages come up that there is a mismatch, and many times it can recognize that.
So what we're going to have to do is the same thing for this one. We've got to get into the interface, so I'll go into the global configuration mode, and then we get into an interface, and for this one it's fa047. We'll get into that interface and do our command, switchport trunk native vlan 5, and hit enter. Now we're set up the same on both of those switches.
I'm going to end, and we can do show interface fa 0 — and I want to look at the switchport information, so let's take a look at the switchport information. As we look here, trunking native mode is VLAN 5, so there it is. We see that VLAN tagging is enabled. We see that the VLANs enabled on here is VLAN 10. And then we've got the encapsulation method, which is dot1q. So everything is looking correct on this switch, and now we're able to communicate without using tagged traffic on VLAN 5.
If I want to remove that, it's pretty simple to do. What we need to do is get into our interface, so I'll get into the interface, and all we have to do is do the same command with "no" at the beginning. We'd have to do that on both devices, right, because once again we need to make sure that the native VLAN is set to the same for this to work properly.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →