TechKnowSurge
Cisco CCNA 2.1 Cisco CCNA 2.2 Cisco CCNA 5.7 Cisco CCNA 1.13
VideoNetworkFree

DEMO: Native VLANs

Native VLANs on trunk links carry untagged traffic between switches, and configuring a non-default native VLAN is an important step in reducing security exposure on managed networks.

Complete this video to capture a CTF flag worth 1 point.

About this video

On an 802.1Q trunk link, traffic belonging to each VLAN is tagged with its VLAN ID as it passes between switches, allowing a single physical connection to carry multiple logical networks. The exception is the native VLAN, whose frames cross the trunk untagged. By default, Cisco switches assign VLAN 1 as the native VLAN, but this default behavior is a well-known attack surface — leaving it unchanged opens the door to VLAN hopping and other exploitation techniques. Changing the native VLAN to a non-default value is a standard hardening practice and also supports legacy devices or protocols that require untagged traffic on a specific VLAN. Configuring a custom native VLAN requires entering the trunk-facing interface on each switch and issuing the switchport trunk native vlan command with a matching VLAN ID on both ends. A mismatch between the two sides generates a warning and can disrupt communication across the trunk, making consistency critical. After applying the configuration, the show interfaces switchport command confirms the new native VLAN assignment, the 802.1Q encapsulation method, and which VLANs are active on the trunk. The native VLAN can be returned to its default at any time by prepending no to the same command on both devices.

What you'll learn

Aligned to

Cisco CCNA
2.1 Configure and verify VLANs (normal range) spanning multiple switches
2.2 Configure and verify interswitch connectivity
5.7 Configure and verify Layer 2 security features
1.13 Describe switching concepts

Key terms

Virtual LAN
VLAN
A logical grouping of network devices that behave as if they are on the same network regardless of physical location.
Native VLAN
The one VLAN on an 802.1Q trunk whose frames are sent untagged. Any untagged frame received on the trunk is assigned to it. Both ends of a trunk must be configured with the same native VLAN.
Trunk Link
A switch port configured to carry traffic for multiple VLANs simultaneously between network devices using VLAN tagging.
IEEE 802.1Q
dot1q
The standard for VLAN tagging on Ethernet, which inserts a four-byte tag containing a 12-bit VLAN ID and a 3-bit priority field into the frame header so that a single link can carry traffic for many VLANs.
Switch
A network device that connects devices within a LAN and forwards traffic based on MAC addresses.
Network Segmentation
The practice of dividing a network into smaller segments to improve performance and limit the spread of security threats.

Topics

Networking Vlans 802 1q Trunk Links Native Vlan Cisco Ios Network Security

Transcript

We're going to take a look at setting up a native VLAN on our trunk lines.

The setup

What we have right now is that we are on this demo laptop right here, and I have an Ethernet cable plugged into switch 2, which is right here, and that is connected into switch 1, which is right here. Going between these two devices is a trunk line that VLANs are allowed to pass on. What happens is, as information comes into switch 2, it tags it with the VLAN that it's supposed to be on and sends it across this trunk line.

More specifically, the demo laptop is set up on the management VLAN, VLAN 10. So when it is trying to remote into this switch right here, or ping — let's say it's pinging this switch right here — what it'll do is come into switch number two, and it will get tagged as it goes out the port, this trunk line. It will get tagged with VLAN 10, and then switch 1 will receive that and understand that's part of VLAN 10, and since it's being pinged, that device will then reply in a similar fashion.

What a native VLAN is

The thing is that we can connect these and have all that traffic going across there, and we can have it labeled, or we can have it tagged with whatever VLAN it's a part of. But we can have a native VLAN, and that is the VLAN that doesn't get tagged across that trunk line. By default that is VLAN 1: VLAN 1 does not get tagged as it goes across that trunk line, and all other traffic does.

What we're going to do is specify that VLAN — let's say VLAN 5 is our native VLAN. The importance of being able to specify what the native VLAN is is that there is some legacy equipment, and there are some things that still require a native VLAN, or cannot tag that traffic, or there are some protocols that need that native VLAN. But on the flip side, if it is just the default one — anytime you have the default, there's potential that you could get hacked, there's some things that you can leverage with it. So it's always good to set things not as the default.

Setting the native VLAN

Let's set the native VLAN to five across that line. What I'm going to do is pull up switch 1 first and we'll program switch 1. We'll need to get into the interface, so I'm going to get into the interface, and this is interface fa 1 0 43, the one that's connected to switch 2. So we'll get into that interface, and the command that we'll use to set this up is trunk native vlan and then the VLAN ID, so in this case right here we're saying it's five. We'll hit enter, and now that traffic, VLAN 5, is not going to be tagged as it goes across there.

Now, we're not generating much traffic, or any traffic, relayed across VLAN 5, so it's not that big of a concern, but at this point in time we would have a mismatch. This device is talking across this trunk line and it's not set to the same native VLAN. There are times when you'll actually see messages come up that there is a mismatch, and many times it can recognize that.

So what we're going to have to do is the same thing for this one. We've got to get into the interface, so I'll go into the global configuration mode, and then we get into an interface, and for this one it's fa047. We'll get into that interface and do our command, switchport trunk native vlan 5, and hit enter. Now we're set up the same on both of those switches.

Verifying and removing it

I'm going to end, and we can do show interface fa 0 — and I want to look at the switchport information, so let's take a look at the switchport information. As we look here, trunking native mode is VLAN 5, so there it is. We see that VLAN tagging is enabled. We see that the VLANs enabled on here is VLAN 10. And then we've got the encapsulation method, which is dot1q. So everything is looking correct on this switch, and now we're able to communicate without using tagged traffic on VLAN 5.

If I want to remove that, it's pretty simple to do. What we need to do is get into our interface, so I'll get into the interface, and all we have to do is do the same command with "no" at the beginning. We'd have to do that on both devices, right, because once again we need to make sure that the native VLAN is set to the same for this to work properly.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →