Switching · VLANs and Trunking

Native VLAN

Make untagged trunk classification deliberate and consistent.

Independent lab examples; selected output and frame summaries are illustrative. Port naming and command support vary by switch and software release.

Network and objective

The example uses default untagged native-VLAN behavior; optional global native tagging changes that policy.

Use two fresh lab switches: H1 on SW1 Gi1/0/1, H2 on SW2 Gi1/0/1, and Gi1/0/24 between the switches. No other production links are connected.

Physical links are solid; device roles and relevant links are labeled.

How it works

On an ordinary 802.1Q trunk, untagged data is classified into the native VLAN and native data is sent untagged by default. Both ends must agree. A mismatch can place untagged traffic into different broadcast domains and can trigger spanning-tree consistency protections.

Use VLAN 99 as an unused native domain in this lab and carry only required user VLANs. A native VLAN need not be a user access VLAN. Do not assume changing its number alone is complete access security, or that all control protocols obey the data allowed list identically.

Configure or inspect

vlan 10
vlan 20
vlan 99
interface GigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20
 switchport nonegotiate

Verify the result

Illustrative output · selected lines

SW1#show interfaces trunk
Port      Mode  Encapsulation Status    Native vlan
Gi1/0/24  on    802.1q        trunking  99
SW2#show interfaces trunk
Port      Mode  Encapsulation Status    Native vlan
Gi1/0/24  on    802.1q        trunking  1

The shown initial state is a mismatch: SW2 still uses native VLAN 1. User tagged traffic can behave differently from untagged/native traffic, so one passing test does not clear the mismatch.

Failure and recovery

Correct both ends’ intended native policy using an out-of-band or console path if management depends on the trunk. Inspect logs and inconsistent spanning-tree state after the change.

interface GigabitEthernet1/0/24
 switchport trunk native vlan 99
end
show interfaces trunk

Key Takeaways

Native VLAN controls ordinary untagged trunk data.
Match native policy at both ends.
A successful tagged flow does not prove untagged correctness.
Keep unused native VLANs separate from host access assignments.
Native tagging support and control-frame handling are platform-specific.