What is Native VLAN? | Cisco VLAN Trunking with Real Examples (802.1Q Tagging & VLAN Mismatch)
🔵 What is a Native VLAN and why does it matter in Cisco networks?
In this video, we break down the concept of Native VLANs in simple terms, perfect for CCNA, CCNP, or anyone learning networking. You'll understand:
✅ The role of Native VLAN in 802.1Q trunking
✅ What happens when untagged frames hit a trunk port
✅ Real-world scenarios with hubs, switches, and Layer 1 devices
✅ What is a Native VLAN mismatch and how to detect it
✅ How VLAN hopping can be a security risk
✅ Cisco CDP and how it helps identify trunk configuration issues
This video is your complete guide to understanding Cisco VLAN trunking and Native VLAN behavior. Whether you're studying for certification or working in a production network, this is must-know knowledge!
What is the Native V LAN?
, trunk ports send and receive Ethernet frames tagged with IEEE 802.1q V LAN tags. The primary idea behind this is to be able to transport frames from multiple V LANs over a single physical link between switches. This means that both ends of a trunk will always receive tagged frames as shown in Figure 1.
But is it always? What if there is a hub in the way or any other layer 1 device? What will happen if an untagged frame somehow gets into the trunk link? Native V LAN has been introduced to solve this specific scenario.
Native V LAN is configured per trunk port, it is locally significant and it tells the switch - "if you receive an untagged data into this port, forward it like it is part of the native V LAN number". For example, if we configure the native V LAN on a trunk to be 20, if data without IEEE 802.1q header comes in that port, it will be forwarded in V LAN 20. You can see an example of this in Figure 2. PC7 is somehow connected to the trunk and is sending untagged frames. When they are received on both sides of the link, they are forwarded into the V LAN 20 (the Native V LAN).
By default, the native V LAN of all trunk ports on Cisco switches is assigned to V LAN 1 but it can be any valid V LAN number.
There is another very important angle to this concept. The switches are not only putting the received untagged data into the native V LAN, but they are also sending the data in the Native V LAN untagged. Look at the example in Figure 3, the frames from V LAN 10 are carried across the trunk with 802.1q headers, but the frames from V LAN20 are carried across untagged because V LAN20 is the Native V LAN of the trunk port. All control plane messages such as CDP, VTP, and DTP are also sent through the Native V LAN i.e untagged.
Native V LAN Mismatch
Interface Trunk configuration is locally significant. This means that the Trunk settings on one switchport do not have to exactly match the settings on the other side of the link. Therefore, you can configure native VLAN 10 on one side and VLAN 20 on the other side of a single trunk link. This causes a dangerous faulty state called Native VLAN mismatch. Cisco proprietary protocol CDP can detect this misconfiguration and report with error messages as shown below. Please note that, if CDP is disabled on the link, there is no way for the switch to automatically detect this.
Native VLAN mismatch can cause some major issues and security implications such as:
Misdirected traffic - Frames, originating in the VLAN configured as Native, are sent untagged across the trunk. Upon receiving on the other side on the link, they are forwarded in different VLAN because trunk settings don't match on both sides.
VLAN hopping - malicious traffic can cross VLAN boundaries.
#VLAN #NativeVLAN #CiscoVLAN #CCNA #CCNP #CiscoNetworking #8021Q #VLANTrunking #CiscoSwitch #VLANMismatch #NetworkSecurity #NetworkingBasics #ITTraining #LearnNetworking