A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Every trunk has one VLAN that carries untagged traffic — the native VLAN. Default is VLAN 1. This exists because a trunk may carry traffic from devices that don't speak 802.1Q (legacy gear, some hypervisors, some management protocols). But the native VLAN has security implications that make it worth its own lesson.
When a frame leaves the trunk on the other side, if it's in the native VLAN, it's sent untagged to the access port. If it's in any other VLAN, it's sent with an 802.1Q tag. That's how the receiving side knows how to handle it.
If you configure native VLAN 99 on one side of a trunk and leave the default 1 on the other, the trunk still comes up. But traffic placed in VLAN 99 on one side arrives untagged on the other side, where it's assumed to be VLAN 1. This leaks traffic across VLAN boundaries and Cisco logs a `%CDP-4-NATIVE_VLAN_MISMATCH` warning.
That log line means Switch1's Gi0/24 native VLAN is 99, but Switch2's Gi0/24 native VLAN is 1. The fix: configure 99 on both sides, or back to 1 on both. Never leave a mismatch — it's a both-bug-and-security-issue.
! On Switch1Switch1(config)# interface gigabitEthernet0/24Switch1(config-if)# switchport trunk native vlan 99! On Switch2 — same portSwitch2(config)# interface gigabitEthernet0/24Switch2(config-if)# switchport trunk native vlan 99! Verify both sides agreeSwitch1# show interfaces trunk | include NativeSwitch2# show interfaces trunk | include Native
Both switches must agree. Cisco's CDP-based mismatch detection catches disagreements automatically and logs them, but only if CDP is enabled. If you've disabled CDP for security, you've also disabled the warning — check manually.
Best practice is to change the native VLAN from the default 1 to an unused VLAN. The reason is security: if an attacker can inject untagged frames onto a trunk, those frames will be placed in the native VLAN. If native is VLAN 1 (the default and often the management VLAN), the attacker lands in the management network. If native is an unused VLAN, they land nowhere useful.
Double-tagging is the classic native-VLAN-based attack. An attacker sends a frame with two 802.1Q tags: the outer tag is the native VLAN (which the first switch strips), the inner tag is a target VLAN. When the frame exits the second switch, the inner tag routes it into a different VLAN. Mitigation: change native VLAN to an unused ID, and never put user traffic in the native VLAN.
On every new trunk, configure native VLAN to an unused ID (99 is common), exclude VLAN 1 from `switchport trunk allowed vlan`, and disable DTP with `switchport nonegotiate`. Three commands, five seconds, and you've closed the most common trunk security gaps.
Native VLAN mastered. Next lesson: how traffic flows between VLANs — the routing requirements.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.