802.1Q Native VLAN on Cisco IOS Switch

The IEEE 802.1Q trunking protocol describes something called the native VLAN. All native VLAN traffic is untagged; it doesn’t have an 802.1Q tag on the Ethernet frame. When you look at it in Wireshark, it will look the same, just like any standard Ethernet frame.

When your Cisco switches receive an Ethernet frame without a tag on an 802.1Q enabled interface, it will assume that it belongs to the native VLAN. For this reason, you need to make sure that the native VLAN is the same on both sides.

By default, VLAN 1 is the native VLAN. We can change this if we want. Let’s look at an example. I will use two switches for this:

cisco sw1 sw2 8021q trunk

I will configure an 802.1Q trunk between those two switches so we can look at the native VLAN:

SW1(config)#interface Fastethernet 0/24
SW1(config-if)#switchport trunk encapsulation dot1q
SW1(config-if)#switchport mode trunk
SW2(config)#interface Fastethernet 0/24
SW2(config-if)#switchport trunk encapsulation dot1q
SW2(config-if)#switchport mode trunk

We can verify our trunk configuration and see the native VLAN like this:

SW1#show interface fastEthernet 0/24 trunk

Port        Mode             Encapsulation  Status        Native vlan
Fa0/24      on               802.1q         trunking      1

Port        Vlans allowed on trunk
Fa0/24      1-4094

Port        Vlans allowed and active in management domain
Fa0/24      1,10,12-13,20,23,34,100,123

Port        Vlans in spanning tree forwarding state and not pruned
Fa0/24      1,10,12-13,20,23,34,100,123
SW2#show interfaces fastEthernet 0/24 trunk

Port        Mode             Encapsulation  Status        Native vlan
Fa0/24      on               802.1q         trunking      1

Port        Vlans allowed on trunk
Fa0/24      1-4094

Port        Vlans allowed and active in management domain
Fa0/24      1,10,12-13,20,23-24,30

Port        Vlans in spanning tree forwarding state and not pruned
Fa0/24      1,10,12-13,20,23-24,30

Above, you can see that the trunk is operational, we are using 802.1Q encapsulation, and the native VLAN is 1. So what kind of traffic is running on the native VLAN? Let’s take a look at a Wireshark capture of our trunk!

Wireshark Cisco Native VLAN

As you can see, some of the management protocols like CDP (Cisco Discovery Protocol) are sent on the native VLAN. For security reasons, it might be a good idea to change the native VLAN from VLAN 1 to something else. You can do it like this:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 660 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

505 Sign Ups in the last 30 days

satisfaction-guaranteed
100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags: ,


Forum Replies

  1. Ahmad,
    A Native VLAN is the vlan that is used should a trunk port receive an frame with no explicit VLAN tag. I will give you an example of how I used Native VLANs in the real world:

    For many of my locations, users have a single network connection to their desk. They use both a VOIP phone (not Cisco :frowning: ), and a PC. Both of these devices use the single network connection. The connection goes to the VOIP phone, and the computer plugs into another port on the phone. The VOIP traffic is on a separate VLAN than the PC data traffic.

    To get this to work, we have to

    ... Continue reading in our forum

  2. Hi Andrew,
    I was just browsing through the native vlan topics and i saw your reply to Ahmad. I dont understand your replay starting “To get this to work, we have to configure each port as a Trunk and allow both the VOIP VLAN and the PC Data vlan on the switch port” Which port are you configuring as a trunk?
    I have configured VOIP vlan and pc data vlan on a switch port and it is not configured as a trunk port for both devices to work with the cat5 from the wall going into the phone first and then the pc connected to the phone.
    The port on the switch is configu

    ... Continue reading in our forum

  3. Hello Karan

    Frames that are sent from almost all network devices such as computers, are sent without tags. Frames sent out of access ports on switches are also sent without tags. Tags are only added when a frame exits a trunk port and are removed once again when it enters the trunk port on the other end. Tagged frames should only exist on the link between two switches connected via a trunk.

    Having said that, the Native VLAN is set up on a trunk so that any frames that do arrive on that trunk port without a tag will be placed on the appropriate VLAN. Situati

    ... Continue reading in our forum

  4. Hello Aniket

    There are two ways to implement the following scenario:

    //cdn-forum.networklessons.com/uploads/default/original/2X/9/9d69130607837348dce9fbafdc97c7ccdceba7b0.jpeg

    One is to configure the Gi0/1 interface as a trunk. Let’s say the voice VLAN on our network is 137 and the data VLAN is 135. We would configure the Gi0/1 interface as a trunk, with a native VLAN of 135 and an allowed VLAN of 137. This means that frames on VLAN 135 destined for H1 would exit the Gi0/1 interface untagged. Any such frames reaching the IP phone would continue on to H1. A

    ... Continue reading in our forum

91 more replies! Ask a question or join the discussion by visiting our Community Forum