802.1Q Native VLAN on Cisco IOS Switch

Hello Mohammed

Let’s use the following topology to answer your questions:

Hosts C and D are on VLAN 99 which is configured as the native VLAN on the trunk. If C pings D, the frame will be tagged when it egresses Fa0/1 on SW1. Such frames will be tagged regardless of whether or not native VLAN tagging is configured. So to answer your second question as well, these frames will always be tagged.

As far as data plane traffic goes, traffic on the native VLAN will never be sent out of a trunk port untagged. The native VLAN configuration tells the trunk port on which VLAN incoming untagged frames should be placed. If you configure VLAN tagging, then any untagged frames that arrive on the trunk interface will be dropped.

Control traffic such as CDP, VTP, PAgP and DTP don’t actually use the native VLAN. They use VLAN1. Interestingly, even if you disallow VLAN1 on a trunk interface, and change the native VLAN to something other than VLAN1, these control protocols will still use it, and switches see this as an exception to the allowed VLANs.

The primary purpose of tagging the native VLAN is to mitigate against VLAN hopping attack techniques. You can find out more about VLAN hopping at the following lesson.

I hope this has been helpful!


1 Like