802.1Q Native VLAN on Cisco IOS Switch

(Rene Molenaar) #29

Hi Sahar,

CDP is a strange protocol when it comes to VLANs. When you configure the native VLAN to be tagged then CDP will show up as being tagged. When you change the native VLAN to another VLAN number, CDP will remain in VLAN 1.

The port VLAN inconsistency error can occur because of a native VLAN mismatch yes. Basically what it means is that your switch has received a PVST BPDU on the wrong VLAN. Make sure your trunk settings are 100% the same on both switches.


(Sahar H) #30

Ty very much!

(Sahar H) #31

Another question…

According to your answer…if i block vlan 1 on the trunk both sides.i wont see cdp neighbors?

(Rene Molenaar) #32

Hi Sahar,

Normally that would make sense yes but CDP is a strange animal. Even if you remove VLAN 1 from your trunk, CDP will be sent between your switches. It doesn’t really follow the normal rules :slight_smile:


(Ahmad D) #33

Hi Rene,

I keep hearing and reading about Native vlan for over many years so far but till now and honestly speaking Im not able to understand one thing. What is the benefit or the reason for being Native Vlan in the first place ? I read your lesson about Vlan Hopping which is really good with no doubt but still I need to know what is Native Vlan used for in the first place. In plain English , what is the job of Native Vlan ? thx

(Andrew P) #34

A Native VLAN is the vlan that is used should a trunk port receive an frame with no explicit VLAN tag. I will give you an example of how I used Native VLANs in the real world:

For many of my locations, users have a single network connection to their desk. They use both a VOIP phone (not Cisco :frowning: ), and a PC. Both of these devices use the single network connection. The connection goes to the VOIP phone, and the computer plugs into another port on the phone. The VOIP traffic is on a separate VLAN than the PC data traffic.

To get this to work, we have to configure each port as a Trunk and allow both the VOIP VLAN and the PC Data vlan on the switch port. We configure the switch so that the native VLAN is the PC Data and the tagged VLAN is the VOIP. The reason for this is because the VOIP phone can read and understand 802.1Q tags, while a PC has no idea what that is–in fact the extra information in the 802.1Q tag makes the PC believe the frame is mal-formed and it will discard it! By configuring the Native vlan as the PC Data vlan, this means the PC gets an untagged frame, so it knows what to do with it. At the same time, the PC is on the correct VLAN.

Does that make sense?

(Mohammad Hasanuz Zaman) #35

Dear Rene,

Thanks for your very nice article.I think,I have find the right one and thats you :slight_smile: . One small questions , By default, Default & Native Vlan 1 on a SW. Switch do use Native Vlan for some mangement Protocol Frame like CDP/VTP/DTP/PAgP/UDLD .So, Is there any use of Default vlan like Native ??? Many Thanks


(Ahmad D) #36

I wish I have such great answer 10 years ago ! Thank you for the hard work.

1 Like
(Andrew P) #37

I think you are asking whether Cisco has any management dependencies on VLAN 1? In other words, is it okay to disable, or filter out VLAN 1? The answer to this is it is okay to do this. In fact, for security purposes, most people avoid using VLAN 1 entirely. By pruning VLAN 1 from trunks, you will not break any needed Cisco protocols.

1 Like
(Whijoon Y) #38

Hi Rene,

How can you capture the frames passing through the trunk by using Wireshark?
As far as I know, the capturing tool Wireshark is supposed to be installed in a server.

Could you show me the topology diagram for the capturing?

Whijoon Yim,

(Shantel - Networklessons.com) split this topic #39

19 posts were merged into an existing topic: 802.1Q Native VLAN on Cisco IOS Switch

(Andrew P) #40

Yes you can. One thing to remember is that you don’t necessarily need wireshark in order to capture the data. You need wireshark to interpret it (although it can capture it as well). Cisco has the ability to capture the data for you, then all you have to do is export the data and read it with Wireshark on any computer you want.

I recommend you check out the Embedded Packet Capture lesson for more details …

(Eng_ A) #41

Hello Rene,
quick question please,
when we applied :

SW1(config)#interface fastEthernet 0/24
SW1(config-if)#switchport trunk native vlan 10

and then i went ahead and did : sh vlan brief , i cannot see that vlan 10 is created at all? can we have more than native vlan at the same time on the same switch?

im getting this:

Port        Mode             Encapsulation  Status        Native vlan
Et0/1       desirable        n-isl          trunking      10
Po1         on               802.1q         trunking      1


1 Like
(Lazaros Agapides) #42

Hello Eng_A

It is important to understand how VLANs are created and how they are applied. In the Cisco IOS, you can apply a VLAN (say to an access port or a trunk port) without it actually existing! And actually, you don’t get an error message for this either. This is also the case when you apply the Native VLAN. So when you apply a native VLAN to a trunk port, there are two steps:

  1. Create the VLAN (or make sure that it already exists)
  2. Apply the Native VLAN configuration to the trunk

As you have already seen, these commands don’t actually have to be implemented in the above order.

So for commands like:

SW1(config-if)#switchport access vlan 10
SW1(config-if)#switchport trunk allowed vlan 10
SW1(config-if)#switchport trunk native vlan 10

vlan 10 may not even exist, but you can still issue the above commands.

The only time a VLAN will be created without explicitly issuing the vlan xx command (where xx is the VLAN ID) is when you create an SVI. For example:

SW1(config)# interface vlan 10

This command creates the SVI on a switch, but it also automatically creates the associated VLAN. If you have terminal monitor on, you will actually see a syslog message that informs you of this.

So, to answer your question, you must create vlan 10 in order for your native vlan configuration to work correctly.

I hope this has been helpful!


(Olaniyi O) #43

At what point do you assign an IP address to a vlan say
“Interface vlan2
IP address…”
instead of assigning IP address to a normal interace.

(Lazaros Agapides) #44

Hello Olaniyi.

The command interface vlan 2for example would be used to create a Switched Virtual Interface (SVI) on a layer 3 switch to function as a default gateway and allow for inter-VLAN routing. If you have a layer 3 switch with two VLANs configured on it, say VLAN 20 and 30 with subnets and respectively, these VLANs cannot communicate with each other. If you create two SVIs, say VLAN 20 and VLAN 30 and assign them IP addresses and respecitvely, you can use these as gateways on the end devices to allow communication between the VLANs on the same switch.

This command is only available on layer 3 switches and NOT on routers. On routers, you would assign an IP address on a specific physical interface.

I hope this has been helpful!


(Shantel - Networklessons.com) split this topic #45

19 posts were merged into an existing topic: 802.1Q Native VLAN on Cisco IOS Switch

(Mohammad M) #47

is there specific topic to describe Native VLAN exactly what dose it uses for and how dose it help switching process ?

(Lazaros Agapides) #48

Hello Mohammad.

Frames that are placed on a trunk include a VLAN tag. Switches know to which VLAN to forward a frame that is received on a trunk interface by this tag. If however for some reason, there is no tag on a frame that is received, the switch must know what to do with it. The Native VLAN configuration essentially tells the switch on which VLAN any UNtagged frames should be placed.

Now if you have connected two switches with a trunk, it is highly unlikely that any frame will arrive without a tag. (If it does, then there is a problem with some configuration). However, if you have a hub between two switches connected with a trunk and you have a PC connected to that hub, then you will definitely receive untagged frames on the trunk ports. Take a look at the following diagram:

Any frames sent by the PC will hit the trunk ports on the two switches untagged. The switches must know what to do with them. This is why the native VLAN must be configured, otherwise these frames will be dropped.

The truth is that such a topology is a very bad idea. You should never create such a network. The capability of switches to deal with untagged frames however must be applied and configured in order for trunks to function correctly from end to end.

I hope this has been helpful!


1 Like
(Hussein Samir) #49

Hi Rene,

I now that the “vlan dot1q tag native” command will tag native vlan on all trunks port but what about the “switchport trunk native vlan tag” command used for ??? notice that this command is enabled by default per interface and can not be seen by applying show run all command, but when I use “no switchport trunk native vlan tag” it’s show up in run config.

The switch model and IOS version is :-
Catalyst 4500 L3 Switch Software (cat4500e-IPBASEK9-M), Version 15.1(1)SG, RELEASE SOFTWARE (fc3)