3

The 5500 manual says one shouldn't use VLAN 1 on access ports. Furthermore, it couldn't be added to trunk ports.

Unfortunately, the manual gives no reason. Normally, all VLANs are tagged on trunk ports. Is VLAN 1 not tagged? Is VLAN 1 then local to a switch only?

Isn't it possible to leave VLAN 1 on all access ports untagged and forward it tagged on the trunks?

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 7, 2017 at 22:39

2 Answers 2

Reset to default
2

Normally, all but the native vlan are tagged on trunk ports. Some vendors do prefer tagging everything on trunk ports.

The "don't use VLAN 1" is a Best Practice™ (aka. religion.) People prefer to avoid baked in defaults so there are fewer surprises down the road. If you have a simple enough network, there's no reason VLAN 1 cannot be used.

VLAN 1 does have special meaning to (eg) spanning-tree.

Improve this answer
1
  • All but the vlan-1 are tagged on trunks is what I understood from the 3Com Manual. We use spanning tree. So VLAN-1 should probably be kept untagged.
    – chris
    Mar 31, 2016 at 3:59
0

VLAN 1 is usually the native (untagged) VLAN. Using VLAN 1, and native VLANs in general, poses some security risk.

Access ports should not use VLAN tags since most end-devices (some servers may) don't understand VLAN tags. Tags are used on trunks, where multiple VLANs are on the same link, in order to distinguish which frames belong to which VLAN. You can have one untagged (native) VLAN on a trunk since you can distinguish it from the tagged frames.

Some devices do not let you disable VLAN 1. It is likely that your switch requires VLAN 1 on a trunk, so you can't configure it.

Improve this answer
2
  • Why can't vlan1 be disabled? I think HP ProCurve can disable it. HP VLAN1 is like all the other VLANs. HP doesn't distinguish between trunk, hybrid and access ports. Each VLAN is just tagged / untagged / forbidden on each port. That's much clearer.
    – chris
    Mar 31, 2016 at 3:51
  • 1
    @chris, as Ricky pointed out, VLAN 1 means something special to STP.
    – Ron Maupin ♦
    Mar 31, 2016 at 4:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.