2

When no VLAN is configured on a Switch, all frames belong to the default VLAN which is VLAN 1. Are those frames in the VLAN 1 tagged!?

And when talking about native VLANs, only untagged frames go in there - which probably means stuff like CDP- or VTP-informationen - so control traffic, right? And one should change the native VLAN to another VLAN than the default VLAN as somebody could listen to the control traffic, right?

I thought that this traffic would be in the management VLAN, but in the management VLAN is the traffic which is used to administer Switches (with Telnet, SSH, ...), right?

Just a few questions which didn't get answered by researching...

Improve this question
6
  • 1
    VLANs are what you make them to be. It's correct, that all frames are tagged in VLAN 1, this for CDP, VTP etc., as you wrote. Best practice from Cisco is to not use VLAN 1 in your corporate network, so again as you wrote, changing native VLAN tagging to another VLAN is a good idea. Any access port or edge port will forward packets in VLAN 1 (if not configured otherwise). And any trunk port will be tagged with native VLAN 1 (if not configured otherwise).
    – user36472
    Commented Jun 4, 2018 at 9:25
  • Thanks @Cown ! is CDP and VTP etc. always in VLAN 1? I mean, it doesn't belong to the native VLAN right, so when I change the native VLAN, the control traffic (CTP, ...) is not affected right?
    – watchme
    Commented Jun 4, 2018 at 9:28
  • 1
    Changing the native VLAN will not affect CDP or VTP.
    – user36472
    Commented Jun 4, 2018 at 9:30
  • @Cown By "is not affected" I meant when the native VLAN is changed, CDP or VTP - traffic still happens via VLAN 1. Thanks!
    – watchme
    Commented Jun 4, 2018 at 9:33
  • 2
    @watchme, actually, link protocols, such as CDP, LLDP, etc., are not part of any VLAN. Yes, they are sent as untagged, but a VLAN is a broadcast domain, and those protocols cannot be forwarded to any other interface, so they are not part of the broadcast domain, they are simply untagged frames. On Cisco devices, you can restrict which VLANs, including any native VLAN, from a trunk, and the link protocols will still work just fine.
    – Ron Maupin ♦
    Commented Jun 4, 2018 at 11:20

1 Answer 1

Reset to default
5

When no VLAN is configured on a Switch, all frames belong to the default VLAN which is VLAN 1

Not necessarily. All untagged frames belong to the port's native VLAN which is the default VLAN by default. The default VLAN in turn is VLAN 1 by default. Both can be changed usually. Tagged frames that are received on any port are dropped when no tagged ports/trunks are configured.

On many devices the default VLAN is also the management VLAN (the VLAN where you can access the device configurations and such).

The native VLAN of a port is the VLAN untagged frames are associated with. It depends on the configuration.

Link-layer traffic like CDP, VTP, LLDP, xSTP, ... is always untagged and it isn't really associated with any VLAN as it's not being forwarded. You can have functional link-layer traffic on a port that has no native (untagged) VLAN configured.

You should have a separate management VLAN - if this is identical to the default VLAN you should change the latter or not use it as native VLAN. No edge port should have the management VLAN as native VLAN.

Improve this answer
5
  • Note: there are VLAN aware STP versions.
    – Ricky
    Commented Jun 4, 2018 at 14:52
  • @ricky Sure, but the BPDUs are still untagged.
    – Zac67 ♦
    Commented Jun 4, 2018 at 17:19
  • As I recall, ISL actually encapsulated (tagged) the BPDUs, not that anyone uses that anymore.
    – Ron Maupin ♦
    Commented Jun 4, 2018 at 17:44
  • @RonMaupin Thx for pointing that out, I'm not that into Cisco. But probably good that ISL is out of use. ;-)
    – Zac67 ♦
    Commented Jun 4, 2018 at 18:09
  • There were other vendor specific STP hacks. (is there a vendor that didn't roll their own? I have gear from 7 different vendors and MST is the only one they share)
    – Ricky
    Commented Jun 4, 2018 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.