2

This answer says "[a] trunk has optionally one untagged VLAN and many tagged VLANS."

I always thought specifying switchport mode trunk would drop untagged frames at that port, but that answer seems to indicate that otherwise.

How do you drop (or ignore or filter) all untagged traffic that arrives on an 802.1q VLAN trunk port?

I thought that perhaps omitting switchport trunk native vlan <n> would do that, but then I thought it might default to vlan 1 which would also be undesirable. What is the best practice here?

Improve this question
2
  • 1
    Remove the native VLAN from the trunk with the switchport trunk allowed vlan command.
    – Ron Maupin ♦
    Commented Aug 25, 2022 at 20:31
  • 1
    "How do you drop (or ignore or filter) all untagged traffic that arrives on an 802.1q VLAN trunk port?" One thing to understand is that there are link-local protocols that send traffic untagged (CDP, LLDP, DTP, etc.), but that traffic will not be forwarded to another interface beyond the one on which it is received. Blocking the native VLAN on a trunk link does not block those protocols (you will need to block each individually) because they are not in a VLAN, they are link protocols; VLAN membership would imply they can be forwarded to other interfaces in the same VLAN, but they cannot be.
    – Ron Maupin ♦
    Commented Aug 25, 2022 at 23:00

1 Answer 1

Reset to default
4

On a Cisco switch, this is done by selecting a native VLAN that is not allowed on the trunk / port.

switchport trunk native vlan 1 ! (normal default)
switchport trunk allowed vlan 100-199

So long as the native vlan is not on the "allow" list, it will be dropped.

(Other vendors may have explicit CLI commands to disable untagged traffic.)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.