1

I have the native VLAN on my trunk links set to VLAN 10 which is my management VLAN that spans the entire network. We have one WLC and Access Points connected on a trunk link set to native VLAN20 which is the wireless VLAN. I was wondering if I should have all network devices on the same Native VLAN to avoid any mismatch issues for cisco and other protocols that run untagged over the network?

We have a lot of Apple and L2 devices on the network that would like to utilize protocols wired or wireless. I have configured mDNS on the WLC but still having issues with basic print jobs. I was planning on moving the WLC to the VLAN10 but I have read articles that recommend different ways of deploying the controller.

    VLAN 10 - Management
    VLAN 20 - Wireless
    VLAN 60 - Hosts

    Router (10.0.1.2) - access port, VLAN 10

    c3750 (10.0.1.1) - you name it we probably got it plugged in
    wlc (10.0.2.3) - trunk port, native VLAN 20

    ==3 switches on trunk links running back to 10.0.1.1 ==
    c3750(10.0.1.3) - trunk port, native VLAN 10
    c3750(10.0.1.4) - trunk port, native VLAN 10
    c3750(10.0.1.5) - trunk port, native VLAN 10
Improve this question
2
  • I think you should try with a WLAN. I use this method and it works well for when i'm crossing over with my VLAN.
    – popscapo
    Commented Jun 15, 2015 at 4:09
  • Did any of the answers help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively you can answer your own question and accept the answer.
    – Ron Maupin ♦
    Commented Aug 6, 2017 at 2:55

1 Answer 1

Reset to default
3

Untagged (native) VLANs don't really offer you any benefit over tagged VLANs, and they present a certain level of security risk. There is no real reason to use untagged VLANs when tagged VLANs are available.

Some people prefer to use a network-wide VLAN for management, one for printers, etc. This scenario presents both security and operational risks. Cisco has been recommending one access switch per VLAN (an access swtich can have multiple VLANs, but those VLANs don't extend to any other access switch), and, if you can, use layer-3 connections to the access switches instead of trunks.

There is a book published by Cisco Press, "LAN Switch Security: What Hackers Know About Your Switches" by Eric Vyncke and Christopher Paggen that explains a lot of these sorts of things.

Improve this answer
1
  • I generally have two different sorts of "management" networks. The first is a real, genuine, out of band management net and by out of band, I mean that this network does not appear anywhere in the switch fabric except on the management ethernet ports of devices. This net has its own dedicated fabric. The second sort is in-band management use for hypervisors and the like. I generally make that the native vlan for the prod switch fabric.
    – GeorgeB
    Commented Jun 14, 2015 at 3:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.