... or does the "default VLAN" have some wider meaning?

Also, can it / should it be changed? For instance, if a switch is going into part of a network that is only one VLAN and it's not VLAN 1, is it possible to make the "default" / native VLAN on all ports a particular VLAN using one global command, or is the preferred method to make all ports access ports and set the access VLAN to 10 on each of them?

up vote 19 down vote accepted

This is an often confused point for people new to the Networking, in particular to people coming up the Cisco track, due to Cisco's over emphasis on this point. It is more or less just a terminology thing. Let me explain.

The 802.1q standard defines a method of tagging traffic between two switches to distinguish which traffic belongs to which VLANs. In Cisco terms, this is what happens on a "trunk" port. I've seen other vendors refer to this as a "tagged" port. In this context, it means the same: adding an identifier to frames to indicate what VLAN the frame belongs to. Terminology aside, the main think to keep in mind is a VLAN tag is necessary, because often the traffic traversing two switches belongs to multiple VLANs, and there must be a way to determine which 1's and 0's belong to which VLAN.

But what happens if a trunk port, who is expecting to receive traffic that includes the VLAN tag, receives traffic with no tag? In the predecessor to 802.1q, known as ISL (cisco proprietary, but archaic, no one supports it anymore, not even Cisco), untagged traffic on a trunk would simply be dropped.

802.1q however, provided for a way to not only receive this traffic, but also associate it to a VLAN of your choosing. This method is known as setting a Native VLAN. Effectively, you configure your trunk port with a Native VLAN, and whatever traffic arrives on that port without an existing VLAN tag, gets associated to your Native VLAN.

As with all configuration items, if you do not explicitly configure something, usually some sort of default behavior exists. In the case of Cisco (and most vendors), the Default Native VLAN is VLAN 1. Which is to say, if you do not set a Native VLAN explicitly, any untagged traffic received on a trunk port is automatically placed in VLAN 1.

The trunk port is the "opposite" (sort of) from what is known as an Access Port. An access port sends and expects to receive traffic with no VLAN tag. The way this can work, is that an access port also only ever sends and expects to receive traffic belonging to one VLAN. The access port is statically configured for a particular VLAN, and any traffic received on that port is internally associated on the Switch itself as belonging to a particular VLAN (despite not tagging traffic for that VLAN when it leaves the switch port).

Now, to add to the confusing mix. Cisco books will often refer to the "default VLAN". The Default VLAN is simply the VLAN which all Access Ports are assigned to until they are explicitly placed in another VLAN. In the case of Cisco switches (and most other Vendors), the Default VLAN is usually VLAN 1. Typically, this VLAN is only relevant on an Access port, which is a port that sends and expects to receive traffic without a VLAN tag (also referred to an 'untagged port' by other vendors).

So, to summarize:

  • The Native VLAN can change. You can set it to anything you like.
  • The Access Port VLAN can change. You can set it to anything you like.
  • The Default Native VLAN is always 1, this can not be change, because its set that way by Cisco
  • The Default VLAN is always 1, this can not be changed, because it is set that way by Cisco

edit: forgot your other questions:

Also, can it / should it be changed?

This is largely an opinion question. I tend to agree with this school of thought:

All unused ports should be in a specific VLAN. All active ports should be explicitly set on to a particular VLAN. Your switch should then prevent traffic from traversing the uplink into the rest of your network if the traffic belongs on VLAN1, or the VLAN you are using for unused ports. Everything else should be allowed up the uplink.

But there are many different theories behind this. As well as differing requirements which would prevent having such a restricted switch policy (scale, resources, etc).

For instance, if a switch is going into part of a network that is only one VLAN and it's not VLAN 1, is it possible to make the "default" / native VLAN on all ports a particular VLAN using one global command, or is the preferred method to make all ports access ports and set the access VLAN to 10 on each of them?

You can not change the default Cisco configurations. You can use the "interface range" to put all ports in a different VLAN in one go. You don't really need to change the Native VLAN on the uplink trunk, so long as the other switch is using the same Native VLAN. If you really want to spare the switch from adding the VLAN Tag, you could get creative and do the following (although, its probably not recommended).

Leave all access ports in the VLAN1. Leave the Native VLAN at its default (VLAN1). On the uplink switch, set the port as a trunk port. And set its Native VLAN to the VLAN you want the lower switch to be a part of. Since the lower switch will send traffic to the upper switch untagged, the upper switch will receive it and associate it with what it considers the Native VLAN.

  • 3
    Great answer, @Eddie. The guys who setup our Cisco switches used the default VLAN 1 for our main data LAN and VLAN 2 for our voice. We're setting up a new site and the two are going to be linked via Ethernet. The new site will use VLANs 11 and 12. Is there some way of preventing VLAN 1 on one side of the link from going across to the other? – Matty Brown Jun 22 '15 at 10:27
  • 1
    I've seen "default VLAN" used as a synonym for "native VLAN" in the past. Also, it's considered best practice to not use VLAN 1 for traffic on Cisco switches, and also to not try to disable it. Otherwise, excellent answer. – Todd Wilcox Jun 22 '15 at 14:50
  • @ToddWilcox That is what makes it so confusing. The default VLAN is 1 The default Native VLAN.is also 1. So in a way, the default VLAN is, by default, the default Native VLAN. But they aren't really the same thing. – Eddie Jun 23 '15 at 3:13

The native VLAN is only relevant to 802.1q, yes it is untagged by default, but can be tagged if required. Ports will be assigned to the native VLAN if no other config is present.

It's ok to keep it as VLAN 1, but it can be changed, you just have to remember to shut down unused ports. What I mean by this, if I plugged my evil hacker laptop into a working port that was left as VLAN 1, I could potentially be able to span across your entire network, whereas you could change the native VLAN to VLAN 10, and then not assign VLAN 10 to any ports.

ISL has no concept of a native VLAN.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.