3

I am aware of all the background information to native VLANs, just to repeat here that they are used for 'control traffic', that is CDP / VTP / PAgP / DTP.

On a router, sub-interfaces can be defined to allow different VLAN IDs over a trunk from a connected switch to communicate, each VLAN ID will be on different subnet, the sub-interfaces act as default gateways and have nothing to do with trunking.

Often in prominent study texts and books and answers on forums, it is always stated that you must define the native VLAN on one of the sub-interfaces (or the physical interface in earlier scenarios).

My question is specifically why do we need the native VLAN defined on one of these sub interfaces when the connected VLANs do not need to pass control traffic (e.g. layer 2) to each other?

In every lab I have setup (PT and GNS3), I never have a problem missing out the native VLAN on a sub interface:

router(config-subif) #**encapsulation dot1q 1 native**
Improve this question
1

3 Answers 3

Reset to default
3

With Cisco devices, you do not need to configure a native VLAN, and it is recommended that you do not configure one. Traffic that is local to the link (CDP, VTP, PAgP, DTP, etc.) will still be sent and received untagged, and it will work correctly. This traffic will never be sent beyond the link, even with a native VLAN configured.

Having a native VLAN configured can present a security risk, as can the use of VLAN 1 (the default VLAN and default native VLAN). If you don't have a native VLAN, then any traffic spoofed to be on the native VLAN will never travel beyond the single link, and that limits any damage which may be done.

You can never delete VLAN 1, but you can limit which VLANs are allowed on a trunk with the switchport trunk allowed vlan <list> command, and just not allow VLAN 1 by excluding it from the list.

Improve this answer
5
  • 2
    Hi Ron,By far best I have heard so far (unless it is want I want to hear!) I found this article on "tagging the native vlan" networkworld.com/article/2234512/cisco-subnet/…
    – Fletch
    May 15, 2016 at 10:46
  • As you say, it is do with a security issue as far I can see
    – Fletch
    May 15, 2016 at 10:55
  • switchport trunk allowed vlan <list>, this is called "vlan pruning*.
    – Max
    May 17, 2016 at 7:34
  • When you add global command switch (config) # vlan dot1q tag native to a switch, this makes sure that ALL VLANS are tagged, so effectively does away with the native vlan, tying in with Ron above that it is best not to have one
    – Fletch
    Jun 8, 2016 at 17:10
  • 1
    Just want to point out that if you are not running an all Cisco environment, disabling VLAN 1 on a trunk will likely cause spanning tree issues. Cisco's "Per VLAN" spanning tree implementations allow Cisco devices to work just fine without VLAN 1 but devices without a per VLAN spanning tree solution use VLAN 1 for BPDUs.
    – YLearn
    Sep 21, 2017 at 22:40
2

For 802.1q - the IEEE standard calls for a VLAN assignment on any frame traversing a trunk (i.e., Native VLAN). By default, this is VLAN 1, but can be changed.

The Native VLAN essentially carries all traffic that does not have a specific VLAN tag associated with it. For instance, let's say you are using a cisco switch and only issue the following commands:

config t
int fa0/1
switchport
switchport mode access
no shut

At that point, this specific interface is not assigned to a specific VLAN (e.g., switchport access vlan 13). So, this interface will use the Native VLAN (whatever you defined it to be).

Because the IEEE specification, you must always have a Native VLAN when using 802.1q. My personal opinion, is they put this in there as a 'fail-safe' for any frames being sent without a VLAN Tag being placed in the 802.1q VLAN Tag field within the frame.

Hope this helps.

Improve this answer
1
  • My view on encapsulation dot1q id native and typically this would be encapsulation dot1q 1 native is that it's inclusion is for devices on the network that do not understand tagging. Data frames from those devices are still picked up (and those devices may not be administered with a VLAN ID (default VLAN 1) or, given an alternative VLAN id such as VLAN 99. This subinterface will accept frames on VLAN 99, OR, untagged frames
    – Fletch
    Jun 8, 2016 at 17:31
1

If the interface is acting as a default gw for a subnet, then it has an IP address and is no longer a "switchport" as such, it is a L3 interface. A L3 interface (which is an Interface with an IP address) has only 1 vlan "attached" to it. This vlan is "untagged", in Cisco language this means native. The native vlan is the vlan that is not tagged. So when you create a SVI you are creating the L3 instance for that L2 vlan.

Double Tagging is a different concept. Double tagging is when an attacker puts a vlan tag on top of an exisiting vlan tag. The first tag is stripped off when it enters the switch. The packet still has its underlying tag on it, which is then used to put the packet in the corresponding vlan; thus allowing an attacker to gain access to another vlan.

Improve this answer
4
  • 1
    Hi Yes thanks, I have edited out the bit about double tagging, that was not needed here. I just need ot know whay the native keyword is needed on a subinterface, when used this keyword show that the particular vlan is the native vlan. My contention is that a native vlan is not needed here
    – Fletch
    May 13, 2016 at 15:10
  • 1
    tagging the native vlan can be used against the double tagging threat (apparently) networkworld.com/article/2234512/cisco-subnet/…
    – Fletch
    May 15, 2016 at 10:43
  • 1
    Is this relevant ? "The "encapsulation dot1Q 1 native" command was added in Cisco IOS version 12.1(3)T., for earlier Cisco IOS, the IP address for Native VLAN is configured on the main interface, and no encapsulation for Vlan1(Native Vlan) under the sub-interface."
    – Fletch
    May 15, 2016 at 11:34
  • Just to be clear, I mean is my statement relevant, not yours!
    – Fletch
    May 15, 2016 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.