Prevent a trunk from passing native (untagged) traffic

Question

I am a network enthusiast and recently tracked down a problem and I'm looking for a solution. I've configured a small 8 port (CISCO SG200) switch as a trunk requiring tagging on VLAN1 and 2. In the Port VLAN membership, the following is displayed

Interface  Mode PVID  Operational VLAN Membership
    g1    Trunk  1    1T,2T

NOTE: There is no command line access to the switch so I can't show typical command line commands and output.

So both sides of the trunk are configured as Trunk 1T,2T. The other switch is a CISCO SG-300 20port (so both are CISCO brand switches).

On reboot/power-cycle of the CISCO SG200, however, the SG200 changes it's configuration to 1U,2T. See below

Interface  Mode PVID  Operational VLAN Membership
    g1    Trunk  1    1U,2T

The result is that VLAN1 traffic no longer flows over the trunk because the SG200 sends VLAN1 without tagging, and the other switch (SG300) requires VLAN1 to be tagged so the untagged VLAN1 traffic is ignored (that is my understanding).

I thought what I was doing was "legal" albeit not standard, but since it isn't working I need to change it. The question is how should I change it so that

• I have two VLANs.
• I have a trunk connecting my two switches that ONLY allow traffic from these two VLANs
• NOTE: I wanted to prevent untagged traffic from being sent at all (over the trunk), but apparently the SG200 doesn't want to support this (after a reboot), and some of the things I read indicated that CISCO wants to send switch communications on VLAN1 so I might want to avoid using VLAN1 and create two other VLANs.

So some thoughts are:

• Use VLAN 2 & 3 for my purposes. I would change the default VLAN to be 2 (in my case), so all ports by default connect to the primary LAN. I want VLAN2 (in this example) to be the wild west, and VLAN3 to be protected. The trunk port would be configured for 2T,3T.

The result would look like this:

Interface  Mode PVID  Operational VLAN Membership
    g1    Trunk   1    2T,3T
    g2    Access  2    2U
    g3    Access  3    3U

I thought there might be some other options but this is all I've got.

Some other articles I found useful were:

• Why is tagged traffic going to VLAN1

• What is VLAN1 interface in routers?

• PVID (Port VLAN ID) is a default VLAN id assigned to frames coming to the port

Answer 1

You need to ensure the PVID, U and T VLANs match on both sides to makes sure you have correct VLAN forwarding across the trunk. If you have a PVID / untagged VLAN mismatch you will be bridging two VLANs together between the switches (STP may even block if there is a mismatch)

This may be a little overkill for your setup, but best practice for security (to avoid VLAN hopping among other things) is to configure your trunks as follows:

• Define a dummy VLAN (other than VLAN 1) to be used on all trunks as the native VLAN. This VLAN should only be assigned as native VLAN on trunks and should never be used for user data.

• Remove VLAN 1 if you can from the trunk (not really possible on Cisco switch). If you can’t remove it, tag it, but don’t ever use it for user data.

• All other VLANs, the ones you use for user data should be tagged.

So, you could define VLAN 99 as the native VLAN, then set the trunks to:

• PVID 99, 1T, 2T, 3T, 99U

and only ever use VLANs 2 and 3 for user traffic.

To avoid access ports being configured for VLAN 1 you can either preconfigure them to either VLAN 2 or VLAN 3. Alternatively, define a black hole VLAN for unused ports and assign all unused ports to that VLAN.

Answer 2

I think you may be thinking about this incorrectly. A VLAN is a broadcast domain. VLANs are a way to break a switch up into multiple, virtual, unconnected switches. Traffic from one VLAN cannot be sent to another VLAN, except through a router. You can place ACLs in the router to allow or deny traffic between VLANs.

I really don't see a problem with using VLAN 1 as untagged with VLAN 2 as tagged, or VLANs 2 and 3 as tagged on the switch trunk interfaces, and not allowing any untagged VLAN on the SG300. VLAN tags do not add any security, they are to simply to mark traffic so that the switch on the other end of the trunk can separate the frames back into the correct VLANs. All the frames are tagged on the trunk, except you can have traffic for one VLAN (native VLAN) not tagged. That doesn't mean that traffic will be assigned to any other VLAN. Either way, the traffic in each VLAN is still isolated.

There are also management frames that are sent untagged between the switches, but those frames are not really part of a VLAN because they use special MAC addresses that cannot be sent beyond the switch interface.

Your VLAN traffic will remain separate on the switches, as if you had a separate switch for each VLAN. Traffic between VLANs must be routed between VLANs, and that is where you restrict what traffic is allowed between the VLANs.