I would like to use a dead vLAN as the native/untagged vLAN on trunk feeds as a security best practice. The trunk feed is between a Cisco and Aruba switch. On Cisco switch, the vLAN is left out of the vLAN database and frames won't get forwarded, making it "dead". The dead vLAN is native on the Cisco trunk interface. However on the Aruba switch it is required to have the vLAN defined before it can be added untagged on the interface. This makes me nervous that this vLAN would be forwarding frames and potentially cause loops or large broadcast domains.
Aruba switches will allow "no untagged vLAN" to be specified. However, I'm pretty sure that will create a vLAN mismatch to a Cisco switch, which requires a native vLAN to be specified.
What is the best way to create a "dead end" vLAN on Aruba/HP switches, so that no traffic is forwarded?
switchport trunk allowed vlan
command to restrict which VLANs are sent across trunks to only those used on the switch. Cisco also recommends that you not have the same VLAN on multiple access switches (a switch can have multiple VLANs, but any VLAN on an access switch should not be allowed on another access switch), and access switches should not connect to each other, only to the distribution (preferably by layer-3). This eliminates many layer-2 and STP problems.