1

I would like to use a dead vLAN as the native/untagged vLAN on trunk feeds as a security best practice. The trunk feed is between a Cisco and Aruba switch. On Cisco switch, the vLAN is left out of the vLAN database and frames won't get forwarded, making it "dead". The dead vLAN is native on the Cisco trunk interface. However on the Aruba switch it is required to have the vLAN defined before it can be added untagged on the interface. This makes me nervous that this vLAN would be forwarding frames and potentially cause loops or large broadcast domains.

Aruba switches will allow "no untagged vLAN" to be specified. However, I'm pretty sure that will create a vLAN mismatch to a Cisco switch, which requires a native vLAN to be specified.

What is the best way to create a "dead end" vLAN on Aruba/HP switches, so that no traffic is forwarded?

Improve this question
11
  • 3
    "a Cisco switch, which requires a native vLAN to be specified." That is not true. Cisco devices do not require a native (untagged) VLAN. What you cannot do is disable VLAN 1 on a Cisco device, but you can remove VLAN 1 from being sent across a trunk. There is absolutely no requirement to have a native VLAN for a Cisco switch, and there is also the command to tag the native VLAN (really not having a native VLAN).
    – Ron Maupin ♦
    Feb 7, 2019 at 18:56
  • Wow, I don't know how I came to that assumption. Thanks for correcting me.
    – Yanzzee
    Feb 7, 2019 at 19:04
  • One of the current Cisco best practices is to not have a native (untagged) VLAN on a trunk, and to use the switchport trunk allowed vlan command to restrict which VLANs are sent across trunks to only those used on the switch. Cisco also recommends that you not have the same VLAN on multiple access switches (a switch can have multiple VLANs, but any VLAN on an access switch should not be allowed on another access switch), and access switches should not connect to each other, only to the distribution (preferably by layer-3). This eliminates many layer-2 and STP problems.
    – Ron Maupin ♦
    Feb 7, 2019 at 19:10
  • So if there's no native vlan set on cisco, doesn't it default to using vlan 1 as native? Then if "vlan dot1q tag native" is then used, woudn't it just tag vlan 1?
    – Yanzzee
    Feb 7, 2019 at 19:54
  • "So if there's no native vlan set on cisco, doesn't it default to using vlan 1 as native?" Yes. "if "vlan dot1q tag native" is then used, woudn't it just tag vlan 1?" Yes that would tag VLAN 1, the default VLAN, but a native VLAN is the untagged VLAN, so that actually has no native VLAN. The problem is that using native and default VLANs (normally the same) can both be security problems. We restrict VLAN 1 from trunks, and we do not use a native VLAN, both for security reasons.
    – Ron Maupin ♦
    Feb 7, 2019 at 20:03

2 Answers 2

Reset to default
1

I understand your question as "How do I get untagged frames to go nowhere on trunk ports?" - your approach with a dummy native VLAN would work. However, as you point out, the dummy VLAN would be functional and could actually be used or cause problems.

So, why don't you simply remove the untagged/native VLAN from those ports? (no vlan <VLID> untagged <port> for HPE/Aruba) That way all untagged traffic is dropped right away by the switch. If it's not possible to remove the native VLAN from a trunk port, make sure you use a different dummy VLAN for each trunk port. That'll make sure there's no unwanted traffic.

Improve this answer
3
  • I think you understand my question correctly. My remaining concern is vlan mismatch issues that might arise, as well as making sure that there isn't any unexpected untagged traffic.
    – Yanzzee
    Feb 7, 2019 at 21:06
  • 1
    That way all untagged traffic is dropped right away by the switch. Wouldn't that cause some fundamental issues with MST, where BPDUs are exchanged without tags, over the trunk's native VLAN?
    – Marc 'netztier' Luethi
    Feb 7, 2019 at 21:13
  • 1
    With MSTP or RSTP, all BPDUs are untagged. Only with PVST are they tagged which I wouldn't use in a mixed environment. BPDUs work regardless of whether or not an untagged VLAN is present.
    – Zac67 ♦
    Feb 7, 2019 at 21:59
0

Thanks for everyone's help. I consolidated the information in this answer.

Aruba OS allows for no untagged vLAN to be configured on an interface. However, Cisco IOS will default to vLAN 1 if there is no native vLAN configured on the interface. vlan dot1q tag native can be entered on Cisco devices in global config, but this will remove all native vLANs from all trunk interfaces. This is the ideal solution if no trunk interfaces need untagged vLANs.

If configuring individual interfaces on a Cisco switch, an unused vLAN can be used as a "dead end" vLAN. As long as it is not in the vLAN database, it should not forward frames within that vLAN. This may result in native vLAN mismatch errors, but shouldn't generally affect the performance of the interface because all used vLANs are tagged.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.