2

I'm taking a course on the CCNA and when learning about VLAN tagging, I came across this: "If an 802.1Q trunk port receives a tagged frame with the VLAN ID that is the same as the native VLAN, it drops the frame."

Is it dropping the frame because the frame is trying to leave the VLAN?

2 Answers 2

1

While the IEEE 802.1Q standard doesn't mandate this behavior (afaik), what you describe is the most common implementation: when a single, "native" VLAN remains untagged on a VLAN trunk, tagged frames with that VLAN ID are not accepted. Other vendors may see it differently though.

Best practice is to tag all frames on a VLAN trunk and not to use a native VLAN.

Is it dropping the frame because the frame is trying to leave the VLAN?

The frame doesn't try to leave its VLAN - the VLANs allowed on a trunk should always be explicitly configured. Frames tagged for disallowed VLANs are dropped, but frames tagged for the native VLAN may be considered malformed and those are also dropped.

A likely purpose for this behavior is consistency: to avoid a mix of tagged and untagged frames belonging to the same VLAN, possibly tagged in one and untagged in the opposite direction.

2

That could be an attempt at a VLAN-hopping attack, where a switch interface (in this case a trunk interface, but it could also happen on an access interface) is used to strip off the tag for the native VLAN, and that would expose a second tag that the attacker placed in the frame to gain access to a VLAN where the attacker should not have access. The modified frame would then be inside the switch and could be forwarded to a trunk where it would now have a tag putting it in a different VLAN.

There were several adjustments made to the way switches handle VLAN tags to mitigate such layer-2 attacks. Cisco Press has an entire book about various layer-2 and switching attacks and how to mitigate them.

Cisco also has a command (vlan dot1q tag native) that tags frames of the native VLAN on the trunk interface, and it drops untagged frames (except those of link protocols, e.g. CDP, that are sent to the special link protocol multicast addresses). In effect, it eliminates a true native VLAN, requiring tags in all VLAN frames.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.