Interface ConfigDomain 2.0

switchport trunk native vlan [vlan-id]

Reassigns the native VLAN on an 802.1Q trunk link. Unlike standard VLAN traffic which receives a 4-byte 802.1Q tag across a trunk, the Native VLAN is explicitly designed to carry untagged frames to maintain backward compatibility with legacy hubs and unmanaged switches.

Quick Reference

Execution ModeSwitch(config-if)#

Prerequisite Modeswitchport mode trunk

Default Factory ValueVLAN 1

Negation Commandno switchport trunk native vlan

Syntax & Parameters

switchport trunk native vlan [vlan-id]

Parameter	Description & Best Practices
[vlan-id]	The VLAN designated to handle untagged traffic crossing this specific link. • Best Practice: Change this to an unused "dead" VLAN (e.g., VLAN 999) that is completely isolated from user data. • Both ends of the physical cable must agree on this ID, or the connection will experience severe spanning-tree issues.

CLI Deployment Scenarios

Scenario 1: Securing the Trunk Link

You are establishing a trunk between two switches and must comply with security policies to move untagged traffic off the default management VLAN (1).

Switch(config)# vlan 999

Switch(config-vlan)# name BLACKHOLE_NATIVE

Switch(config-vlan)# exit

Switch(config)# interface g0/1

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport trunk native vlan 999

Scenario 2: The CDP Mismatch Warning

You configure the Native VLAN on Switch A to 999, but forget to configure Switch B. Cisco Discovery Protocol (CDP) will immediately flood your terminal with syslog warnings.

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet0/1 (999), with Switch-B GigabitEthernet0/1 (1).

! Spanning-tree will block traffic on these specific VLANs until you correct the configuration on Switch-B.

CCNA Exam Gotchas

[!]

Double-Tagging (VLAN Hopping) Mitigation

A common exam question asks how to prevent a "Double-Tagging" VLAN Hopping attack. In this attack, a hacker on an access port matching the Native VLAN sends a frame with two 802.1Q tags. When the switch strips the first tag (because it's the Native VLAN), the hidden second tag slips across the trunk. The solution: Change the Native VLAN to an unused ID (e.g., 999) that no access ports are assigned to.

[!]

The Mismatch Traffic Penalty

If the CCNA asks what happens during a Native VLAN mismatch: Most tagged traffic will continue to flow perfectly fine. However, any untagged traffic will leak between the two mismatched VLANs, causing Spanning Tree Protocol (STP) to detect a loop and block those specific VLANs on that port (resulting in a "PVID inconsistent" state).