The old native vlan question....

Topic came up during troubleshooting a 3524XL sw.
I think my understanding of the native vlan concept is wrong.
I thought on a trunk port (Cisco device) that any packet transversing a trunk link (dot1q trunk that is) has a vlan tag applied on the egress port.  As an untagged packet arrives on the port (prior to being sent out over the trunk), its is tagged with the native vlan (if its not assocated with any other vlan), then sent out the (egress) the trunked port. 
But lately I have been reading that
"A native vlan is the untagged vlan on an 802.1q trunked switchport. The native vlan and management vlan could be the same, but it is better security practice that they aren't. Basically if a switch receives untagged frames on a trunkport, they are assumed to be part of the vlan that are designated on the switchport as the native vlan. Frames egressing a switchport on the native vlan are not tagged. This is the definition however more recent switch software often will allow you to tag all of the frames, even those in the native vlan. This gives some added security and allows the CoS bits to be carried between switches even on the native vlan. Let me know if you need further clarification."
From : https://learningnetwork.cisco.com/thread/8721
So this tells me that you can have a packet transversing a dot1q link w/o a vlan tag...then when it arrives on the other end its put in the vlan that is on that native vlan question.  Is this correct?
If so, and a packet can transverse a trunk link w/o a VLAN tag applied, how does a sw detect (ingress) a native vlan mismatch?
Thanks!

Hi,
It's correct, the native vlan is not tagged by default on the trunk link but some platform can make you tag all traffic though even the native vlan.
The native vlan mismatch is detected through cdp.
Regards.
Alain.
Don't forget to rate helpful posts.

Similar Messages

  • Question about the dot1q native vlan

    On a dot1q trunk, the switch can send untagged frames in the native vlan and tagged frames in the other vlans.
    Both end switches know the native vlan id, but firstly, the receiving switch must determine which frame type(tagged or untagged) the frame is.
    The peer switch how to determine that the received framed is tagged or untagged? There are not any bits in the frame header in either frame format(ethernet or dot1q format) indicating that "I" am untagged or tagged.
    In the other word, after a frame is received , how the receiving switch make certain that the two bytes after the "source mac address" in the frame is a "TPID" field (dot1q tag) but not a "Type/Length" field (untaged Ethernet frame ), or vice versa.

    If the frame's Type/Length field value equals 0x8100 the a TPID field will follow.

  • Does the dot1q native VLAN need to be defined on the switch?

    I understand the issues with using VLAN 1 as the native VLAN on a dot1q trunk. I follow best practices and change the native VLAN to a VLAN that does not carry any other traffic (switchport trunk native vlan x). I usually go a step further and do not define the VLAN in the switch configuration. This way if traffic bleeds into the native VLAN because it is untagged then it cannot go anywhere.   So if I use VLAN 999 as the native VLAN, I do not create VLAN 999 on the switch.   I’m curious if anyone else does this or if there are any thoughts on whether this is a good or bad practice? 

    If you are tagging your native VLAN but do not have that VLAN in the vlan database - it makes no difference if the VLAN exists or not in my opinion. All the vlans on your trunks would be tagged anyway.
    It seems like a clever idea, but not sure if it provides any benefit.

  • UCS Native VLAN Question

    All,
    I have a problem that I just cannot wrap my mind around.  We have UCS setup in a lab with 2 interconnects connected to 2 nexus 5510 switches.  The nexus switches are uplinked to the network via a 4900m switch.  All trunks are setup and tested as functional. All routing is setup and confirmed.  I have an issue in UCS that is baffling me.  In the lab I have kept the native VLAN at vlan1.  I have setup test vlans 2-10 on all the switches and interconnects.  I have created a service profile that contains 1 nic and placed it in VLAN 7.  I have installed Windows 2008 on a blade using this service profile.  In the OS I have statically IP'ed the NIC for the scheme used in VLAN 7.  From the OS I cannot ping another device that is in vlan 7.  I also cannot ping a host on another vlan.  If I place a check on VLAN 1 as the native vlan I still cannot ping anything.  If I place the check for native vlan to vlan 7 I can ping hosts within the same vlan as well as outside the vlan.  So, why do I need to place vlan 7 as the native vlan when all my trunks are set up as vlan 1 being the native vlan?
    Thanks for any help,
    Ken

    Ken,
    When allowing certain VLANs on your Service Profile vNICs you need to set the native VLAN. This is because the way you have it configured currently you're only "allowing VLAN 15", but you're not tagging it.   This would work fine for ESX or Linux where you can assign the dot1q tag at the host.  With Windows unless you have specific drivers doing the tagging for you, you'll need to do this at the vNIC level within UCS.
    Two ways to see this in action.  When creating a service profile in the "Basic" method - not "Expert", you will select a single VLAN for your interfaces.  This will treat the interfaces pretty much like an "Access Port".  Conversely when you use the "Expert mode you're enable the vNIC as a trunk, in which you will "allow" all the VLANs you'd like access to. Sounds like this is the method you have performed.
    For a Windows OS, set the VLAN as Native for the VLAN you want it to access and you'll be sweet.  Unchecking that "Native VLAN" option box is allowing the traffic to traverse out of UCS on the Native VLAN of your network - VLAN 1, which is why it's MAC appears on the other fabric under VLAN1
    Regards,
    Robert

  • Switchport trunk native vlan question...

    What am I missing in regards to the following two lines assigned to a sw interface:
    switchport trunk native vlan 80
    switchport mode trunk
    Why assign a VLAN to the port when your trunking it (meaning you allowing all VLANs to pass)?
    Thank you.

    By default native VLAN is VLAN 1, but can be changed to any No. on the trunk port by command "switchport trunk native vlan #". This will make a new vlan# as native & allow all pkts from this vlan to pass thru trunk untagged.
    Native VLANs are used to carry CDP, PAgP & VTP messages. Thus the Frames on native VLAN are untagged. For these messages to propagate between devices, native VLANS must match on both sides of the trunk. In case of native VLAN mismatch on bothsides of the trunk, STP will put the trunk port in err-disabled state.

  • Native VLAN question

    I asked this in another forum, but was hoping for some other explanations...
    switchport mode trunk
    switchport native vlan 80
    switchport trunk allowed vlan 50, 80
    Can someone provide a line by line explanation of whats being done?
    If I understand correctly, the first line lets ALL vlans through this port. The second line lets all untagged traffic that comes from VLAN 80 through. Line three perplexes me, because if we are trunking the port (letting all VLANs through) why explicitly let these two VLANs through when they are already allowed.
    Thank you.

    Hi
    "switchport mode trunk" means configure the link as a trunk link ie. a link that can carry traffic for multiple vlans. By default it will allow all vlans.
    "switchport native vlan 80" means the vlan on the trunnk link that will not be tagged will be vlan 80. So all other vlan traffic is tagged but not this vlan.
    "switchport trunk allowed vlan 50, 80" means only allow vlan 50 and vlan 80 traffic across this link. There a number of reasons you may want to do this. Perhaps at the other end of the link you know that the switch only has ports in vlan 50 and vlan 80 so there is no need to forward traffic for any other vlan. By not allowing those vlans across the trunk you not only stop broadcast traffic from going across the trunk (which can be achieved with the "vtp pruning" command) but you also stop STP for any other vlans than 50 & 80 across the link.
    HTH
    Jon

  • The old Date Timestamp question

    Hi,
    In my prog I store the Date and Timestamp of a test result. I use them to populate a JTree. The JTree is populated according to the date and the timestamp gives me the test time. I have two methods that extract the Date and Timestamp and store them in a HashMap:
    HashMap<Integer,Date>
    HashMap<Integer,Timestamp>
    My problem is that I need to extract the date from the Timestamp in order to populate the tree correctly. Meaning that I want to add a child to a node relevant to its date.
    Example:
    2006-05-05 (Date) 2006-05-05 16:28:09.093(Timestamp)
    2006-06-05 (Date) 2006-06-05 16:44:09.093(Timestamp)
    Would populate the tree:
    2006-05-05
    |-> 6:28:09.093
    2006-06-05
    |->16:44:09.093
    The child nodes arent populated correctly.
    Your help is appreciated

    You may need to remember that the division of a timestamp into date and time is dependant on the time zone, and by default the time zone where you're running the program will be used. (Midnight being at different times in different places).

  • Various questions on uplink profiles, CoS, native VLAN, downlink trunking

    I will be using vPC End Host Mode with MAC-pinning. I see I can further configure MAC-Pinning. Is this required or will it automatically forward packets by just turning it on? Is it also best not to enable failover for the vnics in this configuration? See this text from the Cisco 1000V deployment Guide:
    Fabric Fail-Over Mode
    Within the Cisco UCS M71KR-E, M71KR-Q and M81KR adapter types, the Cisco Unified Computing System can
    enable a fabric failover capability in which loss of connectivity on a path in use will cause remapping of traffic
    through a redundant path within the Cisco Unified Computing System. It is recommended to allow the Cisco Nexus
    1000V redundancy mechanism to provide the redundancy and not to enable fabric fail-over when creating the
    network interfaces within the UCS Service Profiles. Figure 3 shows the dialog box. Make sure the Enable Failover
    checkbox is not checked."
    What is the 1000V redundancy?? I didn't know it has redundancy. Is it the MAC-Pinning set up in the 1000V? Is it Network State Tracking?
    The 1000V has redundancy and we can even pin VLANs to whatever vNIC we want. See Cisco's Best Practices for Nexus 1000V and UCS.
    Nexus1000V management VLAN. Can I use the same VLAN for this and for ESX-management and for Switch management? E.g VLan 3 for everything.
    According to the below text (1000V Deployment Guide), I can have them all in the same vlan:
    There are no best practices that specify whether the VSM
    and the VMware ESX management interface should be on the same VLAN. If the management VLAN for
    network devices is a different VLAN than that used for server management, the VSM management
    interface should be on the management VLAN used for the network devices. Otherwise, the VSM and the
    VMware ESX management interfaces should share the same VLAN.
    I will also be using CoS and Qos to prioritize the traffic. The CoS can either be set in the 1000V (Host control Full) or per virtual adapter (Host control none) in UCS. Since I don't know how to configure CoS on the 1000V, I wonder if I can just set it in UCS (per adapter) as before when using the 1000V, ie. we have 2 choices.
    Yes, you can still manage CoS using QoS on the vnics when using 1000V:
    The recommended action in the Cisco Nexus 1000V Series is to assign a class of service (CoS) of 6 to the VMware service console and VMkernel flows and to honor these QoS markings on the data center switch to which the Cisco UCS 6100 Series Fabric Interconnect connects. Marking of QoS values can be performed on the Cisco Nexus 1000V Series Switch in all cases, or it can be performed on a per-VIF basis on the Cisco UCS M81KR or P81E within the Cisco Unified Computing System with or without the Cisco Nexus 1000V Series Switch.
    Something else: Native VLANs
    Is it important to have the same native VLAN on the UCS and the Cisco switch? And not to use the default native VLAN 1?   I read somewhere that the native VLAN is used for communication between the switches and CDP amongst others. I know the native VLAN is for all untagged traffic. I see many people set the ESXi management VLAN as native also, and in the above article the native VLAN (default 1) is setup. Why? I have been advised to leave out the native VLAN.
    Example:Will I be able to access a VM set with VLAN 0 (native) if the native VLAN is the same in UCS and the Cisco switch (Eg. VLAN 2)? Can I just configure a access port with the same VLAN ID as the native VLAN, i.e 2 and connect to it with a PC using the same IP network address?
    And is it important to trunk this native VLAN? I see in a Netapp Flexpod config they state this: "This configuration also leverages the native VLAN on the trunk ports to discard untagged packets, by setting the native VLAN on the port channel, but not including this VLAN in the allowed VLANs on the port channel". But I don't understand it...
    What about the downlinks from the FI to the chassis. Do you configure this as a port channel also in UCS? Or is this not possible with the setup described here with 1000V and MAC-pinning.
    No, port channel should not be configured when MAC-pinning is configured.
    [Robert] The VSM doesn't participate in STP so it will never send BPDU's.  However, since VMs can act like bridges & routers these days, we advise to add two commands to your upstream VEM uplinks - PortFast and BPDUFilter.  PortFast so the interface is FWD faster (since there's no STP on the VSM anyway) and BPDUFilter to ignore any received BPDU's from VMs.  I prefer to ignore them then using BPDU Gaurd - which will shutdown the interface if BPDU's are received.
    -Are you thinking of the upstream switch here (Nexus, Catalyst) or the N1kV uplink profile config?
    Edit: 26 July 14:23. Found answers to many of my many questions...

    Answers inline.
    Atle Dale wrote:
    Something else: Native VLANsIs it important to have the same native VLAN on the UCS and the Cisco switch? And not to use the default native VLAN 1?   I read somewhere that the native VLAN is used for communication between the switches and CDP amongst others. I know the native VLAN is for all untagged traffic. I see many people set the ESXi management VLAN as native also, and in the above article the native VLAN (default 1) is setup. Why? I have been advised to leave out the native VLAN.[Robert] The native VLAN is assigned per hop.  This means between the 1000v Uplinks port profile and your UCS vNIC definition, the native VLAN should be the same.  If you're not using a native VLAN, the "default" VLAN will be used for control traffic communication.  The native VLAN and default VLAN are not necessarily the same.  Native refers to VLAN traffic without an 802.1q header and can be assigned or not.  A default VLAN is mandatory.  This happens to start as VLAN 1 in UCS but can be changed. The default VLAN will be used for control traffic communication.  If you look at any switch (including the 1000v or Fabric Interconnects) and do a "show int trunk" from the NXOS CLI, you'll see there's always one VLAN allowed on every interface (by default VLAN 1) - This is your default VLAN.Example:Will I be able to access a VM set with VLAN 0 (native) if the native VLAN is the same in UCS and the Cisco switch (Eg. VLAN 2)? Can I just configure a access port with the same VLAN ID as the native VLAN, i.e 2 and connect to it with a PC using the same IP network address?[Robert] There's no VLAN 0.  An access port doesn't use a native VLAN - as its assigned to only to a single VLAN.  A trunk on the other hand carries multiple VLANs and can have a native vlan assigned.  Remember your native vlan usage must be matched between each hop.  Most network admins setup the native vlan to be the same throughout their network for simplicity.  In your example, you wouldn't set your VM's port profile to be in VLAN 0 (doens't exist), but rather VLAN 2 as an access port.  If VLAN 2 also happens to be your Native VLAN northbound of UCS, then you would configured VLAN 2 as the Native VLAN on your UCS ethernet uplinks.  On switch northbound of the UCS Interconnects you'll want to ensure on the receiving trunk interface VLAN 2 is set as the native vlan also.  Summary:1000v - VM vEthernet port profile set as access port VLAN 21000v - Ethernet Uplink Port profile set as trunk with Native VLAN 2UCS - vNIC in Service Profile allowing all required VLANs, and VLAN 2 set as NativeUCS - Uplink Interface(s) or Port Channel set as trunk with VLAN 2 as Native VLANUpstream Switch from UCS - Set as trunk interface with Native VLAN 2From this example, your VM will be reachable on VLAN 2 from any device - assuming you have L3/routing configured correctly also.And is it important to trunk this native VLAN? I see in a Netapp Flexpod config they state this: "This configuration also leverages the native VLAN on the trunk ports to discard untagged packets, by setting the native VLAN on the port channel, but not including this VLAN in the allowed VLANs on the port channel". But I don't understand it...[Robert] This statement recommends "not" to use a native VLAN.  This is a practice by some people.  Rather than using a native VLAN throughout their network, they tag everything.  This doesn't change the operation or reachability of any VLAN or device - it's simply a design descision.  The reason some people opt not to use a native VLAN is that almost all switches use VLAN 1 as the native by default.  So if you're using the native VLAN 1 for management access to all your devices, and someone connects in (without your knowing) another switch and simply plug into it - they'd land on the same VLAN as your management devices and potentially do harm.What about the downlinks from the FI to the chassis. Do you configure this as a port channel also in UCS? Or is this not possible with the setup descrived here with 1000V and MAC-pinning.[Robert] On the first generation hardware (6100 FI and 2104 IOM) port channeling is not possible.  With the latest HW (6200 and 2200) you can create port channels with all the IOM - FI server links.  This is not configurable.  You either tell the system to use Port Channel or Individual Links.  The major bonus of using a Port Channel is losing a link doesn't impact any pinned interfaces - as it would with individual server interfaces.  To fix a failed link when configured as "Individual" you must re-ack the Chassis to re-pinn the virtual interfaces to the remaining server uplinks.  In regards to 1000v uplinks - the only supported port channeling method is "Mac Pinning".  This is because you can't port channel physical interfaces going to separate Fabrics (one to A and one to B).  Mac Pinning gets around this by using pinning so all uplinks can be utilized at the same time.--[Robert] The VSM doesn't participate in STP so it will never send BPDU's.  However, since VMs can act like bridges & routers these days, we advise to add two commands to your upstream VEM uplinks - PortFast and BPDUFilter.  PortFast so the interface is FWD faster (since there's no STP on the VSM anyway) and BPDUFilter to ignore any received BPDU's from VMs.  I prefer to ignore them then using BPDU Gaurd - which will shutdown the interface if BPDU's are received.-Are you thinking of the upstream switch here (Nexus, Catalyst) or the N1kV uplink profile config?[Robert] The two STP commands would be used only when the VEM (ESX host) is directly connected to an upstream switch.  For UCS these two commands to NOT apply.

  • SG500 auto voice VLAN question about native VLAN

    I have been installing SG300 and SG500 switches and using the auto voice vlan feature by simply changing voice vlan to 100 and using vlan 1 for default and data.  I normally put the switch in L3 mode and make an access porteach for my IP PBX (vlan 100)  and one to connect to existing data network (vlan 1). Then I make a static route in customers default gateway to route back to vlan 100 and everything works nicely for most installs. 
    On my last install I decided to try to change the default vlan 1 to vlan 10 and go with 10 for data and 100 for voice.  The problem I ran into was that the auto generated config on my phone switchports still use vlan 1 as native vlan.  I am trying to find a way to still use auto vlan and get the desired native vlan without having to make manual config changes.
    Should this be possible?
    Thanks in advance.

    Hi Brandon, you need to modify the macro from native vlan 1 to vlan 10.
    Check out this topic how to modify the macro
    https://supportforums.cisco.com/thread/2177613
    -Tom
    Please mark answered for helpful posts

  • Native VLAN 1

    I'm in the process of setting up UCS.  The default native vlan has a vlan ID of 1 in UCS.  Our native vlan is 1000.  So I setup a new vlan with the vlan ID of 1000 and set it as the natvie VLAN.  I cannot delete the VLAN default (1) even though it isn't the native vlan anymore because UCS won't let me.  We use VLAN id 1 for some of our corporate servers so I can't create a vlan with that ID without an overlap.  Since it's not being used as the native vlan anymore can I go ahead and use VLAN default (1) or is there some issue with me using that vlan?
    Additionally, one other question in regard to the natvie vlan.  I setup another UCS environment and have a few ESXi servers running on it with some active vm's.  When I setup UCS I added a vlan for our companines native vlan (vlan id 1000), but I forgot to set it as the Native VLAN.  So VLAN default (1) is still listed as the Native VLAN.  What implications would there be if I changed the Native VLAN to the vlan I setup (vlan id 1000) while there are running ESXi servers and virtual machines.  Neither the ESXi servers or vm's are using either on of those vlan's in service profiles and vnic templates.

    Russ,
    VLAN 1 can't be pruned from your uplinks it's one of those caveats.  We strongly discourage the use of VLAN 1 anywhere in your network as it presents a security risk.  (Since VLAN 1 exists on every switch by default, its hard to block access to devices using that VLAN).
    You can still use VLAN 1 even if it's not set as the native - no problem there.  Just take note that VLAN is not elgible for Disjoint L2 configuration and will always be allowed on all uplinks.  If you don't have any disjoint L2 networks - then its no problem for you.
    When you talk about the Native VLAN be careful.  If things are working as they are with VLAN 1 as the native vlan, changing it could impact your hosts if they need to communicate to other northbound devices.  I really try to caution people against using Native VLANs at all.  You're blindly sending untagged packets, and relying on the upstream L2 device to decide which VLAN to put the traffic onto.  Native VLANs can change from hop to hop also so it opens up the door for VLAN mis-matching.   You're far better off to TAG EVERYTHING - so there's no concern of native VLANs getting mixed up anywhere. 
    Regards,
    Robert

  • UCS native vlan

    Hi,  Can anyone explain how native vlan configuration should be used in UCS? when creating vnic, and checking "trunk", you then select the vlans to be allowed in the trunk, there is also a native vlan radio button beside each vlan. If the Cat 6509 uplink switch is connected to Fabric Interconnect using normal trunk configuration as follows:  interface ten5/2 switchport switchport trunk encap dot1q switchport mode trunk  with the above config on the Cat6509, assuming default vlan 1 is the native vlan, does that mean that i have to check the native VLAN 1 when configuring the vNIC?  Thanks Eng Wee

    Hi folks,
    Although an old post, still an upto date issue!  I've just got round it in my implementation!
    Was looking at all sorts of places, but need to ensure that not only is your native vlan set at your switch end (connecting to the FIs) to the iSCSI vlan, also on your relevant vNICs in your service profiles, AND AND AND, needs to be set as the system native VLAN in the LAN tab.
    Also to note, you don't need native vlan set the same on other links, so if your storage links 'tag' the iSCSI vlan that will be fine.
    Hope this helps.
    Rgds
    Dominic

  • SG500 LACP trunk mismatch native vlan on individual ports

    Hi All,
    I have just configured up a sg500 with a lacp trunk to an upstream switch.
    I am getting native vlan mismatch on the individual ports of the lacp team.
    24-Jan-2013 12:54:48 %CDP-W-NATIVE_VLAN_MISMATCH: Native VLAN mismatch detected on interface gi1/1/24.
    24-Jan-2013 12:57:35 %CDP-W-NATIVE_VLAN_MISMATCH: Native VLAN mismatch detected on interface gi1/1/48.
    The following is showing the correct native vlan
    BH-WS-AC-2#show int switchport port 1
    Port : Po1
    Port Mode: Trunk
    Gvrp Status: disabled
    Ingress Filtering: true
    Acceptable Frame Type: admitAll
    Ingress UnTagged VLAN ( NATIVE ): 2000
    Port is member in:
    Vlan               Name               Egress rule Port Membership Type
    1200               1200                 Tagged           Static       
    1210            Management              Tagged           Static       
    1212               1212                 Tagged           Static       
    2000           Native Vlan             Untagged          Static      
    But the following shows that the individual ports think they are the default vlan 1.
    BH-WS-AC-2#show int switchport gi1/1/48
    Port : gi1/1/48
    Port Mode: Trunk
    Gvrp Status: disabled
    Ingress Filtering: true
    Acceptable Frame Type: admitAll
    Ingress UnTagged VLAN ( NATIVE ): 1
    Port is member in:
    Vlan               Name               Egress rule Port Membership Type
    The following shows the LACP as up:
    BH-WS-AC-2#show int Port-Channel 1
    Load balancing: src-dst-mac-ip.
    Gathering information...
    Channel  Ports
    Po1      Active: gi1/1/24,gi1/1/48
    Is this normal behaviour? as i cannot set the native vlan directly on the gi interface due to it being in the trunk.
    Simon

    Hi Simon, native vlan mismatch is a cosmetic error from CDP. It won't affect services provided the vlans are a member of the ports in question.
    You can set the native vlan while it is within the lag. On the SX500 it would be
    config t
    int po1
    switchport trunk native vlan xxxx
    The port channel is the same as any other individual port so it's not a problem. 802.1q specifies the native vlan is the untagged member, if you want to get rid of the error, make sure the untagged vlans match up on both sides.
    -Tom
    Please mark answered for helpful posts

  • Native VLAN on Cisco Switches

    I have a question regarding the default native  vlan, I have a cisco based environment and I set vlan XXX on a native on  trunk links, I also running Multiple Spanning Tree on my switches &  create instances for vlan segregation.
    My question is here could I put vlan 1 (default) in any of instance or not?
    Thanks & Regards,

    With MST, it is not running per VLAN spanning tree, it sends all BPDUs via instance 0 which is called the CIST. These frames are sent untagged via the native VLAN. Normally this is VLAN 1 but if you change it to another VLAN then the BPDUs are sent untagged on that native VLAN.
    Regarding if to use instance 0 or not, it is often recommended to create as many instances as you need to create the desired topology (usually two) and put your VLANs in those instances. It's a good pratice to map all your VLANs straight away because changing the instance to VLAN mapping makes the MST region become multi region until they all have the same instance to VLAN mapping.
    I would keep all VLANs out of instance 0 but it's definitely possible to have VLANs mapped in instance 0 as well.
    Daniel Dib
    CCIE #37149
    Please rate helpful posts.

  • VLAN trunking, native vlan and management vlan

    Hello all,
    In our situation, we have 3 separate vlans: 100 for management vlan and 101 for data and 102 for voice.
    We have an uplink which is trunked using .1Q. Our access ports has the data vlan as the native. Based on our design, what should be the native vlan for this uplink trunk? Should it be the management vlan or the data vlan? Thanks for your help.

    To answer this question you must remember what the native vlan is. Native is where untagged packets are sent, i.e. packets without a dot1Q tag. It is there mainly for compatibility. On an access port it has no function while normal traffic is not tagged and sent to the vlan that is configured for the port. Traffic for the voice vlan is an exception to this general rule.
    Native vlan setting only plays a role on trunk links where most of the traffic carries a tag. As explained, it is then used as the vlan for untagged traffic.
    When you do not consider this a security breach, you may configure the data-vlan as native. Use another vlan (why not vlan1?) in the case where you want to isolate this traffic.
    I find it good design practice to use the same native vlan throughout the network. This keeps things clear and it's better for anyone who is not completely obsessed with security. The latter kind of people can always find a reason to mess things up, both for themselves and for others;-)
    Regards,
    Leo

  • 1410 native vlan Change

    I need to use vlans in a 1410 bridge environment an i need to change the default native vlan too. The question is: what happens to the BVI1 interface, since this one is associated with the native vlan?; is it automatically associated with the new native vlan?, will i need to create a new interface?, what about the connectivity? (this radio does not have a console port). I wolud like to make all changes via CLI.

    You can configure multiple VLANs on the Wireless bridge using the GUI, you do not need CLI or console access to configure VLANs. Here is a good document which explains how to configure VLANs on Bridges.
    http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_example09186a00801d0815.shtml#vlanbr

Maybe you are looking for