The Native VLAN: Mismatch, Double Tagging, Hardening

Which VLAN owns a frame with no tag?

A trunk is a link that carries several VLANs. A VLAN separates Ethernet forwarding into a local broadcast domain. A tag on a normal tagged data frame identifies its VLAN, but an untagged frame has no VLAN identifier for the receiver to read.

The native VLAN is the receiving trunk's configured group for ordinary untagged data in the conventional Cisco design. On transmission, that same VLAN normally uses untagged data frames unless native tagging is enabled. A VLAN can therefore belong to a switch's forwarding context without a tag on this particular cable.

For untagged data, the receiving port supplies the VLAN classification. The sender's intended VLAN is not written in the frame. This is why a native mismatch can break isolation even when the cable and trunk are up.

How a trunk treats untagged frames

With default native-tagging behaviour, an 802.1Q trunk tags data for every carried VLAN except one: the native VLAN. Its frames cross the trunk with no tag at all. Two rules define it:

How a trunk treats untagged frames

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each item on the left, with what it means on the right.

Why it exists: 802.1Q was designed so a trunk could still carry traffic from devices that don't understand tags. One VLAN had to be the "home" for untagged frames, and that's the native VLAN.

A VLAN 10 frame and a VLAN 1 frame on one trunk

Situation: both switches use the default native VLAN 1. A VLAN 10 frame and a VLAN 1 frame cross the same trunk:

Use PC A 192.168.10.11/24 and PC C 192.168.10.13/24 in VLAN 10. PC B 192.168.1.12/24 and PC D 192.168.1.14/24 are in VLAN 1. Each pair exchanges local data; no router is needed for these pairs. SW1 Gi1/0/23 connects SW2 Gi1/0/24. These are interface names, not application port numbers. Both VLANs exist and are allowed, active and forwarding.

Device key: SW1 · native 1, SW2 · native 1 (switch) · PC A, PC C (laptop) · PC B, PC D (computer)

Lines show the example’s network connections. Thick links: uplinks/WAN, as labelled. The coloured path and envelope follow the current step; its text identifies the sender, receiver and traffic type.

1. Normal VLAN: PC A's frame is tagged VLAN 10 on the trunk, as usual.
2. Native VLAN frame: PC B is in VLAN 1, which is the native VLAN.
3. Crosses untagged. SW1 sends it across the trunk with no 802.1Q tag, because VLAN 1 is native.
4. Placed in SW2's native VLAN. SW2 sees no tag, so it puts the frame into its own native VLAN (1) and delivers it to PC D. It works because both ends agree.

VLAN 10 carries a tag on this trunk; native VLAN 1 does not. Both receiving switches apply the same classification.

The key point: an untagged frame carries no VLAN information at all. The receiving switch simply assumes it belongs to its own native VLAN. That assumption is what makes a mismatch dangerous.

Native VLAN 1 on one end, 99 on the other

Situation: SW1 still uses native VLAN 1, but someone changed SW2 to native VLAN 99. Follow a broadcast from PC B in VLAN 1, so the example tests which local group receives it rather than assuming an unrelated host accepts a unicast frame.

Device key: SW1 · native 1, SW2 · native 99 (switch) · PC B, PC D (computer) · PC X (laptop)

1. Sent untagged. PC B's VLAN 1 broadcast crosses untagged, because VLAN 1 is SW1's native VLAN.
2. Lands in the wrong VLAN. If the port is forwarding, SW2 classifies the untagged frame into VLAN 99 instead of VLAN 1. Spanning-tree inconsistency protection may prevent this forwarding.
3. Spanning tree reacts. PVST+ or Rapid PVST+ may detect a PVID inconsistency and block affected VLANs. Check the actual spanning-tree state rather than assuming the whole trunk is blocked.

The mismatch changes classification of untagged data if forwarding is permitted. Protection can block affected VLANs; inspect the actual state.

Why it happens: neither switch can tell from the frame itself which VLAN it came from. Each end applies its own native setting, so untagged traffic can be classified into a different VLAN if the path is forwarding. CDP can warn of a mismatch; PVST+ or Rapid PVST+ can detect inconsistencies and block affected VLANs.

CDP (Cisco Discovery Protocol) can report the peer's native VLAN. PVST+ (Per-VLAN Spanning Tree Plus) and Rapid PVST+ are loop-prevention protocols with checks for inconsistent VLAN information. A log containing PVID refers to the Port VLAN Identifier, the port's classification for ordinary untagged ingress. A warning identifies a configuration discrepancy; it does not by itself show every VLAN's forwarding state.

The security angle: VLAN hopping by double tagging

Situation: an attacker's laptop is in VLAN 1, and VLAN 1 is also the trunk's native VLAN. The attacker wants to reach a server in VLAN 20.

Device key: Attacker (laptop) · SW1, SW2 (switch)

1. Two tags. The attacker crafts a frame with an outer tag 1 and an inner tag 20.
2. Outer tag stripped. SW1 removes the outer tag (VLAN 1 is native, so it's sent untagged), leaving the hidden tag 20 exposed on the trunk.
3. Delivered into VLAN 20. SW2 reads tag 20 and delivers the frame to the server. The classic example demonstrates one-way injection, not a normal bidirectional routed connection. Actual susceptibility depends on the switch and configuration.

A conceptual double-tagging case, conditional on accepting the crafted frame and the illustrated native-tag handling. It is not a normal two-way routed connection.

Why it works: the classic example depends on native-VLAN tag handling, the attacker sharing that VLAN and the switches accepting the crafted frame. Keep users off the native VLAN and follow your platform's VLAN-hopping protections.

Keeping the native VLAN harmless

Use a dedicated unused VLAN as native (VLAN 99 in this lesson) and keep ordinary user access ports out of it.
Configure the same native VLAN on both ends of every trunk.
Keep it separate from the management VLAN and from VLAN 1.
Consider native data tagging where both devices support it. It does not mean every link-control frame becomes tagged.
Turn off trunk negotiation on user ports (switchport mode access and switchport nonegotiate), so a device can't talk a port into becoming a trunk.

Moving the native VLAN to 99

These commands start in global configuration mode. Creating VLAN 99 and selecting it as native are separate actions. The change below does not set an allowed list, create a gateway or move user ports. Compare both ends first and plan the change together; changing a live management path at one end can interrupt your session.

vlan 99
 name NATIVE
interface GigabitEthernet1/0/23
 switchport mode trunk
 switchport trunk native vlan 99
 switchport nonegotiate

Same native VLAN on the other end of the link. nonegotiate turns off DTP on the trunk.

vlan dot1q tag native

Optional global change on supported platforms. It tags native data and can drop untagged data received on trunks. Confirm the peer settings and platform behaviour before enabling it.

For the untagged-native design below, the router must agree with the switch. If native data is tagged instead, use the matching tagged encapsulation design on the router; do not combine these two examples without checking both ends.

interface GigabitEthernet0/0.99
 encapsulation dot1Q 99 native

The router treats untagged frames on Gi0/0 as VLAN 99, matching the switch.

Confirming both ends agree

Illustrative Cisco Catalyst IOS XE output, shortened and written for this lesson

SW1#show interfaces GigabitEthernet1/0/23 switchport
Name: Gi1/0/23
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 99 (NATIVE)
...

Trunking Native Mode VLAN: 99 is this end's native VLAN; compare it with the other switch. Negotiation of Trunking: Off confirms DTP is disabled. The quick check across all trunks is the Native vlan column of show interfaces trunk.

If the two ends don't match, these log messages are the giveaway:

Illustrative Cisco mismatch log messages, written for this lesson; exact messages vary by platform

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/0/23 (1), with SW2 GigabitEthernet1/0/24 (99).
%SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan id 99 on GigabitEthernet1/0/23 VLAN1.
%SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet1/0/23 on VLAN0001. Inconsistent local vlan.

The CDP message names both ends and their native VLANs. The spanning-tree messages show the port being blocked for the affected VLAN until the native VLANs match.

Short lab: find the mismatch and recover

In an isolated two-switch lab, start with native VLAN 1 at both ends, native tagging off and the illustrated user VLANs active. Confirm both trunk ports with show interfaces trunk. Test the two host pairs before creating a fault.
Create VLAN 99 on SW2, then change only SW2 Gi1/0/24 to native 99. Compare both trunk outputs and inspect show spanning-tree inconsistentports where supported. A failed user test may result from misclassification or protective blocking; do not assume all tagged VLANs stopped.
For this fault exercise, recover by restoring SW2 Gi1/0/24 with switchport trunk native vlan 1 from interface configuration mode. This returns the original baseline; it is not the final hardening design.
Verify matching native values, examine affected STP state and repeat both host tests. Do not disable spanning tree or clear logs as a substitute for repairing the configuration.

Native VLAN quiz

Predict · scenario 1

A trunk uses native VLAN 99 on both ends, native tagging is disabled and VLAN 99 is allowed and forwarding. How is a VLAN 99 data frame sent?

Predict · scenario 2

SW1's trunk has native VLAN 10, SW2's end has native VLAN 20. A VLAN 10 user on SW1 sends a broadcast. If spanning tree does not block the port, where does it end up on SW2?

Predict · scenario 3

Which change stops the double-tagging attack shown above?

Cisco reference

Cisco: native tagging command reference