Lab Objective:
Learn how to change the native VLAN.
Lab Purpose:
The native VLAN is simply the default VLAN all ports are in on the switch. Frames in the native VLAN are untagged by default and represent a security vulnerability. It’s an important security step to change this default behaviour. Native VLAN numbers must match on both sides of a trunk link.
Lab Tool:
Packet Tracer
Lab Topology:
Please use the following topology to complete this lab exercise:
Lab Walkthrough:
Task 1:
Drag two switches onto the canvas and connect them via a crossover cable.
Task 2:
Configure one side as a trunk link and it will create a trunk between the switches.
Switch>en
Switch#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#hostname SW0
SW0(config)#int f0/1
SW0(config-if)#switchport mode trunk
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up
Task 3:
Check the layer 2 status of the port. Note the fact that it is now a trunk and is using VLAN1 as the native VLAN. Check this output on SW1 also. Do you notice any differences with the modes (because it hasn’t been hard-set to trunk)?
SW0#show interface f0/1 switchport
Name: Fa0/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Task 4:
Create VLAN10 and then change the native VLAN. You should see errors right away because Switch1 still uses VLAN1 as the native VLAN.
SW0(config)#vlan 10
SW0(config-vlan)#exit
SW0(config)#interface f0/1
SW0(config-if)#switchport trunk native vlan ?
<1-4094> VLAN ID of the native VLAN when this port is in trunking mode
SW0(config-if)#switchport trunk native vlan 10
SW0(config-if)#end
SW0#
%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on FastEthernet0/1 (10), with Switch FastEthernet0/1 (1).
Task 5:
Check the layer 2 configurations on F0/1 for Switch0.
SW0#show int f0/1 switchport
Name: Fa0/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 10 (VLAN0010)
Voice VLAN: none
Task 6:
Configure VLAN10 on Switch1 and set F0/1 as the native VLAN.
Switch>
Switch>en
Switch#conf t
Switch(config)#hostname SW1
SW1(config)#vlan 10
SW1(config-vlan)#int f0/1
SW1(config-if)#switchport trunk native vlan 10
SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking FastEthernet0/1 on VLAN0010. Port consistency restored.
Notes:
This is yet another important security step. You would usually use a high number for the VLAN and one that is unused by hosts. You can also check the native VLAN with the show interfaces trunk command.
SW0#show interfaces trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1-1005
Port Vlans allowed and active in management domain
Fa0/1 1
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 none
