Native VLAN Mismatch (%CDP-4-NATIVE_VLAN_MISMATCH)
A native VLAN mismatch means the two ends of an 802.1Q trunk disagree about which VLAN travels untagged. Traffic from one VLAN silently leaks into another — a real security risk (VLAN hopping) as well as a connectivity fault. CDP detects it and warns, but cannot fix it.
What you see
%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet0/1 (2), with SW2 GigabitEthernet0/1 (1).
Why it happens
On an 802.1Q trunk, one VLAN is carried without a tag — the native VLAN. Both switches must agree which VLAN that is. If SW1 says VLAN 2 and SW2 says VLAN 1, then untagged frames leaving SW1 as VLAN 2 arrive at SW2 and are placed into VLAN 1.
The result is two VLANs silently bridged together. Hosts that should be isolated can reach each other, broadcast domains merge, and STP can behave unexpectedly. Because the frames are untagged, no error is raised by the data plane at all — only CDP notices, by comparing the two ends.
How to confirm it
show interfaces GigabitEthernet0/1 switchport | include Native show cdp neighbors detail | include Native|Device show interfaces trunk
show interfaces trunk lists the native VLAN per port. Run it on both switches and compare — they must be identical.
The fix
! Set the SAME native VLAN on both ends interface GigabitEthernet0/1 switchport trunk native vlan 999 ! ! Better: force every VLAN to be tagged, including the native vlan dot1q tag native
Best practice is to use a dedicated, unused VLAN (e.g. 999) as native and put no hosts in it. Tagging the native VLAN removes the untagged path entirely and closes the VLAN-hopping vector.
How to stop it happening again
Standardise one native VLAN number across the whole estate, never VLAN 1, and never carry user traffic in it.
Questions people ask
Is a native VLAN mismatch a security problem?
Yes. It bridges two VLANs together without any tagging, which defeats the isolation VLANs exist to provide and enables VLAN hopping. Treat it as a security incident, not just a config typo.
Why does the network still mostly work?
Because untagged frames are still delivered — just into the wrong VLAN. That is precisely what makes it dangerous: connectivity looks fine while isolation is silently broken.
Related reading
What Is A Native VlanVlans Trunking ExplainedVlan Hopping AttackHow To Configure A Trunk Port
Reading the fix is not the same as doing it
Every fault on this page can be broken and repaired on real Cisco routers and switches in our Ahmedabad lab — which is how it stops being theory. Come and see the rack before you pay anything.