What Is the Native VLAN?
The native VLAN is the one VLAN on an 802.1Q trunk whose traffic is sent untagged. Every trunk has exactly one, it defaults to VLAN 1, and it must match on both ends of the trunk or traffic leaks between VLANs.
Why untagged traffic exists
On a trunk, frames normally carry an 802.1Q VLAN tag. The native VLAN is the exception — its frames travel with no tag, originally for backward compatibility. When a switch receives an untagged frame on a trunk, it assumes the native VLAN. See access vs trunk ports.
The security risk: VLAN hopping
If an attacker sends double-tagged frames, they can exploit the native VLAN to hop into another VLAN (a double-tagging attack). Two best practices defend against it: change the native VLAN away from VLAN 1 to an unused VLAN, and never put user devices on VLAN 1.
Native VLAN mismatch
If the two ends of a trunk disagree on the native VLAN, traffic from one native VLAN lands in another — a common misconfiguration CDP will warn you about. Match them on both sides.
Frequently asked questions
What is the native VLAN?
The native VLAN is the single VLAN on an 802.1Q trunk whose traffic is sent untagged. It defaults to VLAN 1 and must match on both ends of the trunk.
Why change the native VLAN from VLAN 1?
To defend against VLAN-hopping (double-tagging) attacks and follow best practice of not using default VLAN 1 for real traffic.
What happens with a native VLAN mismatch?
If the two trunk ends use different native VLANs, untagged traffic is placed into the wrong VLAN, causing connectivity and security problems. CDP flags this mismatch.
Is the native VLAN tagged?
No — by definition its frames are sent untagged. You can force tagging of the native VLAN as a hardening measure.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.