In which configuration mode is switchport trunk native vlan [id] used?

The switchport trunk native vlan [id] command is entered in Interface Config mode on Cisco IOS devices.

VLANInterface Config

switchport trunk native vlan [id]

Configures the native VLAN for an 802.1Q trunk interface, specifying which VLAN's frames are sent untagged on the trunk.

Definition: switchport trunk native vlan [id] is a Cisco IOS interface config command. Configures the native VLAN for an 802.1Q trunk interface, specifying which VLAN's frames are sent untagged on the trunk.

Overview

The `switchport trunk native vlan [id]` command is a critical configuration for 802.1Q trunk links on Cisco switches. It defines which VLAN is the native VLAN on a trunk interface. In 802.1Q trunking, frames from the native VLAN are transmitted untagged (without a VLAN header), while frames from all other VLANs are tagged.

This command allows you to change the default native VLAN (VLAN 1) to a different VLAN for security or operational reasons. The concept of a native VLAN is unique to 802.1Q and is essential for interoperability with devices that do not understand trunking, such as older hubs or switches that expect untagged frames. By default, all trunk ports use VLAN 1 as the native VLAN, but best practices recommend changing it to an unused VLAN to prevent VLAN hopping attacks and reduce the risk of misconfiguration.

This command is used when you need to ensure that untagged traffic on a trunk is associated with a specific VLAN, typically for management traffic or when connecting to devices that cannot tag frames. It fits into the broader workflow of trunk configuration, which includes setting the trunk encapsulation, allowed VLAN list, and pruning. When troubleshooting, verifying the native VLAN mismatch is a common step, as mismatched native VLANs can cause connectivity issues or even merge VLANs unintentionally.

The command takes effect immediately and is saved to the running configuration; it requires interface configuration mode and has no special privilege level beyond what is needed for interface configuration. Understanding this command is fundamental for CCNA and CCNP candidates as it appears in both exam topics and real-world network design.

Syntax·Interface Config

switchport trunk native vlan [id]

When to Use This Command

Setting the native VLAN to a non-default VLAN (e.g., VLAN 99) for management traffic to avoid VLAN 1 security risks.
Aligning native VLANs on both ends of a trunk to prevent VLAN mismatch errors and ensure proper communication.
Configuring a trunk port to carry untagged traffic for a specific VLAN, such as VoIP or legacy devices that do not support tagging.
Changing the native VLAN during network migration to match a new VLAN design without disrupting existing trunk links.

Parameters

Parameter	Syntax	Required	Description
id	<1-4094>	Required	Specifies the VLAN number to be used as the native VLAN on the trunk. Valid values are from 1 to 4094, excluding reserved VLANs (0, 4095). Common mistakes include using VLAN 1 (the default) without considering security implications, or using a VLAN that is not created on the switch. Ensure the VLAN exists in the VLAN database; otherwise, the command is accepted but the interface may not function correctly.

Command Examples

Set native VLAN to 99 on trunk interface

Switch(config-if)# switchport trunk native vlan 99

This command sets the native VLAN to 99 on the current trunk interface. No output is displayed upon successful configuration.

Verify native VLAN configuration

Switch# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1       on           802.1q         trunking      99

Port        Vlans allowed on trunk
Gi0/1       1-1005

Port        Vlans allowed and active in management domain
Gi0/1       1,10,20,99

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       1,10,20,99

The 'show interfaces trunk' output displays trunk details. The 'Native vlan' column shows the configured native VLAN (99). The allowed VLAN list includes VLAN 99. Ensure the native VLAN matches on both ends of the trunk.

Understanding the Output

The command itself produces no output. To verify, use 'show interfaces trunk'. The 'Native vlan' column indicates the VLAN that is untagged on the trunk.

A mismatch between ends causes the port to be err-disabled or connectivity issues. The allowed VLAN list should include the native VLAN. The spanning tree forwarding state shows which VLANs are active.

A good configuration has matching native VLANs on both sides and the native VLAN included in the allowed list.

Configuration Scenarios

Changing the Native VLAN to an Unused VLAN for Security

A network administrator wants to secure a trunk link between two switches by changing the native VLAN from the default VLAN 1 to an unused VLAN (e.g., VLAN 999) to prevent VLAN hopping attacks and reduce the risk of accidental misconfiguration.

Topology

SW1(Gi0/1)---Trunk---(Gi0/1)SW2

Steps

1.Step 1: Access global configuration mode on SW1: SW1> enable
2.Step 2: Enter interface configuration mode for the trunk port: SW1# configure terminal
3.Step 3: Configure the interface as a trunk: SW1(config)# interface GigabitEthernet0/1
4.Step 4: Set the native VLAN to 999: SW1(config-if)# switchport mode trunk
5.Step 5: Repeat steps on SW2 with the same native VLAN: SW1(config-if)# switchport trunk native vlan 999
6.Step 6: Verify the configuration: SW1(config-if)# end

Configuration

! SW1 Configuration
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
! SW2 Configuration
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999

Verify: Use 'show interfaces trunk' to verify the native VLAN is set to 999. Expected output includes 'Native VLAN: 999' for the trunk port.

Watch out: Both ends of the trunk must have the same native VLAN; otherwise, the trunk will not form correctly, and you may see 'native VLAN mismatch' errors in logs.

Configuring Native VLAN for Management Traffic on a Trunk

An organization uses VLAN 10 for management traffic and wants all management frames to be untagged on a trunk link connecting to a router that does not support 802.1Q tagging for its management interface.

Topology

SW1(Gi0/1)---Trunk---(Gi0/0)R1

Steps

1.Step 1: Access global configuration mode on SW1: SW1> enable
2.Step 2: Enter interface configuration mode: SW1# configure terminal
3.Step 3: Configure the interface as a trunk: SW1(config)# interface GigabitEthernet0/1
4.Step 4: Set the native VLAN to 10: SW1(config-if)# switchport mode trunk
5.Step 5: On R1, configure the subinterface for VLAN 10 and ensure the main interface is not tagging: SW1(config-if)# switchport trunk native vlan 10
6.Step 6: Verify the configuration: SW1(config-if)# end

Configuration

! SW1 Configuration
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 10
! R1 Configuration
interface GigabitEthernet0/0
 no ip address
! Subinterface for VLAN 10
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10 native
 ip address 192.168.10.1 255.255.255.0

Verify: On SW1, use 'show interfaces trunk' to confirm native VLAN is 10. On R1, use 'show ip interface brief' to verify the subinterface is up/up.

Watch out: On the router, the subinterface must use the 'native' keyword in the encapsulation command to match the switch's native VLAN; otherwise, the router will drop untagged frames.

Troubleshooting with This Command

When troubleshooting trunk links, the native VLAN configuration is a common source of issues. A healthy trunk will show the same native VLAN on both ends, as verified by 'show interfaces trunk'. The output lists the trunk ports, their mode (trunk), encapsulation (802.1q), and the native VLAN.

If the native VLAN mismatches, the trunk may still come up but will generate 'native VLAN mismatch' syslog messages, and traffic from the native VLAN may be misdirected or dropped. To diagnose, first check the trunk status with 'show interfaces trunk'. Look for the 'Native VLAN' field; if it differs between ends, you have a mismatch.

Also check 'show interfaces trunk' for the list of allowed VLANs; the native VLAN must be included in the allowed list. Another useful command is 'show interfaces switchport' which displays the administrative and operational native VLAN. If the trunk is not forming, verify that both sides are set to trunk mode and that the native VLAN exists on both switches.

Use 'show vlan' to confirm the VLAN is present. If you suspect a VLAN hopping attack, check for unexpected native VLAN changes. A step-by-step diagnostic flow: 1) Verify trunk status with 'show interfaces trunk'. 2) If trunk is down, check physical layer and port-channel configuration. 3) If trunk is up but errors occur, compare native VLAN on both ends. 4) Use 'show logging' to see if native VLAN mismatch messages appear. 5) Correct the mismatch by setting the same native VLAN on both sides.

Correlate with 'debug trunk' (if available) to see negotiation details. Remember that changing the native VLAN on a live trunk can cause temporary disruption; plan maintenance windows accordingly.

CCNA Exam Tips

CCNA exam tip: The native VLAN must match on both ends of a trunk; otherwise, the trunk may not form or may cause VLAN hopping.

CCNA exam tip: By default, VLAN 1 is the native VLAN; changing it is a security best practice.

CCNA exam tip: The 'switchport trunk native vlan' command is only valid on trunk ports; it will be rejected on access ports.

CCNA exam tip: On some switches, the native VLAN must also be allowed on the trunk; use 'switchport trunk allowed vlan add' if needed.

Common Mistakes

Mistake 1: Setting the native VLAN to a VLAN that is not allowed on the trunk, causing untagged traffic to be dropped.

Mistake 2: Forgetting to configure the same native VLAN on the other end of the trunk, leading to a native VLAN mismatch error.

Mistake 3: Using this command on an access port; it only works on trunk ports.

switchport trunk native vlan [id] vs switchport mode trunk

The commands `switchport trunk native vlan [id]` and `switchport mode trunk` are often confused because both are required to set up a trunk interface and both are configured in interface configuration mode under the VLAN category. However, they serve different purposes: one defines the port's trunking mode, while the other specifies the untagged (native) VLAN on that trunk.

Aspect	switchport trunk native vlan [id]	switchport mode trunk
Scope	Defines which VLAN is untagged on the trunk	Enables trunking mode on the interface
Configuration mode	Interface configuration mode	Interface configuration mode
Persistence	Persists even if trunk mode changed	Persists in running-config
Precedence	Only effective if port is in trunk mode	Must be set before native VLAN config typically
Typical use	Set native VLAN to match other end to avoid misconfiguration	Convert access port to trunk to carry multiple VLANs
Effect on tagging	Frames of this VLAN are sent untagged	All VLANs except native are tagged

Use switchport trunk native vlan [id] when you need to specify which VLAN should carry untagged traffic on a trunk, ensuring compatibility with devices that expect a specific native VLAN.

Use switchport mode trunk when you need to enable 802.1Q trunking on an interface to carry traffic for multiple VLANs.

Platform Notes

In IOS-XE (e.g., Catalyst 3650/3850), the syntax and behavior are identical to classic IOS. The command 'switchport trunk native vlan [id]' works the same way. In NX-OS (e.g., Nexus 9000), the equivalent command is 'switchport trunk native vlan [id]' under interface configuration, but note that NX-OS uses a different default native VLAN (VLAN 1) and the command is applied similarly.

However, NX-OS also supports 'switchport mode trunk' and 'switchport trunk allowed vlan' with slight syntax differences. For ASA firewalls, trunking is not typically used; instead, subinterfaces with VLAN assignment are common. There is no direct ASA equivalent.

In IOS-XR (e.g., ASR 9000), trunking is handled differently; the command does not exist. Instead, you configure VLAN subinterfaces with encapsulation. Between IOS versions (12.x, 15.x, 16.x), the command syntax remains consistent, but newer versions may introduce additional options like 'switchport trunk native vlan tag' (to tag native VLAN frames) which is not present in older versions.

Always check the specific IOS version documentation for any nuances.

Related Commands

show interfaces trunk

Displays all trunk ports including the trunking encapsulation (802.1Q or ISL), the native VLAN, VLANs allowed on the trunk, VLANs in the spanning tree forwarding state, and VLANs active in the management domain.

switchport mode trunk

Configures a switch interface as a trunk port, allowing multiple VLANs to traverse the link using IEEE 802.1Q tagging.

switchport trunk allowed vlan [list]

Restricts the VLANs that are allowed to traverse a trunk link on a Cisco switch, used to control which VLAN traffic is permitted on the trunk.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions