Trunk Native VLAN

If you’re here, it’s because you want to understand what the Native VLAN is and how to configure it.
Good news: if you already know what a trunk port is, you’re halfway there!

Figure 1 – VLAN Frames over a Trunk Link

Remember, a trunk port allows multiple VLAN frames to be transported at the same time using 802.1Q tags.

As you can see in the diagram above, frames belonging to VLANs 1 and 2 are transmitted over a trunk link with their 802.1Q tags to their respective destinations.

But… what happens if an untagged frame arrives on a trunk port?

Let’s look at this example:

Figure 2 – Untagged Frame on a Trunk Port

A PC is mistakenly connected to a trunk port and start to send untagged frames.
How does the switch react? It can’t just ignore them. The switch will put the untagged framed in the Native VLAN.

Figure 3 – Native VLAN Behavior

That’s exactly the role of the Native VLAN!
A Native VLAN allows untagged frames arriving on a trunk port to be placed into a specific VLAN: the native VLAN.

Okay you now know Native VLAN exists in this case but why ?

The Native VLAN exists to handle situations where untagged traffic arrives on a trunk interface.
It might seem rare… but in reality, it’s more common than you’d think.

Imagine if a user accidentally plugs into the trunk port connecting two switches…

Figure 4 – A PC Plugged into a Trunk Port

…and starts sending untagged frame.

The traffic reaches the trunk port of the switch. Since the frame is untagged, the switch will automatically places it into the native VLAN which by default is VLAN 1.

Figure 5 – Untagged Frame Assigned to the Native VLAN

As a result, the switch will now untag frames received on the trunk port and send them to all ports configured in VLAN 1.

Refer to the image above.

Why This Behavior Is Dangerous

This means that a PC accidentally connected to a trunk could communicate with all devices in VLAN 1 without you even realizing it.