802.1Q Trunk and Native Vlan
i have two switches connected to PCs. I also have created two vlans( vlan 10 and vlan 20). There is a third vlan (vlan 1) which i didn’t create but it comes with the switch by default.
Now i am going to give you a test question. If PC2 wants to send a frame to PC4 . How SW1 and SW2 will handle the frame as it passes the link between the switches ?
If there is no configuration on the ports that connect SW1 and SW2 . Those ports will be considered as part of vlan 1 and therefore can only pass vlan 1 traffic. In order to have multiple vlan traffic over the link between SW1 and SW2 we have to configure those ports as Trunk ports.
So a port that can carry multiple vlan traffic is called a Trunk Port.
A Trunk link is a link between two trunk ports or to be exact a point-to-point link between two switches, between a switch and a router or between a switch and a server.
Now we have the trunk port configured on SW1 and SW2 . If PC2 send a frame to PC4 . The frame will arrive to SW1 and SW1 will send the frame over the trunk link to SW2 . We know that the frame belong to vlan 10 because PC2 send it, but how the SW2 will know that the frame belong to vlan 10. The answer to this question is SW2 knows which vlan the frame belong because SW1 has added the Vlan number to the frame. Now the question we can ask is what mecanism is used by SW1 to add vlan number to the frame. The answer is, there are two protocols that can be configured when we create the trunk port. The first protocol is called ISL( Inter-Switch Link ). The second protocol is called 802.1Q .
Both protocols help the switch add a vlan number to the frame. But there are some difference between the two protocols. First ISL is developped by cisco (work only on cisco switches), however 802.1Q is a standard protocol (work on all the switches).
ISL protocol encaspsulate the frame by adding a 26 bytes header and the FCS (Frame Sequence
Check) like you see below.
ISL header 26 bytes (contain Vlan ID)
802.1Q protocol doesn’t encapsulate the frame. It just insert a 4 bytes tag right after the source mac address. As you see below
Below is the command you need to tell a switch port to use ISL or 802.1Q .
Switch(config)# interface fastethernet 0/1
Switch(config-if)# switchport trunk encapsulation isl //using ISL
Switch(config-if)# switchport trunk encapsulation dot1q // using 802.1Q
This two protocols are only used by the switches on their trunk port.
For example if PC2 send a frame to PC4 , Since the frame is destined to a device not connected to SW1. So when the frame arrive to SW1 , it will add the vlan number depending on the protocol used( ISL or 802.1Q ). Then SW1 will send the frame over the trunk link to SW2 . When SW2 receives the frame, it will examine it and see that the frame is for vlan 10. But right before SW2 send the frame to the intended device it will remove the ISL or 802.1Q information. Because devices connected to the switch usually don’t understand ISL nor 802.1Q .
Now let’s talk about Native Vlan.
Note : This concept of Native vlan is only used by 802.1Q protocol.
The Native vlan is a vlan that the switch doesn ‘t add vlan information on the frame. By default Vlan 1 is the Native vlan on a switch, but if you want you can change it. So with 802.1Q, a frame sent over the trunk link without vlan information is considered as part of the native vlan.
Where this concept of native vlan comes from ?
As you see in this figure
i have a Hub between the two switches(SW1 and SW2). You may be wondering what the Hub is doing there? You’re right, we don’t use hubs anymore. What i show you in this figure used to be a good pratice back in a days. Because Switches when they first came used to cost lot of money. So to avoid spending to much lot of companies used to put hub between switches.
So let’s take a look at this scenario. If PC1 send a frame to PC7 . When the frame arrives to SW1 , it will see that the frame belong to vlan 1 which is the Native vlan . So SW1 will not add vlan information, it will just send the frame over the trunk link. When the frame arrives to the Hub , it will just foward it out all its ports and PC7 finally gets it.
Now if PC3 send a frame to PC6 . When SW1 receives the frame, it will add the 802.1q tag and send it over the trunk link. The hub receives the frame with the 802.1q tag and send it out all its ports. So PC7 will get the frame but will drop it because PC7 doesn’t understand the 802.1q tag . So to resolve this problem we have to put all PCs connected to the hub to the native vlan which is vlan1.
This is the reason why the native vlan has to be the same on to the connected trunk ports.
If you mismatch the native vlan on the trunk link. For example if i configure the trunk port of SW1 to native vlan 10 and i configure the trunk port of SW2 to native vlan 20 . I will have a native vlan mismatch on the trunk link. So what is going to happen is if i send a vlan 10 frame to SW1 , it will send that frame to SW2 without the vlan information, and when SW2 receives the frame and see that this frame doesn’t have 802.1q tag , SW2 will assume that this frame belong to the native vlan . Guess what, the native for SW2 is not vlan 10 but Vlan 20. So SW2 will forward the frame to vlan 20 and therefore this frame never gets to the intended device. So just be careful when configuring the native vlan .
Now let’s configure the Switches(SW1 and SW2).
SW1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
!Create the vlan
SW1(config)#vlan 10
SW1(config-vlan)#exit
SW1(config)#vlan 20
SW1(config-vlan)#exit
!Assign ports to the vlans
SW1(config)#interface fa0/12
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 10
SW1(config-if)#exit
SW1(config)#interface fa0/13
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 20
SW1(config-if)#exit
!Configure the Trunk port using 802.1Q protocol
SW1(config)#interface fa0/1
SW1(config-if)#switchport trunk encapsulation dot1q
SW1(config-if)#switchport mode trunk
SW2#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
!Create the vlan
SW2(config)#vlan 10
SW2(config-vlan)#exit
SW2(config)#vlan 20
SW2(config-vlan)#exit
!Assign ports to the vlans
SW2(config)#interface fa0/14
SW2(config-if)#switchport mode access
SW2(config-if)#switchport access vlan 10
SW2(config-if)#exit
SW2(config)#interface fa0/15
SW2(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 20
SW2(config-if)#exit
!Configure the Trunk port using 802.1Q protocol
SW2(config)#interface fa0/1
SW2(config-if)#switchport trunk encapsulation dot1q
SW2(config-if)#switchport mode trunk
Let’s verify the trunk configuration on the switches
SW1#show interface trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1-1005
Port Vlans allowed and active in management domain
Fa0/1 1,10,20
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 1,10,20
SW2#show interface trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/1 1-1005
Port Vlans allowed and active in management domain
Fa0/1 1,10,20
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 1,10,20
As you see on both switches, it says Encapsulation 802.1Q. That mean we are using 802.1Q protocol, Status is trunking and the native vlan is vlan 1.
Now let’s play with the native vlan configuration.
SW1(config)#interface fa0/1
SW1(config)#switchport trunk native vlan 10
SW1(config-if)#
%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on FastEthernet0/1 (10), with SW2 FastEthernet0/1 (1).
SW2(config)#interface fa0/1
SW2(config-if)#switchport trunk native vlan 20
SW2(config-if)#
%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on FastEthernet0/1 (20), with SW1 FastEthernet0/1 (10).
As you see both Switches are telling us that there is a native vlan mismatch discovered on their trunk port by CDP(Cisco Discovery Protocol). So now if you are seeing this kind of message on your switches, you should know what to do. Just configure the same native vlan number on both end of the trunk link.
Where the native vlan is used in today networking ?
The native vlan is used by some protocols like CDP (Cisco Discovery Protocol), STP (Spanning Tree Protocol) etc… The native is also used in Voice over IP.
Force the Switch to tag the Native Vlan frame
On some switches you can tell them to tag the Native Vlan frame by using the command below from the global configuration.
What exactly happens when there is a native vlan mismatch?
I get that the native vlans between switches have to be the same. But besides the CDP system messages, what happens if there is a vlan mismatch?
Also, can you configure a different native vlan to the entire switch? Or would you have to do it on every single access/trunk port?
For example: switchport trunk native vlan 4
This would make the native vlan of the trunk port 4. but if you do "show vlan", your default vlan is still 1. I am confused!
Understanding Conditions of NATIVE VLAN MISMATCH
Okay so this is perfect for my switch studies however I am just starting to touch on trucking stuff and thought this would be a good knowledge re-enforcer.
At work I have an access switch that reported this NATIVE VLAN MISMATCH alarm:
Switch A syslog event:
Apr 2 15:40:29 GMT: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet5/20 (106), with [Switch_B] FastEthernet9/3 (103).
So the way I understand this I hope.
It seems that Switch A port gi5/20 tried to establish a trunk with Switch B’s fa9/3 port.
BPDU Guard is also enabled so Switch A’s gi5/20 port immediately err-disabled:
[Switch A]#show interfaces status err-disabled
Port Name Status Reason Err-disabled Vlans
Gi5/20 PC- Usuario err-disabled bpduguard
I fully understand why the port disabled (because it saw a switch on the other side and this port is not configured to be a trunk):
[Switch A]#sh run int gi5/20
Building configuration.
Current configuration: 363 bytes
!
interface GigabitEthernet5/20
description PC- Usuario
switchport access vlan 106
switchport mode access
switchport voice vlan 202
switchport port-security maximum 5
switchport port-security
switchport port-security aging time 5
no snmp trap link-status
storm-control broadcast level 25.00
storm-control action shutdown
service-policy output DBL
end
So what I am trying to understand is the syslog message and what it essentially is saying. What I kind of do not understand is the NATIVE VLAN reference.
I’m guessing at this point but here are my thoughts:
Switch A’s gi5/20 port is configured to be in VLAN 106 as an access port. Does this mean that the for this port, this is considered this ports Native Vlan?
It is an access port so it’s not currently trunking so it cannot see multiple vlan frames running across the link. So, since gi5/20 also saw the vlan of 103 from the other end switch (switch 
it disabled the port because these two vlans do not match and MUST be the same when considering access ports.
Also here is the config of the far side switch port (Switch :
[Switch B]#sh run int fa9/3
Building configuration.
Current configuration: 444 bytes
!
interface FastEthernet9/3
switchport
switchport access vlan 103
switchport mode access
switchport voice vlan 212
wrr-queue cos-map 1 1 1
wrr-queue cos-map 2 1 0
wrr-queue cos-map 3 1 2
wrr-queue cos-map 3 2 3
wrr-queue cos-map 3 3 6
wrr-queue cos-map 3 4 7
priority-queue cos-map 1 4 5
rcv-queue cos-map 1 3 6
no snmp trap link-status
mls qos vlan-based
spanning-tree portfast edge
spanning-tree bpduguard enable
end
Native VLAN mismatch Error on Access Port
I am having two switches connected by access port but with two different vlan at both end. On both ends I got following Native VLAN mismatch discovered errors.
Aug 5 15:16:35.286: %CDP-4- NATIVE_VLAN_MISMATCH : Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug 5 15:17:33.992: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug 5 15:18:32.149: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug 5 15:19:28.217: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug 5 15:20:24.622: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug 5 15:21:17.736: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug 5 15:22:10.554: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug 5 15:23:01.778: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). Aug 5 15:24:00.581: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/39 (14), with SW2 GigabitEthernet0/1/0 (2). SW1#
The Configuration on the ports at both ends:
. Device ID: SW1 Entry address(es): IP address: 172.18.14.3 Platform: cisco WS-C4510R+E, Capabilities: Router Switch IGMP Interface: GigabitEthernet0/1/0, Port ID (outgoing port): GigabitEthernet1/39 Holdtime : 121 sec
In circumstances like this, where you are sure the mismatch is not a real problem, you may consider to disable cdp for those interfaces to shut up those noise information.
