Native Vlan

---

On your CCNA R&S , Layer 2 Threat Mitigation, Part 2., Don mentions (and I know he has on other shows) that he changes (as Cisco recommends) his native Vlan from 1 to an "empty vlan", like 999.
Is there no use of native vlans? Since Don describes this as an empty vlan.
If Cisco recommended you change your native vlan to something else, then at the same time, you and others will state what they generally use for the new Native vlan. I am a little confused about announcing what your native vlan is, if your intent is to not have someone know what it is. I am missing something. Can you help.

Thanks, Acky

FOLLOW-UP Questions and comment: So, In watching the episode further. (I have got to do something about my impatience), I see that management traffic will continue to reside on Vlan 1, whether it is currently the native vlan or not. I am assuming, this is built in as a default or maybe, cannot even be changed?
Other than that, I also assume that any new device connection to an access port- operationally, you would assign to some vlan- other than 1?
You stated that the vlan 1, as the native vlan, is changed on your trunks, which leads me to believe, vlan 1 is kept as the native vlan across the switches otherwise?

@Acky,

The "native vlan" concept is something that we must take into account in 802.1q Tagging. Key concepts:

• The default "native vlan" is VLAN 1 in dot1q. This doesn't mean it has to be vlan 1

• The "native vlan" is the only vlan that allows for UNTAGGED traffic. All vlans can be tagged, even vlan1, if the native vlan is vlan 999.

• By default management traffic is on the "native vlan". Remember, we can change that management traffic to go to a tagged vlan if we want.

We mention that we really don't want any traffic on the "native vlan" all at. So even though many cisco engineers may leave the native vlan as vlan 1, usually the best practice is to not allow any device to send and receive data traffic on that native vlan because there are Layer 2 attacks that can be used with the native vlan. So instead, we change the native vlan to different number and make sure no ports are in this vlan so that even if someone gains access to the native vlan, it doesn't give them any access to any data endpoint.

Your second point: The vlan.dat is kept on each switch. So if you're using multiple swtiches you must ensure that the native vlan is the same between all the switches that are connected together.

@Acky,

You should be able to create another vlan, such as vlan 2 and make it your management. Now, having said that. Not all switches or devices recognize ANY OTHER VLAN but VLAN1 for management traffic. So it may be that you're precluded from moving away from VLAN1 for your management traffic.

Remember that the vlan.dat is on every switch and must be managed switch to switch so that if you change the native vlan on 1 switch, you should probably also change it for all of the connected switches.

**with no further activity on the post, I am marking post as solved.