1

I’m trying to figure out what native vlan should be on my trunked ports.

For example: On a Cisco firewall if I have a port that is trunked for vlans 10,11,12 and that port is connected to a switch. I understand that for any non tagged traffic (traffic not from vlans 10.,11,.12) will go through the native vlan.

But what should I make the native vlan? Should I make it the same as one of the vlans being trunked, or create a new vlan, say vlan 13, and use that as the native vlan on the ASA trunked port?

interface Ethernet0/1

switchport trunk allowed vlan 10,11,12

switchport trunk native vlan 10

switchport mode trunk

3 Spice ups
2

Anything but vlan 1 is fine.

3

The native VLAN should also be distinct from all user VLANs. Be sure it is the same on both ends of the trunk link.

4

You can’t have traffic that is tagged and traffic that is untagged on the same vlan on the same port. So, you’d have to choose a vlan that is different than your tagged vlans.

5

What if i dont even trunk native vlan traffic? Pro s cons? Since untagged traffic will go on the native vlan, what traffic might that be…non data traffic such as cdp, etc?

6

How many trunks do you have?
In theory you can use any VLAN number you like (again I would advise against using VLAN 1) .
You could use the same VLAN for all trunks, but I would suggest against this as it can promote (if you had a reasonable good attacker) VLAN hooping.
Do you use other VLANs? DO you have a schema? just make them logical, maybe trunk one has VLAN 101, trunk two, VLAN 102 etc.
There is no right or wrong answer hear except using native VLANs is a great idea.

7

As an attacker will know the all untagged traffic will go over VLAN 1, lateral movement around a system is easier.
Having native (different) VLANs on trunks means that VLANs only exists on that trunk and on the two connected devices.

If you have additional links, these trunks will have different VLANs (only on them) and this make VLAN hopping a hell of a lot harder. It’s also sensible to only allow what VLANs that are needed down the trunk.

8

So I will create vlan 50 say for native vlan traffic and put that on the trunk.

1 Spice up