Native VLAN mismatch on Cisco 2950

If you are using dot1q as a trunking protocol (most common) you also need to configure the same native VLAN on both ends of the trunk, as the packets of that VLAN are send untagged. use interface config command "switchport trunk native vlan vlan-nr" to change the specific VLAN on one or both sides. This probably is the cause of the native VLAN mismatch you are experiencing. And yes, it can be a good practice to seperate management and users VLANs, though its not a requirement.

You can have it.

It just means that, on the trunk between them, your 3750 is treating un-tagged frames as though they were VLAN 1, and your 2950 is treating un-tagged frames as VLAN 10.

Basically a sign of poor design, but not *necessarily* of any problem.

There is a benefit: what is the one VLAN that you cannot delete or remove and will therefore always be there? VLAN1 The books and prudence suggest manking VLAN 1 the management VLAN and to put your network device management IP addresses on there. Laziness says that it is easier to leave all switchports VLAN 1 for the users and workstations and to just move the management IP address ports to the other VLAN. If you are going to seperate them, make VLAN 1 for your network administration and move the users to another VLAN.

This is a bad idea. It's also a bad practice on a number of fronts ranging from security, node trust, and inband vs. out of band management:

In particular, from a security perspective, not addressing the native VLAN 1 issue opens you up to a VLAN hopping attack.

Change your native VLAN to something other than 1 (as it's the default on all Cisco devices), prune it, and don't assign ANY hosts to it...

Scott Perry wrote:

When you say separate management traffic, what traffic do you refer to exactly? We are in a small network that has one firewall, one network switch, and a couple servers. How would this benefit this particular network and what traffic should I segregate?

Thanks.

Actually, I was just playing with an old 3548 switch, patched to a trunk port on a 3750 and the 3548 was actually disabling ports where a VLAN mismatch was detected.

On the 2950 with all ports on VLAN10, I changed port 1 to access mode

BV

I would think that makes sense - the trunk back to the 3750 treats VLAN 10 as VLAN 1, so you shouldn't be able to use VLAN 1 on the 2950 side of the trunk.

I have come acrossVLAN mismatches on networks where they have multi- vendor switches and haven't figured out how to trunbk properly between two devices from different vendors.