Native VLAN Mismatch: Symptoms, Security Risk, and the Fix

A native VLAN mismatch happens when the two ends of an 802.1Q trunk are configured with different native VLAN IDs. Because native VLAN frames cross the trunk untagged, the receiving switch has no tag to read and files those frames into whatever VLAN it considers native, which merges two separate broadcast domains into one. Cisco switches detect the condition two independent ways, through CDP (Cisco Discovery Protocol) neighbor comparison and through the VLAN identifier carried inside spanning-tree BPDUs, and the fix is always to configure the same native VLAN ID on both trunk ports.

The mechanism

Suppose SW1’s trunk uses native VLAN 1 and SW2’s trunk uses native VLAN 99. SW1 sends VLAN 1 traffic with no tag. SW2 receives untagged frames, applies its own native VLAN, and places that traffic in VLAN 99. In the reverse direction SW2’s untagged VLAN 99 traffic arrives on SW1 and becomes VLAN 1. Two VLANs that were meant to stay isolated are now bridged to each other, and their broadcast domains, spanning-tree topologies, and any Layer 3 subnets riding on them are all entangled.

Every other VLAN on the trunk continues to work perfectly, because tagged frames carry an explicit identifier that both switches honor. The failure is confined to untagged traffic, which is what makes it hard to spot from a connectivity test that happens to use a tagged VLAN.

Detection

Spanning tree. PVST+ and Rapid PVST+, which run one spanning-tree instance per VLAN, stamp the sending VLAN identifier, the PVID, into every BPDU (bridge protocol data unit) they send over a trunk. When the received identifier does not match what the receiver expects for that link, the switch refuses to let traffic leak between the two VLANs and places the port into a PVID inconsistent state, blocking the affected VLANs:

%SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan id 1
  on GigabitEthernet1/0/24 VLAN99.
%SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet1/0/24 on VLAN0099.
  Inconsistent local vlan.
%SPANTREE-2-BLOCK_PVID_PEER: Blocking GigabitEthernet1/0/24 on VLAN0001.
  Inconsistent peer vlan.

Two properties of this block matter. It is selective, affecting only the two disagreeing VLANs rather than the whole trunk. It is also self-clearing: aligning the native VLAN on both ports removes the inconsistency and the port returns to forwarding on its own, with no shutdown cycle and no errdisable recovery involved. The inconsistency wording is what separates these messages from ordinary spanning-tree blocking caused by a redundant path.

CDP. Independently of spanning tree, CDP compares the native VLAN advertised by each neighbor and logs a warning:

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on
  GigabitEthernet1/0/24 (1), with SW2 GigabitEthernet1/0/24 (99).

This message requires CDP to be running on both switches and requires the link to be an operational trunk, so it disappears on a link where discovery was disabled or where only LLDP is enabled, a difference set out in CDP versus LLDP. Its absence is diagnostic in its own right: if two ports never negotiated a trunk, there is no trunk for CDP to compare, so a link that logs no mismatch despite differing switchport trunk native vlan commands is very likely not trunking at all. That case belongs to DTP negotiation, not to this one.

Verification and the fix

Compare the Native vlan column of show interfaces trunk on both switches. To find the trunks in the first place, scan show interfaces status, whose Vlan column reports VLAN membership per port:

SW1# show interfaces status

Port      Name               Status       Vlan       Duplex  Speed Type
Gi1/0/1                      connected    10         a-full a-1000 10/100/1000BaseTX
Gi1/0/2                      notconnect   1            auto   auto 10/100/1000BaseTX
Gi1/0/24                     connected    trunk      a-full a-1000 10/100/1000BaseTX

A trunking port belongs to many VLANs at once, so IOS prints the literal word trunk there rather than a number. An access port prints its access VLAN ID, and a port converted to a Layer 3 interface with no switchport prints routed. The word trunk in that column is the fastest way to identify which ports need their native VLAN compared.

Correcting the mismatch is one command on the end that is wrong:

SW2(config)# interface GigabitEthernet1/0/24
SW2(config-if)# switchport trunk native vlan 1

Confirm afterward that the chosen native VLAN also appears in the permitted list on both ends. The native VLAN receives no exemption from the allowed VLAN list, so a trunk whose native VLAN has been removed from that list carries no untagged traffic at all, which produces an outage that looks nothing like a mismatch. Both lists appear in show interfaces trunk.

Distinguishing it from an allowed-list problem

Observation	Native VLAN mismatch	Allowed VLAN list mismatch
Traffic affected	Untagged traffic in the two native VLANs	The specific VLAN missing from one end’s list
Log messages	PVID inconsistency and CDP mismatch	None
Spanning tree	Port blocked for the affected VLANs	Unchanged
Where to look	Native vlan column on both ends	First VLAN list on both ends
Recovery	Automatic once the IDs match	Requires adding the VLAN back

The double-tagging risk

The native VLAN is the enabler for the VLAN hopping technique known as double tagging. An attacker positioned on an access port whose VLAN happens to equal the trunk’s native VLAN crafts a frame carrying two 802.1Q tags: an outer tag naming the native VLAN and an inner tag naming the target VLAN. The first switch strips the outer tag, because native VLAN traffic leaves the trunk untagged, and forwards the frame with the inner tag still attached. The second switch reads that inner tag as the real VLAN assignment and delivers the frame into the target VLAN, which the attacker was never authorized to reach.

The attack is one-directional, since no return path exists back through the same trick, and it depends entirely on the attacker’s access VLAN matching the trunk’s native VLAN. Three practices remove it:

• Assign every trunk a dedicated native VLAN that exists solely for that purpose and has no access ports in it, and do not use VLAN 1.
• Keep user-facing access ports out of the native VLAN.
• Tag the native VLAN globally with vlan dot1q tag native, which removes the untagged case from the trunk entirely.

How the 200-301 exam tests this

• Read the syslog. The PVID inconsistency pair is presented and you identify both the cause and the remedy. The cause is disagreeing native VLANs, and the remedy is aligning them, after which the port recovers by itself.
• Identify the trunk from output. A show interfaces status excerpt is given and you state what appears in the Vlan column for a trunking port. The answer is the word trunk, with the native VLAN number and the value routed offered as distractors.
• Attribute the symptom. One VLAN fails across a trunk with no log messages, which points to the allowed list rather than a native VLAN mismatch, since a mismatch is loud and affects untagged traffic.
• Harden the trunk. A question asks how to defeat double tagging. The intended answers are an unused dedicated native VLAN or tagging the native VLAN, not disabling spanning tree and not moving hosts.

Loud versus silent is the discrimination every one of these items turns on, and practice questions hammer it in faster than notes can.

Quick reference

• Native VLAN frames cross an 802.1Q trunk untagged; the receiver files them into its own configured native VLAN.
• A mismatch bridges two broadcast domains together while every tagged VLAN keeps working.
• PVST+ and Rapid PVST+ carry the PVID in BPDUs and block the affected VLANs on a mismatch.
• The block clears automatically once both ends agree; no interface bounce is needed.
• CDP logs %CDP-4-NATIVE_VLAN_MISMATCH when both switches run CDP over an operational trunk.
• show interfaces status prints trunk in the Vlan column for a trunking port, a number for access, routed for a Layer 3 port.
• Double tagging works only when the attacker’s access VLAN equals the trunk’s native VLAN.
• Use a dedicated unused native VLAN, keep VLAN 1 out of it, or apply vlan dot1q tag native.