Reference Guide

Virtual LANs (VLAN) | 751
Native VLAN support breaks this barrier so that a port can be connected to both VLAN-aware and
VLAN-unaware stations. Such ports are referred to as hybrid ports. Physical and port-channel interfaces
may be hybrid ports.
Native VLAN is useful in deployments where a Layer 2 port can receive both tagged and untagged traffic
on the same physical port. The classic example is connecting a VOIP phone and a PC to the same port of
the switch. The VOIP phone is configured to generate tagged packets (with VLAN = VOICE VLAN), and
the attached PC generates untagged packets.
To configure a port so that it can be a member of an untagged and tagged VLANs:
Enable Null VLAN as the Default VLAN
In a Carrier Ethernet for Metro Service environment, service providers who perform frequent
reconfigurations for customers with changing requirements occasionally enable multiple interfaces, each
connected to a different customer, before the interfaces are fully configured. This presents a vulnerability
because both interfaces are initially placed in the native VLAN, VLAN 1, and for that period customers are
able to access each other's networks. FTOS has a Null VLAN to eliminate this vulnerability. When you
enable the Null VLAN, all ports are placed into by it default, so that even if you activate the physical ports
of multiple customers, no traffic is allowed to traverse the links until each port is place in another VLAN.
Step Task Command Command Mode
1 Remove any Layer 2 or Layer 3 configurations from the interface. INTERFACE
2 Configure the interface for hybrid mode.
portmode hybrid INTERFACE
3 Configure the interface for switchport mode.
switchport
INTERFACE
4 Add the interface to a tagged or untagged VLAN. [
tagged | untagged] VLAN INTERFACE
Note: An existing switchport or port channel interface cannot be configured for Native VLAN. Interfaces
must have no other Layer 2 or Layer 3 configurations when entering the command
portmode hybrid or a
message like Message 1 is displayed.
Message 1 Native VLAN Error
% Error: Port is in Layer-2 mode Gi 5/6.
Task Command Syntax Command Mode
Disable the default VLAN, so that all ports belong to
the Null VLAN until configured as a member of another
VLAN.
default-vlan disable
Default: the default VLAN is enabled
(
no default-vlan disable).
CONFIGURATION