native VLAN
termThe VLAN whose frames cross an 802.1Q trunk without a tag, and into which a trunk port places any untagged frame it receives.
VLAN 1 by default on Cisco and on Aruba's AOS-CX. Two ends that disagree merge two VLANs; the standard's own name for the idea is the port's PVID.
Cisco's rule for a trunk's egress is the definition at work: 'If a packet has a VLAN ID that is the same as the outgoing port native VLAN ID, the packet is sent untagged; otherwise, the device sends the packet with a tag.' On the way in, an untagged frame is assigned to the native VLAN. If the two ends of a trunk disagree about which VLAN that is, traffic from one VLAN arrives in another, and Cisco warns that 'spanning-tree loops might result'.
The native VLAN is also the hinge of a classic attack. A frame with two tags, the outer one matching the trunk's native VLAN, which is also the attacker's own access VLAN, loses that outer tag at the first switch and crosses the trunk into the VLAN of the inner one. Cisco's campus design guide gives the standard answer: 'Assign the native VLAN to an unused ID or use the Tagged Native VLAN option to avoid VLAN hopping.' Many switches can tag the native VLAN too, which removes the untagged exception altogether.
Also known as: untagged vlan, pvid, port vlan id, vlan 1