What is the native VLAN in 802.1Q, and what are the rules for configuring it on trunk links?

The native VLAN (Virtual Local Area Network) is the VLAN whose frames are sent untagged on an 802.1Q trunk link. By default it's VLAN 1, and both ends of a trunk must be configured with the same native VLAN.

Untagged vs 802.1Q-tagged Ethernet frame. — Luca Ghio, CC BY-SA 4.0, via Wikimedia Commons.

Native VLAN rules:

• Frames on the native VLAN do not receive an 802.1Q tag when sent over the trunk
• If a switch receives an untagged frame on a trunk port, it assigns it to the native VLAN
• Both ends of a trunk link must agree on the native VLAN — a mismatch causes a security risk and connectivity issues
• Each trunk is configured independently, so different trunk links on the same switch can have different native VLANs

Why it exists: The native VLAN was designed for backward compatibility with devices that don't understand VLAN tagging — for example, an old hub connected to a trunk port would only work on the native VLAN.

Security best practice:

• Change the native VLAN from VLAN 1 to an unused VLAN (e.g., VLAN 99 or 999)
• This prevents VLAN hopping attacks where an attacker double-tags frames to jump between VLANs
• Cisco IOS (Internetwork Operating System) will warn you (Native VLAN mismatch) if the two ends of a trunk don't match

Go deeper:

• IEEE 802.1Q — native VLAN (Wikipedia) — untagged frames on a trunk are assumed to be on the native VLAN, the basis for the must-match-both-ends rule.