What is VLAN 1, and why does Cisco recommend moving its default functions to other VLANs?

VLAN (Virtual Local Area Network) 1 is the default VLAN on Cisco switches — it serves as the default data VLAN, native VLAN, and management VLAN, and it cannot be deleted or renamed.

VLAN 1's three default roles:

1. Default VLAN — all switch ports are members of VLAN 1 out of the box
2. Default Native VLAN — untagged traffic on trunk links is assumed to belong to VLAN 1
3. Default Management VLAN — SSH/Telnet management traffic uses VLAN 1

Why move away from VLAN 1?

Security. Since VLAN 1 is the well-known default, attackers know to target it. Cisco best practice is to:

• Assign user data traffic to other VLANs (e.g., VLAN 10, 20, 30)
• Change the native VLAN on trunks to something other than VLAN 1 (e.g., VLAN 99)
• Use a dedicated management VLAN for switch administration

You can also see the legacy VLANs (1002–1005) in show vlan brief — these exist for FDDI and Token Ring compatibility and also cannot be deleted.

Go deeper:

• VLAN hopping (Wikipedia) — why default-VLAN-1 placement is an attack surface and should be moved off.