Explain how VLAN trunking works, what 802.1Q tagging does, and what the native VLAN is. Why is it important to configure trunk ports correctly?

Question

Accepted Answer

VLAN trunking is a networking technique that allows multiple VLANs to share a single physical link between switches. Without trunking, you would need a separate cable for each VLAN that needs to communicate between two switches, which would be impractical in any environment with more than a handful of VLANs.

To understand trunking, you first need to know the difference between access ports and trunk ports. An access port belongs to a single VLAN and connects to end devices like servers or workstations. All traffic on an access port is untagged because the switch knows which VLAN the port belongs to. A trunk port, on the other hand, carries traffic from multiple VLANs simultaneously over a single physical connection. It is used for switch-to-switch links, switch-to-router links, and connections to hypervisors that host virtual machines on different VLANs.

The mechanism that makes trunking possible is 802.1Q tagging, which is the IEEE standard for VLAN identification. When a frame enters a trunk port, the switch inserts a 4-byte tag into the Ethernet frame header. This tag contains the VLAN ID, which is a number between 1 and 4094 that identifies which VLAN the frame belongs to. When the frame arrives at the receiving switch, it reads the VLAN tag, determines which VLAN the frame belongs to, and forwards it accordingly. The tag is then removed before the frame is delivered to an access port on the destination VLAN.

The native VLAN is a special concept on trunk ports. It is the VLAN whose traffic is sent without an 802.1Q tag. By default, the native VLAN is VLAN 1 on most switches. If a frame arrives on a trunk port without a VLAN tag, the switch assumes it belongs to the native VLAN. This feature exists for backward compatibility with devices that do not support VLAN tagging.

Correct trunk port configuration is important for several reasons. First, both ends of a trunk link must agree on which VLANs are allowed. If one switch allows VLANs 10, 20, and 30 on a trunk but the other switch only allows VLANs 10 and 20, traffic for VLAN 30 will be silently dropped. Second, the native VLAN must match on both sides of the trunk. A mismatch can cause traffic to end up on the wrong VLAN, leading to connectivity issues and potential security vulnerabilities.

From a security perspective, it is a best practice to change the native VLAN to something other than VLAN 1 and to disable Dynamic Trunking Protocol, or DTP, on all ports that are not explicitly configured as trunks. DTP allows switches to automatically negotiate trunk links, but an attacker could exploit this by connecting a device that spoofs DTP negotiation to gain access to multiple VLANs. This is known as a switch spoofing attack and is one of the primary methods used in VLAN hopping attacks.