topic Re: Native Vlan mismatch in Network Security

Native Vlan mismatch

johnmcgrath29 — Tue, 19 Oct 2021 17:34:26 GMT

I am getting a vlan mismatch all though I have configured the native vlan on both interfaces as vlan 30

interface FastEthernet0/22

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport mode trunk

This is the configuration on one of the two interfaces on the layer 2 switch the below is one of four interface configurations on the layer 3 switch.

interface FastEthernet0/21

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport trunk encapsulation dot1q

spanning-tree guard root

I don't see why this is not work I am obviously missing something here?

I will add the PKT. file below as well.

Re: Native Vlan mismatch

balaji.bandi — Tue, 19 Oct 2021 17:55:46 GMT

not seen the attachements, is this PT file ? i am not a PT user.

Make sure you created the all the VLAN both sides, and shut and no shut both the side and check.

Re: Native Vlan mismatch

johnmcgrath29 — Tue, 19 Oct 2021 18:36:50 GMT

I am fairly sure I have already done so but I will add the three configurations and you can see if I have missed anything?

hostname CoreSW_1

enable secret 5 $1$mERr$KTYfdhYGp9j1mTr7d5BYo0

ip dhcp excluded-address 192.168.1.1 192.168.1.10

ip dhcp excluded-address 192.168.2.1 192.168.2.20

ip dhcp excluded-address 192.168.3.1 192.168.3.30

ip dhcp pool vlan10

network 192.168.1.0 255.255.255.0

default-router 192.168.1.10

dns-server 8.8.8.8

ip dhcp pool vlan20

network 192.168.2.0 255.255.255.0

default-router 192.168.2.20

dns-server 8.8.8.8

ip dhcp pool vlan30

network 192.168.3.0 255.255.255.0

default-router 192.168.3.30

dns-server 8.8.8.8

ip routing

username Admin secret 5 $1$mERr$KTYfdhYGp9j1mTr7d5BYo0

no ip domain-lookup

spanning-tree mode pvst

spanning-tree vlan 10,20,30 priority 24576

interface FastEthernet0/1

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/2

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/3

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/4

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/5

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/6

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/7

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/8

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/9

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/10

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/11

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/12

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/13

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/14

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/15

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/16

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/17

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/18

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/19

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/20

no switchport

no ip address

duplex auto

speed auto

shutdown

interface FastEthernet0/21

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport trunk encapsulation dot1q

spanning-tree guard root

interface FastEthernet0/22

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport trunk encapsulation dot1q

spanning-tree guard root

interface FastEthernet0/23

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport trunk encapsulation dot1q

spanning-tree guard root

interface FastEthernet0/24

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport trunk encapsulation dot1q

spanning-tree guard root

interface GigabitEthernet0/1

no switchport

no ip address

duplex auto

speed auto

shutdown

interface GigabitEthernet0/2

no switchport

no ip address

duplex auto

speed auto

shutdown

interface Vlan1

no ip address

shutdown

interface Vlan10

mac-address 00e0.f920.2601

ip address 192.168.1.10 255.255.255.0

interface Vlan20

mac-address 00e0.f920.2602

ip address 192.168.2.20 255.255.255.0

interface Vlan30

mac-address 00e0.f920.2603

ip address 192.168.3.30 255.255.255.0

ip classless

ip flow-export version 9

line con 0

exec-timeout 0 0

logging synchronous

line aux 0

line vty 0 4

end

This is the Layer 3 core switch on the configuration I am currently working on I will add Layer 2 switch configuration in my next reply

Re: Native Vlan mismatch

johnmcgrath29 — Tue, 19 Oct 2021 18:41:20 GMT

Here is the layers 2 switches configurations

hostname SW_1

enable secret 5 $1$mERr$KTYfdhYGp9j1mTr7d5BYo0

no ip domain-lookup

username Admin secret 5 $1$mERr$KTYfdhYGp9j1mTr7d5BYo0

spanning-tree mode pvst

spanning-tree extend system-id

interface FastEthernet0/1

switchport access vlan 10

switchport mode access

switchport port-security

switchport port-security mac-address sticky

switchport port-security violation restrict

switchport port-security mac-address sticky 0002.4A14.8DA8

spanning-tree portfast

spanning-tree bpduguard enable

interface FastEthernet0/2

switchport access vlan 10

switchport mode access

switchport port-security

switchport port-security mac-address sticky

switchport port-security violation restrict

switchport port-security mac-address sticky 00E0.B0DE.EBB6

spanning-tree portfast

spanning-tree bpduguard enable

interface FastEthernet0/3

switchport access vlan 20

switchport mode access

switchport port-security

switchport port-security mac-address sticky

switchport port-security violation restrict

switchport port-security mac-address sticky 00D0.BC7C.0C85

spanning-tree portfast

spanning-tree bpduguard enable

interface FastEthernet0/4

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/5

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/6

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/7

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/8

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/9

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/10

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/11

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/12

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/13

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/14

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/15

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/16

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/17

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/18

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/19

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport mode trunk

interface FastEthernet0/20

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport mode trunk

interface FastEthernet0/21

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/22

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport mode trunk

interface FastEthernet0/23

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/24

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport mode trunk

interface GigabitEthernet0/1

switchport access vlan 99

switchport mode access

shutdown

interface GigabitEthernet0/2

switchport access vlan 99

switchport mode access

shutdown

interface Vlan1

no ip address

shutdown

line con 0

logging synchronous

exec-timeout 0 0

line vty 0 4

line vty 5 15

end

and the second layer 2 switch is as follows

hostname SW_2#

enable secret 5 $1$mERr$KTYfdhYGp9j1mTr7d5BYo0

no ip domain-lookup

username Admin secret 5 $1$mERr$KTYfdhYGp9j1mTr7d5BYo0

spanning-tree mode pvst

spanning-tree extend system-id

interface FastEthernet0/1

switchport access vlan 20

switchport mode access

switchport port-security

switchport port-security mac-address sticky

switchport port-security violation restrict

switchport port-security mac-address sticky 0050.0F86.9950

spanning-tree portfast

spanning-tree bpduguard enable

interface FastEthernet0/2

switchport access vlan 30

switchport mode access

switchport port-security

switchport port-security mac-address sticky

switchport port-security violation restrict

switchport port-security mac-address sticky 0050.0F5A.8D60

spanning-tree portfast

spanning-tree bpduguard enable

interface FastEthernet0/3

switchport access vlan 30

switchport mode access

switchport port-security

switchport port-security mac-address sticky

switchport port-security violation restrict

switchport port-security mac-address sticky 000D.BD75.913C

spanning-tree portfast

spanning-tree bpduguard enable

interface FastEthernet0/4

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/5

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/6

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/7

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/8

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/9

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/10

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/11

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/12

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/13

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/14

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/15

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/16

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/17

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/18

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/19

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport mode trunk

interface FastEthernet0/20

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport mode trunk

interface FastEthernet0/21

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport mode trunk

interface FastEthernet0/22

switchport access vlan 99

switchport mode access

spanning-tree portfast

spanning-tree bpduguard enable

shutdown

interface FastEthernet0/23

switchport trunk native vlan 30

switchport trunk allowed vlan 10,20,30

switchport mode trunk

interface FastEthernet0/24

switchport access vlan 99

switchport mode access

spanning-tree bpduguard enable

interface GigabitEthernet0/1

switchport access vlan 99

switchport mode access

shutdown

interface GigabitEthernet0/2

switchport access vlan 99

switchport mode access

shutdown

interface Vlan1

no ip address

shutdown

line con 0

logging synchronous

exec-timeout 0 0

line vty 0 4

line vty 5 15

end

Re: Native Vlan mismatch

johnmcgrath29 — Tue, 19 Oct 2021 21:13:54 GMT

Can anybody see anything on the three switch configurations. I am missing on the trunk interfaces that is giving me a VLAN mismatch on my devices?

Re: Native Vlan mismatch

Marius Gunnerud — Tue, 19 Oct 2021 21:31:31 GMT

Could you provide the native vlan mismatch log you are seeing as well as the following:

show cdp neighbor

show int status

Re: Native Vlan mismatch

balaji.bandi — Tue, 19 Oct 2021 21:41:49 GMT

Can you post the below output from both the switches?

show vlan

show cdp neigh

show spann brief

Re: Native Vlan mismatch

johnmcgrath29 — Tue, 19 Oct 2021 21:57:19 GMT

CoreSW_1#show vlan

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active

10 VLAN0010 active

20 VLAN0020 active

30 VLAN0030 active

99 VLAN0099 active

1002 fddi-default active

1003 token-ring-default active

1004 fddinet-default active

1005 trnet-default active

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

1 enet 100001 1500 - - - - - 0 0

10 enet 100010 1500 - - - - - 0 0

20 enet 100020 1500 - - - - - 0 0

30 enet 100030 1500 - - - - - 0 0

99 enet 100099 1500 - - - - - 0 0

1002 fddi 101002 1500 - - - - - 0 0

1003 tr 101003 1500 - - - - - 0 0

1004 fdnet 101004 1500 - - - ieee - 0 0

1005 trnet 101005 1500 - - - ibm - 0 0

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

Remote SPAN VLANs

------------------------------------------------------------------------------

Primary Secondary Type Ports

------- --------- ----------------- ------------------------------------------

CoreSW_1#show cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID Local Intrfce Holdtme Capability Platform Port ID

SW_1 Fas 0/24 155 S 2960 Fas 0/24

SW_2# Fas 0/21 150 S 2960 Fas 0/21

SW_2# Fas 0/23 150 S 2960 Fas 0/23

SW_1 Fas 0/22 155 S 2960 Fas 0/22

CoreSW_1#show vlan brief

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active

10 VLAN0010 active

20 VLAN0020 active

30 VLAN0030 active

99 VLAN0099 active

1002 fddi-default active

1003 token-ring-default active

1004 fddinet-default active

1005 trnet-default active

Re: Native Vlan mismatch

johnmcgrath29 — Tue, 19 Oct 2021 22:04:03 GMT

SW_1#show vlan

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active

10 VLAN0010 active Fa0/1, Fa0/2

20 VLAN0020 active Fa0/3

30 VLAN0030 active

99 VLAN0099 active Fa0/4, Fa0/5, Fa0/6, Fa0/7

Fa0/8, Fa0/9, Fa0/10, Fa0/11

Fa0/12, Fa0/13, Fa0/14, Fa0/15

Fa0/16, Fa0/17, Fa0/18, Fa0/21

Fa0/23, Gig0/1, Gig0/2

1002 fddi-default active

1003 token-ring-default active

1004 fddinet-default active

1005 trnet-default active

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

1 enet 100001 1500 - - - - - 0 0

10 enet 100010 1500 - - - - - 0 0

20 enet 100020 1500 - - - - - 0 0

30 enet 100030 1500 - - - - - 0 0

99 enet 100099 1500 - - - - - 0 0

1002 fddi 101002 1500 - - - - - 0 0

1003 tr 101003 1500 - - - - - 0 0

1004 fdnet 101004 1500 - - - ieee - 0 0

1005 trnet 101005 1500 - - - ibm - 0 0

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

SW_1#show cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID Local Intrfce Holdtme Capability Platform Port ID

SW_2# Fas 0/20 6 S 2960 Fas 0/20

CoreSW_1 Fas 0/22 108 3560 Fas 0/22

SW_2# Fas 0/19 66 S 2960 Fas 0/19

CoreSW_1 Fas 0/24 168 3560 Fas 0/24

SW_1#show vlan brief

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active

10 VLAN0010 active Fa0/1, Fa0/2

20 VLAN0020 active Fa0/3

30 VLAN0030 active

99 VLAN0099 active Fa0/4, Fa0/5, Fa0/6, Fa0/7

Fa0/8, Fa0/9, Fa0/10, Fa0/11

Fa0/12, Fa0/13, Fa0/14, Fa0/15

Fa0/16, Fa0/17, Fa0/18, Fa0/21

Fa0/23, Gig0/1, Gig0/2

1002 fddi-default active

1003 token-ring-default active

1004 fddinet-default active

1005 trnet-default active

SW_1#

SW_2##show vlan

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active

10 VLAN0010 active

20 VLAN0020 active Fa0/1

30 VLAN0030 active Fa0/2, Fa0/3

99 VLAN0099 active Fa0/4, Fa0/5, Fa0/6, Fa0/7

Fa0/8, Fa0/9, Fa0/10, Fa0/11

Fa0/12, Fa0/13, Fa0/14, Fa0/15

Fa0/16, Fa0/17, Fa0/18, Fa0/22

Fa0/24, Gig0/1, Gig0/2

1002 fddi-default active

1003 token-ring-default active

1004 fddinet-default active

1005 trnet-default active

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

1 enet 100001 1500 - - - - - 0 0

10 enet 100010 1500 - - - - - 0 0

20 enet 100020 1500 - - - - - 0 0

30 enet 100030 1500 - - - - - 0 0

99 enet 100099 1500 - - - - - 0 0

1002 fddi 101002 1500 - - - - - 0 0

1003 tr 101003 1500 - - - - - 0 0

1004 fdnet 101004 1500 - - - ieee - 0 0

1005 trnet 101005 1500 - - - ibm - 0 0

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

Remote SPAN VLANs

------------------------------------------------------------------------------

Primary Secondary Type Ports

------- --------- ----------------- ------------------------------------------

SW_2##

SW_2##show cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID Local Intrfce Holdtme Capability Platform Port ID

SW_1 Fas 0/20 121 S 2960 Fas 0/20

CoreSW_1 Fas 0/21 38 3560 Fas 0/21

CoreSW_1 Fas 0/23 158 3560 Fas 0/23

SW_2##

SW_1#show vlan brief

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active

10 VLAN0010 active Fa0/1, Fa0/2

20 VLAN0020 active Fa0/3

30 VLAN0030 active

99 VLAN0099 active Fa0/4, Fa0/5, Fa0/6, Fa0/7

Fa0/8, Fa0/9, Fa0/10, Fa0/11

Fa0/12, Fa0/13, Fa0/14, Fa0/15

Fa0/16, Fa0/17, Fa0/18, Fa0/21

Fa0/23, Gig0/1, Gig0/2

1002 fddi-default active

1003 token-ring-default active

1004 fddinet-default active

1005 trnet-default active

That's all the information from the three switches I hope that helps?

Remote SPAN VLANs

------------------------------------------------------------------------------

Primary Secondary Type Ports

------- --------- ----------------- ------------------------------------------

Re: Native Vlan mismatch

johnmcgrath29 — Wed, 20 Oct 2021 09:34:28 GMT

CoreSW_1(config)#int fa0/23

CoreSW_1(config-if)#channel-

CoreSW_1(config-if)#channel-group 1 mode des

CoreSW_1(config-if)#channel-group 1 mode desirable

CoreSW_1(config-if)#

Creating a port-channel interface Port-channel 1

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/23, changed state to down

%EC-5-CANNOT_BUNDLE2: Fa0/23 is not compatible with Po1 and will be suspended (vlan mask is different)

This is a new error I have here

Re: Native Vlan mismatch

johnmcgrath29 — Thu, 21 Oct 2021 10:41:08 GMT

The reason for the issue was that I assigned the vlans to the physical interfaces and not the inter port-channel 1 you need to remove switchport trunk allowed vlan 10,20,30 from the physical interfaces and then use the below configuration

conf t

int port-channel 1

switchport trunk allowed vlan 10,20,30

Re: Native Vlan mismatch

balaji.bandi — Thu, 21 Oct 2021 10:45:16 GMT

That is correct, once the member in port-channel always change the settings on port-channel, not to individual interface, that create in consistance.

hope that resolves the issue.