NATIVE_VLAN_MISMATCH

[captainit]

Hello,
I see from my logs in SG220-26 26-Port Gigabit Smart Switch:

NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on gi1, with Cisco-SG220 gi25

In same switch gi1:

From show running config: 

Can you please help me solve this? I don’t understand. I know the error indicates that the native VLAN should be the same on both ends, but there are no ends because there is no network cable connected from gi25 to another.
Also I don't understand what is the relation to gi1.

Please help me to solve it☹

[Ramblin Tech]

SwitchF476F8/gi1 shows "connected". What is it connected to? CDP can report a native VLAN mismatch; what does CDP say about gi1?

[captainit]

gi1 is connected to a port of patch panel

[captainit]

Attaching another screenshot.

Thanks

[Ramblin Tech]

Gi1 is receiving a CDP packet from port gi25 on a SG220-26 switch associated with IP address 192.168.100.251. Gi25 is configured with Native VLAN 1, while local port gi1 is configured for native VLAN 1000, hence the VLAN mismatch message.

Is there possibly another SG220-26 connected to this same patch panel that has IP addr 192.168.100.251?

[captainit]

I have:
Cisco SG220 - Main Rack - what I sent you 192.168.1.246
Cisco SG220 - Secondary Rack - another switch - in same IP segment 192.168.1.245

192.168.100.251 - is also SG220-26 26-Port Gigabit Smart Switch 

[captainit]

From 192.168.100.251:

Thanks

[Ramblin Tech]

"192.168.100.251 - is also SG220-26 26-Port Gigabit Smart Switch "

CDP on 192.168.1.246 is claiming that there is L2 connectivity between its own port gi1 and remote port gi25 on the above switch (192.168.100.251), with a VLAN mismatch between the two ports (vlan 1000 local vs vlan 1 remote).

[captainit]

I understand. GE1 in 192.168.1.246 is access mode:

DO I need to change only the native vlan to vlan id=1? 
Do I need to change it also to Trunk (does it mean that the two switches are connected together by ethernet cable)?

I understand that only in Trunk I need to change the native vlan, because w it wihen configured as access mode, lt will get the native vlan of the assigned vlan?

Thanks
Many many thanks

[Ramblin Tech]

Access mode is normally intended for connectivity from the switch to an end-system (desktop, server, IOT device, etc) that operates only with untagged frames. In your case, you have two switches connected with at least one of them (.246) operating in access mode, but with a mismatch in their port configs for native VLANs. This represents a potential security vulnerability in that an untagged frame egressing .246 will have come from vlan 1000, but after ingressing .251 it will be associated with vlan 1 and vice versa (vlan-hopping vulnerability).

I will assume that the two switches connected together is intentional, so my recommendation is to connect switches together using only trunk configurations, even if there is only a single vlan to be carried on the link in your current design, as designs change over time. It will be less disruptive to add additional vlans to a trunk in the future than to reconfigure an access port to be a trunk later . I would also tag every frame on the trunk and not rely on native vlans to handle untagged frames (caveat: I do not know if the SG220 supports the IOS command to tag all frames on a trunk).

[captainit]

Update
When I change GE1 from access mode to trunk on 192.168.1.246 - the admin panel of 192.168.100.251 fall down.
When change it back to access mode vlan 1000 is up again.

vlan 1000= segment 100 (192.168.100.0/24)

What can I do please?

Thanks

[captainit]

And I also added to trunk vlan1000 and 192.168.100.251 stopped working when doing it

[Ramblin Tech]

I suspect that this link (.246/gi1 -- .251/gi25) is the path used to connect to .251 for management purposes and that when you make changes to the ports, the connectivity is lost. What is the current config of gi25 on .251?

[captainit]

 

 Thanks

[Ramblin Tech]

It appears that the management interface of .251 (ie, 192.168.100.251) is associated with vlan 1, but the management subnet (192.168.100.0/24) is associated with vlan 1000 in the rest of the network. That is an issue that needs to be rectified, but let us see if we can get into trunking mode first.

When you changed .246/g1 to a trunk, did you also explicitly configure its native vlan to be 1000? That should still send out vlan1000 frames untagged to .251/g25, which will stuff them into its own native vlan 1.

Also, do you have local access to the SG220 switches where you can connect a console cable? The best way to make changes that might be service-impacting would be to schedule a maintenance window and be onsite with the devices (or have out-of-band access to their consoles). You could reconfigure the trunks on both switches via their consoles and be back up in a matter of minutes.