cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
41045
Views
95
Helpful
18
Replies

Management and Native VLAN Best Practices

rtmiles24
Beginner
Beginner

Currently our network has a Native VLAN of X set on the trunk links.

We have a management VLAN of Y for all our management traffic.

I have read 2 separate recommendations regarding how to handle these VLAN's.

The first recommends using the Native VLAN as the Management VLAN.

The second recommends keeping these VLAN's separate as I currently have it designed.

Both recommendations came from reputable sources.

What is the best practice, and just as importantly, why is it better than the other option?

Thanks in advance.

18 Replies 18

Joel
Beginner
Beginner

The management and native VLAN is 1 by default. It’s good practise to separate management and user data traffic. Best practise changing the native VLAN to an unused VLAN. I would recommend if possible locking down the VTY sessions and if possible firewall the management VLAN so only relevant users can establish a connection to the kit.

SANS has an old publication on VLAN implementations. There’s a section on VLAN hoping and native VLAN.

http://www.sans.org/security-resources/idfaq/vlan.php

Joel, Thanks for your time. I have already implemented the best practices you mentioned in your reply. I read the documentation you linked to as well. However, I am still looking for a clear reason to combine or keep separate the Native and Management VLAN's. Previously I have found differing opinions from CCIE level resources and want a definitive final answer with justification.

Hello,

The only reason to consider native vlan the same as manamnet vlan is having some devices which do not support vlan tagging. Those devices need to receive frames with no tag.

If all your devices support vlan tagging, assign an unused VLAN to the native VLAN, and put all unactive interfaces into that VLAN.

Hope it helps,

Masoud

Thanks for the info! We are a pure Cisco shop so we are good to go in the VLAN tagging area.

Why put all unactive interfaces into native VLAN? Can you explain more?

You might do something like to prevent accidental use of the interfaces.  The idea is that if something does connect to it when it's not supposed to, then it won't receive service since the Native VLAN should (normally, and in theory) not carry user traffic.

 

I'm of the opinion that you don't put inactive interfaces on the native VLAN, but rather define a VLAN ID (something other than VLAN 1 because you should avoid VLAN 1 for everything) as a VLAN for "these ports are not supposed to be in-use".  Then put inactive ports into "mode access" and apply that VLAN.

 

But, that's just my opinion.  Masoud showcased an environment when using the native VLAN as the "port is inactive" VLAN.  If you're in tha