Native Vlan as Management Vlan

[mikemanz83]

Hello!

We are configuring a bunch of Cisco Merakis APs  in a switch, and the switchports are being configured as Trunks with the native vlan the same as the management vlan of the APs, for example Vlan 100. This Native Vlan is different as the Switch Native vlan. The Aps are getting their Ips through DHCP.

The same is true for some point to point ubiquitis with the native vlan being the same as their management vlan, for example vlan 150.

Why is the reason for this?

Thank you!!

[Kasun Bandara]

you can configure specific native vlan per each trunk port. so make sure all devices which required native vlan, are connected to trunk ports have correct native vlan. also what is the switch model? if its CBS series, make sure you disable smart port feature.

[Flavio Miranda]

Hi

 Native vlan is per trunk configured and is locally significante, that´s why  you see more then on vlan as native. And you use native vlan when you dont want to tag a packet. Meaning, the DHCP request from the Access Point to the DHCP server will cross the trunk with no tag on it. And will be replied by the DHCP server with no tag on it.

The real reason why we use native vlan is here:

"The switch port to which the primary AP is connected can be a trunk port or an access port and must be configured to trunk Native VLAN for management traffic. Data traffic must be trunked with appropriate VLANs for local switching as well"

[mikemanz83]

Hi Flavio! Thanks for your answer.

One of my questions is, why that traffic have to be untagged?

[Karsten Iwen]

In fact, the APs can operate with tagging for the management connection. But with any system, the initial communication to the cloud (Meraki) or controller (like Catalyst APs) has to work. And this is much easier when the native VLAN can be used for this functionality. If you want you can later add tagging to this communication, but both maintenance and troubleshooting is complicated. Having AP management on the native VLAN is likely a good idea. 

For my Meraki deployments I prefer to terminate this VLAN on the firewall and use it not only for MRs, but also for the Meraki switches for dashboard connectivity.