Using "vlan dot1q tag native" and Meraki gateways

[danielddddddddd]

Hi,

I have a client who is using the command "vlan dot1q tag native" on their Catalyst switches (causing all packets even on the default VLAN to be tagged and require tags), and Meraki MX105 firewalls.

Packets leaving the MX105s are tagged on all VLANs except the default VLAN 1. When packets hit the C9300s they are discarded, as per the command's request.

I've changed the Meraki ports to drop untagged traffic like so:

This has not fixed the problem.

If I change the Meraki configuration so that a dummy VLAN (not required on that port) is the native port and the rest is tagged, that works but is inelegant.

Is there a correct Catalyst solution here please? Can I permit non-tagged traffic on just the trunk ports I need to? I don't see an interface-level command for this.

Thanks all

[MHM Cisco World]

vlan dot1q tag native <<- this command per interface' remove it and hence SW will untag traffic of native vlan 

MHM

[danielddddddddd]

Reconfiguring my entire network is not possible.

[MHM Cisco World]

That why I mention this command per interface

Only make SW untag native vlan in trunk toward FW

Note:- not all SW support command per interface but in global mode 

MHM

[danielddddddddd]

Thank you for your suggestion - my original post was asking how to do this, not what to do. I realise that permitting and sending untagged traffic on just these trunk ports is what is required, but I don't know how to do this.

The C9300 with software v17.16.01 does not have a 'vlan' or 'dot1q' at interface level and I do not know if there is another command I should issue.

[paul driver]

Hello
as the native vlan is not per switch but per interface - I would say using an unused vlan as the native and pruning it off all trunks is the most viable option - infact it recommended as a best practice  - as removing the native vlan as being tagged is also recommended but you state this cannot be done.

[MHM Cisco World]

I check yesterday 

C9k not support per interface native vlan untag command so you can disbale it 

Meraki FW not support native vlan tag 

So you workaround is only way to solve issue.

Thanks 

MHM