What is a native VLAN?

The one VLAN whose traffic crosses a trunk untagged. It exists for compatibility with devices that do not understand 802.1Q tagging. Everything else on the trunk carries a tag.

Why is a native VLAN mismatch dangerous?

Because the frame carries no tag, so the receiving switch applies its own native VLAN. Traffic from one VLAN silently appears in another, joining two broadcast domains, and neither switch logs an error — each did exactly what it was told.

How should I set the native VLAN?

Identically on both ends, and to an unused VLAN ID that carries no traffic. That way an untagged frame on the trunk belongs to nothing and reaches nothing.

Why does traffic work one way and not the other?

Usually an allowed VLAN list that differs between the two ends. The VLAN is pruned in one direction only, which produces exactly that asymmetric symptom.

Is anything sent anywhere?

No. This is a simulation of the tagging rules running in your browser. No traffic is generated and nothing about your network is transmitted.

Home › Networking › VLAN Trunk Visualizer

VLAN Trunk Visualizer

Send a frame between two switches and watch where the 802.1Q tag is added and removed — including what happens when the two ends disagree about the native VLAN.

Local toolYour network plan stays in your browser. Nothing you enter is uploaded, logged, or sent to any server.

Source access port VLAN

Destination access port VLAN

Switch 1 native VLAN

Switch 2 native VLAN

Switch 1 allowed VLANs

Switch 2 allowed VLANs

Checks

Tagging, native VLANs, and why a mismatch is dangerous

An access port belongs to one VLAN. A frame arriving there carries no VLAN information — the switch classifies it by the port. When that frame leaves on a trunk, the switch inserts an 802.1Q tag naming the VLAN, so the switch at the far end knows which broadcast domain it belongs to.

The native VLAN is the exception. Traffic in the native VLAN crosses the trunk untagged. That exists for historical compatibility with devices that do not understand tagging.

Which produces the fault worth understanding. If switch 1 has native VLAN 10 and switch 2 has native VLAN 20, a frame from VLAN 10 leaves untagged, arrives at switch 2, and — having no tag — is classified into VLAN 20. Two broadcast domains are now joined. Neither switch logs an error, because from each one's point of view it did exactly what it was configured to do. This is sometimes called VLAN hopping, and it is why security guidance recommends setting the native VLAN to an unused ID carrying no traffic at all.

The allowed list prunes which VLANs a trunk carries. A VLAN missing from one end's list is dropped in that direction, which produces the confusing symptom of traffic working one way and not the other.

Related tools

VLAN + Subnet Designer allocates the addressing. VLAN Planner documents what you already have.