200-301 · Question #413
How is the native VLAN secured in a network?
The correct answer is D. configure it as a different VLAN ID on each end of the link. To secure the native VLAN, it should be configured as a different, unused VLAN ID on each end of the trunk link, and preferably not VLAN 1, which is the default native VLAN on many switches. This prevents double-tagging attacks and isolates untagged traffic.
Question
How is the native VLAN secured in a network?
Options
- Aseparate from other VLANs within the administrative domain
- Bgive it a value in the private VLAN range
- Cassign it as VLAN 1
- Dconfigure it as a different VLAN ID on each end of the link
How the community answered
(38 responses)- A3% (1)
- B16% (6)
- C8% (3)
- D74% (28)
Why each option
To secure the native VLAN, it should be configured as a different, unused VLAN ID on each end of the trunk link, and preferably not VLAN 1, which is the default native VLAN on many switches. This prevents double-tagging attacks and isolates untagged traffic.
While separating it is good, merely being separate doesn't define the specific security mechanism for the native VLAN itself.
Giving it a value in the private VLAN range relates to Private VLAN (PVLAN) technology, which is a different security feature, not the primary method for securing the native VLAN.
Assigning it as VLAN 1 is the default and often insecure configuration, as VLAN 1 is a well-known VLAN that attackers frequently target.
Securing the native VLAN involves configuring it to use an arbitrary, unused VLAN ID (not VLAN 1) on each end of a trunk link, making sure the IDs match. This practice helps prevent VLAN hopping attacks, especially double-tagging attacks, by ensuring untagged traffic is not sent to a well-known or critical VLAN.
Concept tested: Native VLAN security best practices
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/vlan/configuration_guide/b_vlan_3se_3850_cg/b_vlan_3se_3850_cg_chapter_011.html
Topics
Community Discussion
No community discussion yet for this question.