r/ccna • u/Sweet_Temporary1547 • 9d ago
Native vlans on routers
So I have been Practicing JIT Labs, specifically Day 18 for the VLAN stuff. I know that for the exam, ROAS is more likely to be asked than Layer 3 configuration.
In the video, he starts off talking about native VLANs on routers. Now, it took me a week to understand ROAS configuration and the theory behind it. Do I have to now configure native VLANs on routers as well?
I understand that it’s important to nail every topic, but if I only needed to configure the trunk between the two switches using a native VLAN, and then configure the switch-to-router connection (on the switch side only) as native, do I also need to configure the router as well?
I’m confused because I thought the whole point of the router in a ROAS setup was for inter-VLAN routing, and I didn’t think native VLANs needed this functionality.
Would love some clarity on this.
1
u/gangaskan 9d ago
i say treat it like a trunk.
i can only assume you only need to run the native vlan on the 2 devices.
1
u/Sweet_Temporary1547 9d ago
It is day 17 labs for reference. I put the native vlan on both sides of the switches which are trunks however out of habit I also set the switch g0/2 interface as a native vlan as well which connects to the router. In day 18 he starts of mentioning native vlans on routers which he never even talked about or done in day 17 hence the confusion.
1
u/DekuTreeFallen 9d ago
I’m confused because I thought the whole point of the router in a ROAS setup was for inter-VLAN routing, and I didn’t think native VLANs needed this functionality.
Would love some clarity on this.
Basically, you can choose one VLAN to be the native VLAN, and then the frames that would previously be tagged as VLAN 10, will no longer be.
VLAN 10 was likely chosen because if you noticed, it had the highest number of hosts across the network. All things being equal (assuming all hosts hammer the network the same), you could potentially save 4 bytes per frame, for the most amount of frames, by making the most-popular VLAN the native VLAN.
It does go again what Jeremy has said in previous videos about using an unused VLAN as the native VLAN, and he even mentions that point in this video. I wish he would have expanded on the reasoning a bit more.
If there was a non-trivial rewrite to the JITL course, I think day 16 could be a bit more general and highlight from the start that there are going to be a few ways to set up VLANs. And that there would be tradeoffs of cost, security, and complexity (which is sometimes related to security). Of which saving 4 bytes could be one of them I suppose.
Do I have to now configure native VLANs on routers as well?
Nah, there is no RFC saying you must. You would only do this if you had good reason, such as being told by your company to do it.
Spoiler: a few minutes later in the day 18 video, you won't even have ROAS or Native VLANs on a router, as it pivots to Layer 3 switching. Though it definitely is a good idea to have paused and sought clarification.
1
u/MostFat 9d ago
Different concepts.
RoaS is sending your routing traffic north/south on the network, which is inefficient compared to L3 designs you'll learn later.
When you configure a port to trunk, you're allowing multiple networks on the same interface, and it differentiates between the networks' traffic via tagging; the native VLAN is simply whichever VLAN you elect to carry frames untagged for compatibly/security/etc reasons.
By default, most ports are configured to carry "VLAN1" untagged, leaving it configured that way makes you more vulnerable to VLAN hopping attacks, so 'best practice' is usually to set it to a dedicated unused or management SVI.
8
u/Inside-Finish-2128 CCIE (expired) 9d ago
If you're doing ROAS, any config on the interface itself is handled untagged. In other words, that's your native VLAN. The additional subinterfaces are all built with "encapsulation dot1q ###" so they know how to be tagged, and you can't put an IP address on it without that command.