Hands-On Lab: Changing the Native VLAN and Shutting Down Unused Ports

Lab Objective

Change the native VLAN on a trunk link from the default VLAN 1 to a dedicated unused VLAN, and administratively shut down all switch ports that currently have no device connected.

Lab Purpose

Leaving the native VLAN at its default value of 1 is a well-known security weakness, since VLAN 1 is a predictable target for certain Layer 2 attacks. Similarly, unused switch ports left enabled and in the default VLAN represent an open door for anyone who can physically access a wiring closet — both are baseline hardening steps expected on any production switch.

Lab Topology

Switch1 ---- Gi1/0/24 (trunk to Switch2)

Switch1 also has unused ports Gi1/0/20
through Gi1/0/23 with no device connected

Dedicated native VLAN to be used: VLAN 999
(created but assigned no access ports,
 existing purely to serve as the native VLAN)

Task 1: Create the Dedicated Native VLAN

Create VLAN 999 named NativeUnused.

Task 2: Change the Trunk's Native VLAN

On Gi1/0/24, change the native VLAN from the default to VLAN 999.

Task 3: Verify the Native VLAN Change

Confirm the trunk now shows VLAN 999 as native rather than VLAN 1.

Task 4: Shut Down Unused Ports

Administratively shut down Gi1/0/20 through Gi1/0/23.

Task 5: Verify the Unused Ports Are Disabled

Confirm each port shows an administratively down status.

Solution and Verification

Switch1(config)# vlan 999
Switch1(config-vlan)# name NativeUnused
Switch1(config-vlan)# exit

Switch1(config)# interface gigabitethernet1/0/24
Switch1(config-if)# switchport trunk native vlan 999

Switch1# show interfaces trunk

Port      Mode   Encapsulation  Status    Native vlan
Gi1/0/24  on     802.1q         trunking  999

Switch1(config)# interface range gigabitethernet1/0/20-23
Switch1(config-if-range)# shutdown

Switch1# show interfaces status

Port       Name    Status                Vlan
Gi1/0/20           disabled              1
Gi1/0/21           disabled              1
Gi1/0/22           disabled              1
Gi1/0/23           disabled              1

Key Takeaway

Both ends of a trunk must agree on the native VLAN — changing it on only one side creates a native VLAN mismatch, a condition IOS explicitly warns about via CDP-based detection. Combined with disabling unused ports, these two steps close two of the most commonly exploited Layer 2 weaknesses in an unhardened switch configuration.

Hands-On Lab: Changing the Native VLAN and Shutting Down Unused Ports

Lab Objective

Lab Purpose

Lab Topology

Task 1: Create the Dedicated Native VLAN

Task 2: Change the Trunk's Native VLAN

Task 3: Verify the Native VLAN Change

Task 4: Shut Down Unused Ports

Task 5: Verify the Unused Ports Are Disabled

Solution and Verification

Key Takeaway

Related Articles

Hands-On Lab: Assigning Spanning Tree Priority to Multiple VLANs Simultaneously

Hands-On Lab: Configuring Spanning Tree Root Bridges Using the IOS Macro Command

Hands-On Lab: Configuring Spanning Tree Protocol Root Bridges Manually

Hands-On Lab: Verifying Spanning Tree Port States on Catalyst Switches

Hands-On Lab: Restricting Allowed VLANs on Trunks and Changing VTP Version

Hands-On Lab: Configuring Extended VLANs on Cisco Catalyst Switches

Related Articles

Hands-On Lab: Assigning Spanning Tree Priority to Multiple VLANs Simultaneously
This hands-on lab configures Spanning Tree bridge priority across several VLANs in a single command using a VLAN range, rather than repeating the configuration individually for each VLAN, and verifies the priority was correctly applied to every VLAN in the range.
Continue

Hands-On Lab: Configuring Spanning Tree Root Bridges Using the IOS Macro Command
This hands-on lab uses the spanning-tree root primary and root secondary macro commands to configure a primary and backup root bridge without manually calculating priority values, and verifies IOS automatically selects an appropriate priority relative to the current root.
Continue

Hands-On Lab: Configuring Spanning Tree Protocol Root Bridges Manually
This hands-on lab manually influences Spanning Tree root bridge election by adjusting bridge priority on two competing switches, verifying which switch becomes root before and after the change, and confirming the resulting port roles update accordingly.
Continue

Hands-On Lab: Verifying Spanning Tree Port States on Catalyst Switches
This hands-on lab observes a switch port transitioning through the Spanning Tree Protocol states of blocking, listening, learning, and forwarding as it comes online, and covers the show commands used to check a port's current state and role.
Continue

Hands-On Lab: Restricting Allowed VLANs on Trunks and Changing VTP Version
This hands-on lab covers restricting which VLANs are permitted to cross a specific trunk link, preventing unnecessary broadcast traffic and improving security, and separately covers safely changing a switch's VTP version within an existing domain.
Continue

Hands-On Lab: Configuring Extended VLANs on Cisco Catalyst Switches
This hands-on lab covers creating VLANs in the extended range above 1005, explains why VTP version matters for supporting them, and verifies an extended VLAN functions identically to a standard-range VLAN once created.
Continue