Hands-On Lab: Changing the Native VLAN and Shutting Down Unused Ports

Lab Objective

Change the native VLAN on a trunk link from the default VLAN 1 to a dedicated unused VLAN, and administratively shut down all switch ports that currently have no device connected.

Lab Purpose

Leaving the native VLAN at its default value of 1 is a well-known security weakness, since VLAN 1 is a predictable target for certain Layer 2 attacks. Similarly, unused switch ports left enabled and in the default VLAN represent an open door for anyone who can physically access a wiring closet — both are baseline hardening steps expected on any production switch.

Lab Topology

Switch1 ---- Gi1/0/24 (trunk to Switch2)

Switch1 also has unused ports Gi1/0/20
through Gi1/0/23 with no device connected

Dedicated native VLAN to be used: VLAN 999
(created but assigned no access ports,
 existing purely to serve as the native VLAN)

Task 1: Create the Dedicated Native VLAN

Create VLAN 999 named NativeUnused.

Task 2: Change the Trunk's Native VLAN

On Gi1/0/24, change the native VLAN from the default to VLAN 999.

Task 3: Verify the Native VLAN Change

Confirm the trunk now shows VLAN 999 as native rather than VLAN 1.

Task 4: Shut Down Unused Ports

Administratively shut down Gi1/0/20 through Gi1/0/23.

Task 5: Verify the Unused Ports Are Disabled

Confirm each port shows an administratively down status.

Solution and Verification

Switch1(config)# vlan 999
Switch1(config-vlan)# name NativeUnused
Switch1(config-vlan)# exit

Switch1(config)# interface gigabitethernet1/0/24
Switch1(config-if)# switchport trunk native vlan 999

Switch1# show interfaces trunk

Port      Mode   Encapsulation  Status    Native vlan
Gi1/0/24  on     802.1q         trunking  999

Switch1(config)# interface range gigabitethernet1/0/20-23
Switch1(config-if-range)# shutdown

Switch1# show interfaces status

Port       Name    Status                Vlan
Gi1/0/20           disabled              1
Gi1/0/21           disabled              1
Gi1/0/22           disabled              1
Gi1/0/23           disabled              1

Key Takeaway

Both ends of a trunk must agree on the native VLAN — changing it on only one side creates a native VLAN mismatch, a condition IOS explicitly warns about via CDP-based detection. Combined with disabling unused ports, these two steps close two of the most commonly exploited Layer 2 weaknesses in an unhardened switch configuration.