Examkin

Question

Difficulty: HardInterswitch Connectivity and Trunking (802.1Q)

Two Cisco Catalyst switches, Switch-1 and Switch-2, are connected directly via their GigabitEthernet0/1 interfaces. Switch-1 is configured with `switchport trunk native vlan 99` and `switchport trunk allowed vlan 10,20,99`. Switch-2 is configured with `switchport trunk native vlan 10` and `switchport trunk allowed vlan 10,20,99`. A workstation connected to an access port in VLAN 99 on Switch-1 transmits an untagged broadcast frame. Assuming both trunk ports are operational, how will Switch-2 process this frame upon receiving it over the trunk link?

  1. Switch-2 accepts the untagged frame, assigns it to its own configured native VLAN (VLAN 10), and forwards it to ports within VLAN 10.Answer
  2. B
    Switch-2 inspects its MAC address table for VLAN 99, identifies the originating VLAN ID from the frame header, and forwards the frame to ports in VLAN 99.
  3. C
    Switch-2 drops the frame immediately upon arrival because the receiving trunk interface detects an incoming untagged frame on an allowed non-default VLAN.
  4. D
    Switch-2 automatically transitions GigabitEthernet0/1 into an access port with Spanning Tree PortFast enabled to prevent Layer 2 loops caused by the native VLAN mismatch.

Answer

Switch-2 accepts the untagged frame, assigns it to its own configured native VLAN (VLAN 10), and forwards it to ports within VLAN 10.
Under IEEE 802.1Q trunking rules, frames belonging to the trunk's native VLAN are transmitted untagged. Switch-1 transmits the VLAN 99 broadcast frame without an 802.1Q tag because VLAN 99 is its local native VLAN. When Switch-2 receives this untagged frame on its trunk interface, it associates the frame with its own configured native VLAN (VLAN 10). As a result, the frame is processed within VLAN 10 on Switch-2, causing cross-VLAN traffic leakage.

Step-by-Step Solution

1
Analyze frame egress from Switch-1
Switch-1 receives the broadcast in VLAN 99. Because VLAN 99 is configured as the native VLAN on Switch-1's trunk interface, Switch-1 strips/omits the 802.1Q header tag and sends the frame untagged across the trunk link.
By definition in IEEE 802.1Q, traffic belonging to the native VLAN is transmitted across a trunk without an inserted 4-byte 802.1Q VLAN tag.
2
Analyze frame ingress at Switch-2
Switch-2 receives an untagged Ethernet frame on its trunk interface GigabitEthernet0/1.
The frame arrives without any 802.1Q tag identifying its originating VLAN.
3
Apply native VLAN ingress mapping logic on Switch-2
Switch-2 maps the incoming untagged frame to its local native VLAN, which is VLAN 10.
A switch trunk interface always associates untagged incoming frames with its own locally configured native VLAN setting.
4
Determine forwarding domain
The broadcast frame is flooded to all operational access ports in VLAN 10 on Switch-2.
Traffic sent on VLAN 99 on Switch-1 leaks directly into VLAN 10 on Switch-2 due to the native VLAN mismatch.

Key Concept

IEEE 802.1Q Native VLAN Ingress/Egress Processing and Mismatch Behavior
Rate this question

Topics

Interswitch Connectivity and Trunking (802.1Q)

More questions from this topic