Examkin

Question

Difficulty: MediumInterswitch Connectivity and Trunking (802.1Q)

Two Cisco Catalyst switches, SW1 and SW2, are connected via an IEEE 802.1Q trunk link. Interface GigabitEthernet0/1 on SW1 is configured with native VLAN 10, while interface GigabitEthernet0/1 on SW2 is configured with native VLAN 20. When a host in VLAN 10 connected to SW1 sends a broadcast frame across the trunk link, how does SW2 process this frame upon arrival?

  1. SW2 receives the untagged frame on its trunk interface and forwards it to all active ports assigned to VLAN 20, causing inter-VLAN traffic leakage.Answer
  2. B
    SW2 drops the frame immediately because the 802.1Q header contains a VLAN identification mismatch error.
  3. C
    SW2 transitions the trunk interface into an err-disabled state because Spanning Tree PortFast Guard detects a switch-to-switch loop.
  4. D
    SW2 inspects the CDP Type-Length-Value (TLV) payload, automatically rewrites the frame header to match VLAN 10, and forwards it to VLAN 10 ports.

Answer

SW2 receives the untagged frame on its trunk interface and forwards it to all active ports assigned to VLAN 20, causing inter-VLAN traffic leakage.
Under IEEE 802.1Q trunking rules, frames belonging to the native VLAN are sent across the trunk link untagged. When SW1 sends a frame for VLAN 10, it strips any tag because VLAN 10 is its native VLAN. When SW2 receives this untagged frame on a trunk interface configured with native VLAN 20, SW2 associates all untagged incoming traffic with its local native VLAN (VLAN 20) and forwards it accordingly, resulting in inter-VLAN leakage between VLAN 10 and VLAN 20.

Step-by-Step Solution

1
Analyze how 802.1Q handles native VLAN egress traffic on SW1
By default, IEEE 802.1Q trunk interfaces transmit frames belonging to the configured native VLAN without inserting a 4-byte 802.1Q tag header. Thus, SW1 transmits the VLAN 10 broadcast frame untagged.
802.1Q maintains backward compatibility with legacy non-trunking devices by omitting VLAN tags on the designated native VLAN.
2
Analyze how SW2 handles untagged ingress traffic on an 802.1Q trunk
When a switch receives an untagged frame on an 802.1Q trunk port, it automatically maps that frame to whichever VLAN is locally configured as the native VLAN on that specific interface. On SW2, the native VLAN is VLAN 20.
Switches rely entirely on local interface configuration to classify incoming untagged frames.
3
Determine the operational outcome of the mismatch
The broadcast frame sent by VLAN 10 on SW1 is flooded out ports in VLAN 20 on SW2, creating an unintended security vulnerability and cross-VLAN traffic leakage.
Mismatched native VLAN configurations merge separate broadcast domains at Layer 2.

Key Concept

802.1Q Native VLAN Tagging Mechanics and Mismatch Behavior
Estimated Time:1m 30s
Rate this question

Topics

Interswitch Connectivity and Trunking (802.1Q)

More questions from this topic