Examkin

Question

Difficulty: MediumInterswitch Connectivity and Trunking (802.1Q)

A network engineer observes that hosts in VLAN 10 on Switch-1 are unexpectedly communicating with hosts in VLAN 20 on Switch-2 across a direct 802.1Q trunk link. Upon reviewing the interface configurations, the engineer finds that Switch-1 has its trunk native VLAN set to VLAN 10, while Switch-2 has its trunk native VLAN set to VLAN 20. When a host in VLAN 10 on Switch-1 sends an uncompressed Ethernet broadcast frame, what is the exact behavior of Switch-2 when it receives this frame?

  1. Switch-2 accepts the untagged frame and forwards it out all active ports belonging to VLAN 20.Answer
  2. B
    Switch-2 inspects the 802.1Q header tag of VLAN 10 and drops the frame because it does not match native VLAN 20.
  3. C
    CDP detects the native VLAN mismatch upon receiving the frame and dynamically changes Switch-2's native VLAN to VLAN 10 to preserve VLAN isolation.
  4. D
    Switch-2 blocks the frame because PortFast on the trunk interface automatically transitions the port into an STP blocking state.

Answer

Switch-2 accepts the untagged frame and forwards it out all active ports belonging to VLAN 20.
When a switch transmits a frame for its configured native VLAN over an IEEE 802.1Q trunk link, it strips the VLAN tag and sends the frame untagged. When the receiving switch accepts an untagged frame on an 802.1Q trunk port, it associates that frame with its own locally configured native VLAN. Because Switch-1 has native VLAN 10 and Switch-2 has native VLAN 20, frames originating in VLAN 10 leave Switch-1 untagged and are ingested into VLAN 20 by Switch-2, causing cross-VLAN traffic leakage.

Step-by-Step Solution

1
Analyze frame egress behavior on Switch-1
Frames originating in VLAN 10 match Switch-1's native VLAN setting (VLAN 10) on the 802.1Q trunk, so Switch-1 transmits the frame across the link untagged (without an 802.1Q VLAN header tag).
By 802.1Q standards, traffic for the configured native VLAN on a trunk link is egressed without adding a 4-byte 802.1Q tag.
2
Analyze frame ingress behavior on Switch-2
Switch-2 receives the untagged frame on its trunk interface. It maps any incoming untagged frame to its local native VLAN configuration, which is VLAN 20.
Switch ports process untagged incoming frames as belonging to whatever native VLAN is locally configured on that receiving trunk port.
3
Determine forwarding decision
Because the frame is now assigned to VLAN 20 inside Switch-2, the broadcast frame is flooded to all active access ports in VLAN 20 on Switch-2.
This behavior results in VLAN hopping / traffic leakage across distinct VLANs due to mismatched native VLAN configurations.

Key Concept

IEEE 802.1Q Native VLAN Tagging and Mismatch Behavior
Estimated Time:1m 30s
Rate this question

Topics

Interswitch Connectivity and Trunking (802.1Q)

More questions from this topic