Examkin

Question

Difficulty: HardSwitching Concepts and VLANs

A network administrator connects two Layer 2 switches, SwitchA and SwitchB, using an IEEE 802.1Q trunk link on port GigabitEthernet 0/1. SwitchA is configured with native VLAN 20 on its trunk interface, whereas SwitchB is configured with native VLAN 10 on its trunk interface. Host A, connected to an access port on SwitchA assigned to VLAN 20, sends an untagged ARP request broadcast frame. Assuming port security and VLAN filtering do not drop the traffic, what will happen when this broadcast frame arrives at SwitchB?

  1. SwitchB accepts the untagged frame and floods it out all active access ports assigned to VLAN 10, resulting in unexpected cross-VLAN traffic leaking.Answer
  2. B
    SwitchB drops the incoming frame immediately because IEEE 802.1Q trunks automatically discard untagged frames when a native VLAN mismatch is detected.
  3. C
    SwitchB inspects the frame's Layer 3 IP header and routes the broadcast packet directly to VLAN 20 hosts.
  4. D
    SwitchB forces an automatic Spanning Tree Protocol root bridge election to reassign native VLAN IDs dynamically across both switches.

Answer

SwitchB accepts the untagged frame and floods it out all active access ports assigned to VLAN 10, resulting in unexpected cross-VLAN traffic leaking.
Under IEEE 802.1Q, frames belonging to a trunk's native VLAN are sent without an explicit 802.1Q VLAN header tag. SwitchA transmits Host A's VLAN 20 broadcast frame untagged because VLAN 20 is configured as SwitchA's native VLAN. When SwitchB receives this untagged frame on its trunk interface, it tags/associates the frame internally with its own locally configured native VLAN (VLAN 10). Consequently, SwitchB floods the broadcast frame to all ports in VLAN 10, creating a cross-VLAN security and operational issue known as native VLAN leakage.

Step-by-Step Solution

1
Analyze frame egress at SwitchA
Host A sends a broadcast frame in VLAN 20. SwitchA forwards it across the trunk. Since VLAN 20 matches SwitchA's native VLAN on the trunk port, SwitchA strips/omits the 802.1Q VLAN tag.
IEEE 802.1Q standard specifies that frames belonging to the configured native VLAN are transmitted untagged over a trunk link.
2
Analyze frame ingress at SwitchB
SwitchB receives an untagged Ethernet frame on its trunk port GigabitEthernet 0/1.
The trunk link physically delivers the untagged frame to SwitchB's receiving port.
3
Apply SwitchB local native VLAN rules
SwitchB associates the untagged incoming frame with its local native VLAN, which is VLAN 10.
By definition, any untagged frame arriving on an 802.1Q trunk port is implicitly assigned to the native VLAN configured on the receiving switch interface.
4
Determine forwarding behavior for broadcast traffic
SwitchB floods the broadcast frame to all active access ports belonging to VLAN 10.
Broadcast frames are flooded throughout the local broadcast domain (VLAN 10), causing cross-VLAN traffic leakage.

Key Concept

802.1Q Native VLAN Ingress/Egress Tagging & Mismatch Behavior
Estimated Time:2m 0s
Rate this question

Topics

Switching Concepts and VLANs

More questions from this topic