--- title: Tagged VLAN 1 In a Trunk Is a Really Bad Idea «... description: Using tagged VLAN 1 in a VLAN trunk is problematic and should be avoided. VLAN 1 historically became the default/native VLAN because IEEE reserved VLAN 0 for... canonical: https://daily.dev/posts/tagged-vlan-1-in-a-trunk-is-a-really-bad-idea-ipspace-net-blog-pal22lqlf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Tagged VLAN 1 In a Trunk Is a Really Bad Idea « ipSpace.net blog | daily.dev og:description: Using tagged VLAN 1 in a VLAN trunk is problematic and should be avoided. VLAN 1 historically became the default/native VLAN because IEEE reserved VLAN 0 for... og:url: https://daily.dev/posts/tagged-vlan-1-in-a-trunk-is-a-really-bad-idea-ipspace-net-blog-pal22lqlf og:image: https://api.daily.dev/og/posts/PAl22lQLf.png og:image:alt: Tagged VLAN 1 In a Trunk Is a Really Bad Idea « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Tagged VLAN 1 In a Trunk Is a Really Bad Idea « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 5 min read · 0 upvotes · 0 comments ## Summary Using tagged VLAN 1 in a VLAN trunk is problematic and should be avoided. VLAN 1 historically became the default/native VLAN because IEEE reserved VLAN 0 for 802.1p priority bits, leaving VLAN 1 as the standard for untagged packets. Testing across multiple network OS platforms (Arista EOS, Aruba CX, Cisco IOS, Nexus OS, VyOS, Junos, Dell OS10) revealed that most vendors assume VLAN 1 is the native VLAN, requiring workarounds like fake native VLANs or special commands to force tagging. The recommendation is clear: do not use VLAN 1 as a tagged VLAN in trunks; if VLAN 1 must appear in a trunk, use it as the native VLAN. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is VLAN 1 the default native VLAN in 802.1Q trunks? VLAN 1 became the default native VLAN because IEEE reserved VLAN 0 for reuse of the 802.1Q header to carry 802.1p priority bits on untagged packets. Since VLAN 0 was unavailable, VLAN 1 was assigned to untagged packets, making it the default VLAN. Forwarding hardware then used the same VLAN MAC FIB to handle both tagged and untagged traffic. _Network engineers dealing with trunk design decisions track vendor behavior like this on daily.dev._ ### How do I configure tagged VLAN 1 on Cisco IOS or Nexus OS trunks? Cisco IOS and Nexus OS have no direct command to tag VLAN 1; the workaround is to assign a fake native VLAN instead. On Cisco IOS layer-2 images, VLAN 1002 is used as the fake native VLAN. On Nexus OS, the highest available VLAN is used. Note that 'vlan dot1q tag native' is a global command affecting all trunk ports. Cisco IOSv subinterfaces cannot tag VLAN 1 at all — the 'encapsulation dot1q 1' command always appends the 'native' keyword. _Engineers navigating Cisco VLAN trunk edge cases find vendor-specific workarounds discussed on daily.dev._ ### Which network OS platforms support tagged VLAN 1 in a trunk and which do not? Arista EOS and Aruba CX support it with a special command to tag native VLAN packets. Cisco IOS and Nexus OS require a fake native VLAN workaround. Cisco IOSv cannot do it at all. VyOS requires configuring VLAN 1 directly on the built-in bridge interface. Junos switches work but use a fake VLAN 1 config on unit 0. Dell OS10 refuses unless the internal VLAN is changed to something other than VLAN 1. _Teams evaluating multi-vendor network setups track compatibility findings like these on daily.dev._ ## Similar posts on daily.dev - [5 VLAN mistakes I keep seeing people make](https://daily.dev/posts/5-vlan-mistakes-i-keep-seeing-people-make-h78e5conu) · XDA Developers · 1 upvotes · 0 comments - [Mixing managed and unmanaged switches broke my network in ways I never expected](https://daily.dev/posts/mixing-managed-and-unmanaged-switches-broke-my-network-in-ways-i-never-expected-ciyujm06s) · XDA Developers · 0 upvotes · 0 comments - [5 rules I use for sane VLAN design at home \(without overcomplicating it\)](https://daily.dev/posts/5-rules-i-use-for-sane-vlan-design-at-home-without-overcomplicating-it--3wvgbumjq) · XDA Developers · 0 upvotes · 1 comments - [Your switch's management VLAN is sitting on the same network as your smart plug, and that's a massive security problem](https://daily.dev/posts/your-switch-s-management-vlan-is-sitting-on-the-same-network-as-your-smart-plug-and-that-s-a-massiv-2bzjv8vb3) · XDA Developers · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/tagged-vlan-1-in-a-trunk-is-a-really-bad-idea-ipspace-net-blog-pal22lqlf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Tagged VLAN 1 In a Trunk Is a Really Bad Idea « ipSpace.net blog","url":"https://daily.dev/posts/tagged-vlan-1-in-a-trunk-is-a-really-bad-idea-ipspace-net-blog-pal22lqlf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tagged-vlan-1-in-a-trunk-is-a-really-bad-idea-ipspace-net-blog-pal22lqlf"},"datePublished":"2026-08-11T08:52:26.582Z","dateModified":"2026-08-11T09:02:02.810Z","description":"Using tagged VLAN 1 in a VLAN trunk is problematic and should be avoided. VLAN 1 historically became the default/native VLAN because IEEE reserved VLAN 0 for...","image":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","thumbnailUrl":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tagged-vlan-1-in-a-trunk-is-a-really-bad-idea-ipspace-net-blog-pal22lqlf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"Tagged VLAN 1 In a Trunk Is a Really Bad Idea « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tagged-vlan-1-in-a-trunk-is-a-really-bad-idea-ipspace-net-blog-pal22lqlf#faq","mainEntity":[{"@type":"Question","name":"Why is VLAN 1 the default native VLAN in 802.1Q trunks?","acceptedAnswer":{"@type":"Answer","text":"VLAN 1 became the default native VLAN because IEEE reserved VLAN 0 for reuse of the 802.1Q header to carry 802.1p priority bits on untagged packets. Since VLAN 0 was unavailable, VLAN 1 was assigned to untagged packets, making it the default VLAN. Forwarding hardware then used the same VLAN MAC FIB to handle both tagged and untagged traffic. Network engineers dealing with trunk design decisions track vendor behavior like this on daily.dev."}},{"@type":"Question","name":"How do I configure tagged VLAN 1 on Cisco IOS or Nexus OS trunks?","acceptedAnswer":{"@type":"Answer","text":"Cisco IOS and Nexus OS have no direct command to tag VLAN 1; the workaround is to assign a fake native VLAN instead. On Cisco IOS layer-2 images, VLAN 1002 is used as the fake native VLAN. On Nexus OS, the highest available VLAN is used. Note that 'vlan dot1q tag native' is a global command affecting all trunk ports. Cisco IOSv subinterfaces cannot tag VLAN 1 at all — the 'encapsulation dot1q 1' command always appends the 'native' keyword. Engineers navigating Cisco VLAN trunk edge cases find vendor-specific workarounds discussed on daily.dev."}},{"@type":"Question","name":"Which network OS platforms support tagged VLAN 1 in a trunk and which do not?","acceptedAnswer":{"@type":"Answer","text":"Arista EOS and Aruba CX support it with a special command to tag native VLAN packets. Cisco IOS and Nexus OS require a fake native VLAN workaround. Cisco IOSv cannot do it at all. VyOS requires configuring VLAN 1 directly on the built-in bridge interface. Junos switches work but use a fake VLAN 1 config on unit 0. Dell OS10 refuses unless the internal VLAN is changed to something other than VLAN 1. Teams evaluating multi-vendor network setups track compatibility findings like these on daily.dev."}}]} ```