Troubleshoot › Error Decoder › %CDP-4-NATIVE_VLAN_MISMATCH

What does %CDP-4-NATIVE_VLAN_MISMATCH mean?

Native VLAN mismatch on a trunk

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/0/49 (501), with Switch2 GigabitEthernet1/0/49 (1)

Platform: Cisco IOS / IOS XE. Values shown are the documented defaults — confirm them on your platform with the check commands below.

What it means

A trunk is a link carrying many VLANs (separate virtual networks) between switches. Traffic for one special VLAN — the 'native' VLAN — crosses the trunk without a tag. The two switches disagree about which VLAN that is, so untagged traffic leaving switch A in VLAN 501 arrives at switch B and lands in VLAN 1. Two separate networks are now silently leaking into each other.

Likely causes, in order

• Someone changed the native VLAN on one switch during a migration and not the other.
• A new switch was connected with default settings (native VLAN 1) to a trunk configured for something else.
• Part of a staged security change — moving the native VLAN off VLAN 1 — that was only half finished.

Check, in order

1. Copyshow interfaces trunkThe native VLAN configured on each end of the trunk — they must match exactly.
2. Copyshow spanning-tree inconsistentportsWhether spanning tree has already blocked a port to protect the network from this leak.

The fix

• Pick the intended native VLAN and set it identically on both ends of the trunk: switchport trunk native vlan <id>.
• Better still, tag the native VLAN (vlan dot1q tag native) or move it to an unused VLAN with no devices in it — that removes this whole class of leak.
• Verify the log message stops and both switches agree in show interfaces trunk.

Source: Cisco 802.1Q trunking documentation

More error messages