3

The 5500 manual says one shouldn't use VLAN 1 on access ports. Furthermore, it couldn't be added to trunk ports.

Unfortunately, the manual gives no reason. Normally, all VLANs are tagged on trunk ports. Is VLAN 1 not tagged? Is VLAN 1 then local to a switch only?

Isn't it possible to leave VLAN 1 on all access ports untagged and forward it tagged on the trunks?

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. Commented Aug 7, 2017 at 22:39

2 Answers 2

Reset to default
2

Normally, all but the native vlan are tagged on trunk ports. Some vendors do prefer tagging everything on trunk ports.

The "don't use VLAN 1" is a Best Practice™ (aka. religion.) People prefer to avoid baked in defaults so there are fewer surprises down the road. If you have a simple enough network, there's no reason VLAN 1 cannot be used.

VLAN 1 does have special meaning to (eg) spanning-tree.

Improve this answer
1
  • All but the vlan-1 are tagged on trunks is what I understood from the 3Com Manual. We use spanning tree. So VLAN-1 should probably be kept untagged. Commented Mar 31, 2016 at 3:59
0

VLAN 1 is usually the native (untagged) VLAN. Using VLAN 1, and native VLANs in general, poses some security risk.

Access ports should not use VLAN tags since most end-devices (some servers may) don't understand VLAN tags. Tags are used on trunks, where multiple VLANs are on the same link, in order to distinguish which frames belong to which VLAN. You can have one untagged (native) VLAN on a trunk since you can distinguish it from the tagged frames.

Some devices do not let you disable VLAN 1. It is likely that your switch requires VLAN 1 on a trunk, so you can't configure it.

Improve this answer
2
  • Why can't vlan1 be disabled? I think HP ProCurve can disable it. HP VLAN1 is like all the other VLANs. HP doesn't distinguish between trunk, hybrid and access ports. Each VLAN is just tagged / untagged / forbidden on each port. That's much clearer. Commented Mar 31, 2016 at 3:51
  • 1
    @chris, as Ricky pointed out, VLAN 1 means something special to STP. Commented Mar 31, 2016 at 4:07

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.