Service Manual

Enabling Null VLAN as the Default VLAN
In a Carrier Ethernet for Metro Service environment, service providers who perform frequent reconfigurations
for customers with changing requirements occasionally enable multiple interfaces, each connected to a
different customer, before the interfaces are fully configured.
This presents a vulnerability because both interfaces are initially placed in the native VLAN, VLAN 1, and for
that period customers are able to access each other's networks. Dell Networking OS has a Null VLAN to
eliminate this vulnerability. When you enable the Null VLAN, all ports are placed into it by default, so even if
you activate the physical ports of multiple customers, no traffic is allowed to traverse the links until each port
is place in another VLAN.
To enable Null VLAN, use the following command.
• Disable the default VLAN, so that all ports belong to the Null VLAN until configured as a member of
another VLAN.
CONFIGURATION mode
default-vlan disable
Default: the default VLAN is enabled (no default-vlan disable).
Configuring Native VLANs
Traditionally, ports can be either untagged for membership to one VLAN or tagged for membership to
multiple VLANs.
You must connect an untagged port to a VLAN-unaware station (one that does not understand VLAN tags)
and connect a tagged port to a VLAN-aware station (one that generates and understands VLAN tags).
Native VLAN support breaks this barrier so that you can connect a port to both VLAN-aware and VLAN-
unaware stations. Such ports are referred to as hybrid ports. Physical and port-channel interfaces may be
hybrid ports.
Native VLAN is useful in deployments where a Layer 2 port can receive both tagged and untagged traffic on
the same physical port. The classic example is connecting a voice-over-IP (VoIP) phone and a PC to the same
port of the switch. The VoIP phone is configured to generate tagged packets (with VLAN = VOICE VLAN) and
the attached PC generates untagged packets.
NOTE
: You cannot configure an existing switchport or port channel interface for Native VLAN. Interfaces
must have no other Layer 2 or Layer 3 configurations when using the portmode hybrid command or a
similar message displays: % Error: Port is in Layer-2 mode Gi 5/6.
To configure a port so that it can be a member of untagged and tagged VLANs, use the following commands.
1 Remove any Layer 2 or Layer 3 configurations from the interface.
INTERFACE mode
2 Configure the interface for Hybrid mode.
Virtual LANs (VLANs) 1122