What Is the Default VLAN on a Cisco Switch?

On any Cisco Catalyst or Nexus switch straight out of the box, the default VLAN is VLAN 1. From the moment you apply power to a factory-fresh switch, all physical Ethernet interfaces are active, unconfigured, and assigned as untagged access ports to this default broadcast domain.

While VLAN 1 makes initial setup plug-and-play—allowing devices connected to any port to communicate immediately without configuration—relying on it in production introduces operational and security liabilities. Understanding how Cisco handles VLAN 1, how it differs from native and management VLANs, and how to safely migrate traffic away from it is an essential baseline for enterprise network administration.

Cisco Catalyst Default VLAN Specifications and Architecture

According to official Cisco Catalyst Software Configuration Guides for Cisco IOS and Cisco IOS-XE, VLAN 1 is hardcoded into switch firmware as the permanent administrative and operational default.

Core Architectural Specifications

• Default VLAN ID: 1
• Default VLAN Name: default
• VLAN Range Classification: Normal-range VLAN (VLAN IDs 1–1005). Normal-range definitions are stored in flash memory within the vlan.dat database file.
• Factory Port Assignment: Every standard Ethernet interface (FastEthernet, GigabitEthernet, TenGigabitEthernet) belongs to VLAN 1 by default.
• 802.1Q Trunk Association: IEEE 802.1Q trunk encapsulation designates VLAN 1 as the default untagged native VLAN.
• Control Plane Binding: Critical Cisco Layer 2 control protocols—including Cisco Discovery Protocol (CDP), VLAN Trunking Protocol (VTP), Port Aggregation Protocol (PAgP), Dynamic Trunking Protocol (DTP), and Spanning Tree Protocol (STP)—are architecturally tied to VLAN 1 for neighbor negotiation and topology maintenance.
• Administrative Immutability: VLAN 1 cannot be deleted, cleared, or renamed. The entry VLAN 0001 remains permanently registered in the switch’s internal Layer 2 forwarding table.

Default VLAN vs. Native VLAN vs. Management VLAN: Key Differences

In casual conversation, engineers often use the terms “default VLAN,” “native VLAN,” and “management VLAN” interchangeably. In Cisco architectures, however, they represent three distinct Layer 2 concepts that happen to share the same ID (VLAN 1) in factory-default configurations.

How to Verify Default VLAN Port Assignments in Cisco IOS

Before restructuring your Layer 2 environment, inspect how your switch currently maps ports to VLAN 1. You can verify port membership and trunk behavior using four standard Cisco IOS commands.

Step 1: Check Global Port Memberships

Run show vlan brief to get an immediate summary of which interfaces reside in VLAN 1:

Switch# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi1/0/1, Gi1/0/2, Gi1/0/3, Gi1/0/4
                                                Gi1/0/5, Gi1/0/6, Gi1/0/7, Gi1/0/8
10   USERS                            active    
20   VOICE                            active    

Interfaces listed alongside 1 default are actively operating inside the default broadcast domain.

Step 2: Inspect Port Operational Status

To quickly check duplex, speed, and VLAN assignments across all interfaces simultaneously, execute:

Switch# show interfaces status
Port      Name               Status       Vlan       Duplex  Speed Type
Gi1/0/1                      connected    1            a-full  a-1000 10/100/1000BaseTX
Gi1/0/2                      notconnect   1              auto    auto 10/100/1000BaseTX
Gi1/0/3                      connected    10           a-full  a-1000 10/100/1000BaseTX
Gi1/0/24                     connected    trunk        a-full  a-1000 10/100/1000BaseTX

Step 3: Audit Layer 2 Properties on a Specific Interface

To view detailed Layer 2 characteristics—such as administrative mode, operational mode, and access VLAN assignment—query the specific switchport:

Switch# show interfaces GigabitEthernet 1/0/1 switchport
Name: Gi1/0/1
Switchport: Enabled
Administrative Mode: dynamic auto
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)

Step 4: Verify Native VLAN ID Across Trunk Links

To determine if an active trunk is still using VLAN 1 as its untagged native channel, run:

Switch# show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi1/0/24    on               802.1q         trunking      1

Port        Vlans allowed on trunk
Gi1/0/24    1-4094

Port        Vlans allowed and active in management domain
Gi1/0/24    1,10,20

If Native vlan displays 1, untagged frames traverse that link on the default VLAN, signaling that the trunk needs hardening.

Security Vulnerabilities of VLAN 1: Why Default Assignments Are Risky

Leaving user endpoints, management services, and trunk native links assigned to VLAN 1 creates an expanded attack surface. Because VLAN 1 is universally predictable across all Cisco hardware, attackers leverage this default state for reconnaissance and Layer 2 exploitation.

Threat 1: VLAN Hopping via Switch Spoofing

By default, older Cisco switches set interfaces to dynamic auto or dynamic desirable. If an attacker connects a rogue device running software like Yersinia and sends Dynamic Trunking Protocol (DTP) packets, the switchport may negotiate an active 802.1Q trunk link. Once trunking is established, the attacker gains direct access to all VLANs permitted across that link.

Threat 2: 802.1Q Double-Tagging Attacks

Double-tagging exploits how switches handle native VLAN headers:
1. An attacker connected to an access port on VLAN 1 crafts an Ethernet frame with two 802.1Q tags: an outer tag of VLAN 1 (the trunk’s native VLAN) and an inner tag of the target victim network (e.g., VLAN 50).
2. The first switch receives the frame, observes that the outer tag matches its trunk’s native VLAN (VLAN 1), strips the outer tag, and forwards the packet untagged across the trunk.
3. The downstream switch reads the remaining inner tag (VLAN 50) and forwards the packet into the target subnet without routing validation.

While double-tagging is strictly unidirectional (the attacker cannot receive return packets directly), it allows blind packet injection, such as spoofed UDP or ICMP traffic, into restricted segments.

Layer 2 Hardening Principles

To mitigate these exposures:
* Never assign end-user workstations, printers, or servers to VLAN 1.
* Move the administrative SVI (interface Vlan) to an isolated, non-default VLAN ID.
* Change the native VLAN on all 802.1Q trunks to an unused, non-routable ID.
* Disable unused switchports, assign them to an isolated quarantine VLAN, and shut them down administratively.

Frequently Asked Questions: Deleting, Renaming, or Disabling VLAN 1

Can you delete VLAN 1 from a Cisco switch?

No. If you enter global configuration mode and attempt to remove VLAN 1, the switch rejects the command immediately:

Switch(config)# no vlan 1
% Default VLAN 1 may not be deleted.

VLAN 1 is hardcoded into Cisco IOS/IOS-XE as a permanent system object and cannot be cleared from the VLAN database.

Can you rename VLAN 1?

No. Attempting to alter the administrative label assigned to VLAN 1 will result in an error:

Switch(config)# vlan 1
Switch(config-vlan)# name MANAGEMENT
% Default VLAN 1 may not be renamed.

Its name will remain default for the lifespan of the operating system image.

Can you administratively shut down VLAN 1?

It depends on the context (Layer 2 vs. Layer 3):
* Layer 3 Interface (SVI): You can safely shut down the management interface by running shutdown under interface Vlan 1. This disables Layer 3 IP reachability on that SVI without impacting Layer 2 switching.
* Layer 2 VLAN State: On modern Cisco Catalyst switches running IOS-XE, the CLI allows you to execute shutdown directly inside VLAN configuration mode (vlan 1 -> shutdown). This halts Layer 2 bridging for user payloads inside VLAN 1. However, doing so does not stop core internal control traffic.

What happens to control plane protocols if VLAN 1 is pruned from a trunk?

If you manually prune VLAN 1 from an 802.1Q trunk using switchport trunk allowed vlan remove 1, Cisco control plane protocols do not break.

Internal control frames—such as CDP, VTP, DTP, and PAgP—are handled by the switch’s internal backplane supervisor. The switch continues to transmit and process these control protocols across trunk links over VLAN 1 regardless of the trunk’s allowed VLAN list. Similarly, Per-VLAN Spanning Tree Plus (PVST+) continues sending BPDUs for other active VLANs undisturbed.

Configuration Guide: Reassigning Switchports and Changing the Native VLAN

Follow this implementation template to transition access interfaces away from VLAN 1, reassign native trunking, and quarantine unallocated ports.

1. Create Dedicated Production VLANs and Reassign Access Ports

! Step 1: Create production VLANs
Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name DATA_USERS
Switch(config-vlan)# exit

Switch(config)# vlan 20
Switch(config-vlan)# name VOICE
Switch(config-vlan)# exit

! Step 2: Reassign user-facing access ports away from VLAN 1
Switch(config)# interface range GigabitEthernet 1/0/1 - 10
Switch(config-if-range)# description User Access Ports
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# switchport voice vlan 20
Switch(config-if-range)# switchport nonegotiate
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# spanning-tree bpduguard enable
Switch(config-if-range)# exit

2. Configure a Non-Default Native VLAN on 802.1Q Trunks

To prevent double-tagging, designate an unused VLAN ID (e.g., VLAN 999) as a dedicated native VLAN across all interconnected switches.

! Step 1: Define an unused dummy VLAN for native traffic
Switch(config)# vlan 999
Switch(config-vlan)# name UNUSED_NATIVE
Switch(config-vlan)# state active
Switch(config-vlan)# exit

! Step 2: Apply the new native VLAN to trunk uplinks
Switch(config)# interface GigabitEthernet 1/0/24
Switch(config-if)# description Uplink_to_Core
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 999
Switch(config-if)# switchport trunk allowed vlan 10,20,999
Switch(config-if)# switchport nonegotiate
Switch(config-if)# exit

! Optional hardening: Force the switch to tag the native VLAN globally
Switch(config)# vlan dot1q tag native

Note: The switchport trunk native vlan ID must match on both ends of the link. A mismatch triggers CDP native VLAN mismatch errors (%CDP-4-NATIVE_VLAN_MISMATCH) and can cause Spanning Tree to block the port to prevent loops.

3. Quarantine and Park All Unused Switchports

Unused interfaces should never remain active in VLAN 1. Move them to an unrouted, dead-end VLAN and disable them administratively:

! Step 1: Create an isolated parking lot VLAN
Switch(config)# vlan 666
Switch(config-vlan)# name PARKING_LOT
Switch(config-vlan)# exit

! Step 2: Isolate and disable all idle ports
Switch(config)# interface range GigabitEthernet 1/0/11 - 23
Switch(config-if-range)# description Quarantined Unused Port
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 666
Switch(config-if-range)# switchport nonegotiate
Switch(config-if-range)# shutdown
Switch(config-if-range)# end

Switch# copy running-config startup-config

Conclusion

On a Cisco switch, the default VLAN is VLAN 1—an immutable, factory-configured broadcast domain that hosts all interfaces upon first boot and carries fundamental Layer 2 control protocols. While Cisco IOS prevents you from deleting or renaming VLAN 1, network security best practices dictate that it should never carry standard end-user data, management access, or untagged trunk traffic. By provisioning dedicated data subnets, relocating management SVIs, altering trunk native VLANs to dedicated dummy IDs, and parking dormant ports, you eliminate the security risks of default configurations while maintaining normal switch control plane operations.

Please follow and like us: