A native VLAN mismatch warning identifies a disagreement to investigate, not permission to change the first uplink in the log. Confirm which physical or logical link connects the peers, whether both sides are trunks, and how untagged traffic is classified. STP may protect affected VLANs by blocking an inconsistent path; disabling that protection can make the problem worse.
Scope and evidence: Hypothetical Catalyst 9300 IOS XE 17.15 lab using standalone 802.1Q trunks and Rapid PVST+. This is not NX-OS, MST-region migration or a multi-chassis bundle procedure. No device logs, packet captures or customer outcome are presented as real. Commands are read-only unless explicitly marked as configuration changes.
Cisco Native VLAN Mismatch Symptoms and Untagged Traffic
SW-A Gi1/0/48 connects directly to SW-B Gi1/0/48. Both operate as trunks and permit VLANs 20,99,999; all three VLANs already exist and are active locally. Native VLAN is 99 on SW-A and incorrectly 999 on SW-B. Native data tagging is not enabled globally in this isolated example. The intended design uses native VLAN 99 at both ends; that number is a lab choice, not a universal recommendation.
With ordinary untagged native-data behavior, the two ends can associate an untagged frame with different VLAN identities. Tagged VLAN 20 is a separate path and may behave differently. A native mismatch therefore does not mean every VLAN on the trunk must fail. Rapid PVST+/PVST+ can also detect VLAN inconsistency and block affected VLAN/port forwarding to prevent a loop. The warning, classification risk and actual STP state are related evidence, not interchangeable observations.
Identify the Trunk Peer and Logical Uplink Interface
Run these read-only privileged EXEC checks on both switches:
show cdp neighbors detail
show interfaces trunk
show interfaces gigabitEthernet1/0/48 switchport
show running-config interface gigabitEthernet1/0/48
show etherchannel summary
The neighbor detail should identify the intended remote device and remote port for the local interface. If CDP is disabled, use approved LLDP/cabling/management evidence instead; absence of a CDP message is not proof that native VLANs match. Verify the remote configuration directly rather than trusting an old log or remembered cable map.
| Evidence | Healthy result for this design | Abnormal result and next action |
|---|---|---|
| Peer/interface mapping | SW-A Gi1/0/48 ↔ SW-B Gi1/0/48 | Unexpected peer/port: trace cabling and intended link ownership before editing. |
| Trunk output | Operational trunk on both ends, intended allowed list, native 99 on each | Native 99 versus 999 confirms the lab disagreement. Different operational modes may instead indicate a trunk/access mismatch. |
| Switchport/configuration | Intended native assignment and operational trunking agree | Compare administrative and operational state; a configured trunk intent alone does not establish actual behavior. |
| EtherChannel summary | This lab interface is not a channel member | If the link is a port-channel, assess the logical interface and member consistency; do not apply a standalone recipe to one bundled port. |
The LACP guide covers bundle membership. This article changes native classification, not channel negotiation or the allowed VLAN list.
Check Native Tagging Mode and STP PVID Protection
These checks remain read-only:
show running-config | include ^vlan dot1q tag native
show spanning-tree inconsistentports
show spanning-tree vlan 99
show spanning-tree vlan 999
show spanning-tree vlan 20
show logging
The filtered global configuration should have no enabled vlan dot1q tag native line in this default-tagging lab. An empty result means the command is absent from the normal running-config display, not a packet-level measurement. If native tagging is enabled, compare supported ingress/egress behavior on both peers against the exact platform documentation; do not toggle a global setting during an isolated port investigation.
show spanning-tree inconsistentports identifies current protective inconsistency states. The per-VLAN commands show roles/states for the affected instances and a tagged control VLAN. A PVID/type inconsistency is not the same as a normal alternate/discarding path in a redundant topology. A blocked port may be doing exactly what the design requires.
Review show logging for the relevant interface, time window and mismatch/inconsistency events. %CDP-4-NATIVE_VLAN_MISMATCH is a possible warning label, not a fabricated log required for this scenario. Repeated messages after a change need fresh peer and topology evidence. Historical messages do not prove the mismatch still exists.
Data-frame tagging and control-protocol handling are not identical in every case; do not infer all BPDU/CDP behavior from one simplified native-data diagram. Cisco’s PVID/type-inconsistency guide explains the protective STP relationship.
Correct the Documented Native VLAN Assignment on One Peer
Configuration-changing, SW-B only. Before proceeding, verify the intended native VLAN with the network owner, confirm VLAN 99 exists/active, record both interface stanzas and keep out-of-band access. A native VLAN change affects untagged classification and can interrupt management or services; it is not guaranteed hitless. If both ends must change in another deployment, coordinate the transition rather than treating this one-sided lab as a migration plan.
configure terminal
interface gigabitEthernet1/0/48
switchport trunk native vlan 99
end
This leaves VLAN existence, allowed lists, STP mode and global native tagging unchanged. Do not replace the allowed list or disable CDP/STP merely to remove a warning. On a port-channel, use a platform-specific logical-interface change plan instead.
For the recorded fault-injection baseline, rollback on SW-B is:
configure terminal
interface gigabitEthernet1/0/48
switchport trunk native vlan 999
end
That restores the mismatch and classification risk in the lab, not a working production service. An operational recovery plan must identify a known-good path and verify management/traffic after restoration.
Verify Native VLAN Agreement, STP State and Traffic
Repeat the trunk and switchport commands on both ends. Expect native VLAN 99 at each end and the original allowed list intact. Repeat inconsistent-port and per-VLAN STP checks. Correctly resolved inconsistency can recover as valid BPDUs are processed; timing and final forwarding role depend on topology. Do not force forwarding or reset interfaces solely because recovery is not instantaneous.
If an inconsistency persists, verify the actual peer, additional links, access/trunk mismatch or intervening Layer 2 transport. If the role is simply alternate/discarding with a healthy forwarding path elsewhere, that may be normal. The allowed-but-not-forwarding guide handles that distinction in more detail.
Run approved endpoint/service tests for the intended untagged/native workload and tagged VLAN 20, with the correct access VLAN and address context. A quiet warning log is not equivalent to correct delivery. Observe MAC learning and application behavior over the agreed window, then persist accepted configuration with copy running-config startup-config; that command writes startup configuration.
Prevent Native VLAN Mismatches and Review Cisco References
Document both native identity and native tagging policy for each trunk, including logical bundles and non-Cisco peers. Compare both ends during replacement/change review. Monitor current inconsistencies separately from ordinary STP redundancy. For an endpoint-to-gateway failure without native disagreement, use the VLAN gateway guide.
- Cisco Catalyst 9300 IOS XE 17.15 VLAN trunks, including native VLAN and allowed-list semantics.
- Cisco: PVID/type inconsistencies.