![]()
Well, as I work on my Security section, the Native VLAN (the base network without tags aka VLAN 1) is most definitely something you have to be cognizant of when enforcing Trunk behavior (admit only VLAN tagged) and Access ports (admit only untagged) behavior. Otherwise you’ll lose access to your equipment.
You must have a management VLAN present, if you want to configure your switches in this locked down mode. You can no longer use Winbox plugged into a properly configured switch from one of its Access ports. You can only connect over a Trunk port. If that is an up-link port, then you’ll have to go to wherever that is, which in my examples will be the main Router.
I see the appeal of not allowing for the presence of a Native VLAN. What I did was configure a port on the router just for this purpose, to put you in the MGMT_VLAN, so you can hit every switch in the environment. When switches are configured to only accept tagged traffic over their Trunks, the Native VLAN, which is actually taggless on the wire, gets dropped!
It seems we’ve simply replaced the Native VLAN for a MGMT VLAN. Since this must be done on all equipment, we’ve come full circle back to having a base network ip scheme, only now, it has tags.