Using Native VLAN's for improved security and redundancy

We have three zones. Public, DMZ, and Inside. I created vlan 20 for Public, 30 for DMZ, and vlan 40 for Inside. Then i created vlan dummy_vlan2, dummy_vlan3, and dummy_vlan4, then i went into the vlan database and suspended each. Then, I went to each access port (via the interface-range qualifier) and assigned the native vlan and set the vlan membership explicitly, nearly the same as you showed in your article (you showed an example of allowing all vlans). Finally, I explicited allowed only vlans 20,30, and 40 on the Trunk.

I hope this is the appropriate place for it, but here is how I set it up, straight from the documentation I wrote.

——

+ Set up the Aggregated Ports

Set up PAGP on Switch01 side

# conf t
(config)# interface range gi 1/43 - 44
(config-if-range)# channel-group 1 mode desirable

Set up PAGP on Switch02 side

(config)# interface range gi 1/43 - 44
(config-if-range)# channel-group 1 mode desirable

port-channel 1 is the resulting virtual interface

The following command will verify what has been set up.
# show etherchannel summary

Set up the IEEE 802.1Q Trunk

SW02

(config)# interface port-channel 1
(config-if)# switchport trunk encapsulation dot1q
(config-if)# switchport mode trunk

SW01

(config)# interface port-channel 1
(config-if)# switchport trunk encapsulation dot1q
(config-if)# switchport mode trunk

+ Configure VTP

SW01

(config)# vtp mode server
(config)# vtp domain xxxxxxx
(config)# vtp password xxxxxxxxxxxxxxx

SW02

(config)# vtp mode server
(config)# vtp domain xxxxxxx
(config)# vtp password xxxxxxxxxxxxxxx

+ Vlan Configuration

SW01
Create Dummy VLANs

(config)# vlan 2
(config-vlan)# name dummy_vlan2
(config)# vlan 3
(config-vlan)# name dummy_vlan3
(config)# vlan 4
(config-vlan)# name dummy_vlan4
(config)# end

Suspend dummy_vlan’s

#vlan database
#vlan 2 state suspend
#vlan 3 state suspend
#vlan 4 state suspend

Create Active VLAN’s

#vlan 20
#name PUBLIC_VLAN
#interface range 1/1 - 4
#switchport access vlan 20
#switchport trunk native vlan 2

#vlan 30
(config-vlan)#name DMZ_VLAN
(config-vlan)#interface range 1/17 - 32
(config-vlan)#switchport access vlan 30
(config-vlan)#switchport trunk native vlan 3

#vlan 40
(config-vlan)#name INSIDE_VLAN
(config-vlan)#interface range 1/33 - 35
(config-vlan)#switchport access vlan 40
(config-vlan)#switchport trunk native vlan 4

Configure Trunk Interface

(config)# interface port-channel 1
(config-if)# switchport trunk allowed vlan 20,30,40
(config-if)#end
# wr mem