- Never use native VLAN for any network. By default VLAN-1 is native VLAN.
- If deemed necessary change the native VLAN from VLAN id 1
- While configuring a VLAN network configure endpoint interfaces clearly as access ports.
- Always specify allowed VLAN ids per trunk, never allow all VLAN traffic to pass through any trunk port.
Про остальное, тоже не забываем.