■ Change the Native VLAN to one not assigned to any users. 

■ On links that should be trunks, turn off trunking negotiation by setting the mode to trunk, specifying the encapsulation type, and adding the nonnegotiate command. 

■ On links that should never be trunks, turn off trunking negotiation by setting the switchport mode to host. This sets it as an access port, enables Portfast, and disables EtherChannel negotiation. 

■ Limit the VLAN traffic carried by the trunk to only those VLANs it needs to carry.