■ Change the Native VLAN to one not assigned to any users.
■ On links that should be trunks, turn off trunking negotiation by setting the mode to trunk, specifying the encapsulation type, and adding the nonnegotiate command.
■ On links that should never be trunks, turn off trunking negotiation by setting the switchport mode to host. This sets it as an access port, enables Portfast, and disables EtherChannel negotiation.
■ Limit the VLAN traffic carried by the trunk to only those VLANs it needs to carry.