Day 19: DTP and VTP Protocols

DTP & VTP: CCNA Reference Sheet

Overview

DTP (Dynamic Trunking Protocol): Auto-negotiates port mode (access vs trunk). Enabled by default; should be disabled for security.

VTP (VLAN Trunking Protocol): Auto-syncs VLAN database across switches. Default mode = SERVER; rarely used in modern networks; high risk.

Both not in official CCNA 200-301 syllabus but useful for understanding why manual configuration is recommended.

 

---

 

Part 1: DTP (Dynamic Trunking Protocol)

Core Concept

DTP automatically negotiates whether switch port should be access or trunk instead of manual configuration.

Status: Enabled by default on all Cisco interfaces; NOT recommended for production (security risk).

DTP Modes & Behaviors

Critical Distinction:

• Dynamic Desirable = Active (initiates trunk negotiation)

• Dynamic Auto = Passive (waits to be asked)

• Two Auto ports = NO trunk (both passive; neither initiates)

DTP Compatibility Matrix

When ports connect to each other, which result in trunk formation?

                | Access | Trunk | Dyn Des | Dyn Auto

-----------------+--------+-------+---------+----------

Access           | Access | ✗     | Access  | Access

Trunk            | ✗      | Trunk | Trunk   | Trunk

Dynamic Desirable| Access | Trunk | Trunk   | Trunk

Dynamic Auto     | Access | Trunk | Trunk   | Access

Key Rules:

• Access ↔ Trunk = MISMATCH (configuration error; no communication)

• Access wins in negotiation (dynamic modes default down to access if connected to access)

• Active always wins (Dynamic Desirable forces trunk with Dynamic Auto)

• Both Passive = Access (two Dynamic Auto ports cannot negotiate trunk)

Default DTP Modes

Legacy Switches: switchport mode dynamic desirable (older networks needed trunks by default)

Modern Switches: switchport mode dynamic auto (explicit trunking recommended)

DTP with Non-Cisco Devices

Non-Cisco Device (router, PC, non-Cisco switch):

├─ Does NOT understand DTP frames

├─ Ignores DTP messages

├─ Defaults to ACCESS MODE

└─ Result: Safe (no unintended trunk formed)

Encapsulation Negotiation

On older switches supporting both 802.1Q and ISL:

switchport trunk encapsulation negotiate   (default)

  ↓

DTP negotiates which to use

  ├─ If both support ISL: ISL selected (favored)

  ├─ If only 802.1Q: 802.1Q selected

  └─ DTP frames sent in VLAN 1 (ISL) or native VLAN (802.1Q)

Modern Switches:

  └─ Only 802.1Q supported; no negotiation needed

Disabling DTP (Security Best Practice)

Option 1: Set explicit mode

switchport mode access   (disables DTP, forces access)

switchport mode trunk    (disables DTP, forces trunk)

Option 2: Disable negotiation on trunks

switchport mode trunk

switchport nonegotiate   (disables DTP while maintaining trunk mode)

Best Practice:

Access Ports:

  switchport mode access

Trunk Ports:

  switchport mode trunk

  switchport nonegotiate

Why Disable DTP?

Security Risks:

• Accidental trunking from misconfiguration

• DTP overhead in production

• Unexpected negotiation behavior (two auto ports fail silently)

• Unintended VLAN access

Recommendation: Manually configure all ports; disable DTP explicitly.

 

---

 

Part 2: VTP (VLAN Trunking Protocol)

Core Concept

VTP automatically synchronizes VLAN database across switches in same domain instead of manual VLAN creation on every switch.

Status: Default mode = SERVER; rarely used in modern networks; high risk of accidental VLAN deletion.

VTP Versions

Key: v3 supports extended VLAN range (1006–4094) and stores client VLAN db in NVRAM (survives reboot).

VTP Modes

Critical Behaviors:

• SERVER also acts as CLIENT — if connected to higher-revision SERVER, it syncs to match

• CLIENT cannot modify VLANs while in client mode (must switch to transparent/server first)

• TRANSPARENT forwards VTP ads (acts as relay for other domains)

VTP Domains

VTP Domain = group of switches sharing synchronized VLAN database.

Key Points:

• Same domain = VLAN database syncs

• Different domain = no sync

• Domain name case-sensitive

• Default = NULL (unconfigured)

Automatic Domain Assignment (DANGEROUS):

New switch (domain = NULL) connects to network

  ↓

Receives VTP advertisement from SERVER

  ↓

Automatically joins advertised domain

  ├─ Domain name assigned

  ├─ VLAN database syncs to server's revision

  └─ Becomes CLIENT or SERVER (version-dependent)

RISK: New switch may have outdated VLAN data

Revision Numbers: The Main Danger of VTP

Revision Number = version of VLAN database; increments with each VLAN add/modify/delete.

How It Works:

SERVER tracks revision number (starts at 0)

  ├─ Increments by 1 per VLAN change

  ├─ Advertises revision to all clients

  └─ Highest revision = "most recent" (assumed)

CLIENTS assume:

  └─ Higher revision number = more up-to-date VLAN database

  └─ Will sync to any server with higher revision

The Danger: Old Switch with High Revision Number

Current Network:

  ├─ Switch A (SERVER): revision 50 (correct VLANs, current)

  ├─ Switch B (CLIENT): synced to revision 50

  └─ Switch C (CLIENT): synced to revision 50

Old Switch (brought up after 2 years):

  ├─ Was in network 2 years ago with revision 150

  ├─ Has 150 old VLAN changes accumulated

  ├─ Connects to network...

What Happens:

  ├─ Old switch has revision 150 (higher than current 50!)

  ├─ All switches assume 150 is "latest"

  ├─ All switches sync VLAN database to old switch

  └─ ALL VLANs added in last 2 years are DELETED

     → NETWORK DOWN!

Why?

  └─ Higher revision number but OLDER DATA

Reset Revision Number to 0:

Method 1: Change Domain

  vtp domain unused_domain

  vtp domain original_domain

  (Domain change resets revision to 0)

Method 2: Change to Transparent Mode

  vtp mode transparent

  (Transparent mode resets revision; remove from VTP domain)

Before Connecting Old Switch:

1. Set to TRANSPARENT mode

2. Verify VLAN database is correct

3. Confirm revision = 0

4. Then connect to network

VTP Configuration

Setup VTP SERVER:

Switch_A(config)# vtp mode server

Switch_A(config)# vtp domain Manufacturing

Switch_A(config)# vtp password secure_password

Switch_A(config)# vlan 10

Switch_A(config-vlan)# name Engineering

Switch_A(config-vlan)# exit

(VLANs automatically propagate to all clients)

Setup VTP CLIENT:

Switch_B(config)# vtp mode client

Switch_B(config)# vtp domain Manufacturing

Switch_B(config)# vtp password secure_password

(No VLAN configuration; auto-syncs from server)

Setup TRANSPARENT (Isolated):

Switch_C(config)# vtp mode transparent

Switch_C(config)# vlan 30

Switch_C(config-vlan)# name Finance

Switch_C(config-vlan)# exit

(Maintains independent VLAN database)

Verification:

show vtp status        → VTP mode, domain, revision number, MD5 digest

show vlan brief        → VLAN database on this switch

 

---

 

DTP vs VTP Summary

 

---

 

Best Practices

DTP

✓ DO: Manually configure all ports

  switchport mode access

  switchport mode trunk

  switchport nonegotiate

✗ DON'T: Rely on DTP defaults

✗ DON'T: Mix dynamic modes

✗ DON'T: Connect switches without explicit mode config

VTP

✓ DO: Use TRANSPARENT mode only if isolated

  vtp mode transparent

✓ DO: Reset revision before adding old switch

  vtp domain temp_domain

  vtp domain original_domain

✗ DON'T: Use VTP in production

✗ DON'T: Connect old switches directly without mode reset

✗ DON'T: Mix VTP versions (v1/v2 incompatible with v3)

 

---

 

CCNA Exam Essentials