# Day 19: DTP and VTP Protocols

# DTP & VTP: CCNA Reference Sheet

## Overview

DTP (Dynamic Trunking Protocol): Auto-negotiates port mode (access vs trunk). Enabled by default; should be disabled for security.

VTP (VLAN Trunking Protocol): Auto-syncs VLAN database across switches. Default mode = SERVER; rarely used in modern networks; high risk.

Both not in official CCNA 200-301 syllabus but useful for understanding why manual configuration is recommended.

---

## Part 1: DTP (Dynamic Trunking Protocol)

### Core Concept

DTP automatically negotiates whether switch port should be access or trunk instead of manual configuration.

Status: Enabled by default on all Cisco interfaces; NOT recommended for production (security risk).

### DTP Modes & Behaviors

<div align="left" dir="ltr" id="bkmrk-mode-command-behavio"><table><colgroup><col width="99"></col><col width="148"></col><col width="241"></col><col width="135"></col></colgroup><tbody><tr><td>Mode

</td><td>Command

</td><td>Behavior

</td><td>Forms Trunk?

</td></tr><tr><td>Access

</td><td>switchport mode access

</td><td>Forces access port; actively prevents trunk; will not negotiate

</td><td>No (blocks trunk)

</td></tr><tr><td>Trunk

</td><td>switchport mode trunk

</td><td>Forces trunk; negotiates trunk formation with other switches

</td><td>Yes (if other side compatible)

</td></tr><tr><td>Dynamic Desirable

</td><td>switchport mode dynamic desirable

</td><td>ACTIVE mode; proactively tries to form trunk; negotiates with trunk/dyn-des/dyn-auto

</td><td>Yes (if other side allows)

</td></tr><tr><td>Dynamic Auto

</td><td>switchport mode dynamic auto

</td><td>PASSIVE mode; waits for other side to try; negotiates only if other side initiates

</td><td>Only if other side is trunk/dyn-des

</td></tr></tbody></table>

</div>Critical Distinction:

- Dynamic Desirable = Active (initiates trunk negotiation)
- Dynamic Auto = Passive (waits to be asked)
- Two Auto ports = NO trunk (both passive; neither initiates)

### DTP Compatibility Matrix

When ports connect to each other, which result in trunk formation?

 | Access | Trunk | Dyn Des | Dyn Auto

\-----------------+--------+-------+---------+----------

Access | Access | ✗ | Access | Access

Trunk | ✗ | Trunk | Trunk | Trunk

Dynamic Desirable| Access | Trunk | Trunk | Trunk

Dynamic Auto | Access | Trunk | Trunk | Access

#   


Key Rules:

- Access ↔ Trunk = MISMATCH (configuration error; no communication)
- Access wins in negotiation (dynamic modes default down to access if connected to access)
- Active always wins (Dynamic Desirable forces trunk with Dynamic Auto)
- Both Passive = Access (two Dynamic Auto ports cannot negotiate trunk)

### Default DTP Modes

Legacy Switches: switchport mode dynamic desirable (older networks needed trunks by default)

Modern Switches: switchport mode dynamic auto (explicit trunking recommended)

### DTP with Non-Cisco Devices

Non-Cisco Device (router, PC, non-Cisco switch):

├─ Does NOT understand DTP frames

├─ Ignores DTP messages

├─ Defaults to ACCESS MODE

└─ Result: Safe (no unintended trunk formed)

#   


### Encapsulation Negotiation

On older switches supporting both 802.1Q and ISL:

switchport trunk encapsulation negotiate (default)

 ↓

DTP negotiates which to use

 ├─ If both support ISL: ISL selected (favored)

 ├─ If only 802.1Q: 802.1Q selected

 └─ DTP frames sent in VLAN 1 (ISL) or native VLAN (802.1Q)

#   


Modern Switches:

 └─ Only 802.1Q supported; no negotiation needed

#   


### Disabling DTP (Security Best Practice)

Option 1: Set explicit mode

switchport mode access (disables DTP, forces access)

switchport mode trunk (disables DTP, forces trunk)

#   


Option 2: Disable negotiation on trunks

switchport mode trunk

switchport nonegotiate (disables DTP while maintaining trunk mode)

#   


Best Practice:

Access Ports:

 switchport mode access

#   


Trunk Ports:

 switchport mode trunk

 switchport nonegotiate

#   


### Why Disable DTP?

Security Risks:

- Accidental trunking from misconfiguration
- DTP overhead in production
- Unexpected negotiation behavior (two auto ports fail silently)
- Unintended VLAN access

Recommendation: Manually configure all ports; disable DTP explicitly.

---

## Part 2: VTP (VLAN Trunking Protocol)

### Core Concept

VTP automatically synchronizes VLAN database across switches in same domain instead of manual VLAN creation on every switch.

Status: Default mode = SERVER; rarely used in modern networks; high risk of accidental VLAN deletion.

### VTP Versions

<div align="left" dir="ltr" id="bkmrk-version-vlan-range-t"><table><colgroup><col width="64"></col><col width="87"></col><col width="78"></col><col width="104"></col><col width="107"></col><col width="184"></col></colgroup><tbody><tr><td>Version

</td><td>VLAN Range

</td><td>Token Ring

</td><td>NVRAM Client

</td><td>Extended VLAN

</td><td>Use

</td></tr><tr><td>v1

</td><td>1–1005

</td><td>No

</td><td>No (RAM only)

</td><td>No

</td><td>Obsolete

</td></tr><tr><td>v2

</td><td>1–1005

</td><td>Yes

</td><td>No (RAM only)

</td><td>No

</td><td>Obsolete; compatible with v1

</td></tr><tr><td>v3

</td><td>1–4094

</td><td>Yes

</td><td>Yes (NVRAM)

</td><td>Yes

</td><td>Best; NOT backwards compatible

</td></tr></tbody></table>

</div>Key: v3 supports extended VLAN range (1006–4094) and stores client VLAN db in NVRAM (survives reboot).

### VTP Modes

<div align="left" dir="ltr" id="bkmrk-mode-can-modify-vlan"><table><colgroup><col width="93"></col><col width="132"></col><col width="90"></col><col width="75"></col><col width="53"></col><col width="77"></col><col width="103"></col></colgroup><tbody><tr><td>Mode

</td><td>Can Modify VLAN?

</td><td>Syncs Database?

</td><td>Storage

</td><td>Sends Ads?

</td><td>Forwards Ads?

</td><td>Use Case

</td></tr><tr><td>Server

</td><td>✓ Add/Modify/Delete

</td><td>✓ (syncs to others)

</td><td>NVRAM

</td><td>✓

</td><td>✓

</td><td>Primary VLAN management; default mode

</td></tr><tr><td>Client

</td><td>✗ Read-only

</td><td>✓ (syncs from server)

</td><td>RAM (v1/v2) NVRAM (v3)

</td><td>✗

</td><td>✓

</td><td>Follows server; auto-syncs

</td></tr><tr><td>Transparent

</td><td>✓ Add/Modify/Delete

</td><td>✗ Independent

</td><td>NVRAM

</td><td>✗

</td><td>✓

</td><td>Lab/testing; separate domain; revision reset

</td></tr></tbody></table>

</div>Critical Behaviors:

- SERVER also acts as CLIENT — if connected to higher-revision SERVER, it syncs to match
- CLIENT cannot modify VLANs while in client mode (must switch to transparent/server first)
- TRANSPARENT forwards VTP ads (acts as relay for other domains)

### VTP Domains

VTP Domain = group of switches sharing synchronized VLAN database.

Key Points:

- Same domain = VLAN database syncs
- Different domain = no sync
- Domain name case-sensitive
- Default = NULL (unconfigured)

Automatic Domain Assignment (DANGEROUS):

New switch (domain = NULL) connects to network

 ↓

Receives VTP advertisement from SERVER

 ↓

Automatically joins advertised domain

 ├─ Domain name assigned

 ├─ VLAN database syncs to server's revision

 └─ Becomes CLIENT or SERVER (version-dependent)

#   


RISK: New switch may have outdated VLAN data

#   


### Revision Numbers: The Main Danger of VTP

Revision Number = version of VLAN database; increments with each VLAN add/modify/delete.

How It Works:

SERVER tracks revision number (starts at 0)

 ├─ Increments by 1 per VLAN change

 ├─ Advertises revision to all clients

 └─ Highest revision = "most recent" (assumed)

#   


CLIENTS assume:

 └─ Higher revision number = more up-to-date VLAN database

 └─ Will sync to any server with higher revision

#   


The Danger: Old Switch with High Revision Number

Current Network:

 ├─ Switch A (SERVER): revision 50 (correct VLANs, current)

 ├─ Switch B (CLIENT): synced to revision 50

 └─ Switch C (CLIENT): synced to revision 50

#   


Old Switch (brought up after 2 years):

 ├─ Was in network 2 years ago with revision 150

 ├─ Has 150 old VLAN changes accumulated

 ├─ Connects to network...

#   


What Happens:

 ├─ Old switch has revision 150 (higher than current 50!)

 ├─ All switches assume 150 is "latest"

 ├─ All switches sync VLAN database to old switch

 └─ ALL VLANs added in last 2 years are DELETED

 → NETWORK DOWN!

#   


Why?

 └─ Higher revision number but OLDER DATA

#   


Reset Revision Number to 0:

Method 1: Change Domain

 vtp domain unused\_domain

 vtp domain original\_domain

 (Domain change resets revision to 0)

#   


Method 2: Change to Transparent Mode

 vtp mode transparent

 (Transparent mode resets revision; remove from VTP domain)

#   


Before Connecting Old Switch:

1. Set to TRANSPARENT mode
2. Verify VLAN database is correct
3. Confirm revision = 0
4. Then connect to network

### VTP Configuration

Setup VTP SERVER:

Switch\_A(config)# vtp mode server

Switch\_A(config)# vtp domain Manufacturing

Switch\_A(config)# vtp password secure\_password

Switch\_A(config)# vlan 10

Switch\_A(config-vlan)# name Engineering

Switch\_A(config-vlan)# exit

(VLANs automatically propagate to all clients)

#   


Setup VTP CLIENT:

Switch\_B(config)# vtp mode client

Switch\_B(config)# vtp domain Manufacturing

Switch\_B(config)# vtp password secure\_password

(No VLAN configuration; auto-syncs from server)

#   


Setup TRANSPARENT (Isolated):

Switch\_C(config)# vtp mode transparent

Switch\_C(config)# vlan 30

Switch\_C(config-vlan)# name Finance

Switch\_C(config-vlan)# exit

(Maintains independent VLAN database)

#   


Verification:

show vtp status → VTP mode, domain, revision number, MD5 digest

show vlan brief → VLAN database on this switch

#   


---

## DTP vs VTP Summary

<div align="left" dir="ltr" id="bkmrk-feature-dtp-vtp-purp"><table><colgroup><col width="135"></col><col width="248"></col><col width="242"></col></colgroup><tbody><tr><td>Feature

</td><td>DTP

</td><td>VTP

</td></tr><tr><td>Purpose

</td><td>Auto-negotiate port mode (access/trunk)

</td><td>Auto-sync VLAN database

</td></tr><tr><td>What It Controls

</td><td>Port mode (L2 switching)

</td><td>VLAN configuration (L2 management)

</td></tr><tr><td>Default Status

</td><td>ENABLED on all ports

</td><td>SERVER mode (all switches)

</td></tr><tr><td>Communication

</td><td>Sent on ports (negotiation)

</td><td>Sent via trunk ports (domain sync)

</td></tr><tr><td>Main Danger

</td><td>Accidental trunk formation

</td><td>Revision number attack (old data)

</td></tr><tr><td>Recommendation

</td><td>DISABLE (manual config)

</td><td>DO NOT USE (use management tools)

</td></tr></tbody></table>

</div>---

## Best Practices

### DTP

✓ DO: Manually configure all ports

 switchport mode access

 switchport mode trunk

 switchport nonegotiate

#   


✗ DON'T: Rely on DTP defaults

✗ DON'T: Mix dynamic modes

✗ DON'T: Connect switches without explicit mode config

#   


### VTP

✓ DO: Use TRANSPARENT mode only if isolated

 vtp mode transparent

#   


✓ DO: Reset revision before adding old switch

 vtp domain temp\_domain

 vtp domain original\_domain

#   


✗ DON'T: Use VTP in production

✗ DON'T: Connect old switches directly without mode reset

✗ DON'T: Mix VTP versions (v1/v2 incompatible with v3)

#   


---

## CCNA Exam Essentials

<div align="left" dir="ltr" id="bkmrk-concept-key-detail-d"><table><colgroup><col width="170"></col><col width="407"></col></colgroup><tbody><tr><td>Concept

</td><td>Key Detail

</td></tr><tr><td>DTP Default

</td><td>Enabled on all Cisco interfaces

</td></tr><tr><td>Dynamic Desirable

</td><td>Active mode; proactively tries to form trunk

</td></tr><tr><td>Dynamic Auto

</td><td>Passive mode; waits for other side to try

</td></tr><tr><td>Two Auto Ports

</td><td>NO trunk (both passive; neither initiates)

</td></tr><tr><td>Access ↔ Trunk

</td><td>Mismatch; does NOT work; configuration error

</td></tr><tr><td>DTP Security

</td><td>Disable with switchport mode + switchport nonegotiate

</td></tr><tr><td>VTP Default

</td><td>SERVER mode (all switches default to server)

</td></tr><tr><td>VTP Versions

</td><td>v1 (old), v2 (old), v3 (best; 1006–4094 range)

</td></tr><tr><td>VTP Server

</td><td>Can add/modify/delete VLANs; syncs to others

</td></tr><tr><td>VTP Client

</td><td>Read-only; syncs from server

</td></tr><tr><td>VTP Transparent

</td><td>Independent VLAN db; forwards ads but doesn't sync

</td></tr><tr><td>Revision Number

</td><td>Higher = assumed more recent; old switch risk

</td></tr><tr><td>VTP Danger

</td><td>Old switch with high revision deletes all VLANs

</td></tr><tr><td>VTP Reset

</td><td>Change domain or set to transparent mode

</td></tr><tr><td>VTP Recommendation

</td><td>DO NOT USE in production; manual management safer

</td></tr><tr><td>Non-Cisco DTP

</td><td>Ignores DTP; defaults to access (safe)

</td></tr></tbody></table>

</div>