Day 19: DTP and VTP Protocols

DTP & VTP: CCNA Reference Sheet
Overview
DTP (Dynamic Trunking Protocol): Auto-negotiates port mode (access vs trunk). Enabled by default; should be disabled for security.
VTP (VLAN Trunking Protocol): Auto-syncs VLAN database across switches. Default mode = SERVER; rarely used in modern networks; high risk.
Both not in official CCNA 200-301 syllabus but useful for understanding why manual configuration is recommended.
 
 
Part 1: DTP (Dynamic Trunking Protocol)
Core Concept
DTP automatically negotiates whether switch port should be access or trunk instead of manual configuration.
Status: Enabled by default on all Cisco interfaces; NOT recommended for production (security risk).
DTP Modes & Behaviors
Mode
Command
Behavior
Forms Trunk?
Access
switchport mode access
Forces access port; actively prevents trunk; will not negotiate
No (blocks trunk)
Trunk
switchport mode trunk
Forces trunk; negotiates trunk formation with other switches
Yes (if other side compatible)
Dynamic Desirable
switchport mode dynamic desirable
ACTIVE mode; proactively tries to form trunk; negotiates with trunk/dyn-des/dyn-auto
Yes (if other side allows)
Dynamic Auto
switchport mode dynamic auto
PASSIVE mode; waits for other side to try; negotiates only if other side initiates
Only if other side is trunk/dyn-des
Critical Distinction:
Dynamic Desirable = Active (initiates trunk negotiation)
Dynamic Auto = Passive (waits to be asked)
Two Auto ports = NO trunk (both passive; neither initiates)
DTP Compatibility Matrix
When ports connect to each other, which result in trunk formation?
                | Access | Trunk | Dyn Des | Dyn Auto
-----------------+--------+-------+---------+----------
Access           | Access | ✗     | Access  | Access
Trunk            | ✗      | Trunk | Trunk   | Trunk
Dynamic Desirable| Access | Trunk | Trunk   | Trunk
Dynamic Auto     | Access | Trunk | Trunk   | Access
Key Rules:
Access ↔ Trunk = MISMATCH (configuration error; no communication)
Access wins in negotiation (dynamic modes default down to access if connected to access)
Active always wins (Dynamic Desirable forces trunk with Dynamic Auto)
Both Passive = Access (two Dynamic Auto ports cannot negotiate trunk)
Default DTP Modes
Legacy Switches: switchport mode dynamic desirable (older networks needed trunks by default)
Modern Switches: switchport mode dynamic auto (explicit trunking recommended)
DTP with Non-Cisco Devices
Non-Cisco Device (router, PC, non-Cisco switch):
├─ Does NOT understand DTP frames
├─ Ignores DTP messages
├─ Defaults to ACCESS MODE
└─ Result: Safe (no unintended trunk formed)
Encapsulation Negotiation
On older switches supporting both 802.1Q and ISL:
switchport trunk encapsulation negotiate   (default)
  ↓
DTP negotiates which to use
  ├─ If both support ISL: ISL selected (favored)
  ├─ If only 802.1Q: 802.1Q selected
  └─ DTP frames sent in VLAN 1 (ISL) or native VLAN (802.1Q)
Modern Switches:
  └─ Only 802.1Q supported; no negotiation needed
Disabling DTP (Security Best Practice)
Option 1: Set explicit mode
switchport mode access   (disables DTP, forces access)
switchport mode trunk    (disables DTP, forces trunk)
Option 2: Disable negotiation on trunks
switchport mode trunk
switchport nonegotiate   (disables DTP while maintaining trunk mode)
Best Practice:
Access Ports:
  switchport mode access
Trunk Ports:
  switchport mode trunk
  switchport nonegotiate
Why Disable DTP?
Security Risks:
Accidental trunking from misconfiguration
DTP overhead in production
Unexpected negotiation behavior (two auto ports fail silently)
Unintended VLAN access
Recommendation: Manually configure all ports; disable DTP explicitly.
 
 
Part 2: VTP (VLAN Trunking Protocol)
Core Concept
VTP automatically synchronizes VLAN database across switches in same domain instead of manual VLAN creation on every switch.
Status: Default mode = SERVER; rarely used in modern networks; high risk of accidental VLAN deletion.
VTP Versions
Version
VLAN Range
Token Ring
NVRAM Client
Extended VLAN
Use
v1
1–1005
No
No (RAM only)
No
Obsolete
v2
1–1005
Yes
No (RAM only)
No
Obsolete; compatible with v1
v3
1–4094
Yes
Yes (NVRAM)
Yes
Best; NOT backwards compatible
Key: v3 supports extended VLAN range (1006–4094) and stores client VLAN db in NVRAM (survives reboot).
VTP Modes
Mode
Can Modify VLAN?
Syncs Database?
Storage
Sends Ads?
Forwards Ads?
Use Case
Server
✓ Add/Modify/Delete
✓ (syncs to others)
NVRAM
✓
✓
Primary VLAN management; default mode
Client
✗ Read-only
✓ (syncs from server)
RAM (v1/v2) NVRAM (v3)
✗
✓
Follows server; auto-syncs
Transparent
✓ Add/Modify/Delete
✗ Independent
NVRAM
✗
✓
Lab/testing; separate domain; revision reset
Critical Behaviors:
SERVER also acts as CLIENT — if connected to higher-revision SERVER, it syncs to match
CLIENT cannot modify VLANs while in client mode (must switch to transparent/server first)
TRANSPARENT forwards VTP ads (acts as relay for other domains)
VTP Domains
VTP Domain = group of switches sharing synchronized VLAN database.
Key Points:
Same domain = VLAN database syncs
Different domain = no sync
Domain name case-sensitive
Default = NULL (unconfigured)
Automatic Domain Assignment (DANGEROUS):
New switch (domain = NULL) connects to network
  ↓
Receives VTP advertisement from SERVER
  ↓
Automatically joins advertised domain
  ├─ Domain name assigned
  ├─ VLAN database syncs to server's revision
  └─ Becomes CLIENT or SERVER (version-dependent)
RISK: New switch may have outdated VLAN data
Revision Numbers: The Main Danger of VTP
Revision Number = version of VLAN database; increments with each VLAN add/modify/delete.
How It Works:
SERVER tracks revision number (starts at 0)
  ├─ Increments by 1 per VLAN change
  ├─ Advertises revision to all clients
  └─ Highest revision = "most recent" (assumed)
CLIENTS assume:
  └─ Higher revision number = more up-to-date VLAN database
  └─ Will sync to any server with higher revision
The Danger: Old Switch with High Revision Number
Current Network:
  ├─ Switch A (SERVER): revision 50 (correct VLANs, current)
  ├─ Switch B (CLIENT): synced to revision 50
  └─ Switch C (CLIENT): synced to revision 50
Old Switch (brought up after 2 years):
  ├─ Was in network 2 years ago with revision 150
  ├─ Has 150 old VLAN changes accumulated
  ├─ Connects to network...
What Happens:
  ├─ Old switch has revision 150 (higher than current 50!)
  ├─ All switches assume 150 is "latest"
  ├─ All switches sync VLAN database to old switch
  └─ ALL VLANs added in last 2 years are DELETED
     → NETWORK DOWN!
Why?
  └─ Higher revision number but OLDER DATA
Reset Revision Number to 0:
Method 1: Change Domain
  vtp domain unused_domain
  vtp domain original_domain
  (Domain change resets revision to 0)
Method 2: Change to Transparent Mode
  vtp mode transparent
  (Transparent mode resets revision; remove from VTP domain)
Before Connecting Old Switch:
Set to TRANSPARENT mode
Verify VLAN database is correct
Confirm revision = 0
Then connect to network
VTP Configuration
Setup VTP SERVER:
Switch_A(config)# vtp mode server
Switch_A(config)# vtp domain Manufacturing
Switch_A(config)# vtp password secure_password
Switch_A(config)# vlan 10
Switch_A(config-vlan)# name Engineering
Switch_A(config-vlan)# exit
(VLANs automatically propagate to all clients)
Setup VTP CLIENT:
Switch_B(config)# vtp mode client
Switch_B(config)# vtp domain Manufacturing
Switch_B(config)# vtp password secure_password
(No VLAN configuration; auto-syncs from server)
Setup TRANSPARENT (Isolated):
Switch_C(config)# vtp mode transparent
Switch_C(config)# vlan 30
Switch_C(config-vlan)# name Finance
Switch_C(config-vlan)# exit
(Maintains independent VLAN database)
Verification:
show vtp status        → VTP mode, domain, revision number, MD5 digest
show vlan brief        → VLAN database on this switch
 
 
DTP vs VTP Summary
Feature
DTP
VTP
Purpose
Auto-negotiate port mode (access/trunk)
Auto-sync VLAN database
What It Controls
Port mode (L2 switching)
VLAN configuration (L2 management)
Default Status
ENABLED on all ports
SERVER mode (all switches)
Communication
Sent on ports (negotiation)
Sent via trunk ports (domain sync)
Main Danger
Accidental trunk formation
Revision number attack (old data)
Recommendation
DISABLE (manual config)
DO NOT USE (use management tools)
 
 
Best Practices
DTP
✓ DO: Manually configure all ports
  switchport mode access
  switchport mode trunk
  switchport nonegotiate
✗ DON'T: Rely on DTP defaults
✗ DON'T: Mix dynamic modes
✗ DON'T: Connect switches without explicit mode config
VTP
✓ DO: Use TRANSPARENT mode only if isolated
  vtp mode transparent
✓ DO: Reset revision before adding old switch
  vtp domain temp_domain
  vtp domain original_domain
✗ DON'T: Use VTP in production
✗ DON'T: Connect old switches directly without mode reset
✗ DON'T: Mix VTP versions (v1/v2 incompatible with v3)
 
 
CCNA Exam Essentials
Concept
Key Detail
DTP Default
Enabled on all Cisco interfaces
Dynamic Desirable
Active mode; proactively tries to form trunk
Dynamic Auto
Passive mode; waits for other side to try
Two Auto Ports
NO trunk (both passive; neither initiates)
Access ↔ Trunk
Mismatch; does NOT work; configuration error
DTP Security
Disable with switchport mode + switchport nonegotiate
VTP Default
SERVER mode (all switches default to server)
VTP Versions
v1 (old), v2 (old), v3 (best; 1006–4094 range)
VTP Server
Can add/modify/delete VLANs; syncs to others
VTP Client
Read-only; syncs from server
VTP Transparent
Independent VLAN db; forwards ads but doesn't sync
Revision Number
Higher = assumed more recent; old switch risk
VTP Danger
Old switch with high revision deletes all VLANs
VTP Reset
Change domain or set to transparent mode
VTP Recommendation
DO NOT USE in production; manual management safer
Non-Cisco DTP
Ignores DTP; defaults to access (safe)