Day 19: DTP and VTP Protocols

DTP & VTP: CCNA Reference Sheet

Overview

DTP (Dynamic Trunking Protocol): Auto-negotiates port mode (access vs trunk). Enabled by default; should be disabled for security.

VTP (VLAN Trunking Protocol): Auto-syncs VLAN database across switches. Default mode = SERVER; rarely used in modern networks; high risk.

Both not in official CCNA 200-301 Studysyllabus Guide:but Cisco'suseful for understanding why manual configuration is recommended.

Part 1: DTP and VTP Protocols

1.0 Introduction: The Enduring Relevance of DTP and VTP

While DTP and VTP are no longer standalone topics in the current CCNA curriculum, they remain critical "under-the-hood" protocols. They govern the default behavior of Cisco Catalyst switches and can cause significant troubleshooting and security issues if left unmanaged.

Understanding these protocols is essential for interpreting switch behavior, securing networks against Layer 2 vulnerabilities, and ensuring stable trunking.

2.0 (Dynamic Trunking ProtocolProtocol)

Core Concept

DTP is a Cisco-proprietary protocol designed to automate the creation of trunk links. Itautomatically negotiates whether aswitch linkport should be an access port or a trunk andinstead determinesof themanual encapsulationconfiguration.

Status: Enabled by default on all Cisco interfaces; NOT recommended for production (typicallysecurity 802.1Q)risk).

2.1 DTP AdministrativeModes Modes& Behaviors

Critical Distinction:

Dynamic Desirable = Active (initiates trunk negotiation)

Dynamic Auto = Passive (waits to be asked)

Two Auto ports = NO trunk (both passive; neither initiates)

DTP Compatibility Matrix

When ports connect to each other, which result in trunk formation?

                | Access | Trunk | Dyn Des | Dyn Auto

-----------------+--------+-------+---------+----------

Access           | Access | ✗     | Access  | Access

Trunk            | ✗      | Trunk | Trunk   | Trunk

Dynamic Desirable| Access | Trunk | Trunk   | Trunk

Dynamic Auto     | Access | Trunk | Trunk   | Access

Key Rules:

Access ↔ Trunk = MISMATCH (configuration error; no communication)

Access wins in negotiation (dynamic modes default down to access if connected to access)

Active always wins (Dynamic Desirable forces trunk with Dynamic Auto)

Both Passive = Access (two Dynamic Auto ports cannot negotiate trunk)

Default DTP Modes

Legacy Switches: switchport mode dynamic desirable (older networks needed trunks by default)

Modern Switches: switchport mode dynamic auto (explicit trunking recommended)

DTP with Non-Cisco Devices

Non-Cisco Device (router, PC, non-Cisco switch):

├─ Does NOT understand DTP frames

├─ Ignores DTP messages

├─ Defaults to ACCESS MODE

└─ Result: Safe (no unintended trunk formed)

Encapsulation Negotiation

On older switches supporting both 802.1Q and ISL:

switchport trunk encapsulation negotiate   (default)

  ↓

DTP negotiates which to use

  ├─ If both support ISL: ISL selected (favored)

  ├─ If only 802.1Q: 802.1Q selected

  └─ DTP frames sent in VLAN 1 (ISL) or native VLAN (802.1Q)

Modern Switches:

  └─ Only 802.1Q supported; no negotiation needed

Disabling DTP (Security Best Practice)

Option 1: Set explicit mode

switchport mode access   (disables DTP, forces access)

switchport mode trunk    (disables DTP, forces trunk)

Option 2: Disable negotiation on trunks

switchport mode trunk

switchport nonegotiate   (disables DTP while maintaining trunk mode)

Best Practice:

Access Ports:

  switchport mode access

Trunk Ports:

  switchport mode trunk

  switchport nonegotiate

Why Disable DTP?

Security Risks:

Accidental trunking from misconfiguration

DTP overhead in production

Unexpected negotiation behavior (two auto ports fail silently)

Unintended VLAN access

Recommendation: Manually configure all ports; disable DTP explicitly.

Part 2: VTP (VLAN Trunking Protocol)

Core Concept

VTP automatically synchronizes VLAN database across switches in same domain instead of manual VLAN creation on every switch.

Status: Default mode = SERVER; rarely used in modern networks; high risk of accidental VLAN deletion.

VTP Versions

Key: v3 supports extended VLAN range (1006–4094) and stores client VLAN db in NVRAM (survives reboot).

VTP Modes

Critical Behaviors:

SERVER also acts as CLIENT — if connected to higher-revision SERVER, it syncs to match

CLIENT cannot modify VLANs while in client mode (must switch to transparent/server first)

TRANSPARENT forwards VTP ads (acts as relay for other domains)

VTP Domains

VTP Domain = group of switches sharing synchronized VLAN database.

Key Points:

Same domain = VLAN database syncs

Different domain = no sync

Domain name case-sensitive

Default = NULL (unconfigured)

Automatic Domain Assignment (DANGEROUS):

New switch (domain = NULL) connects to network

  ↓

Receives VTP advertisement from SERVER

  ↓

Automatically joins advertised domain

  ├─ Domain name assigned

  ├─ VLAN database syncs to server's revision

  └─ Becomes CLIENT or SERVER (version-dependent)

RISK: New switch may have outdated VLAN data

Revision Numbers: The Main Danger of VTP

Revision Number = version of VLAN database; increments with each VLAN add/modify/delete.

How It Works:

SERVER tracks revision number (starts at 0)

  ├─ Increments by 1 per VLAN change

  ├─ Advertises revision to all clients

  └─ Highest revision = "most recent" (assumed)

CLIENTS assume:

  └─ Higher revision number = more up-to-date VLAN database

  └─ Will sync to any server with higher revision

The Danger: Old Switch with High Revision Number

Current Network:

  ├─ Switch A (SERVER): revision 50 (correct VLANs, current)

  ├─ Switch B (CLIENT): synced to revision 50

  └─ Switch C (CLIENT): synced to revision 50

Old Switch (brought up after 2 years):

  ├─ Was in network 2 years ago with revision 150

  ├─ Has 150 old VLAN changes accumulated

  ├─ Connects to network...

What Happens:

  ├─ Old switch has revision 150 (higher than current 50!)

  ├─ All switches assume 150 is "latest"

  ├─ All switches sync VLAN database to old switch

  └─ ALL VLANs added in last 2 years are DELETED

     → NETWORK DOWN!

Why?

  └─ Higher revision number but OLDER DATA

Reset Revision Number to 0:

Method 1: Change Domain

  vtp domain unused_domain

  vtp domain original_domain

  (Domain change resets revision to 0)

Method 2: Change to Transparent Mode

  vtp mode transparent

  (Transparent mode resets revision; remove from VTP domain)

Before Connecting Old Switch:

Set to TRANSPARENT mode

Verify VLAN database is correct

Confirm revision = 0

Then connect to network

VTP Configuration

Setup VTP SERVER:

Switch_A(config)# vtp mode server

Switch_A(config)# vtp domain Manufacturing

Switch_A(config)# vtp password secure_password

Switch_A(config)# vlan 10

Switch_A(config-vlan)# name Engineering

Switch_A(config-vlan)# exit

(VLANs automatically propagate to all clients)

Setup VTP CLIENT:

Switch_B(config)# vtp mode client

Switch_B(config)# vtp domain Manufacturing

Switch_B(config)# vtp password secure_password

(No VLAN configuration; auto-syncs from server)

Setup TRANSPARENT (Isolated):

Switch_C(config)# vtp mode transparent

Switch_C(config)# vlan 30

Switch_C(config-vlan)# name Finance

Switch_C(config-vlan)# exit

(Maintains independent VLAN database)

Verification:

show vtp status        → VTP mode, domain, revision number, MD5 digest

show vlan brief        → VLAN database on this switch

DTP vs VTP Summary

Best Practices

DTP

✓ DO: Manually configure all ports

  switchport mode access

  switchport mode trunk

  switchport nonegotiate

✗ DON'T: Rely on DTP defaults

✗ DON'T: Mix dynamic modes

✗ DON'T: Connect switches without explicit mode config

VTP

✓ DO: Use TRANSPARENT mode only if isolated

  vtp mode transparent

✓ DO: Reset revision before adding old switch

  vtp domain temp_domain

  vtp domain original_domain

✗ DON'T: Use VTP in production

✗ DON'T: Connect old switches directly without mode reset

✗ DON'T: Mix VTP versions (v1/v2 incompatible with v3)

CCNA Exam Essentials

2.2 DTP Negotiation Outcomes

The "Auto" Trap: If both switches are left in the default Dynamic Auto state, a trunk will never form. Both sides wait passively for the other to start the negotiation, resulting in a standard access link.

2.3 Security Risks: VLAN Hopping

A malicious actor can spoof DTP frames to trick a dynamic port into becoming a trunk. Once a trunk is formed, the attacker gains access to all VLANs allowed on that link, bypassing network segmentation.

Best Practices:

End-User Ports: Always use switchport mode access to disable negotiation.

Trunk Links: Hardcode using switchport mode trunk and disable negotiation with switchport nonegotiate.

3.0 VLAN Trunking Protocol (VTP)

VTP maintains a consistent VLAN database across a network. It allows an administrator to add, delete, or rename VLANs on one switch and have those changes propagate to all other switches in the domain.

3.1 VTP Operational Modes

Server (Default): Can create, modify, and delete VLANs. Changes are advertised to the domain and saved in NVRAM (vlan.dat).

Client: Cannot change VLANs locally. Synchronizes its database with the Server. In VTP v1/v2, changes are not saved to NVRAM (lost on reboot).

Transparent: Does not synchronize with the domain. It forwards VTP advertisements butMismatch; does notNOT processwork; them.configuration Local VLANs can be created but are not advertised. Configuration Revision is always 0.

3.2 The "VTP Bomb"

VTP uses a Configuration Revision Number to track updates. A switch will always overwrite its database if it receives an advertisement with a higher revision number.

The Risk: If you connect a repurposed switch with a high revision number and the same domain name, it can instantly overwrite the production VLAN database, potentially deleting all VLANs and causing a network-wide outage.

Safety Procedure to Reset Revision to 0:

Isolate the switch.

Change VTP mode to Transparent (this resets revision to 0).

Change VTP mode back to Client/Server.

Verify with show vtp status.

4.0 Configuration and Verification Command Reference

4.1 DTP Commands

4.2 VTP Commands

5.0 Key Troubleshooting Insights

VTP Version Limits: VTP v1 and v2 only synchronize Normal Range VLANs (1–1005). To sync Extended Range VLANs (1006–4094), you must use VTP v3 or Transparent mode.

VTP Pruning: This feature prevents unnecessary broadcast traffic from flooding across trunks to switches that don't have active ports in those VLANs.

Native VLAN Mismatch: DTP does not fix Native VLAN mismatches. If one side is VLAN 1 and the other is VLAN 99, you will receive CDP error messages and traffic will leak between VLANs.