Chapter 13: Dynamic Trunking Protocol and VLAN Trunking Protocol
Introduces DTP and VTP as Cisco switch protocols that support VLAN configuration and interswitch connectivity, and explains why they remain relevant to the CCNA exam.
After this chapter you will be able to
- DTP and VTP relevance. Explain that DTP and VTP are auxiliary Cisco switch protocols that streamline VLAN configuration and management, and why their absence from the named CCNA exam topics does not make them irrelevant.
- Administrative and operational modes. Distinguish a port’s configured administrative mode from the access or trunk mode in which it actually operates. Explain what happens when access or trunk mode is manually configured.
- DTP port mode negotiation. Explain how neighboring switches use DTP messages and their configured port modes to determine operational modes.
- Dynamic mode negotiation. Explain how dynamic auto and dynamic desirable use DTP to determine whether connected switch ports operate as access ports or form a trunk.
- DTP trunk negotiation risk. Explain how an attacker can use DTP messages to turn a switch connection into a trunk and why that creates a security risk.
- DTP disabling methods. Describe the two ways shown to stop a switch port from sending DTP messages, and explain why the section recommends switchport nonegotiate even on a manually configured access port.
- VTP database synchronization. Explain that VTP lets Cisco switches exchange VLAN information and synchronize their VLAN databases according to the latest version.
- Shared VLAN database value. Explain why switches need the relevant VLANs in their databases and why VTP can be useful in a large LAN.
- VLAN database synchronization. Trace how a VLAN change on one switch reaches other switches through VTP, and explain why a receiving switch accepts an update only when its revision number is higher.
- VTP domain membership. Explain what a VTP domain name does, what happens when a switch has no domain name, and how unnamed switches join a configured domain.
- Server and client modes. Distinguish VTP server and client modes by their participation in VLAN database synchronization and their ability to change VLANs.
- Transparent and off modes. Explain how transparent and off modes differ in VTP message forwarding, and when the section recommends each mode.
- Primary server VLAN control. Explain who can change VLANs in a VTP version 3 domain and how primary-server status is assigned.
- Extended-range VLAN propagation. Distinguish normal-range and extended-range VLANs and explain what VTP version 3 changes about distributing them.
- VTP database overwrite risk. Explain how a newly connected switch in the same VTP domain can overwrite other switches’ VLAN databases and disrupt connectivity.
- Version 3 primary server protection. Explain why a newly connected high-revision switch does not pose the same database-overwrite risk in VTP version 3.
What it builds on
- Configuring VLANs and access ports (chapter 12) · Introduces VLAN configuration on switches.
- Connecting switches with trunk ports (chapter 12) · Introduces trunk ports connecting switches.
- Configuring trunk ports (chapter 12) · Configuring switch ports as trunks.
- Router on a stick (chapter 12) · A switch trunk connection to a router for router-on-a-stick.
- Assigning ports to VLANs (chapter 12) · Assigning switch ports to VLANs
- The IEEE 802.1Q tag (chapter 12) · The 802.1Q tag used on trunk links
- Creating and naming VLANs (chapter 12) · The earlier discussion of creating VLANs establishes what information switches need to maintain.
Section by section
Introduction
Introduces DTP and VTP as Cisco switch protocols that support VLAN configuration and interswitch connectivity, and explains why they remain relevant to the CCNA exam.
- DTP and VTP relevance: Explain that DTP and VTP are auxiliary Cisco switch protocols that streamline VLAN configuration and management, and why their absence from the named CCNA exam topics does not make them irrelevant.
Why it matters: It explains why these protocols are worth studying alongside VLANs and interswitch connectivity.
Key terms: Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), VLANs, interswitch connectivity
13.1 Dynamic Trunking Protocol
Introduces how DTP lets Cisco switches negotiate access or trunk operation, distinguishes configured from operational port modes, and explains why DTP is often disabled.
- Administrative and operational modes: Distinguish a port’s configured administrative mode from the access or trunk mode in which it actually operates. Explain what happens when access or trunk mode is manually configured.
Why it matters: The distinction lets you tell a configured setting from the port’s actual behavior. - DTP port mode negotiation: Explain how neighboring switches use DTP messages and their configured port modes to determine operational modes.
Why it matters: It explains why a switch port’s actual mode can depend on the switch at the other end. - DTP limits and tradeoff: Explain why DTP is commonly disabled despite being active by default, and when trunk mode must instead be manually configured.
Why it matters: Automatic trunk negotiation is convenient, but it is not appropriate or available on every connection.
Key terms: administrative mode, operational mode, switchport mode access, switchport mode trunk, Dynamic Trunking Protocol, DTP messages, Cisco-proprietary, security vulnerability, router on a stick
13.1.1 DTP negotiation
Explains how DTP negotiates switch-port modes, how to check the resulting mode, and when it can negotiate trunk encapsulation.
- Dynamic mode negotiation: Explain how dynamic auto and dynamic desirable use DTP to determine whether connected switch ports operate as access ports or form a trunk.
Why it matters: The configured mode alone does not always tell you whether a link will operate as a trunk. - Configured and observed port modes: Describe how to check a port’s administrative and operational modes and interpret the section’s static access example.
Why it matters: Checking the operational mode confirms what the port is actually doing after configuration or negotiation. - Manual trunk mode and mismatch: Explain why a manually configured trunk port can still send DTP messages and why an access-port-to-trunk-port connection should be avoided.
Why it matters: A manual trunk setting does not make every neighboring port configuration compatible. - Trunk encapsulation negotiation: Describe the encapsulation choice DTP can negotiate on switches supporting both 802.1Q and ISL, including the outcomes given for negotiate and explicitly configured protocols.
Why it matters: On switches that support both protocols, agreeing to trunk is not enough; the tagging protocol must also match.
Key terms: DTP negotiation, administrative mode, operational mode, dynamic auto, dynamic desirable, show interfaces interface-name switchport, static access, administrative mode trunk, DTP messages, access + trunk
13.1.2 Disabling DTP
This section explains the security risk of DTP negotiation and how to disable it on switch ports.
- DTP trunk negotiation risk: Explain how an attacker can use DTP messages to turn a switch connection into a trunk and why that creates a security risk.
Why it matters: It explains why leaving trunk negotiation available on a switch port can expose other VLANs. - DTP disabling methods: Describe the two ways shown to stop a switch port from sending DTP messages, and explain why the section recommends switchport nonegotiate even on a manually configured access port.
Why it matters: Using nonegotiate keeps DTP off even if a port’s configured mode changes later.
Key terms: DTP, dynamic auto, access mode, trunk link, VLANs, switchport mode access, switchport nonegotiate, Negotiation of Trunking
13.2 VLAN Trunking Protocol
This section introduces how VTP synchronizes VLAN databases across Cisco switches and why that can help in a LAN.
- VTP database synchronization: Explain that VTP lets Cisco switches exchange VLAN information and synchronize their VLAN databases according to the latest version.
Why it matters: This is the basic purpose of VTP and the limit on where it can be used. - Shared VLAN database value: Explain why switches need the relevant VLANs in their databases and why VTP can be useful in a large LAN.
Why it matters: It connects VLAN synchronization to both a communication failure and the work of managing many switches.
Key terms: VLAN Trunking Protocol, VTP, VLAN database, Cisco-proprietary, VLAN 4
13.2.1 VTP synchronization
Explains how switches in a VTP domain synchronize VLAN databases using revision numbers and trunk-port messages.
- VLAN database synchronization: Trace how a VLAN change on one switch reaches other switches through VTP, and explain why a receiving switch accepts an update only when its revision number is higher.
Why it matters: The revision number explains when a switch treats a received VLAN database as an update. - VTP domain membership: Explain what a VTP domain name does, what happens when a switch has no domain name, and how unnamed switches join a configured domain.
Why it matters: A shared domain name is what lets the switches in this example participate in VTP synchronization.
Key terms: VTP revision number, Configuration Revision, VLAN database, VTP messages, trunk ports, VTP domain, VTP domain name, domain NULL, vtp domain domain-name
13.2.2 VTP modes
This section compares the four VTP modes by whether switches can change VLANs, synchronize VLAN databases, and forward VTP messages.
- Server and client modes: Distinguish VTP server and client modes by their participation in VLAN database synchronization and their ability to change VLANs.
Why it matters: The mode determines whether a switch can originate VLAN changes or only receive them through VTP. - Transparent and off modes: Explain how transparent and off modes differ in VTP message forwarding, and when the section recommends each mode.
Why it matters: Transparent mode lets one switch be managed independently without blocking VTP messages, while off mode disables VTP where it is not used.
Key terms: VTP server mode, VTP client mode, VLAN database, revision number, VTP transparent mode, VTP off mode, VTP messages
13.2.3 VTP versions
Explains why VTP version 3 is preferred, focusing on primary-server control and support for extended-range VLANs.
- VTP version differences: Distinguish the three VTP versions and explain why version 3 is preferred when using VTP.
Why it matters: The version determines which VLAN-management capabilities are available. - Primary server VLAN control: Explain who can change VLANs in a VTP version 3 domain and how primary-server status is assigned.
Why it matters: Restricting VLAN changes to one switch reduces the risk of an unintended domain-wide change. - Extended-range VLAN propagation: Distinguish normal-range and extended-range VLANs and explain what VTP version 3 changes about distributing them.
Why it matters: Version 3 lets switches distribute extended-range VLANs while participating in a VTP domain.
Key terms: VTP version 1, VTP version 2, VTP version 3, off mode, primary server, secondary server, vtp primary, VTP domain, VLAN database, normal-range VLANs
13.2.4 Is VTP dangerous?
This section explains how a newly connected switch can disrupt a VTP domain, how to prevent that problem, and why VTP version 3 avoids it.
- VTP database overwrite risk: Explain how a newly connected switch in the same VTP domain can overwrite other switches’ VLAN databases and disrupt connectivity.
Why it matters: It explains why connecting an apparently ordinary switch could cause a network outage. - Revision number reset methods: Describe why an incoming switch’s VTP revision number should be reset to 0 and state the three methods given, including their version limits.
Why it matters: A pre-connection reset provides a practical safeguard against the outage described here. - Version 3 primary server protection: Explain why a newly connected high-revision switch does not pose the same database-overwrite risk in VTP version 3.
Why it matters: It distinguishes the older VTP outage risk from the protection provided by version 3.
Key terms: VTP domain, VLAN database, revision number, VTP revision number, VTP domain name, transparent, off, server, client, VTP version 3
13.3 Summary
Where this is used later
- EtherChannel configuration (chapter 16) · The familiar distinction between negotiated and manually configured trunk ports supports the section’s analogy.
- Dynamic EtherChannel (chapter 16) · The distinction between initiating and responding to negotiation.
Concepts explained in this chapter
- VTPVTP synchronization is the process by which switches update their VLAN databases to match the latest database version advertised by another switch.
- Dynamic Trunking ProtocolDTP negotiation is the exchange of Dynamic Trunking Protocol messages to agree on a switch-link operational mode.
- dynamic autoswitchport mode dynamic auto is a Cisco IOS command that configures a switch port to passively negotiate trunking with a neighboring port.
- primary serverA VTP primary server is the single VTP version 3 server in a domain authorized to create, modify, and delete VLANs.
- VTP off modeVTP off mode is a VTP operating mode in which a switch does not participate in VTP or forward VTP messages.
- administrative modeAn administrative mode is the configured switch-port mode that determines how the port negotiates or operates as an access or trunk port.
- operational modeAn operational mode is the mode in which a switch port is currently operating, such as access or trunk mode.
- VTP revision numberA VTP revision number is a version counter used to determine which VLAN database information should synchronize within a VTP domain.
- dynamic desirableswitchport mode dynamic desirable is a Cisco IOS command that configures a switch port to actively negotiate trunking with a neighboring port.
- extended-range vlanAn extended-range VLAN is a VLAN numbered from 1006 through 4094 in Cisco switch VLAN classification.
- vtp primaryvtp primary is a Cisco IOS privileged EXEC command that designates a VTP server as the primary server for its domain.
- VTP domainA VTP domain is a group of switches in a LAN that share the same VTP domain name and VLAN configuration information.
- switchport nonegotiateswitchport nonegotiate is a Cisco IOS interface command that prevents a switch port from sending Dynamic Trunking Protocol messages.
- VTP modeA VTP mode is a switch operating role that determines how the switch creates, synchronizes, forwards, or ignores VTP information.
- VTP client modeVTP client mode is a VTP operating mode in which a switch cannot modify VLANs but receives and synchronizes VLAN database advertisements.
- VTP server modeVTP server mode is a VTP operating mode in which a switch can create, modify, and delete VLANs and advertise those changes to other switches in the VTP domain.
- VTP transparent modeVTP transparent mode is a VTP operating mode in which a switch maintains an independent VLAN database, does not synchronize it, and forwards VTP messages.
- vlan databaseA VLAN database is a switch-maintained record of configured VLANs and the ports assigned to them.
- switchport modeswitchport mode is a Cisco IOS interface-configuration command family that sets or controls a switch port's administrative mode.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.